vaspera 2.7.0 → 2.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +72 -0
- package/README.md +111 -7
- package/dist/__tests__/agents/adversary/tactics/api.test.d.ts +5 -0
- package/dist/__tests__/agents/adversary/tactics/api.test.d.ts.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/api.test.js +369 -0
- package/dist/__tests__/agents/adversary/tactics/api.test.js.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/llm.test.d.ts +5 -0
- package/dist/__tests__/agents/adversary/tactics/llm.test.d.ts.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/llm.test.js +409 -0
- package/dist/__tests__/agents/adversary/tactics/llm.test.js.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/registry.test.d.ts +7 -0
- package/dist/__tests__/agents/adversary/tactics/registry.test.d.ts.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/registry.test.js +74 -0
- package/dist/__tests__/agents/adversary/tactics/registry.test.js.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/web-app.test.d.ts +7 -0
- package/dist/__tests__/agents/adversary/tactics/web-app.test.d.ts.map +1 -0
- package/dist/__tests__/agents/adversary/tactics/web-app.test.js +374 -0
- package/dist/__tests__/agents/adversary/tactics/web-app.test.js.map +1 -0
- package/dist/__tests__/compliance-bundle.test.d.ts +9 -0
- package/dist/__tests__/compliance-bundle.test.d.ts.map +1 -0
- package/dist/__tests__/compliance-bundle.test.js +344 -0
- package/dist/__tests__/compliance-bundle.test.js.map +1 -0
- package/dist/__tests__/healthcare-compliance.test.d.ts +9 -0
- package/dist/__tests__/healthcare-compliance.test.d.ts.map +1 -0
- package/dist/__tests__/healthcare-compliance.test.js +233 -0
- package/dist/__tests__/healthcare-compliance.test.js.map +1 -0
- package/dist/action/diff-mode.d.ts +124 -8
- package/dist/action/diff-mode.d.ts.map +1 -1
- package/dist/action/diff-mode.js +384 -65
- package/dist/action/diff-mode.js.map +1 -1
- package/dist/action/diff-mode.test.js +3 -3
- package/dist/action/diff-mode.test.js.map +1 -1
- package/dist/action/pr-comment.test.js +1 -0
- package/dist/action/pr-comment.test.js.map +1 -1
- package/dist/action/sarif-upload.test.js +1 -0
- package/dist/action/sarif-upload.test.js.map +1 -1
- package/dist/agents/adversary/config.d.ts +113 -0
- package/dist/agents/adversary/config.d.ts.map +1 -0
- package/dist/agents/adversary/config.js +391 -0
- package/dist/agents/adversary/config.js.map +1 -0
- package/dist/agents/adversary/index.d.ts +41 -0
- package/dist/agents/adversary/index.d.ts.map +1 -0
- package/dist/agents/adversary/index.js +838 -0
- package/dist/agents/adversary/index.js.map +1 -0
- package/dist/agents/adversary/reporting/compliance-mapper.d.ts +108 -0
- package/dist/agents/adversary/reporting/compliance-mapper.d.ts.map +1 -0
- package/dist/agents/adversary/reporting/compliance-mapper.js +391 -0
- package/dist/agents/adversary/reporting/compliance-mapper.js.map +1 -0
- package/dist/agents/adversary/reporting/index.d.ts +10 -0
- package/dist/agents/adversary/reporting/index.d.ts.map +1 -0
- package/dist/agents/adversary/reporting/index.js +10 -0
- package/dist/agents/adversary/reporting/index.js.map +1 -0
- package/dist/agents/adversary/reporting/poc-generator.d.ts +44 -0
- package/dist/agents/adversary/reporting/poc-generator.d.ts.map +1 -0
- package/dist/agents/adversary/reporting/poc-generator.js +308 -0
- package/dist/agents/adversary/reporting/poc-generator.js.map +1 -0
- package/dist/agents/adversary/tactics/api.d.ts +13 -0
- package/dist/agents/adversary/tactics/api.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/api.js +815 -0
- package/dist/agents/adversary/tactics/api.js.map +1 -0
- package/dist/agents/adversary/tactics/auth.d.ts +13 -0
- package/dist/agents/adversary/tactics/auth.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/auth.js +676 -0
- package/dist/agents/adversary/tactics/auth.js.map +1 -0
- package/dist/agents/adversary/tactics/index.d.ts +129 -0
- package/dist/agents/adversary/tactics/index.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/index.js +199 -0
- package/dist/agents/adversary/tactics/index.js.map +1 -0
- package/dist/agents/adversary/tactics/infra.d.ts +13 -0
- package/dist/agents/adversary/tactics/infra.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/infra.js +827 -0
- package/dist/agents/adversary/tactics/infra.js.map +1 -0
- package/dist/agents/adversary/tactics/injection.d.ts +12 -0
