thuban 0.4.9 → 0.4.11

package/packages/crucible/.golden/golden-master.json

@@ -1,414 +0,0 @@
-{
-  "version": 1,
-  "timestamp": "2026-07-01T11:20:04.329Z",
-  "hash": "8752892137ff7720",
-  "count": 50,
-  "meta": {
-    "score": 100,
-    "level": "gentle",
-    "seeds": 50,
-    "duration": 281
-  },
-  "findings": [
-    {
-      "seedId": "csharp/seed-009.cs",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "SQL injection via string concatenation in SqlCommand"
-    },
-    {
-      "seedId": "csharp/seed-033.cs",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "Path traversal in file write with user-supplied report name enabling overwrite of arbitrary files"
-    },
-    {
-      "seedId": "csharp/seed-034.cs",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "MD5 used for password hashing via MD5.Create()"
-    },
-    {
-      "seedId": "csharp/seed-037.cs",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "SHA1 used for HMAC signing instead of SHA256 or higher"
-    },
-    {
-      "seedId": "csharp/seed-042.cs",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "Unsafe deserialization via DataContractSerializer reading from request body"
-    },
-    {
-      "seedId": "csharp/seed-045.cs",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "csharp",
-      "detected": true,
-      "label": "SSRF via HttpClient.GetAsync with user-controlled endpoint URL"
-    },
-    {
-      "seedId": "csharp/seed-048.cs",
-      "category": "xxe",
-      "severity": "critical",
-      "language": "csharp",
-      "detected": true,
-      "label": "XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)"
-    },
-    {
-      "seedId": "go/seed-019.go",
-      "category": "xss",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "XSS via w.Write injecting user input into inline JavaScript variable"
-    },
-    {
-      "seedId": "go/seed-029.go",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "Path traversal via os.Open with user-supplied filename concatenated to base path"
-    },
-    {
-      "seedId": "go/seed-034.go",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "MD5 used for password hashing via crypto/md5"
-    },
-    {
-      "seedId": "go/seed-036.go",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "go",
-      "detected": true,
-      "label": "SHA1 used for HMAC signing and MD5 for file integrity verification"
-    },
-    {
-      "seedId": "go/seed-042.go",
-      "category": "open_redirect",
-      "severity": "medium",
-      "language": "go",
-      "detected": true,
-      "label": "Open redirect via http.Redirect using user-supplied return URL after password reset"
-    },
-    {
-      "seedId": "go/seed-050.go",
-      "category": "open_redirect",
-      "severity": "medium",
-      "language": "go",
-      "detected": true,
-      "label": "Open redirect via http.Redirect with Referer header used as redirect destination"
-    },
-    {
-      "seedId": "java/seed-009.java",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "SQL injection via string concatenation in executeQuery"
-    },
-    {
-      "seedId": "java/seed-034.java",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "MD5 used for password hashing via MessageDigest"
-    },
-    {
-      "seedId": "java/seed-042.java",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "Unsafe deserialization in JMS message listener via ObjectMessage"
-    },
-    {
-      "seedId": "java/seed-044.java",
-      "category": "xxe",
-      "severity": "critical",
-      "language": "java",
-      "detected": true,
-      "label": "XXE via XMLReader without disabling external entities or DOCTYPE processing"
-    },
-    {
-      "seedId": "java/seed-048.java",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "SSRF via URL.openConnection with user-supplied URL parameter"
-    },
-    {
-      "seedId": "java/seed-049.java",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "java",
-      "detected": true,
-      "label": "SSRF via URL.openStream with user-controlled webhook URL"
-    },
-    {
-      "seedId": "js/seed-014.js",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "SQL injection via Sequelize literal() with user input"
-    },
-    {
-      "seedId": "js/seed-015.js",
-      "category": "sql_injection",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "SQL injection via bulk IN clause construction with user-supplied IDs"
-    },
-    {
-      "seedId": "js/seed-026.js",
-      "category": "command_injection",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "command injection via child_process.exec in scheduled job"
-    },
-    {
-      "seedId": "js/seed-030.js",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "path traversal via user-controlled directory in readdir and readFileSync"
-    },
-    {
-      "seedId": "js/seed-044.js",
-      "category": "eval_abuse",
-      "severity": "critical",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() called with user-controlled expression string"
-    },
-    {
-      "seedId": "js/seed-046.js",
-      "category": "eval_abuse",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() used in JSON reviver to execute serialized function strings"
-    },
-    {
-      "seedId": "js/seed-047.js",
-      "category": "eval_abuse",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "eval() inside setTimeout and setInterval with user-controlled string"
-    },
-    {
-      "seedId": "js/seed-052.js",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "javascript",
-      "detected": true,
-      "label": "SSRF via got/superagent with redirect following and user-controlled URL"
