tribunal-kit 6.0.0 → 7.0.0

package/.agent/scripts/security_scan.js

@@ -22,10 +22,10 @@
  *   node .agent/scripts/security_scan.js . --files src/auth.ts src/db.ts
  */
 
-"use strict";
+'use strict';
 
-const fs = require("fs");
-const path = require("path");
+const fs = require('fs');
+const path = require('path');
 
 const {
   RED,
@@ -40,18 +40,12 @@ const {
   banner,
   timer,
   formatMs,
-} = require("./_colors");
+} = require('./_colors');
 
-const { walkDir, SOURCE_EXTENSIONS } = require("./_utils");
+const { walkDir, SOURCE_EXTENSIONS, DEFAULT_SKIP_DIRS } = require('./_utils');
 
 // ── Security-specific source extensions (broader than default) ──────────────
-const SCAN_EXTENSIONS = new Set([
-  ...SOURCE_EXTENSIONS,
-  ".py",
-  ".go",
-  ".java",
-  ".rb",
-]);
+const SCAN_EXTENSIONS = new Set([...SOURCE_EXTENSIONS, '.py', '.go', '.java', '.rb']);
 
 const SEVERITY_COLORS = {
   critical: RED + BOLD,
@@ -67,142 +61,117 @@ const PATTERNS = [
   // Secrets
   [
     /(?:password|passwd|pwd)\s*=\s*["'][^"']+["']/i,
-    "critical",
-    "Hardcoded Secret",
-    "Hardcoded password detected",
+    'critical',
+    'Hardcoded Secret',
+    'Hardcoded password detected',
   ],
   [
     /(?:api_key|apikey|api_secret)\s*=\s*["'][^"']+["']/i,
-    "critical",
-    "Hardcoded Secret",
-    "Hardcoded API key detected",
+    'critical',
+    'Hardcoded Secret',
+    'Hardcoded API key detected',
   ],
   [
     /(?:secret|token|auth_token)\s*=\s*["'][A-Za-z0-9+/=]{16,}["']/i,
-    "critical",
-    "Hardcoded Secret",
-    "Hardcoded secret/token detected",
+    'critical',
+    'Hardcoded Secret',
+    'Hardcoded secret/token detected',
   ],
   [
     /(?:PRIVATE_KEY|private_key)\s*=\s*["']/i,
-    "critical",
-    "Hardcoded Secret",
-    "Hardcoded private key detected",
+    'critical',
+    'Hardcoded Secret',
+    'Hardcoded private key detected',
   ],
 
   // SQL Injection
   [
     /(?:query|execute|raw)\s*\(\s*[`"'].*\$\{/i,
-    "high",
-    "SQL Injection",
-    "String interpolation in SQL query — use parameterized queries",
+    'high',
+    'SQL Injection',
+    'String interpolation in SQL query — use parameterized queries',
   ],
   [
     /(?:query|execute|raw)\s*\(\s*["'].*\+\s*(?:req|input|params|body)/i,
-    "high",
-    "SQL Injection",
-    "String concatenation with user input in SQL",
+    'high',
+    'SQL Injection',
+    'String concatenation with user input in SQL',
   ],
   [
     /\.raw\s*\(\s*`/,
-    "medium",
-    "SQL Injection",
-    "Raw query with template literal — verify inputs are sanitized",
+    'medium',
+    'SQL Injection',
+    'Raw query with template literal — verify inputs are sanitized',
   ],
 
   // XSS
   [
     /\.innerHTML\s*=/,
-    "high",
-    "XSS",
-    "Direct innerHTML assignment — use textContent or a sanitizer",
+    'high',
+    'XSS',
+    'Direct innerHTML assignment — use textContent or a sanitizer',
   ],
   [
     /dangerouslySetInnerHTML/,
-    "medium",
-    "XSS",
-    "dangerouslySetInnerHTML used — ensure input is sanitized",
+    'medium',
+    'XSS',
+    'dangerouslySetInnerHTML used — ensure input is sanitized',
   ],
-  [/document\.write\s*\(/, "high", "XSS", "document.write() is an XSS vector"],
+  [/document\.write\s*\(/, 'high', 'XSS', 'document.write() is an XSS vector'],
 
