tribunal-kit 9.2.5 → 9.2.6

package/.agent/scripts/cross_agent_correlator.js

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+/**
+ * cross_agent_correlator.js — Tribunal Intelligence Findings Correlator
+ * Correlates, deduplicates, and resolves conflicts between findings from multiple agents.
+ *
+ * Correlation rules (strict):
+ *   Two findings are correlated ONLY if ALL of the following are true:
+ *     1. Same file (exact path match)
+ *     2. Same line (exact) OR nearby line (<=5) AND same category AND same type/title similarity
+ *     3. Evidence overlap is validated: requires BOTH same location AND similar description
+ *
+ *   The previous implementation used an OR between (file+line+category) and (evidence description),
+ *   which caused false merges across files and between unrelated vulnerability types.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { BOLD, RESET, YELLOW, sectionHeader } = require('./_colors');
+
+// Maximum line distance for considering two findings "nearby"
+const MAX_LINE_DISTANCE = 5;
+
+function parseFindings(reportsPaths) {
+  const allFindings = [];
+  for (const reportPath of reportsPaths) {
+    if (fs.existsSync(reportPath)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+        if (data && data.findings && Array.isArray(data.findings)) {
+          const fds = data.findings.map(f => ({
+            ...f,
+            _source_agent: path.basename(reportPath, '.json'),
+          }));
+          allFindings.push(...fds);
+        }
+      } catch (e) {
+        console.error(`Failed to parse ${reportPath}:`, e.message);
+      }
+    }
+  }
+  return allFindings;
+}
+
+/**
+ * Determines if two findings represent the same underlying issue.
+ *
+ * Requirements for correlation:
+ *   1. Must be in the SAME file
+ *   2. Must meet ONE of:
+ *      a. Exact same line number
+ *      b. Nearby lines (<=MAX_LINE_DISTANCE) AND same category AND similar title/type
+ *      c. Evidence has overlapping location (file:line) — NOT just description
+ */
+function shouldCorrelate(a, b) {
+  const aFile = a.location?.file;
+  const bFile = b.location?.file;
+
+  // Rule: findings without file location are never correlated
+  if (!aFile || !bFile) return false;
+
+  // Rule: must be in the same file
+  if (aFile !== bFile) return false;
+
+  const aLine = a.location?.line;
+  const bLine = b.location?.line;
+
+  // Case 2a: exact same line
+  if (aLine && bLine && aLine === bLine && a.category === b.category) {
+    return true;
+  }
+
+  // Case 2b: nearby lines + same category + similar type
+  if (aLine && bLine && Math.abs(aLine - bLine) <= MAX_LINE_DISTANCE && a.category === b.category) {
+    // Additional guard: require same type OR very similar title
+    const sameType = a.type && b.type && a.type === b.type;
+    const similarTitle = titleSimilarity(a.title, b.title) > 0.5;
+    if (sameType || similarTitle) {
+      return true;
+    }
+    return false;
+  }
+
+  // Case 2c: evidence has overlapping location (file:line match, not just description)
+  if (a.evidence && b.evidence) {
+    const aLocations = a.evidence.map(e => e.location).filter(l => l && l.includes(':'));
+    const bLocations = b.evidence.map(e => e.location).filter(l => l && l.includes(':'));
+    if (aLocations.length > 0 && bLocations.length > 0) {
+      const overlap = aLocations.some(al => bLocations.includes(al));
+      if (overlap && a.category === b.category) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Simple word-overlap similarity for titles.
+ * Returns a value between 0 and 1.
+ */
+function titleSimilarity(a, b) {
+  if (!a || !b) return 0;
+  const wordsA = new Set(
+    a
+      .toLowerCase()
+      .split(/\W+/)
+      .filter(w => w.length > 2),
+  );
+  const wordsB = new Set(
+    b
+      .toLowerCase()
+      .split(/\W+/)
+      .filter(w => w.length > 2),
+  );
+  if (wordsA.size === 0 || wordsB.size === 0) return 0;
+  let overlap = 0;
+  for (const w of wordsA) {
+    if (wordsB.has(w)) overlap++;
+  }
+  return overlap / Math.max(wordsA.size, wordsB.size);
+}
+
+function correlateFindings(findings) {
+  const correlated = [];
+  const processed = new Set();
+
+  for (let i = 0; i < findings.length; i++) {
+    if (processed.has(i)) continue;
+    const base = findings[i];
+    const mergedGroup = [base];
+    processed.add(i);
+
+    for (let j = i + 1; j < findings.length; j++) {
+      if (processed.has(j)) continue;
+      const other = findings[j];
+
+      if (shouldCorrelate(base, other)) {
+        mergedGroup.push(other);
+        processed.add(j);
+      }
+    }
+
+    if (mergedGroup.length > 1) {
+      const merged = { ...base };
+
+      // Merge evidence (deduplicated by description+location key)
+      const allEvidence = new Map();
+      mergedGroup.forEach(f => {
+        (f.evidence || []).forEach(e =>
+          allEvidence.set(e.description + '||' + (e.location || ''), e),
+        );
+      });
+      merged.evidence = Array.from(allEvidence.values());
+
+      // Track related findings
+      merged.related_findings = mergedGroup.map(f => f.id).filter(id => id !== merged.id);
+
+      // Merge agents
+      merged.agents = [...new Set(mergedGroup.map(f => f._source_agent))];
+
+      // Handle confidence and conflicts
+      const statuses = new Set(mergedGroup.map(f => f.status));
+      if (statuses.size > 1) {
+        merged.status = 'UNVERIFIED';
+        merged.confidence = 0.5;
+        merged.title = `[CONFLICTED] ${base.title}`;
+      } else {
+        merged.title = `[CORRELATED] ${base.title}`;
+        merged.confidence = Math.max(
+          ...mergedGroup.map(f => (typeof f.confidence === 'number' ? f.confidence : 0.8)),
+        );
+      }
+
+      // Severity: take the highest — but ONLY within the same vulnerability type
+      const severityOrder = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+      const lowestIndex = Math.min(
+        ...mergedGroup.map(f => {
+          const idx = severityOrder.indexOf((f.severity || '').toUpperCase());
+          return idx === -1 ? 4 : idx;
+        }),
+      );
+      merged.severity = severityOrder[lowestIndex];
+
+      correlated.push(merged);
+    } else {
+      base.agents = [base._source_agent];
+      correlated.push(base);
+    }
+  }
+
+  return correlated;
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const outPath =
+    args.find(a => a.startsWith('--out='))?.split('=')[1] || 'correlated_findings.json';
+  const reportFiles = args.filter(a => !a.startsWith('--'));
+
+  console.log(`${BOLD}Tribunal — Cross-Agent Correlator${RESET}`);
+  if (reportFiles.length === 0) {
+    console.log(YELLOW + 'No finding reports provided.' + RESET);
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    return;
+  }
+
+  const findings = parseFindings(reportFiles);
+  const correlated = correlateFindings(findings);
+
+  fs.writeFileSync(outPath, JSON.stringify({ findings: correlated }, null, 2));
+
+  console.log(sectionHeader('Correlation Results'));
+  console.log(`Original findings: ${findings.length}`);
+  console.log(`Correlated findings: ${correlated.length}`);
+  console.log(`\nWritten to: ${outPath}`);
+}
+
+if (require.main === module) {
+  main();
+}

