trace-sec 2.1.10 → 2.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trace-sec",
-  "version": "2.1.10",
+  "version": "2.1.11",
   "description": "Threat Reconnaissance & Attack-path Correlation Engine — Security Verification Layer for Coding Agents with Fine-Tuned SecureBERT 2.0 & Laya AI",
   "type": "module",
   "main": "bin/trace.js",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trace-sec"
-version = "2.1.10"
+version = "2.1.11"
 description = "Threat Reconnaissance & Attack-path Correlation Engine"
 readme = "README.md"
 requires-python = ">=3.11"

package/src/trace_engine/cli.py

@@ -289,22 +289,69 @@ def test(
         active_tokens={"user-a": "user-a", "user-b": "user-b", "admin": "admin"},
     )
 
-    console.print(f"\n[bold green]Executing Controlled Runtime Tests[/bold green] against [white]{target}[/white]...")
+    # Check target connectivity
+    target_online = False
+    try:
+        import httpx
+        with httpx.Client(timeout=1.0) as chk:
+            chk.get(target)
+            target_online = True
+    except Exception:
+        target_online = False
+
+    if target_online:
+        console.print(f"\n[bold green]Executing Controlled Runtime Tests[/bold green] against [white]{target}[/white]...")
+    else:
+        console.print(f"\n[yellow]Notice:[/yellow] Target runtime [white]{target}[/white] is offline or unreachable.")
+        console.print(f"  [dim]• Active HTTP exploit probes require a running service (e.g. localhost or lab testbed).[/dim]")
+        console.print(f"  [dim]• Auditing codebase via Neuro-Symbolic Attack-Path Model (Safe Offline Mode)...[/dim]\n")
+
     executed = 0
     confirmed = 0
+    correlator = EvidenceCorrelator()
+    findings: List[Finding] = []
 
     for hyp in hypotheses:
-        pack = default_registry.get(hyp.recommended_test_pack)
-        if pack:
-            executed += 1
-            res = pack.execute(hyp, client, context)
-            if res.confirmed:
-                confirmed += 1
-                console.print(f"  [bold red]CONFIRMED:[/bold red] [{hyp.id}] {res.summary}")
-            else:
-                console.print(f"  [dim]Passed / Inconclusive:[/dim] [{hyp.id}] {res.summary}")
-
-    console.print(f"\n[dim]Executed {executed} test packs. {confirmed} attack paths confirmed.[/dim]\n")
+        test_res = None
+        if target_online:
+            pack = default_registry.get(hyp.recommended_test_pack)
+            if pack:
+                executed += 1
+                try:
+                    test_res = pack.execute(hyp, client, context)
+                    if test_res and test_res.confirmed:
+                        confirmed += 1
+                        console.print(f"  [bold red]CONFIRMED:[/bold red] [{hyp.id}] {test_res.summary}")
+                    else:
+                        console.print(f"  [dim]Passed / Inconclusive:[/dim] [{hyp.id}] {test_res.summary}")
+                except Exception:
+                    test_res = None
+
+        finding = correlator.correlate(hyp, test_res, graph_model)
+        if finding:
+            findings.append(finding)
+
+    # Persist findings & APM
+    trace_dir = init_trace_dir(project_dir)
+    save_apm_sqlite(graph_model, trace_dir / "graph.db")
+    store = FindingStore(trace_dir)
+    store.save_findings(findings)
+
+    try:
+        root_trace = Path(".trace")
+        root_trace.mkdir(parents=True, exist_ok=True)
+        (root_trace / "last_scan_repo.txt").write_text(str(project_dir), encoding="utf-8")
+        if project_dir != Path(".").resolve():
+            root_store = FindingStore(root_trace)
+            root_store.save_findings(findings)
+    except Exception:
+        pass
+
+    if target_online:
+        console.print(f"\n[dim]Executed {executed} test packs. {confirmed} attack paths confirmed at runtime.[/dim]\n")
+
+    print_findings_table(findings)
+    console.print(f"[dim]Total findings identified: {len(findings)} (Saved to {trace_dir / 'findings.json'})[/dim]\n")
 
 
 @app.command()

package/src/trace_engine/interactive.py

@@ -438,13 +438,14 @@ def run_interactive_story() -> None:
         display_story_header(4, 4, "Attack Vector Selection", "Select specific vulnerability testpacks to deploy")
 
