tryassay 0.33.1 → 0.34.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +20 -0
- package/dist/cli.js.map +1 -1
- package/dist/commands/hunt.d.ts +2 -0
- package/dist/commands/hunt.js +58 -7
- package/dist/commands/hunt.js.map +1 -1
- package/dist/commands/mcp.d.ts +14 -0
- package/dist/commands/mcp.js +18 -0
- package/dist/commands/mcp.js.map +1 -0
- package/dist/commands/watch.d.ts +19 -0
- package/dist/commands/watch.js +158 -0
- package/dist/commands/watch.js.map +1 -0
- package/dist/hunt/__tests__/finding-to-template.test.d.ts +1 -0
- package/dist/hunt/__tests__/finding-to-template.test.js +213 -0
- package/dist/hunt/__tests__/finding-to-template.test.js.map +1 -0
- package/dist/hunt/__tests__/parse-utils.test.js +28 -1
- package/dist/hunt/__tests__/parse-utils.test.js.map +1 -1
- package/dist/hunt/__tests__/taint-analysis.test.d.ts +1 -0
- package/dist/hunt/__tests__/taint-analysis.test.js +556 -0
- package/dist/hunt/__tests__/taint-analysis.test.js.map +1 -0
- package/dist/hunt/__tests__/templates.test.js +2 -2
- package/dist/hunt/__tests__/templates.test.js.map +1 -1
- package/dist/hunt/deep-dive.d.ts +2 -2
- package/dist/hunt/deep-dive.js +4 -4
- package/dist/hunt/deep-dive.js.map +1 -1
- package/dist/hunt/discovery.js +2 -2
- package/dist/hunt/discovery.js.map +1 -1
- package/dist/hunt/finding-to-template.d.ts +47 -0
- package/dist/hunt/finding-to-template.js +288 -0
- package/dist/hunt/finding-to-template.js.map +1 -0
- package/dist/hunt/orchestrator.d.ts +3 -0
- package/dist/hunt/orchestrator.js +20 -5
- package/dist/hunt/orchestrator.js.map +1 -1
- package/dist/hunt/taint-analysis.d.ts +49 -0
- package/dist/hunt/taint-analysis.js +429 -0
- package/dist/hunt/taint-analysis.js.map +1 -0
- package/dist/hunt/templates/csv-injection.d.ts +2 -0
- package/dist/hunt/templates/csv-injection.js +148 -0
- package/dist/hunt/templates/csv-injection.js.map +1 -0
- package/dist/hunt/templates/django-misconfig.d.ts +2 -0
- package/dist/hunt/templates/django-misconfig.js +172 -0
- package/dist/hunt/templates/django-misconfig.js.map +1 -0
- package/dist/hunt/templates/express-misconfig.d.ts +2 -0
- package/dist/hunt/templates/express-misconfig.js +156 -0
- package/dist/hunt/templates/express-misconfig.js.map +1 -0
- package/dist/hunt/templates/file-upload.d.ts +2 -0
- package/dist/hunt/templates/file-upload.js +131 -0
- package/dist/hunt/templates/file-upload.js.map +1 -0
- package/dist/hunt/templates/graphql-abuse.d.ts +2 -0
- package/dist/hunt/templates/graphql-abuse.js +161 -0
- package/dist/hunt/templates/graphql-abuse.js.map +1 -0
- package/dist/hunt/templates/hardcoded-credentials.d.ts +2 -0
- package/dist/hunt/templates/hardcoded-credentials.js +109 -0
- package/dist/hunt/templates/hardcoded-credentials.js.map +1 -0
- package/dist/hunt/templates/idor.d.ts +2 -0
- package/dist/hunt/templates/idor.js +102 -0
- package/dist/hunt/templates/idor.js.map +1 -0
- package/dist/hunt/templates/index.d.ts +2 -2
- package/dist/hunt/templates/index.js +38 -5
- package/dist/hunt/templates/index.js.map +1 -1
- package/dist/hunt/templates/insecure-deserialization.d.ts +2 -0
- package/dist/hunt/templates/insecure-deserialization.js +131 -0
- package/dist/hunt/templates/insecure-deserialization.js.map +1 -0
- package/dist/hunt/templates/mass-assignment.d.ts +2 -0
- package/dist/hunt/templates/mass-assignment.js +101 -0
- package/dist/hunt/templates/mass-assignment.js.map +1 -0
- package/dist/hunt/templates/nextjs-misconfig.d.ts +2 -0
- package/dist/hunt/templates/nextjs-misconfig.js +127 -0