   // Insecure Functions
-  [
-    /\beval\s*\(/,
-    "high",
-    "Code Injection",
-    "eval() is a code injection vector — avoid entirely",
-  ],
-  [
-    /new\s+Function\s*\(/,
-    "high",
-    "Code Injection",
-    "new Function() is equivalent to eval()",
-  ],
+  [/\beval\s*\(/, 'high', 'Code Injection', 'eval() is a code injection vector — avoid entirely'],
+  [/new\s+Function\s*\(/, 'high', 'Code Injection', 'new Function() is equivalent to eval()'],
   [
     /child_process\.exec\s*\(/,
-    "medium",
-    "Command Injection",
-    "exec() with unsanitized input is a command injection vector",
+    'medium',
+    'Command Injection',
+    'exec() with unsanitized input is a command injection vector',
   ],
   [
     /subprocess\.call\s*\(\s*[^,\]]*\bshell\s*=\s*True/,
-    "high",
-    "Command Injection",
-    "subprocess with shell=True — use shell=False and pass args as list",
+    'high',
+    'Command Injection',
+    'subprocess with shell=True — use shell=False and pass args as list',
   ],
 
   // Crypto
   [
     /createHash\s*\(\s*["']md5["']/,
-    "medium",
-    "Weak Crypto",
-    "MD5 is cryptographically broken — use SHA-256+",
-  ],
-  [
-    /createHash\s*\(\s*["']sha1["']/,
-    "medium",
-    "Weak Crypto",
-    "SHA-1 is deprecated — use SHA-256+",
+    'medium',
+    'Weak Crypto',
+    'MD5 is cryptographically broken — use SHA-256+',
   ],
+  [/createHash\s*\(\s*["']sha1["']/, 'medium', 'Weak Crypto', 'SHA-1 is deprecated — use SHA-256+'],
   [
     /Math\.random\s*\(/,
-    "low",
-    "Weak Randomness",
-    "Math.random() is not cryptographically secure — use crypto.randomBytes()",
+    'low',
+    'Weak Randomness',
+    'Math.random() is not cryptographically secure — use crypto.randomBytes()',
   ],
 
   // Auth Issues
   [
     /algorithms\s*:\s*\[\s*["']none["']/,
-    "critical",
-    "Auth Bypass",
+    'critical',
+    'Auth Bypass',
     "JWT 'none' algorithm allows auth bypass",
   ],
-  [
-    /verify\s*:\s*false/,
-    "high",
-    "Auth Bypass",
-    "SSL/TLS verification disabled",
-  ],
-  [
-    /rejectUnauthorized\s*:\s*false/,
-    "high",
-    "Auth Bypass",
-    "TLS certificate validation disabled",
-  ],
+  [/verify\s*:\s*false/, 'high', 'Auth Bypass', 'SSL/TLS verification disabled'],
+  [/rejectUnauthorized\s*:\s*false/, 'high', 'Auth Bypass', 'TLS certificate validation disabled'],
 
   // Information Disclosure
   [
     /console\.log\s*\(.*(?:password|secret|token|key)/i,
-    "medium",
-    "Info Disclosure",
-    "Sensitive data logged to console",
+    'medium',
+    'Info Disclosure',
+    'Sensitive data logged to console',
   ],
   [
     /\.env(?:\.local|\.production)/,
-    "low",
-    "Info Disclosure",
-    "Env file reference — ensure not committed to git",
+    'low',
+    'Info Disclosure',
+    'Env file reference — ensure not committed to git',
   ],
 ];
 
@@ -218,20 +187,16 @@ function scanFile(filepath, projectRoot) {
 
   let content;
   try {
-    content = fs.readFileSync(filepath, "utf8");
+    content = fs.readFileSync(filepath, 'utf8');
   } catch {
     return findings;
   }
 
-  const lines = content.split("\n");
+  const lines = content.split('\n');
   for (let i = 0; i < lines.length; i++) {
     const stripped = lines[i].trim();
     // Skip comments
-    if (
-      stripped.startsWith("//") ||
-      stripped.startsWith("#") ||
-      stripped.startsWith("*")
-    ) {
+    if (stripped.startsWith('//') || stripped.startsWith('#') || stripped.startsWith('*')) {
       continue;
     }
 
@@ -266,9 +231,7 @@ function scanDirectory(projectRoot, targetFiles) {
 
   if (targetFiles && targetFiles.length > 0) {
     for (const fpath of targetFiles) {
-      const absPath = path.isAbsolute(fpath)
-        ? fpath
-        : path.join(projectRoot, fpath);
+      const absPath = path.isAbsolute(fpath) ? fpath : path.join(projectRoot, fpath);
       if (fs.existsSync(absPath) && fs.statSync(absPath).isFile()) {
         // FIX: Push individually instead of spread to avoid O(n²)
         const fileFindings = scanFile(absPath, projectRoot);
@@ -278,7 +241,18 @@ function scanDirectory(projectRoot, targetFiles) {
     return allFindings;
   }
 
