tryassay 0.32.0 → 0.33.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/dist/cli.js +55 -0
  2. package/dist/cli.js.map +1 -1
  3. package/dist/commands/assess.js +73 -0
  4. package/dist/commands/assess.js.map +1 -1
  5. package/dist/commands/bounty-chain.d.ts +1 -0
  6. package/dist/commands/bounty-chain.js +34 -0
  7. package/dist/commands/bounty-chain.js.map +1 -0
  8. package/dist/commands/bounty-check.d.ts +10 -0
  9. package/dist/commands/bounty-check.js +104 -0
  10. package/dist/commands/bounty-check.js.map +1 -0
  11. package/dist/commands/bounty-discover.d.ts +6 -0
  12. package/dist/commands/bounty-discover.js +45 -0
  13. package/dist/commands/bounty-discover.js.map +1 -0
  14. package/dist/commands/bounty-scan.d.ts +7 -0
  15. package/dist/commands/bounty-scan.js +312 -0
  16. package/dist/commands/bounty-scan.js.map +1 -0
  17. package/dist/commands/bounty-watch.d.ts +9 -0
  18. package/dist/commands/bounty-watch.js +210 -0
  19. package/dist/commands/bounty-watch.js.map +1 -0
  20. package/dist/commands/hunt.d.ts +11 -0
  21. package/dist/commands/hunt.js +216 -0
  22. package/dist/commands/hunt.js.map +1 -0
  23. package/dist/hunt/__tests__/deep-dive.test.d.ts +1 -0
  24. package/dist/hunt/__tests__/deep-dive.test.js +102 -0
  25. package/dist/hunt/__tests__/deep-dive.test.js.map +1 -0
  26. package/dist/hunt/__tests__/discovery.test.d.ts +1 -0
  27. package/dist/hunt/__tests__/discovery.test.js +55 -0
  28. package/dist/hunt/__tests__/discovery.test.js.map +1 -0
  29. package/dist/hunt/__tests__/e2e.test.d.ts +1 -0
  30. package/dist/hunt/__tests__/e2e.test.js +261 -0
  31. package/dist/hunt/__tests__/e2e.test.js.map +1 -0
  32. package/dist/hunt/__tests__/matcher.test.d.ts +1 -0
  33. package/dist/hunt/__tests__/matcher.test.js +63 -0
  34. package/dist/hunt/__tests__/matcher.test.js.map +1 -0
  35. package/dist/hunt/__tests__/orchestrator.test.d.ts +1 -0
  36. package/dist/hunt/__tests__/orchestrator.test.js +73 -0
  37. package/dist/hunt/__tests__/orchestrator.test.js.map +1 -0
  38. package/dist/hunt/__tests__/parse-utils.test.d.ts +1 -0
  39. package/dist/hunt/__tests__/parse-utils.test.js +28 -0
  40. package/dist/hunt/__tests__/parse-utils.test.js.map +1 -0
  41. package/dist/hunt/__tests__/state.test.d.ts +1 -0
  42. package/dist/hunt/__tests__/state.test.js +49 -0
  43. package/dist/hunt/__tests__/state.test.js.map +1 -0
  44. package/dist/hunt/__tests__/templates.test.d.ts +1 -0
  45. package/dist/hunt/__tests__/templates.test.js +32 -0
  46. package/dist/hunt/__tests__/templates.test.js.map +1 -0
  47. package/dist/hunt/__tests__/triage.test.d.ts +1 -0
  48. package/dist/hunt/__tests__/triage.test.js +91 -0
  49. package/dist/hunt/__tests__/triage.test.js.map +1 -0
  50. package/dist/hunt/__tests__/types.test.d.ts +1 -0
  51. package/dist/hunt/__tests__/types.test.js +65 -0
  52. package/dist/hunt/__tests__/types.test.js.map +1 -0
  53. package/dist/hunt/deep-dive.d.ts +8 -0
  54. package/dist/hunt/deep-dive.js +86 -0
  55. package/dist/hunt/deep-dive.js.map +1 -0
  56. package/dist/hunt/discovery.d.ts +15 -0
  57. package/dist/hunt/discovery.js +116 -0
  58. package/dist/hunt/discovery.js.map +1 -0
  59. package/dist/hunt/matcher.d.ts +8 -0
  60. package/dist/hunt/matcher.js +27 -0
  61. package/dist/hunt/matcher.js.map +1 -0
  62. package/dist/hunt/orchestrator.d.ts +27 -0
  63. package/dist/hunt/orchestrator.js +91 -0