-    },
-    {
-      "seedId": "kotlin/seed-019.kt",
-      "category": "xss",
-      "severity": "medium",
-      "language": "kotlin",
-      "detected": true,
-      "label": "WebView evaluateJavascript with unsanitized user string"
-    },
-    {
-      "seedId": "kotlin/seed-032.kt",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "kotlin",
-      "detected": true,
-      "label": "Download path constructed from user-controlled filename without sanitization"
-    },
-    {
-      "seedId": "kotlin/seed-038.kt",
-      "category": "insecure_crypto",
-      "severity": "medium",
-      "language": "kotlin",
-      "detected": true,
-      "label": "SHA-1 used for certificate pinning and signature verification"
-    },
-    {
-      "seedId": "php/seed-003.php",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "php",
-      "detected": true,
-      "label": "Hardcoded AWS credentials and S3 configuration"
-    },
-    {
-      "seedId": "php/seed-017.php",
-      "category": "xss",
-      "severity": "high",
-      "language": "php",
-      "detected": true,
-      "label": "$_POST values echoed directly into HTML form — stored XSS vector"
-    },
-    {
-      "seedId": "php/seed-018.php",
-      "category": "xss",
-      "severity": "high",
-      "language": "php",
-      "detected": true,
-      "label": "print_r or var_dump of user input rendered in HTML context"
-    },
-    {
-      "seedId": "php/seed-029.php",
-      "category": "path_traversal",
-      "severity": "critical",
-      "language": "php",
-      "detected": true,
-      "label": "include() with user-supplied path — local file inclusion / RFI"
-    },
-    {
-      "seedId": "python/seed-001.py",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "hardcoded AWS access key and secret key"
-    },
-    {
-      "seedId": "python/seed-029.py",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "python",
-      "detected": true,
-      "label": "path traversal via open() with unvalidated user-supplied file path"
-    },
-    {
-      "seedId": "python/seed-036.py",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "python",
-      "detected": true,
-      "label": "DES cipher usage and AES-ECB mode with static key"
-    },
-    {
-      "seedId": "python/seed-049.py",
-      "category": "deserialization",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "pickle.load used with untrusted file upload and shelve with user-controlled key"
-    },
-    {
-      "seedId": "python/seed-052.py",
-      "category": "yaml_injection",
-      "severity": "critical",
-      "language": "python",
-      "detected": true,
-      "label": "yaml.load() without safe_load — RCE via !!python/object tags in YAML"
-    },
-    {
-      "seedId": "ruby/seed-002.rb",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "ruby",
-      "detected": true,
-      "label": "Hardcoded database password in database.yml equivalent or initializer"
-    },
-    {
-      "seedId": "ruby/seed-005.rb",
-      "category": "hardcoded_secret",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "Hardcoded JWT secret and admin API token"
-    },
-    {
-      "seedId": "ruby/seed-021.rb",
-      "category": "xss",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "ActionMailer HTML email built with unescaped user content"
-    },
-    {
-      "seedId": "ruby/seed-028.rb",
-      "category": "command_injection",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "Kernel.system called with interpolated hostname for network diagnostics"
-    },
-    {
-      "seedId": "ruby/seed-044.rb",
-      "category": "open_redirect",
-      "severity": "high",
-      "language": "ruby",
-      "detected": true,
-      "label": "redirect_to params[:url] without validation — open redirect"
-    },
-    {
-      "seedId": "rust/seed-011.rs",
-      "category": "unsafe_block",
-      "severity": "critical",
-      "language": "rust",
-      "detected": true,
-      "label": "Unsafe foreign function interface call without input validation"
-    },
-    {
-      "seedId": "rust/seed-044.rs",
-      "category": "crypto_misuse",
-      "severity": "high",
-      "language": "rust",
-      "detected": true,
-      "label": "MD5 crate used for password or data integrity hashing"
-    },
-    {
-      "seedId": "ts/seed-004.ts",
-      "category": "hardcoded_secret",
-      "severity": "critical",
-      "language": "typescript",
-      "detected": true,
-      "label": "hardcoded Stripe secret key and webhook secret in typed service"
-    },
-    {
-      "seedId": "ts/seed-032.ts",
-      "category": "path_traversal",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "zip-slip path traversal via user-uploaded archive with unvalidated entry names"
-    },
-    {
-      "seedId": "ts/seed-034.ts",
-      "category": "insecure_crypto",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "MD5 used for password hashing in typed auth service"
-    },
-    {
-      "seedId": "ts/seed-048.ts",
-      "category": "ssrf",
-      "severity": "high",
-      "language": "typescript",
-      "detected": true,
-      "label": "SSRF via fetch with unvalidated user-supplied URL"
-    }
-  ]
-}

package/packages/crucible/README.md

@@ -1,93 +0,0 @@
-# The Crucible
-
-**Thuban's adversarial testing engine.** It doesn't just scan code — it ATTACKS it.
-
-The Crucible stress-tests both your codebase and Thuban itself, planting known-bad patterns, mutating real code, running golden master regression checks, and launching adversarial inputs at the scanner to find blind spots, regressions, and crashes.