-  const files = walkDir(projectRoot, { extensions: SCAN_EXTENSIONS });
+  const files = walkDir(projectRoot, {
+    extensions: SCAN_EXTENSIONS,
+    skipDirs: new Set([
+      ...DEFAULT_SKIP_DIRS,
+      'test',
+      'tests',
+      '__tests__',
+      'spec',
+      'specs',
+      'fixtures',
+    ]),
+  });
 
   for (const filepath of files) {
     // FIX: Push individually instead of spread to avoid O(n²)
@@ -295,11 +269,8 @@ function scanDirectory(projectRoot, targetFiles) {
 function printFindings(findings, minSeverity) {
   const minRank = SEVERITY_RANK[minSeverity] ?? 3;
   const filtered = findings
-    .filter((f) => (SEVERITY_RANK[f.severity] ?? 3) <= minRank)
-    .sort(
-      (a, b) =>
-        (SEVERITY_RANK[a.severity] ?? 3) - (SEVERITY_RANK[b.severity] ?? 3),
-    );
+    .filter(f => (SEVERITY_RANK[f.severity] ?? 3) <= minRank)
+    .sort((a, b) => (SEVERITY_RANK[a.severity] ?? 3) - (SEVERITY_RANK[b.severity] ?? 3));
 
   if (filtered.length === 0) {
     console.log(
@@ -308,13 +279,13 @@ function printFindings(findings, minSeverity) {
     return 0;
   }
 
-  let currentCategory = "";
+  let currentCategory = '';
   for (const finding of filtered) {
     if (finding.category !== currentCategory) {
       currentCategory = finding.category;
       console.log(`\n  ${BOLD}${currentCategory}${RESET}`);
     }
-    const color = SEVERITY_COLORS[finding.severity] || "";
+    const color = SEVERITY_COLORS[finding.severity] || '';
     console.log(
       `    ${color}[${finding.severity.toUpperCase()}]${RESET} ${finding.file}:${finding.line}`,
     );
@@ -326,18 +297,18 @@ function printFindings(findings, minSeverity) {
 }
 
 function main() {
-  const args = { path: null, severity: "low", files: null };
+  const args = { path: null, severity: 'low', files: null };
   const raw = process.argv.slice(2);
 
   for (let i = 0; i < raw.length; i++) {
-    if (raw[i] === "--severity" && raw[i + 1]) {
+    if (raw[i] === '--severity' && raw[i + 1]) {
       args.severity = raw[++i];
-    } else if (raw[i] === "--files") {
+    } else if (raw[i] === '--files') {
       args.files = [];
-      while (i + 1 < raw.length && !raw[i + 1].startsWith("--")) {
+      while (i + 1 < raw.length && !raw[i + 1].startsWith('--')) {
         args.files.push(raw[++i]);
       }
-    } else if (!raw[i].startsWith("--") && !args.path) {
+    } else if (!raw[i].startsWith('--') && !args.path) {
       args.path = raw[i];
     }
   }
@@ -356,7 +327,7 @@ function main() {
   }
 
   console.log(
-    banner("security_scan.js", {
+    banner('security_scan.js', {
       Project: projectRoot,
       Severity: `${args.severity}+`,
     }),
@@ -376,12 +347,12 @@ function main() {
     bySeverity[f.severity] = (bySeverity[f.severity] || 0) + 1;
   }
 
-  const uniqueFiles = new Set(findings.map((f) => f.file)).size;
+  const uniqueFiles = new Set(findings.map(f => f.file)).size;
 
-  for (const sev of ["critical", "high", "medium", "low"]) {
+  for (const sev of ['critical', 'high', 'medium', 'low']) {
     const c = bySeverity[sev] || 0;
     if (c > 0) {
-      const color = SEVERITY_COLORS[sev] || "";
+      const color = SEVERITY_COLORS[sev] || '';
       console.log(`  ${color}${sev.toUpperCase()}: ${c}${RESET}`);
     }
   }

package/.agent/scripts/session_manager.js

@@ -13,31 +13,31 @@
  *   node .agent/scripts/session_manager.js export [--stdout]
  */
 
-"use strict";
+'use strict';
 
-const fs = require("fs");
-const path = require("path");
+const fs = require('fs');
+const path = require('path');
 
-const STATE_FILE = ".agent_session.json";
+const STATE_FILE = '.agent_session.json';
 