  64. package/dist/hunt/orchestrator.js.map +1 -0
  65. package/dist/hunt/parse-utils.d.ts +8 -0
  66. package/dist/hunt/parse-utils.js +44 -0
  67. package/dist/hunt/parse-utils.js.map +1 -0
  68. package/dist/hunt/state.d.ts +5 -0
  69. package/dist/hunt/state.js +35 -0
  70. package/dist/hunt/state.js.map +1 -0
  71. package/dist/hunt/templates/auth-bypass.d.ts +2 -0
  72. package/dist/hunt/templates/auth-bypass.js +80 -0
  73. package/dist/hunt/templates/auth-bypass.js.map +1 -0
  74. package/dist/hunt/templates/cors-misconfig.d.ts +2 -0
  75. package/dist/hunt/templates/cors-misconfig.js +88 -0
  76. package/dist/hunt/templates/cors-misconfig.js.map +1 -0
  77. package/dist/hunt/templates/csrf-bypass.d.ts +2 -0
  78. package/dist/hunt/templates/csrf-bypass.js +65 -0
  79. package/dist/hunt/templates/csrf-bypass.js.map +1 -0
  80. package/dist/hunt/templates/index.d.ts +3 -0
  81. package/dist/hunt/templates/index.js +29 -0
  82. package/dist/hunt/templates/index.js.map +1 -0
  83. package/dist/hunt/templates/injection.d.ts +2 -0
  84. package/dist/hunt/templates/injection.js +103 -0
  85. package/dist/hunt/templates/injection.js.map +1 -0
  86. package/dist/hunt/templates/open-redirect.d.ts +2 -0
  87. package/dist/hunt/templates/open-redirect.js +93 -0
  88. package/dist/hunt/templates/open-redirect.js.map +1 -0
  89. package/dist/hunt/templates/path-traversal.d.ts +2 -0
  90. package/dist/hunt/templates/path-traversal.js +94 -0
  91. package/dist/hunt/templates/path-traversal.js.map +1 -0
  92. package/dist/hunt/templates/prototype-pollution.d.ts +2 -0
  93. package/dist/hunt/templates/prototype-pollution.js +108 -0
  94. package/dist/hunt/templates/prototype-pollution.js.map +1 -0
  95. package/dist/hunt/templates/ssrf.d.ts +2 -0
  96. package/dist/hunt/templates/ssrf.js +75 -0
  97. package/dist/hunt/templates/ssrf.js.map +1 -0
  98. package/dist/hunt/templates/timing-attack.d.ts +2 -0
  99. package/dist/hunt/templates/timing-attack.js +108 -0
  100. package/dist/hunt/templates/timing-attack.js.map +1 -0
  101. package/dist/hunt/templates/weak-random.d.ts +2 -0
  102. package/dist/hunt/templates/weak-random.js +73 -0
  103. package/dist/hunt/templates/weak-random.js.map +1 -0
  104. package/dist/hunt/triage.d.ts +8 -0
  105. package/dist/hunt/triage.js +78 -0
  106. package/dist/hunt/triage.js.map +1 -0
  107. package/dist/lib/__tests__/bounty-scan.test.d.ts +1 -0
  108. package/dist/lib/__tests__/bounty-scan.test.js +15 -0
  109. package/dist/lib/__tests__/bounty-scan.test.js.map +1 -0
  110. package/dist/lib/__tests__/chain-analyzer.test.d.ts +1 -0
  111. package/dist/lib/__tests__/chain-analyzer.test.js +47 -0
  112. package/dist/lib/__tests__/chain-analyzer.test.js.map +1 -0
  113. package/dist/lib/__tests__/finding-dedup.test.d.ts +1 -0
  114. package/dist/lib/__tests__/finding-dedup.test.js +30 -0
  115. package/dist/lib/__tests__/finding-dedup.test.js.map +1 -0
  116. package/dist/lib/__tests__/learned-rules.test.js +25 -0
  117. package/dist/lib/__tests__/learned-rules.test.js.map +1 -1
  118. package/dist/lib/__tests__/novelty-checker.test.d.ts +1 -0
  119. package/dist/lib/__tests__/novelty-checker.test.js +57 -0
  120. package/dist/lib/__tests__/novelty-checker.test.js.map +1 -0
  121. package/dist/lib/__tests__/program-registry.test.d.ts +1 -0
  122. package/dist/lib/__tests__/program-registry.test.js +40 -0