-
----
-
-## Commands
-
-```
-thuban crucible run [path] [--level gentle|medium|hell]   Full adversarial run
-thuban crucible run [path] [--language js|py|java|...]    Targeted language run
-thuban crucible seed [path]                               Generate seed files only
-thuban crucible mutate [path]                             Run mutation testing only
-thuban crucible golden [path]                             Run golden master comparison
-thuban crucible self-test                                 Attack Thuban itself
-thuban crucible kenny                                     Run Kenny test battery
-thuban crucible approve                                   Bless current output as golden master
-thuban crucible report                                    View last Crucible HTML report
-```
-
----
-
-## Levels
-
-| Level  | What runs                                      | Typical time |
-|--------|------------------------------------------------|--------------|
-| gentle | Basic JS/TS seeds + golden master              | < 30 seconds |
-| medium | Full seeding (all 9 languages) + mutation engine + golden master | 1–5 minutes |
-| hell   | Everything: seeding, mutation, golden master, self-attack, Kenny mode, full HTML report | As long as it takes |
-
----
-
-## How It Works
-
-### 1. Seeding Engine
-Generates 486+ syntactically-valid seed files across 9 languages — each containing a known-bad pattern (secrets, injection, deprecated APIs, memory leaks, SSRF, path traversal, etc.). Thuban is then run against these and detection rates recorded.
-
-### 2. Mutation Engine
-Takes real code from your project, copies it to a temp directory, and applies systematic mutations (operator flips, string corruption, comment injection, import swaps). Then checks whether Thuban still catches the issues. **Never modifies original files.**
-
-### 3. Golden Master
-After a run, results are saved as a golden master JSON. Subsequent runs diff against the master and report:
-- **New detections** — Thuban found something it didn't before (good)
-- **Lost detections** — Thuban stopped finding something (BAD regression)
-- **Changed severity/category** — drift in how issues are classified
-
-Run `thuban crucible approve` to bless the current output as the new baseline.
-
-### 4. Self-Attack Mode
-Generates adversarial inputs — 100KB single-line files, binary disguised as JS, deeply nested code, null-byte injections, BOM markers, circular symlinks — and fires them at Thuban with a 30-second timeout. Reports any crashes, hangs, or silent failures.
-
-### 5. Kenny Mode
-Recreates the exact test battery from the 7 CTO reports that validated Thuban v0.3.2, plus 20+ new cases. Named as an easter egg tribute. Generates an HTML report showing what was planted, found, missed, and the overall detection rate.
-
----
-
-## Golden Master Workflow
-
-```bash
-# First run — save as golden master
-thuban crucible golden . && thuban crucible approve
-
-# Later runs — compare to saved master
-thuban crucible golden .
-# Shows regressions if detection rate dropped
-```
-
-Golden master files are stored in `packages/crucible/.golden/` and can be committed to git to share baselines with your team.
-
----
-
-## Reading the HTML Report
-
-The Crucible generates an interactive HTML report (`thuban-crucible-report-<date>.html`) with:
-
-- **Crucible Score (0–100)** — weighted composite of detection rate, mutation coverage, self-attack pass rate, regression penalty
-- **Detection rate by category** — how well Thuban catches each issue type
-- **Detection rate by language** — heatmap showing coverage gaps across all 9 languages
-- **Mutations survived vs caught** — which mutation types evade detection
-- **Golden master regressions** — red callouts for anything lost since last approval
-- **Self-attack results** — pass/fail table for adversarial inputs
-- **Kenny mode results** — planted vs found vs missed per test case
-- **Recommendations** — auto-generated based on worst-performing areas
-
----
-
-## Kenny Mode
-
-Kenny Mode is named in tribute to the CTO whose 7 detailed test reports across 5 languages exposed real-world gaps in Thuban v0.3.2. It recreates every confirmed finding from those reports and runs them automatically.
-
-New cases beyond Kenny's original battery test patterns he hadn't covered: Kotlin phantom APIs, Rust unsafe blocks, PHP base64-encoded eval, Ruby dynamic dispatch, TypeScript type erasure, SSRF in Java, Go goroutine race conditions, Python pickle deserialization, C# Process.Start injection, JS prototype pollution.