-const { GREEN, YELLOW, BLUE, CYAN, RED, BOLD, RESET } = require("./_colors");
+const { GREEN, YELLOW, BLUE, CYAN, RED, BOLD, RESET } = require('./_colors');
 
 const VALID_COMMANDS = new Set([
-  "save",
-  "load",
-  "show",
-  "clear",
-  "status",
-  "tag",
-  "list",
-  "export",
+  'save',
+  'load',
+  'show',
+  'clear',
+  'status',
+  'tag',
+  'list',
+  'export',
 ]);
 const LIST_PAGE_SIZE = 10;
 
 function loadState() {
   if (!fs.existsSync(STATE_FILE)) return {};
   try {
-    const content = fs.readFileSync(STATE_FILE, "utf8");
+    const content = fs.readFileSync(STATE_FILE, 'utf8');
     return JSON.parse(content);
   } catch {
     return {};
@@ -45,7 +45,7 @@ function loadState() {
 }
 
 function saveState(state) {
-  fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), "utf8");
+  fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), 'utf8');
 }
 
 function cmdSave(note) {
@@ -73,7 +73,7 @@ function cmdLoad() {
     console.log(`${YELLOW}No active session — use 'save' first.${RESET}`);
     return;
   }
-  const tagsStr = (current.tags || []).join(", ") || "none";
+  const tagsStr = (current.tags || []).join(', ') || 'none';
   console.log(`${BOLD}Current session:${RESET}`);
   console.log(`  Session: #${current.session}`);
   console.log(`  Time:    ${current.timestamp}`);
@@ -91,8 +91,8 @@ function cmdShow() {
   console.log(`${BOLD}Session History (${history.length} total):${RESET}`);
   const recent = history.slice(-10).reverse();
   for (const entry of recent) {
-    const tagsStr = (entry.tags || []).join(", ") || "";
-    const tagsDisplay = tagsStr ? `  [${tagsStr}]` : "";
+    const tagsStr = (entry.tags || []).join(', ') || '';
+    const tagsDisplay = tagsStr ? `  [${tagsStr}]` : '';
     console.log(
       `\n  ${BLUE}#${entry.session}${RESET} — ${entry.timestamp.slice(0, 16)}${tagsDisplay}`,
     );
@@ -115,28 +115,22 @@ function cmdStatus() {
   const current = state.current;
 
   if (!history.length) {
-    console.log(
-      `${YELLOW}No session history — use 'save' to start tracking.${RESET}`,
-    );
+    console.log(`${YELLOW}No session history — use 'save' to start tracking.${RESET}`);
     return;
   }
 
   const total = history.length;
   const recent = history.slice(-3).reverse();
 
-  console.log(
-    `\n${BOLD}${CYAN}━━━ Session Status ━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`,
-  );
+  console.log(`\n${BOLD}${CYAN}━━━ Session Status ━━━━━━━━━━━━━━━━━━━━━━━━${RESET}`);
   console.log(`  Total sessions: ${total}`);
   if (current) {
-    console.log(
-      `  Active:         #${current.session} — ${current.note.slice(0, 60)}`,
-    );
+    console.log(`  Active:         #${current.session} — ${current.note.slice(0, 60)}`);
   }
   console.log(`\n${BOLD}  Last 3 sessions:${RESET}`);
   for (const entry of recent) {
-    const tagsStr = (entry.tags || []).join(", ") || "";
-    const tagsDisplay = tagsStr ? `  [${tagsStr}]` : "";
+    const tagsStr = (entry.tags || []).join(', ') || '';
+    const tagsDisplay = tagsStr ? `  [${tagsStr}]` : '';
     const ts = entry.timestamp.slice(0, 16);
     console.log(`    ${BLUE}#${entry.session}${RESET} ${ts}${tagsDisplay}`);
     console.log(`    ${entry.note.slice(0, 70)}`);
@@ -154,16 +148,12 @@ function cmdTag(label) {
   const state = loadState();
   const current = state.current;
   if (!current) {
-    console.log(
-      `${YELLOW}No active session — use 'save' first before tagging.${RESET}`,
-    );
+    console.log(`${YELLOW}No active session — use 'save' first before tagging.${RESET}`);
     process.exit(1);
   }
   if (!current.tags) current.tags = [];
   if (current.tags.includes(label)) {
-    console.log(
-      `${YELLOW}Tag '${label}' already exists on session #${current.session}.${RESET}`,
-    );
+    console.log(`${YELLOW}Tag '${label}' already exists on session #${current.session}.${RESET}`);
     return;
   }
 