package/.agent/scripts/dependency_analyzer.js

@@ -64,6 +64,14 @@ const NODE_BUILTINS = new Set([
   'worker_threads',
   'timers',
   'v8',
+  'module',
+  'vm',
+  'async_hooks',
+  'inspector',
+  'diagnostics_channel',
+  'test',
+  'console',
+  'wasi',
   'node:fs',
   'node:path',
   'node:os',
@@ -85,14 +93,22 @@ const NODE_BUILTINS = new Set([
   'node:perf_hooks',
   'node:worker_threads',
   'node:timers',
+  'node:module',
+  'node:vm',
+  'node:async_hooks',
+  'node:inspector',
+  'node:diagnostics_channel',
+  'node:test',
+  'node:console',
+  'node:wasi',
 ]);
 
 function extractImports(projectRoot) {
   const imports = new Set();
   const importPatterns = [
-    /(?:import|export)\s+.*?\s+from\s+["']([^"'.][^"']*)["']/g,
-    /require\s*\(\s*["']([^"'.][^"']*)["']/g,
-    /import\s*\(\s*["']([^"'.][^"']*)["']/g,
+    /(?:import|export)\s+.*?\s+from\s+["']([^"'.\r\n][^"'\r\n]*)["']/g,
+    /require\s*\(\s*["']([^"'.\r\n][^"'\r\n]*)["']\s*\)/g,
+    /import\s*\(\s*["']([^"'.\r\n][^"'\r\n]*)["']\s*\)/g,
   ];
 