package/packages/crucible/report-generator.js

@@ -1 +0,0 @@
-"use strict";const fs=require("fs"),path=require("path"),crypto=require("crypto");function getScannerVersion(){try{return JSON.parse(fs.readFileSync(path.join(__dirname,"..","..","package.json"),"utf-8")).version||"unknown"}catch{return"unknown"}}function calculateCrucibleScore(e={}){let t=0,n=0;if(e.seedResults&&e.seedResults.total>0&&(t+=e.seedResults.detected/e.seedResults.total*100*.4,n+=.4),e.mutationResults&&e.mutationResults.total>0&&(t+=e.mutationResults.killed/e.mutationResults.total*100*.25,n+=.25),e.kennyResults&&(t+=.25*(e.kennyResults.score||0),n+=.25),e.selfAttackResults&&(t+=.1*(e.selfAttackResults.score||0),n+=.1),0===n)return 0;const s=t/n;return Math.round(Math.min(100,Math.max(0,s)))}function scoreColor(e){return e>=90?"#22c55e":e>=70?"#f59e0b":e>=50?"#f97316":"#ef4444"}function scoreLabel(e){return e>=90?"Excellent":e>=70?"Good":e>=50?"Fair":e>=30?"Poor":"Critical"}function esc(e){return String(e||"").replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#039;")}function generateHTML(e){const t=e.title||"Crucible Report",n=e.timestamp||(new Date).toISOString(),s=e.level||"medium",a="number"==typeof e.score?e.score:calculateCrucibleScore(e),r=scoreColor(a),o=scoreLabel(a),d=buildSeedSection(e.seedResults),i=buildMutationSection(e.mutationResults),l=buildKennySection(e.kennyResults),c=buildSelfAttackSection(e.selfAttackResults),p=buildGoldenSection(e.goldenComparison),u=buildDivergenceSection(e.divergenceStats);return`<!DOCTYPE html>\n<html lang="en">\n<head>\n  <meta charset="UTF-8">\n  <meta name="viewport" content="width=device-width, initial-scale=1.0">\n  <title>${esc(t)}</title>\n  <style>\n    :root {\n      --bg: #0f0f0f;\n      --surface: #1a1a1a;\n      --surface2: #242424;\n      --border: #2e2e2e;\n      --text: #e5e5e5;\n      --text-muted: #888;\n      --accent: #f97316;\n      --green: #22c55e;\n      --red: #ef4444;\n      --amber: #f59e0b;\n      --blue: #3b82f6;\n      --purple: #a855f7;\n    }\n    * { box-sizing: border-box; margin: 0; padding: 0; }\n    body {\n      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;\n      background: var(--bg);\n      color: var(--text);\n      line-height: 1.6;\n      min-height: 100vh;\n    }\n    a { color: var(--accent); text-decoration: none; }\n    h1, h2, h3 { font-weight: 700; }\n\n    /* ── Header ── */\n    .header {\n      background: linear-gradient(135deg, #1a0a00 0%, #0f0f0f 60%);\n      border-bottom: 1px solid var(--border);\n      padding: 2rem;\n      display: flex;\n      align-items: center;\n      gap: 2rem;\n    }\n    .header-logo {\n      font-size: 2.5rem;\n      font-weight: 900;\n      background: linear-gradient(135deg, #f97316, #ef4444);\n      -webkit-background-clip: text;\n      -webkit-text-fill-color: transparent;\n      letter-spacing: -1px;\n    }\n    .header-info { flex: 1; }\n    .header-info h1 { font-size: 1.5rem; color: var(--text); }\n    .header-meta { color: var(--text-muted); font-size: 0.85rem; margin-top: 0.25rem; }\n\n    /* ── Score gauge ── */\n    .score-gauge {\n      text-align: center;\n      min-width: 120px;\n    }\n    .score-circle {\n      width: 100px; height: 100px;\n      border-radius: 50%;\n      border: 4px solid ${r};\n      display: flex; flex-direction: column;\n      align-items: center; justify-content: center;\n      margin: 0 auto 0.5rem;\n      box-shadow: 0 0 20px ${r}40;\n    }\n    .score-number { font-size: 2rem; font-weight: 900; color: ${r}; }\n    .score-label-small { font-size: 0.7rem; color: var(--text-muted); }\n    .score-grade { font-size: 0.9rem; font-weight: 700; color: ${r}; }\n\n    /* ── Container ── */\n    .container { max-width: 1200px; margin: 0 auto; padding: 2rem; }\n\n    /* ── Summary cards ── */\n    .cards {\n      display: grid;\n      grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));\n      gap: 1rem;\n      margin-bottom: 2rem;\n    }\n    .card {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      padding: 1.25rem;\n    }\n    .card-value { font-size: 2rem; font-weight: 900; }\n    .card-label { font-size: 0.8rem; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.05em; margin-top: 0.25rem; }\n    .card.green .card-value { color: var(--green); }\n    .card.red .card-value   { color: var(--red); }\n    .card.amber .card-value { color: var(--amber); }\n    .card.blue .card-value  { color: var(--blue); }\n    .card.purple .card-value{ color: var(--purple); }\n\n    /* ── Sections ── */\n    .section {\n      background: var(--surface);\n      border: 1px solid var(--border);\n      