  123. package/dist/lib/__tests__/program-registry.test.js.map +1 -0
  124. package/dist/lib/__tests__/retry.test.d.ts +1 -0
  125. package/dist/lib/__tests__/retry.test.js +23 -0
  126. package/dist/lib/__tests__/retry.test.js.map +1 -0
  127. package/dist/lib/__tests__/watchlist.test.d.ts +1 -0
  128. package/dist/lib/__tests__/watchlist.test.js +88 -0
  129. package/dist/lib/__tests__/watchlist.test.js.map +1 -0
  130. package/dist/lib/chain-analyzer.d.ts +25 -0
  131. package/dist/lib/chain-analyzer.js +105 -0
  132. package/dist/lib/chain-analyzer.js.map +1 -0
  133. package/dist/lib/finding-dedup.d.ts +2 -0
  134. package/dist/lib/finding-dedup.js +9 -0
  135. package/dist/lib/finding-dedup.js.map +1 -0
  136. package/dist/lib/issue-reporter.d.ts +13 -0
  137. package/dist/lib/issue-reporter.js +51 -0
  138. package/dist/lib/issue-reporter.js.map +1 -0
  139. package/dist/lib/novelty-checker.d.ts +60 -0
  140. package/dist/lib/novelty-checker.js +223 -0
  141. package/dist/lib/novelty-checker.js.map +1 -0
  142. package/dist/lib/program-registry.d.ts +12 -0
  143. package/dist/lib/program-registry.js +18 -0
  144. package/dist/lib/program-registry.js.map +1 -0
  145. package/dist/lib/retry.d.ts +5 -0
  146. package/dist/lib/retry.js +19 -0
  147. package/dist/lib/retry.js.map +1 -0
  148. package/dist/lib/watchlist.d.ts +23 -0
  149. package/dist/lib/watchlist.js +31 -0
  150. package/dist/lib/watchlist.js.map +1 -0
  151. package/dist/runtime/safe-executor.js +1 -1
  152. package/dist/runtime/safe-executor.js.map +1 -1
  153. package/dist/runtime/types.d.ts +1 -1
  154. package/dist/sdk/forward-verify.js +1 -1
  155. package/dist/sdk/forward-verify.js.map +1 -1
  156. package/dist/types.d.ts +45 -0
  157. package/package.json +1 -1
package/dist/types.d.ts CHANGED
@@ -253,3 +253,48 @@ export interface AssessmentResult {
253
253
  inputTokens: number;
254
254
  outputTokens: number;
255
255
  }
256
+ export interface VulnerabilityTemplate {
257
+ id: string;
258
+ name: string;
259
+ cwe: string;
260
+ filePatterns: string[];
261
+ triagePrompt: string;
262
+ deepDivePrompt: string;
263
+ knownBypasses: string[];
264
+ specReferences: string[];
265
+ severityRange: [string, string];
266
+ negativePatterns?: string[];
267
+ minMatchScore?: number;
268
+ }
269
+ export interface HuntHypothesis {
270
+ id: number;
271
+ templateId: string;
272
+ file: string;
273
+ line?: number;
274
+ confidence: 'high' | 'medium' | 'low';
275
+ summary: string;
276
+ attackerControl: string;
277
+ impact: string;
278
+ }
279
+ export interface HuntFinding {
280
+ hypothesisId: number;
281
+ templateId: string;
282
+ file: string;
283
+ line?: number;
284
+ cwe: string;
285
+ severity: 'critical' | 'high' | 'medium' | 'low';
286
+ title: string;
287
+ attackScenario: string;
288
+ reproductionSteps: string;
289
+ evidence: string;
290
+ recommendation: string;
291
+ confirmed: boolean;
292
+ }
293
+ export interface HuntState {
294
+ scannedAt: string;
295
+ path: string;
296
+ fileHashes: Record<string, string>;
297
+ filesScanned: number;
298
+ hypotheses: HuntHypothesis[];
299
+ findings: HuntFinding[];
300
+ }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "tryassay",
3
- "version": "0.32.0",
3
+ "version": "0.33.1",
4
4
  "description": "AI code verification CLI — find bugs that tests miss, linters ignore, and code review overlooks",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",