   // Use shared walkDir from _utils.js (excluding test directories)
@@ -117,11 +133,17 @@ function extractImports(projectRoot) {
       continue;
     }
 
+    // Strip template literals and comments to prevent matching mock diffs and generated templates
+    const sanitized = content
+      .replace(/`[\s\S]*?`/g, '""')
+      .replace(/\/\*[\s\S]*?\*\//g, '')
+      .replace(/\/\/.*$/gm, '');
+
     for (const pattern of importPatterns) {
       // Reset regex state for each file
       pattern.lastIndex = 0;
       let match;
-      while ((match = pattern.exec(content)) !== null) {
+      while ((match = pattern.exec(sanitized)) !== null) {
         let pkg = match[1];
         if (pkg.startsWith('@')) {
           const parts = pkg.split('/');

package/.agent/scripts/evidence_verifier.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * evidence_verifier.js — Source Evidence Verification
+ *
+ * Verifies that evidence locations actually exist in the repository.
+ * Detects fabricated source locations and stale evidence.
+ *
+ * Trust boundary: evidence is UNTRUSTED until this module confirms it.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+/**
+ * Parse an evidence location string into file and line.
+ * Accepts formats: "file.py:42", "file.py", "path/to/file.py:100"
+ */
+function parseEvidenceLocation(loc) {
+  if (!loc || typeof loc !== 'string') return null;
+  const match = loc.match(/^(.+?)(?::(\d+))?$/);
+  if (!match) return null;
+  return { file: match[1], line: match[2] ? parseInt(match[2], 10) : null };
+}
+
+/**
+ * Verify a single evidence item against the repository.
+ *
+ * Returns:
+ *   { verified: true, content_hash, actual_content }  — if file+line exist
+ *   { verified: false, reason }                       — if fabricated/stale
+ */
+function verifyEvidence(evidence, repoRoot) {
+  if (!evidence.location) {
+    return { verified: false, reason: 'No location specified in evidence.' };
+  }
+
+  const parsed = parseEvidenceLocation(evidence.location);
+  if (!parsed) {
+    return { verified: false, reason: `Cannot parse location: ${evidence.location}` };
+  }
+
+  // Resolve and enforce path boundary
+  const resolvedFile = path.resolve(repoRoot, parsed.file);
+  const normalizedRepo = path.resolve(repoRoot);
+  if (!resolvedFile.startsWith(normalizedRepo)) {
+    return { verified: false, reason: `Path traversal detected: ${parsed.file}` };
+  }
+
+  if (!fs.existsSync(resolvedFile)) {
+    return { verified: false, reason: `File does not exist: ${parsed.file}` };
+  }
+
+  let fileContent;
+  try {
+    fileContent = fs.readFileSync(resolvedFile, 'utf8');
+  } catch (e) {
+    return { verified: false, reason: `Cannot read file: ${e.message}` };
+  }
+
+  const lines = fileContent.split('\n');
+
+  if (parsed.line !== null) {
+    if (parsed.line < 1 || parsed.line > lines.length) {
+      return {
+        verified: false,
+        reason: `Line ${parsed.line} does not exist in ${parsed.file} (file has ${lines.length} lines)`,
+      };
+    }
+
+    const actualLine = lines[parsed.line - 1];
+    const lineHash = crypto.createHash('sha256').update(actualLine).digest('hex').substring(0, 16);
+
+    return {
+      verified: true,
+      actual_content: actualLine.trim(),
+      content_hash: lineHash,
+      file: parsed.file,
+      line: parsed.line,
+    };
+  }
+
+  // File exists but no line specified
+  const fileHash = crypto.createHash('sha256').update(fileContent).digest('hex').substring(0, 16);
+  return {
+    verified: true,
+    content_hash: fileHash,
+    file: parsed.file,
+    line: null,
+  };
+}
+
+/**
+ * Verify all evidence items in a finding.
+ * Returns the finding with evidence_verification results attached.
+ */
+function verifyFindingEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) {
+    return { ...finding, evidence_verification: { status: 'NO_EVIDENCE' } };
+  }
+
+  const results = finding.evidence.map(e => ({
+    evidence: e,
+    verification: verifyEvidence(e, repoRoot),
+  }));
+
+  const verifiedCount = results.filter(r => r.verification.verified).length;
+  const totalCount = results.length;
+
+  let status;
+  if (verifiedCount === 0) {
+    status = 'ALL_FABRICATED';
+  } else if (verifiedCount === totalCount) {
+    status = 'ALL_VERIFIED';
+  } else {
+    status = 'PARTIAL';
+  }
+
+  return {
+    ...finding,
+    evidence_verification: {
+      status,
+      verified_count: verifiedCount,
+      total_count: totalCount,
+      details: results.map(r => ({
+        location: r.evidence.location,
+        verified: r.verification.verified,
+        reason: r.verification.reason,
+        content_hash: r.verification.content_hash,
+      })),
+    },
+  };
+}
+
+/**
+ * Check if evidence has become stale by comparing content hashes.
+ * A hash mismatch means the code changed after the finding was generated.
+ */
+function checkStaleEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) return finding;
+
+  const staleItems = [];
+  for (const e of finding.evidence) {
+    if (!e.location || !e.content_hash) continue;
+    const current = verifyEvidence(e, repoRoot);
+    if (current.verified && current.content_hash !== e.content_hash) {
+      staleItems.push({
+        location: e.location,
+        original_hash: e.content_hash,
+        current_hash: current.content_hash,
+      });
+    }
+  }
+
+  if (staleItems.length > 0) {
+    return {
+      ...finding,
+      stale_evidence: staleItems,
+    };
+  }
+  return finding;
+}
+
+module.exports = {
+  parseEvidenceLocation,
+  verifyEvidence,
+  verifyFindingEvidence,
+  checkStaleEvidence,
+};