border-radius: 8px;\n      margin-bottom: 1.5rem;\n      overflow: hidden;\n    }\n    .section-header {\n      display: flex; align-items: center; justify-content: space-between;\n      padding: 1rem 1.25rem;\n      border-bottom: 1px solid var(--border);\n      cursor: pointer;\n      user-select: none;\n    }\n    .section-header:hover { background: var(--surface2); }\n    .section-title { font-size: 1rem; font-weight: 700; display: flex; align-items: center; gap: 0.5rem; }\n    .section-badge {\n      font-size: 0.75rem; font-weight: 600;\n      padding: 0.2rem 0.6rem; border-radius: 999px;\n      background: var(--surface2); border: 1px solid var(--border);\n    }\n    .section-badge.pass { background: #052e16; border-color: #16a34a; color: var(--green); }\n    .section-badge.fail { background: #450a0a; border-color: #dc2626; color: var(--red); }\n    .section-body { padding: 1.25rem; }\n\n    /* ── Bar charts ── */\n    .bar-chart { display: flex; flex-direction: column; gap: 0.5rem; }\n    .bar-row { display: flex; align-items: center; gap: 0.75rem; }\n    .bar-label { width: 160px; font-size: 0.85rem; text-align: right; color: var(--text-muted); flex-shrink: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }\n    .bar-track { flex: 1; height: 20px; background: var(--surface2); border-radius: 4px; overflow: hidden; position: relative; }\n    .bar-fill { height: 100%; border-radius: 4px; transition: width 0.4s ease; display: flex; align-items: center; padding-left: 8px; font-size: 0.75rem; font-weight: 600; color: white; }\n    .bar-count { font-size: 0.8rem; color: var(--text-muted); min-width: 60px; }\n\n    /* ── Test table ── */\n    .test-table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }\n    .test-table th {\n      text-align: left; padding: 0.5rem 0.75rem;\n      border-bottom: 1px solid var(--border);\n      color: var(--text-muted); font-weight: 600;\n      text-transform: uppercase; letter-spacing: 0.05em; font-size: 0.75rem;\n    }\n    .test-table td { padding: 0.5rem 0.75rem; border-bottom: 1px solid var(--border); vertical-align: top; }\n    .test-table tr:last-child td { border-bottom: none; }\n    .test-table tr:hover td { background: var(--surface2); }\n    .pass-icon { color: var(--green); font-weight: 700; }\n    .fail-icon { color: var(--red); font-weight: 700; }\n    .warn-icon { color: var(--amber); font-weight: 700; }\n    .badge {\n      display: inline-block; font-size: 0.7rem; font-weight: 600;\n      padding: 0.1rem 0.4rem; border-radius: 4px; margin: 0 0.1rem;\n    }\n    .badge-critical { background: #450a0a; color: #fca5a5; border: 1px solid #ef4444; }\n    .badge-high     { background: #431407; color: #fdba74; border: 1px solid #f97316; }\n    .badge-medium   { background: #422006; color: #fcd34d; border: 1px solid #f59e0b; }\n    .badge-category { background: #1e1b4b; color: #a5b4fc; border: 1px solid #6366f1; }\n    .badge-lang     { background: #052e16; color: #86efac; border: 1px solid #22c55e; }\n\n    /* ── Golden comparison ── */\n    .regression { background: #450a0a; border: 1px solid var(--red); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .improvement { background: #052e16; border: 1px solid var(--green); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n    .neutral { background: var(--surface2); border: 1px solid var(--border); border-radius: 6px; padding: 1rem; margin-top: 1rem; }\n\n    /* ── Collapse toggle ── */\n    .chevron { transition: transform 0.2s; }\n    .collapsed .chevron { transform: rotate(-90deg); }\n    .collapsible-body { display: block; }\n    .collapsed .collapsible-body { display: none; }\n\n    /* ── Responsive ── */\n    @media (max-width: 768px) {\n      .header { flex-direction: column; text-align: center; }\n      .bar-label { width: 100px; }\n    }\n\n    /* ── Footer ── */\n    .footer {\n      text-align: center;\n      padding: 2rem;\n      color: var(--text-muted);\n      font-size: 0.8rem;\n      border-top: 1px solid var(--border);\n    }\n  </style>\n</head>\n<body>\n\n<div class="header">\n  <div class="header-logo">&#x1F525; CRUCIBLE</div>\n  <div class="header-info">\n    <h1>${esc(t)}</h1>\n    <div class="header-meta">\n      Level: <strong>${esc(s)}</strong> &nbsp;|&nbsp;\n      Generated: <strong>${esc(new Date(n).toLocaleString())}</strong> &nbsp;|&nbsp;\n      Branch: <strong>kenny-mode</strong> &nbsp;|&nbsp;\n      Scanner: <strong>v${esc(getScannerVersion())}</strong>\n    </div>\n  </div>\n  <div class="score-gauge">\n    <div class="score-circle">\n      <div class="score-number">${a}</div>\n      <div class="score-label-small">/ 