         pack_mapping = {
-            "1": ("BOLA / IDOR", "bola", "Multi-tenant object access & IDOR cross-account authorization leak"),
-            "2": ("SQL & Command Injection", "injection", "Statistical timing oracle (p < 0.01) & error extraction"),
-            "3": ("SSRF ScopeGuard", "ssrf", "Egress network validation against RFC 1918 loopback & metadata IPs"),
-            "4": ("BFLA / RBAC Elevation", "bfla", "Broken function-level authorization & administrative privilege check"),
-            "5": ("Path Traversal", "path_traversal", "Canonical directory escape & arbitrary file disclosure probes"),
-            "6": ("CORS Misconfiguration", "cors", "Wildcard Access-Control-Allow-Origin & credential reflection"),
-            "7": ("Mass Assignment", "mass_assignment", "Unbounded payload parameter binding to persistent entities"),
+            "1": ("Authentication & Auth Gates", "authentication", "Missing token validation & unauthenticated state-changing routes"),
+            "2": ("BOLA / IDOR", "bola", "Multi-tenant object access & IDOR cross-account authorization leak"),
+            "3": ("SQL & Command Injection", "injection", "Statistical timing oracle (p < 0.01) & error extraction"),
+            "4": ("SSRF ScopeGuard", "ssrf", "Egress network validation against RFC 1918 loopback & metadata IPs"),
+            "5": ("BFLA / RBAC Elevation", "bfla", "Broken function-level authorization & administrative privilege check"),
+            "6": ("Path Traversal", "path_traversal", "Canonical directory escape & arbitrary file disclosure probes"),
+            "7": ("CORS Misconfiguration", "cors", "Wildcard Access-Control-Allow-Origin & credential reflection"),
+            "8": ("Mass Assignment", "mass_assignment", "Unbounded payload parameter binding to persistent entities"),
         }
 
         console.print(f"  [{BOLD_WHITE}]Available Testpacks:[/{BOLD_WHITE}]")
@@ -518,6 +519,15 @@ def run_interactive_story() -> None:
 
         if selected_packs:
             hypotheses = [h for h in all_hypotheses if h.recommended_test_pack in selected_packs]
+            if not hypotheses and all_hypotheses:
+                avail_cats = list({h.category.value for h in all_hypotheses})
+                console.print(
+                    f"\n  [{ORANGE}]Notice:[/{ORANGE}] [{WHITE}]No endpoints matched the selected testpack filter ({', '.join(selected_packs)}).[/{WHITE}]"
+                )
+                console.print(
+                    f"  [{DIM_WHITE}]Codebase contains attack vectors for: {', '.join(avail_cats)}. Auditing all codebase attack paths to prevent false negatives...[/{DIM_WHITE}]\n"
+                )
+                hypotheses = all_hypotheses
         else:
             hypotheses = all_hypotheses
 

package/src/trace_engine/testpacks/authentication.py

@@ -48,12 +48,18 @@ class AuthenticationTestPack(TestPack):
                 f"Send unauthenticated {method} request to {target_url}",
                 f"Received HTTP {obs.response_status} rather than expected 401/403",
             ]
+        elif obs.response_status == 0:
+            confirmed = False
+            summary = f"Target host unreachable ({obs.response_body}). Live probe inconclusive."
+        else:
+            confirmed = False
+            summary = f"Authentication enforced (server responded with HTTP {obs.response_status})."
 
         return TestExecutionResult(
             testpack_name=self.name,
             hypothesis_id=hypothesis.id,
             confirmed=confirmed,
-            confidence=0.90 if confirmed else 0.15,
+            confidence=0.90 if confirmed else (None if obs.response_status == 0 else 0.15),
             summary=summary,
             observations=observations,
             reproduction_steps=steps,

package/src/trace_engine/testpacks/bfla.py

@@ -58,12 +58,18 @@ class BflaTestPack(TestPack):
                 f"Invoke privileged endpoint {method} {target_url}",
                 f"Received HTTP {obs.response_status} indicating unauthorized function execution",
             ]
+        elif obs.response_status == 0:
+            confirmed = False
+            summary = f"Target host unreachable ({obs.response_body}). Live probe inconclusive."
+        else:
+            confirmed = False
+            summary = f"Function-level authorization enforced (received HTTP {obs.response_status})."
 
         return TestExecutionResult(
             testpack_name=self.name,
             hypothesis_id=hypothesis.id,
             confirmed=confirmed,
-            confidence=0.92 if confirmed else 0.20,
+            confidence=0.92 if confirmed else (None if obs.response_status == 0 else 0.20),
             summary=summary,
             observations=observations,
             reproduction_steps=steps,

package/src/trace_engine/testpacks/bola.py

@@ -83,11 +83,15 @@ class BolaTestPack(TestPack):
                     ]
                     break
 
+        any_reachable = any(obs.response_status != 0 for obs in observations)
+        if not confirmed and not any_reachable:
+            summary = "Target host unreachable. Dynamic probe inconclusive."
+
         return TestExecutionResult(
             testpack_name=self.name,
             hypothesis_id=hypothesis.id,
             confirmed=confirmed,
-            confidence=0.98 if confirmed else 0.20,
+            confidence=0.98 if confirmed else (None if not any_reachable else 0.20),
             summary=summary,
             observations=observations,
             reproduction_steps=steps,