package/.agent/scripts/finding_schema.js

@@ -0,0 +1,104 @@
+const { z } = require('zod');
+
+const FindingSchema = z
+  .object({
+    id: z.string().min(1, 'Finding must have a stable identifier (id)'),
+    category: z.string().min(1, 'Finding must have a category'),
+    type: z.string().optional(),
+    severity: z.enum([
+      'CRITICAL',
+      'HIGH',
+      'MEDIUM',
+      'LOW',
+      'INFO',
+      'Critical',
+      'Important',
+      'Minor',
+    ]),
+    confidence: z
+      .number()
+      .min(0)
+      .max(1)
+      .or(z.enum(['High', 'Medium', 'Low'])),
+    status: z.enum(['DETECTED', 'VERIFIED', 'UNVERIFIED', 'FIXED', 'REGRESSION-PROTECTED']),
+    title: z.string().min(1, 'Finding must have a title or description'),
+    location: z
+      .object({
+        file: z.string().optional(),
+        line: z.number().optional(),
+      })
+      .strict()
+      .optional(),
+    evidence: z
+      .array(
+        z
+          .object({
+            type: z.string(),
+            description: z.string(),
+            location: z.string().optional(),
+          })
+          .strict(),
+      )
+      .min(1, 'Finding must contain concrete evidence'),
+    impact: z.string().optional(),
+    remediation: z.string().optional(),
+    validation: z
+      .object({
+        required: z.boolean().default(true),
+      })
+      .passthrough()
+      .optional(),
+    verification: z
+      .object({
+        test_executed: z.boolean().optional(),
+        test_output: z.string().optional(),
+        command: z.string().optional(),
+        exit_code: z.number().optional(),
+        static_proof: z.boolean().optional(),
+        tool: z.string().optional(),
+        tool_output: z.string().optional(),
+      })
+      .passthrough()
+      .optional(),
+    related_findings: z.array(z.string()).optional().default([]),
+  })
+  .strict();
+
+const FindingsReportSchema = z.object({
+  findings: z.array(FindingSchema),
+});
+
+function validateFinding(finding) {
+  const result = FindingSchema.safeParse(finding);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+function validateFindingsReport(report) {
+  const result = FindingsReportSchema.safeParse(report);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+module.exports = {
+  FindingSchema,
+  FindingsReportSchema,
+  validateFinding,
+  validateFindingsReport,
+};