100</div>\n    </div>\n    <div class="score-grade">${esc(o)}</div>\n    <div class="score-label-small">Crucible Score</div>\n  </div>\n</div>\n\n<div class="container">\n  ${buildSummaryCards(e,a)}\n  ${p}\n  ${u}\n  ${d}\n  ${i}\n  ${l}\n  ${c}\n</div>\n\n<div class="footer">\n  Generated by <strong>Thuban Crucible</strong> &mdash; The Fire Test for Security Scanners\n</div>\n\n<script>\n  // Collapsible sections\n  document.querySelectorAll('.section-header').forEach(h => {\n    h.addEventListener('click', () => {\n      h.closest('.section').classList.toggle('collapsed');\n    });\n  });\n<\/script>\n</body>\n</html>`}function buildSummaryCards(e,t){const n=e.seedResults||{},s=e.mutationResults||{},a=e.kennyResults||{},r=n.total>0?Math.round(n.detected/n.total*100):null,o=s.total>0?Math.round(s.killed/s.total*100):null,d=[];return n.total&&(d.push(`<div class="card ${r>=70?"green":"red"}">\n      <div class="card-value">${r}%</div>\n      <div class="card-label">Seed Detection Rate</div>\n    </div>`),d.push(`<div class="card blue">\n      <div class="card-value">${n.total}</div>\n      <div class="card-label">Seeds Tested</div>\n    </div>`)),s.total&&d.push(`<div class="card ${o>=70?"green":"amber"}">\n      <div class="card-value">${o}%</div>\n      <div class="card-label">Mutation Kill Rate</div>\n    </div>`),void 0!==a.score&&d.push(`<div class="card ${a.score>=70?"green":"amber"}">\n      <div class="card-value">${a.score}</div>\n      <div class="card-label">Kenny Score</div>\n    </div>`),d.push(`<div class="card purple">\n    <div class="card-value">${t}</div>\n    <div class="card-label">Crucible Score</div>\n  </div>`),`<div class="cards">${d.join("")}</div>`}function buildSeedSection(e){if(!e)return"";const t=e.total||0,n=e.detected||0,s=e.missed||0,a=e.byLanguage||{},r=e.byCategory||{},o=Object.entries(a).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),d=Object.entries(r).sort(([,e],[,t])=>t.detected/t.total-e.detected/e.total).map(([e,t])=>{const n=t.total>0?Math.round(t.detected/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n        <div class="bar-label">${esc(e)}</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n        </div>\n        <div class="bar-count">${t.detected}/${t.total}</div>\n      </div>`}).join(""),i=0===s?'<span class="section-badge pass">All seeds detected</span>':`<span class="section-badge fail">${s} missed</span>`,l=(e.tests||[]).slice(0,200).map(e=>`<tr>\n    <td><span class="${e.detected?"pass-icon":"fail-icon"}">${e.detected?"✓":"✗"}</span></td>\n    <td><code>${esc(e.id)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td><span class="badge badge-${esc((e.severity||"medium").toLowerCase())}">${esc(e.severity)}</span></td>\n    <td style="color:var(--text-muted);font-size:0.8rem">${esc(e.expected)}</td>\n  </tr>`).join("");return`\n<div class="section" id="seed-section">\n  <div class="section-header">\n    <div class="section-title">&#127807; Seed Results <span style="color:var(--text-muted);font-weight:400;font-size:0.9rem">${n}/${t} detected</span></div>\n    ${i}\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="display:grid;grid-template-columns:1fr 1fr;gap:2rem;margin-bottom:1.5rem">\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Language</h3>\n        <div class="bar-chart">${o||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n      <div>\n        <h3 style="margin-bottom:0.75rem;font-size:0.9rem;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.05em">By Category</h3>\n        <div class="bar-chart">${d||'<div style="color:var(--text-muted)">No data</div>'}</div>\n      </div>\n    </div>\n    ${l?`\n    <table class="test-table">\n      <thead><tr>\n        <th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Severity</th><th>Expected</th>\n      </tr></thead>\n      <tbody>${l}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildMutationSection(e){if(!e)return"";const t=e.total||0,n=e.killed||0,s=e.survived||0,a=t>0?Math.round(n/t*100):0,r=a>=70?"#22c55e":a>=50?"#f59e0b":"#ef4444",o=(e.tests||[]).slice(0,100).map(e=>`<tr>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}">${e.killed?"