@@ -183,9 +173,7 @@ function cmdTag(label) {
   }
 
   saveState(state);
-  console.log(
-    `${GREEN}✅ Tagged session #${current.session} with '${label}'.${RESET}`,
-  );
+  console.log(`${GREEN}✅ Tagged session #${current.session} with '${label}'.${RESET}`);
 }
 
 function cmdList(showAll) {
@@ -205,12 +193,10 @@ function cmdList(showAll) {
   );
 
   for (const entry of recent) {
-    const tagsStr = (entry.tags || []).join(", ");
-    const tagsDisplay = tagsStr ? `  [${YELLOW}${tagsStr}${RESET}]` : "";
+    const tagsStr = (entry.tags || []).join(', ');
+    const tagsDisplay = tagsStr ? `  [${YELLOW}${tagsStr}${RESET}]` : '';
     const ts = entry.timestamp.slice(0, 16);
-    console.log(
-      `\n  ${BOLD}${BLUE}#${entry.session}${RESET} — ${ts}${tagsDisplay}`,
-    );
+    console.log(`\n  ${BOLD}${BLUE}#${entry.session}${RESET} — ${ts}${tagsDisplay}`);
     console.log(`  ${entry.note}`);
   }
 
@@ -231,31 +217,29 @@ function cmdExport(toStdout) {
     return;
   }
 
-  const lines = ["# Session Export\n"];
+  const lines = ['# Session Export\n'];
   lines.push(`Generated: ${new Date().toISOString().slice(0, 16)}\n`);
   lines.push(`Total sessions: ${history.length}\n\n---\n`);
 
   const reversed = history.slice().reverse();
   for (const entry of reversed) {
-    const sessionNum = entry.session || "?";
-    const ts = (entry.timestamp || "").slice(0, 16);
-    const note = entry.note || "";
+    const sessionNum = entry.session || '?';
+    const ts = (entry.timestamp || '').slice(0, 16);
+    const note = entry.note || '';
     const tags = entry.tags || [];
-    const tagsStr = tags.length ? `\n**Tags:** ${tags.join(", ")}` : "";
+    const tagsStr = tags.length ? `\n**Tags:** ${tags.join(', ')}` : '';
 
     lines.push(`## Session #${sessionNum} — ${ts}\n`);
     lines.push(`${note}${tagsStr}\n\n---\n`);
   }
 
-  const content = lines.join("\n");
+  const content = lines.join('\n');
   if (toStdout) {
     console.log(content);
   } else {
-    const exportPath = path.resolve("session_export.md");
-    fs.writeFileSync(exportPath, content, "utf8");
-    console.log(
-      `${GREEN}✅ Exported ${history.length} sessions to${RESET} ${exportPath}`,
-    );
+    const exportPath = path.resolve('session_export.md');
+    fs.writeFileSync(exportPath, content, 'utf8');
+    console.log(`${GREEN}✅ Exported ${history.length} sessions to${RESET} ${exportPath}`);
   }
 }
 
@@ -272,31 +256,30 @@ function main() {
 
   if (!VALID_COMMANDS.has(cmd)) {
     console.log(`${RED}Unknown command: '${cmd}'${RESET}`);
-    console.log(`Valid commands: ${[...VALID_COMMANDS].sort().join(", ")}`);
+    console.log(`Valid commands: ${[...VALID_COMMANDS].sort().join(', ')}`);
     process.exit(1);
   }
 
-  if (cmd === "save") {
-    let note = args.slice(1).join(" ").trim();
-    if (!note)
-      note = `session ${new Date().toISOString().slice(0, 16).replace("T", " ")}`;
+  if (cmd === 'save') {
+    let note = args.slice(1).join(' ').trim();
+    if (!note) note = `session ${new Date().toISOString().slice(0, 16).replace('T', ' ')}`;
     cmdSave(note);
-  } else if (cmd === "load") {
+  } else if (cmd === 'load') {
     cmdLoad();
-  } else if (cmd === "show") {
+  } else if (cmd === 'show') {
     cmdShow();
-  } else if (cmd === "clear") {
+  } else if (cmd === 'clear') {
     cmdClear();
-  } else if (cmd === "status") {
+  } else if (cmd === 'status') {
     cmdStatus();
-  } else if (cmd === "tag") {
-    const label = args.slice(1).join(" ").trim();
+  } else if (cmd === 'tag') {
+    const label = args.slice(1).join(' ').trim();
     cmdTag(label);
-  } else if (cmd === "list") {
-    const showAll = args.includes("--all");
+  } else if (cmd === 'list') {
+    const showAll = args.includes('--all');
     cmdList(showAll);
-  } else if (cmd === "export") {
-    const toStdout = args.includes("--stdout");
+  } else if (cmd === 'export') {
+    const toStdout = args.includes('--stdout');
     cmdExport(toStdout);
   }
 }