- package/dist/hunt/templates/nextjs-misconfig.js.map +1 -0
- package/dist/hunt/templates/postmessage.d.ts +2 -0
- package/dist/hunt/templates/postmessage.js +180 -0
- package/dist/hunt/templates/postmessage.js.map +1 -0
- package/dist/hunt/templates/race-condition.d.ts +2 -0
- package/dist/hunt/templates/race-condition.js +138 -0
- package/dist/hunt/templates/race-condition.js.map +1 -0
- package/dist/hunt/templates/spring-misconfig.d.ts +2 -0
- package/dist/hunt/templates/spring-misconfig.js +177 -0
- package/dist/hunt/templates/spring-misconfig.js.map +1 -0
- package/dist/hunt/templates/xxe.d.ts +2 -0
- package/dist/hunt/templates/xxe.js +187 -0
- package/dist/hunt/templates/xxe.js.map +1 -0
- package/dist/hunt/triage.d.ts +2 -2
- package/dist/hunt/triage.js +4 -4
- package/dist/hunt/triage.js.map +1 -1
- package/dist/realtime/__tests__/catch-real-bugs.test.d.ts +9 -0
- package/dist/realtime/__tests__/catch-real-bugs.test.js +205 -0
- package/dist/realtime/__tests__/catch-real-bugs.test.js.map +1 -0
- package/dist/realtime/__tests__/code-buffer.test.d.ts +1 -0
- package/dist/realtime/__tests__/code-buffer.test.js +202 -0
- package/dist/realtime/__tests__/code-buffer.test.js.map +1 -0
- package/dist/realtime/__tests__/correction-injector.test.d.ts +1 -0
- package/dist/realtime/__tests__/correction-injector.test.js +168 -0
- package/dist/realtime/__tests__/correction-injector.test.js.map +1 -0
- package/dist/realtime/__tests__/stream-interceptor.test.d.ts +1 -0
- package/dist/realtime/__tests__/stream-interceptor.test.js +193 -0
- package/dist/realtime/__tests__/stream-interceptor.test.js.map +1 -0
- package/dist/realtime/__tests__/streaming-checks.test.d.ts +1 -0
- package/dist/realtime/__tests__/streaming-checks.test.js +479 -0
- package/dist/realtime/__tests__/streaming-checks.test.js.map +1 -0
- package/dist/realtime/__tests__/streaming-verifier.test.d.ts +1 -0
- package/dist/realtime/__tests__/streaming-verifier.test.js +157 -0
- package/dist/realtime/__tests__/streaming-verifier.test.js.map +1 -0
- package/dist/realtime/code-buffer.d.ts +52 -0
- package/dist/realtime/code-buffer.js +276 -0
- package/dist/realtime/code-buffer.js.map +1 -0
- package/dist/realtime/correction-injector.d.ts +56 -0
- package/dist/realtime/correction-injector.js +96 -0
- package/dist/realtime/correction-injector.js.map +1 -0
- package/dist/realtime/index.d.ts +14 -0
- package/dist/realtime/index.js +11 -0
- package/dist/realtime/index.js.map +1 -0
- package/dist/realtime/mcp-server.d.ts +14 -0
- package/dist/realtime/mcp-server.js +200 -0
- package/dist/realtime/mcp-server.js.map +1 -0
- package/dist/realtime/stream-interceptor.d.ts +65 -0
- package/dist/realtime/stream-interceptor.js +174 -0
- package/dist/realtime/stream-interceptor.js.map +1 -0
- package/dist/realtime/streaming-checks.d.ts +55 -0
- package/dist/realtime/streaming-checks.js +452 -0
- package/dist/realtime/streaming-checks.js.map +1 -0
- package/dist/realtime/streaming-verifier.d.ts +57 -0
- package/dist/realtime/streaming-verifier.js +134 -0
- package/dist/realtime/streaming-verifier.js.map +1 -0
- package/dist/realtime/types.d.ts +99 -0
- package/dist/realtime/types.js +8 -0
- package/dist/realtime/types.js.map +1 -0
- package/package.json +2 -1
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared types for the real-time verification pipeline.
|
|
3
|
+
*
|
|
4
|
+
* Phase 2 of the 10x roadmap: verify code as it streams from the LLM,
|
|
5
|
+
* not after generation completes.