✓":"✗"}</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td>${(e.applied||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" ")}</td>\n    <td><span class="${e.killed?"pass-icon":"fail-icon"}" style="font-size:0.85rem">${e.killed?"Killed":"Survived"}</span></td>\n  </tr>`).join("");return`\n<div class="section" id="mutation-section">\n  <div class="section-header">\n    <div class="section-title">&#129516; Mutation Kill Rate <span style="color:${r};margin-left:0.5rem">${a}%</span></div>\n    <span class="section-badge ${a>=70?"pass":"fail"}">${n}/${t} killed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1rem">\n      <div class="bar-row">\n        <div class="bar-label">Kill Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${a}%; background:${r}">${a}%</div>\n        </div>\n        <div class="bar-count">${n}/${t}</div>\n      </div>\n      <div class="bar-row">\n        <div class="bar-label">Survival Rate</div>\n        <div class="bar-track">\n          <div class="bar-fill" style="width:${t>0?Math.round(s/t*100):0}%; background:#ef4444">${t>0?Math.round(s/t*100):0}%</div>\n        </div>\n        <div class="bar-count">${s}/${t}</div>\n      </div>\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Mutations Applied</th><th>Result</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildKennySection(e){if(!e)return"";const t=e.score||0,n=e.total||0,s=e.passed||0,a=(e.failed,scoreColor(t)),r=Object.entries(e.batteries||{}).map(([e,t])=>{const n=t.total>0?Math.round(t.passed/t.total*100):0,s=n>=70?"#22c55e":n>=50?"#f59e0b":"#ef4444";return`<div class="bar-row">\n      <div class="bar-label">${esc(e)}</div>\n      <div class="bar-track">\n        <div class="bar-fill" style="width:${n}%; background:${s}">${n}%</div>\n      </div>\n      <div class="bar-count">${t.passed}/${t.total}</div>\n    </div>`}).join(""),o=(e.tests||[]).map(e=>{const t=(e.missingDetections||[]).map(e=>`<span class="badge badge-category">${esc(e)}</span>`).join(" "),n=(e.falsePositives||[]).map(e=>`<span class="badge badge-high">${esc(e)}</span>`).join(" ");return`<tr>\n      <td><span class="${e.passed?"pass-icon":e.crashed||e.timedOut?"warn-icon":"fail-icon"}">${e.passed?"✓":e.crashed?"⚡":e.timedOut?"⏱":"✗"}</span></td>\n      <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.id)}</td>\n      <td>${esc(e.name)}</td>\n      <td><span class="badge badge-lang">${esc(e.battery)}</span></td>\n      <td>${t||n||'<span style="color:var(--text-muted)">—</span>'}</td>\n    </tr>`}).join("");return`\n<div class="section" id="kenny-section">\n  <div class="section-header">\n    <div class="section-title">&#128293; Kenny Mode <span style="color:${a};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${t>=70?"pass":"fail"}">${s}/${n} passed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="bar-chart" style="margin-bottom:1.5rem">\n      ${r||'<div style="color:var(--text-muted)">No battery data</div>'}\n    </div>\n    ${o?`\n    <table class="test-table">\n      <thead><tr><th></th><th>ID</th><th>Test</th><th>Battery</th><th>Issues</th></tr></thead>\n      <tbody>${o}</tbody>\n    </table>`:""}\n  </div>\n</div>`}function buildSelfAttackSection(e){if(!e)return"";const t=e.score||0,n=(e.crashes||[]).length,s=(e.hangs||[]).length,a=(e.missedDetections||[]).length,r=(e.passed||[]).length,o=scoreColor(t),d=(e.crashes||[]).map(e=>`<tr>\n    <td><span class="fail-icon">⚡</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--red)">${esc(e.error||"")}</td>\n  </tr>`).join(""),i=(e.hangs||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⏱</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td>${esc(e.description)}</td>\n    <td style="color:var(--amber)">Timed out after ${e.timeout}ms</td>\n  </tr>`).join(""),l=(e.passed||[]).map(e=>`<tr>\n    <td><span class="pass-icon">✓</span></td>\n    <td><code>${esc(e.payload)}</code></td>\n    <td colspan="2">${esc(e.description)}</td>\n  </tr>`).join("");return`\n<div class="section" id="self-attack-section">\n  <div class="section-header">\n    <div class="section-title">&#128481; Self-Attack <span style="color:${o};margin-left:0.5rem">${t}/100</span></div>\n    <span class="section-badge ${n+s===0?"pass":"fail"}">${n} crash, ${s} hang, ${a} missed</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    ${n+s+a+r>0?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Payload</th><th>Description</th><th>Details</th></tr></thead>\n      <tbody>\n        ${d}\n        ${i}\n        ${l}\n      </tbody>\n    </table>`:'<div style="color:var(--text-muted)">No self-attack results</div>'}\n  </div>\n</div>`}function buildGoldenSection(e){if(!e||!e.hasMaster)return"";const t=e.passed?"improvement":"regression",n=e.passed?"