package/.agent/scripts/findings_validator.js

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * findings_validator.js — Validates reviewer output against the finding contract.
+ * Malformed output is quarantined, and only valid findings are passed forward.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const { validateFinding } = require('./finding_schema');
+const { BOLD, RESET, RED, YELLOW, GREEN } = require('./_colors');
+
+function main() {
+  const args = process.argv.slice(2);
+  const inputPath = args.find(a => a.startsWith('--in='))?.split('=')[1];
+  const outPath = args.find(a => a.startsWith('--out='))?.split('=')[1];
+  const quarantinePath =
+    args.find(a => a.startsWith('--quarantine='))?.split('=')[1] || 'quarantined_findings.json';
+
+  if (!inputPath || !outPath) {
+    console.log(
+      RED +
+        'Usage: node findings_validator.js --in=<file> --out=<file> [--quarantine=<file>]' +
+        RESET,
+    );
+    process.exit(1);
+  }
+
+  console.log(`${BOLD}Tribunal — Findings Schema Validator${RESET}`);
+  console.log(`Validating: ${inputPath}`);
+
+  if (!fs.existsSync(inputPath)) {
+    console.log(YELLOW + `Input file not found: ${inputPath}. Emitting empty valid array.` + RESET);
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+  } catch (e) {
+    console.error(RED + `Failed to parse JSON: ${e.message}` + RESET);
+    console.log(YELLOW + `Quarantining entire file.` + RESET);
+    fs.writeFileSync(
+      quarantinePath,
+      JSON.stringify({ error: e.message, raw: fs.readFileSync(inputPath, 'utf8') }, null, 2),
+    );
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  const rawFindings = Array.isArray(data) ? data : data.findings || [];
+  const validFindings = [];
+  const quarantinedFindings = [];
+
+  // Resource limits (§18)
+  const MAX_FINDINGS = 5000;
+  const MAX_EVIDENCE_PER_FINDING = 100;
+  const MAX_STRING_LENGTH = 10240; // 10KB
+
+  if (rawFindings.length > MAX_FINDINGS) {
+    console.log(
+      YELLOW +
+        `WARNING: ${rawFindings.length} findings exceed limit of ${MAX_FINDINGS}. Processing first ${MAX_FINDINGS}.` +
+        RESET,
+    );
+    quarantinedFindings.push({
+      finding: {
+        _diagnostic: `${rawFindings.length - MAX_FINDINGS} findings exceeded limit and were dropped`,
+      },
+      errors: [{ path: 'findings', message: `Exceeded maximum of ${MAX_FINDINGS} findings` }],
+    });
+  }
+
+  const processable = rawFindings.slice(0, MAX_FINDINGS);
+
+  for (const finding of processable) {
+    // Check evidence array size limit
+    if (
+      finding.evidence &&
+      Array.isArray(finding.evidence) &&
+      finding.evidence.length > MAX_EVIDENCE_PER_FINDING
+    ) {
+      quarantinedFindings.push({
+        finding,
+        errors: [
+          {
+            path: 'evidence',
+            message: `${finding.evidence.length} evidence items exceeds limit of ${MAX_EVIDENCE_PER_FINDING}`,
+          },
+        ],
+      });
+      continue;
+    }
+
+    // Check string length limits
+    const stringFields = ['title', 'impact', 'remediation'];
+    let oversized = false;
+    for (const field of stringFields) {
+      if (
+        finding[field] &&
+        typeof finding[field] === 'string' &&
+        finding[field].length > MAX_STRING_LENGTH
+      ) {
+        quarantinedFindings.push({
+          finding,
+          errors: [
+            {
+              path: field,
+              message: `${field} length ${finding[field].length} exceeds limit of ${MAX_STRING_LENGTH}`,
+            },
+          ],
+        });
+        oversized = true;
+        break;
+      }
+    }
+    if (oversized) continue;
+
+    const result = validateFinding(finding);
+    if (result.valid) {
+      validFindings.push(result.data);
+    } else {
+      quarantinedFindings.push({
+        finding,
+        errors: result.errors,
+      });
+    }
+  }
+
+  fs.writeFileSync(outPath, JSON.stringify({ findings: validFindings }, null, 2));
+
+  if (quarantinedFindings.length > 0) {
+    fs.writeFileSync(quarantinePath, JSON.stringify({ quarantined: quarantinedFindings }, null, 2));
+    console.log(
+      YELLOW +
+        `Quarantined ${quarantinedFindings.length} invalid findings to ${quarantinePath}` +
+        RESET,
+    );
+  }
+
+  console.log(GREEN + `Passed ${validFindings.length} valid findings to ${outPath}` + RESET);
+}
+
+if (require.main === module) {
+  main();
+}