|
|
6
|
+
*/
|
|
7
|
+
export type CodeUnitKind = 'statement' | 'function' | 'block' | 'line';
|
|
8
|
+
export interface CodeUnit {
|
|
9
|
+
/** The complete code text for this unit */
|
|
10
|
+
text: string;
|
|
11
|
+
/** What kind of code structure completed */
|
|
12
|
+
kind: CodeUnitKind;
|
|
13
|
+
/** Byte offset in the full buffer where this unit starts */
|
|
14
|
+
startOffset: number;
|
|
15
|
+
/** Byte offset in the full buffer where this unit ends */
|
|
16
|
+
endOffset: number;
|
|
17
|
+
/** Detected or configured language */
|
|
18
|
+
language: string;
|
|
19
|
+
}
|
|
20
|
+
export type CheckSeverity = 'critical' | 'high' | 'medium' | 'low';
|
|
21
|
+
export interface StreamingCheck {
|
|
22
|
+
/** Unique identifier (e.g. 'sql_parameterized', 'learned_rule_42') */
|
|
23
|
+
id: string;
|
|
24
|
+
/** Human-readable name */
|
|
25
|
+
name: string;
|
|
26
|
+
/** Languages this check applies to (empty = all) */
|
|
27
|
+
languages: string[];
|
|
28
|
+
/** Pre-compiled regex pattern */
|
|
29
|
+
pattern: RegExp;
|
|
30
|
+
/** What a match means */
|
|
31
|
+
verdict: 'FAIL' | 'PASS';
|
|
32
|
+
/** Severity when this check triggers a FAIL */
|
|
33
|
+
severity: CheckSeverity;
|
|
34
|
+
/** Human-readable evidence template (may include $1, $2 for captures) */
|
|
35
|
+
evidenceTemplate: string;
|
|
36
|
+
/** Optional fix suggestion */
|
|
37
|
+
suggestion?: string;
|
|
38
|
+
/** Source: 'formal' (hand-crafted) or 'learned' (from rule catalog) */
|
|
39
|
+
source: 'formal' | 'learned';
|
|
40
|
+
/**
|
|
41
|
+
* Optional context keywords for relevance filtering.
|
|
42
|
+
* If set, this check only runs when at least one keyword appears
|
|
43
|
+
* in the code unit text (case-insensitive). If unset, the check
|
|
44
|
+
* runs against all code units (no filtering).
|
|
45
|
+
*/
|
|
46
|
+
contextKeywords?: string[];
|
|
47
|
+
}
|
|
48
|
+
export interface CompiledCheckSet {
|
|
49
|
+
/** All checks, pre-filtered by language and pre-compiled */
|
|
50
|
+
checks: StreamingCheck[];
|
|
51
|
+
/** Language these checks are filtered for */
|
|
52
|
+
language: string;
|
|
53
|
+
/** Time taken to compile (ms) */
|
|
54
|
+
compileTimeMs: number;
|
|
55
|
+
}
|
|
56
|
+
export interface VerificationEvent {
|
|
57
|
+
/** Finding or pass */
|
|
58
|
+
type: 'finding' | 'pass';
|
|
59
|
+
/** The code unit that was checked */
|
|
60
|
+
codeUnit: CodeUnit;
|
|
61
|
+
/** Which check produced this event */
|
|
62
|
+
checkId: string;
|
|
63
|
+
/** Check name */
|
|
64
|
+
checkName: string;
|
|
65
|
+
/** Pass or fail */
|
|
66
|
+
verdict: 'PASS' | 'FAIL';
|
|
67
|
+
/** Evidence string explaining the verdict */
|
|
68
|
+
evidence: string;
|
|
69
|
+
/** Severity (only meaningful for FAIL) */
|
|
70
|
+
severity: CheckSeverity;
|
|
71
|
+
/** Fix suggestion if available */
|
|
72
|
+
suggestion?: string;
|
|
73
|
+
/** How long this check took (ms) */
|
|
74
|
+
latencyMs: number;
|
|
75
|
+
}
|
|
76
|
+
export interface StreamingVerifierStats {
|
|
77
|
+
/** Total code units processed */
|
|
78
|
+
unitsProcessed: number;
|
|
79
|
+
/** Total individual checks run */
|
|
80
|
+
checksRun: number;
|
|
81
|
+
/** Total findings (FAIL verdicts) */
|
|
82
|
+
findings: number;
|
|
83
|
+
/** Average latency per code unit (ms) */
|
|
84
|
+
avgLatencyMs: number;
|
|
85
|
+
/** Max latency for any single code unit (ms) */
|
|
86
|
+
maxLatencyMs: number;
|
|
87
|
+
/** Total elapsed time (ms) */
|
|
88
|
+
totalTimeMs: number;
|
|
89
|
+
}
|
|
90
|
+
export interface CorrectionResult {
|
|
91
|
+
/** The re-generated segment after correction */
|
|
92
|
+
correctedText: string;
|
|
93
|
+
/** The original text that was wrong */
|
|
94
|
+
originalText: string;
|
|
95
|
+
/** The finding that triggered correction */
|
|
96
|
+
finding: VerificationEvent;
|
|
97
|
+
/** Tokens consumed for the correction */
|
|
98
|
+
tokensUsed: number;
|
|
99
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/realtime/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "tryassay",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.34.0",
|
|
4
4
|
"description": "AI code verification CLI — find bugs that tests miss, linters ignore, and code review overlooks",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -45,6 +45,7 @@
|
|
|
45
45
|
],
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@anthropic-ai/sdk": "^0.39.0",
|
|
48
|
+
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
48
49
|
"@supabase/supabase-js": "^2.95.3",
|
|
49
50
|
"@upstash/ratelimit": "^2.0.8",
|
|
50
51
|
"@upstash/redis": "^1.36.2",
|