✓":"✗",s=(e.lostDetections||[]).map(e=>`<div style="color:var(--red);font-size:0.85rem">&#8722; ${esc(e)}</div>`).join(""),a=(e.newDetections||[]).map(e=>`<div style="color:var(--green);font-size:0.85rem">&#43; ${esc(e)}</div>`).join("");return`\n<div class="section" id="golden-section">\n  <div class="section-header">\n    <div class="section-title">&#127775; Golden Master Comparison</div>\n    <span class="section-badge ${e.passed?"pass":"fail"}">${e.passed?"No regressions":`${e.regressions} regression(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div class="${t}">\n      <strong>${n} ${esc(e.summary)}</strong>\n      <div style="margin-top:0.5rem;color:var(--text-muted);font-size:0.85rem">\n        Golden from: ${esc(e.goldenTimestamp||"unknown")} &nbsp;|&nbsp;\n        Previous score: ${null!=e.goldenScore?e.goldenScore:"N/A"}\n      </div>\n    </div>\n    ${s?`<div style="margin-top:1rem"><strong style="color:var(--red)">Regressions (lost detections):</strong>${s}</div>`:""}\n    ${a?`<div style="margin-top:1rem"><strong style="color:var(--green)">Improvements (new detections):</strong>${a}</div>`:""}\n  </div>\n</div>`}function buildDivergenceSection(e){if(!e||!e.sampled)return"";const t=null!=e.agreementRate?e.agreementRate:0,n=t>=95?"#22c55e":t>=80?"#f59e0b":"#ef4444",s=(e.divergences||[]).length,a=(e.divergences||[]).map(e=>`<tr>\n    <td><span class="warn-icon">⚠</span></td>\n    <td><code>${esc(e.seedId)}</code></td>\n    <td><span class="badge badge-lang">${esc(e.language)}</span></td>\n    <td><span class="badge badge-category">${esc(e.category)}</span></td>\n    <td style="font-size:0.8rem;color:var(--text-muted)">${esc(e.phase)}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.heuristicCategories))}</td>\n    <td style="font-size:0.8rem">${esc(JSON.stringify(e.productionCategories))}</td>\n  </tr>`).join("");return`\n<div class="section" id="divergence-section">\n  <div class="section-header">\n    <div class="section-title">&#128269; Heuristic-CLI Agreement <span style="color:${n};margin-left:0.5rem">${t}%</span></div>\n    <span class="section-badge ${0===s?"pass":"fail"}">${0===s?"No divergences":`${s} divergence(s)`}</span>\n    <span class="chevron">&#8964;</span>\n  </div>\n  <div class="collapsible-body section-body">\n    <div style="color:var(--text-muted);font-size:0.85rem;margin-bottom:1rem">\n      Randomly sampled ${Math.round(100*e.sampleRate)}% of seeds where the fast heuristic\n      (<code>_simulateScan()</code>) reported "detected", then cross-checked against the real\n      production scanner (CodeScanner + HallucinationDetector). Agreement: <strong>${t}%</strong>\n      on ${e.sampled} sampled seed(s). This never affects the headline Crucible score.\n    </div>\n    ${a?`\n    <table class="test-table">\n      <thead><tr><th></th><th>Seed</th><th>Lang</th><th>Category</th><th>Phase</th><th>Heuristic</th><th>Production</th></tr></thead>\n      <tbody>${a}</tbody>\n    </table>`:""}\n  </div>\n</div>`}class ReportGenerator{constructor(e={}){this.outputDir=path.resolve(e.outputDir||process.cwd())}generate(e,t={}){const n=(e.timestamp||(new Date).toISOString()).replace(/[:.]/g,"-").slice(0,19),s=t.filename||`crucible-report-${n}.html`,a=path.basename(s),r=path.join(this.outputDir,a),o=generateHTML(e);return fs.writeFileSync(r,o,"utf-8"),r}generateJSON(e,t={}){const n=e.timestamp||(new Date).toISOString(),s=n.replace(/[:.]/g,"-").slice(0,19),a=t.filename||`crucible-report-${s}.json`,r=path.basename(a),o=path.join(this.outputDir,r),d="number"==typeof e.score?e.score:calculateCrucibleScore(e),i={timestamp:n,score:d,scoreLabel:scoreLabel(d),scannerVersion:getScannerVersion(),level:e.level||"medium",seeds:e.seedResults?{total:e.seedResults.total,detected:e.seedResults.detected,missed:e.seedResults.missed,rate:e.seedResults.total>0?Math.round(e.seedResults.detected/e.seedResults.total*100):null}:null,mutations:e.mutationResults?{total:e.mutationResults.total,killed:e.mutationResults.killed,survived:e.mutationResults.survived,killRate:e.mutationResults.total>0?Math.round(e.mutationResults.killed/e.mutationResults.total*100):null}:null,kenny:e.kennyResults?{score:e.kennyResults.score,passed:e.kennyResults.passed,total:e.kennyResults.total}:null,selfAttack:e.selfAttackResults?{score:e.selfAttackResults.score}:null,golden:e.goldenComparison?{passed:e.goldenComparison.passed,regressions:e.goldenComparison.regressions}:null,divergence:e.divergenceStats&&e.divergenceStats.sampled?{sampleRate:e.divergenceStats.sampleRate,sampled:e.divergenceStats.sampled,agreements:e.divergenceStats.agreements,agreementRate:e.divergenceStats.agreementRate,divergences:e.divergenceStats.divergences}:null};return fs.writeFileSync(o,JSON.stringify(i,null,2),"utf-8"),o}}module.exports={ReportGenerator:ReportGenerator,generateHTML:generateHTML,calculateCrucibleScore:calculateCrucibleScore,scoreColor:scoreColor,scoreLabel:scoreLabel,getScannerVersion:getScannerVersion};