- package/dist/agents/adversary/tactics/injection.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/injection.js +549 -0
- package/dist/agents/adversary/tactics/injection.js.map +1 -0
- package/dist/agents/adversary/tactics/llm.d.ts +13 -0
- package/dist/agents/adversary/tactics/llm.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/llm.js +767 -0
- package/dist/agents/adversary/tactics/llm.js.map +1 -0
- package/dist/agents/adversary/tactics/web-app.d.ts +13 -0
- package/dist/agents/adversary/tactics/web-app.d.ts.map +1 -0
- package/dist/agents/adversary/tactics/web-app.js +717 -0
- package/dist/agents/adversary/tactics/web-app.js.map +1 -0
- package/dist/agents/adversary/types.d.ts +407 -0
- package/dist/agents/adversary/types.d.ts.map +1 -0
- package/dist/agents/adversary/types.js +12 -0
- package/dist/agents/adversary/types.js.map +1 -0
- package/dist/agents/index.d.ts +1 -0
- package/dist/agents/index.d.ts.map +1 -1
- package/dist/agents/index.js +2 -0
- package/dist/agents/index.js.map +1 -1
- package/dist/agents/zero-day-hunter.d.ts +1 -1
- package/dist/agents/zero-day-hunter.d.ts.map +1 -1
- package/dist/analysis/data-flow.d.ts +154 -0
- package/dist/analysis/data-flow.d.ts.map +1 -0
- package/dist/analysis/data-flow.js +393 -0
- package/dist/analysis/data-flow.js.map +1 -0
- package/dist/analysis/index.d.ts +9 -0
- package/dist/analysis/index.d.ts.map +1 -0
- package/dist/analysis/index.js +9 -0
- package/dist/analysis/index.js.map +1 -0
- package/dist/badge-service/index.d.ts +144 -0
- package/dist/badge-service/index.d.ts.map +1 -0
- package/dist/badge-service/index.js +206 -0
- package/dist/badge-service/index.js.map +1 -0
- package/dist/certification/consensus.test.js +2 -0
- package/dist/certification/consensus.test.js.map +1 -1
- package/dist/certification/store.d.ts.map +1 -1
- package/dist/certification/store.js +4 -0
- package/dist/certification/store.js.map +1 -1
- package/dist/certification/types.d.ts +3 -3
- package/dist/certification/types.d.ts.map +1 -1
- package/dist/certification/types.js +2 -0
- package/dist/certification/types.js.map +1 -1
- package/dist/commands/certification/certify.d.ts.map +1 -1
- package/dist/commands/certification/certify.js +18 -4
- package/dist/commands/certification/certify.js.map +1 -1
- package/dist/compliance/attestation.d.ts +39 -0
- package/dist/compliance/attestation.d.ts.map +1 -0
- package/dist/compliance/attestation.js +364 -0
- package/dist/compliance/attestation.js.map +1 -0
- package/dist/compliance/cfr42-part2.d.ts +42 -0
- package/dist/compliance/cfr42-part2.d.ts.map +1 -0
- package/dist/compliance/cfr42-part2.js +408 -0
- package/dist/compliance/cfr42-part2.js.map +1 -0
- package/dist/compliance/compliance-bundle.d.ts +100 -0
- package/dist/compliance/compliance-bundle.d.ts.map +1 -0
- package/dist/compliance/compliance-bundle.js +210 -0
- package/dist/compliance/compliance-bundle.js.map +1 -0
- package/dist/compliance/healthcare-bundle.d.ts +68 -0
- package/dist/compliance/healthcare-bundle.d.ts.map +1 -0
- package/dist/compliance/healthcare-bundle.js +104 -0
- package/dist/compliance/healthcare-bundle.js.map +1 -0
- package/dist/compliance/hipaa.d.ts.map +1 -1
- package/dist/compliance/hipaa.js +14 -11
- package/dist/compliance/hipaa.js.map +1 -1
- package/dist/compliance/index.d.ts +10 -2
- package/dist/compliance/index.d.ts.map +1 -1
- package/dist/compliance/index.js +9 -3
- package/dist/compliance/index.js.map +1 -1
- package/dist/compliance/mapper.d.ts.map +1 -1
- package/dist/compliance/mapper.js +3 -17
- package/dist/compliance/mapper.js.map +1 -1
- package/dist/compliance/nist-800-53.d.ts +22 -6
- package/dist/compliance/nist-800-53.d.ts.map +1 -1
- package/dist/compliance/nist-800-53.js +264 -272
- package/dist/compliance/nist-800-53.js.map +1 -1
- package/dist/compliance/report.d.ts +31 -2
- package/dist/compliance/report.d.ts.map +1 -1
- package/dist/compliance/report.js +255 -4
- package/dist/compliance/report.js.map +1 -1
- package/dist/compliance/types.d.ts +1 -1
- package/dist/compliance/types.d.ts.map +1 -1
- package/dist/config/flags.d.ts +12 -12
- package/dist/cost/index.d.ts +1 -1
- package/dist/cost/index.d.ts.map +1 -1
- package/dist/cost/index.js +1 -1
- package/dist/cost/index.js.map +1 -1
- package/dist/cost/tracker.d.ts +64 -0
- package/dist/cost/tracker.d.ts.map +1 -1
- package/dist/cost/tracker.js +165 -0
- package/dist/cost/tracker.js.map +1 -1
- package/dist/eval/fixtures/healthcare/audit-gaps.d.ts +28 -0
- package/dist/eval/fixtures/healthcare/audit-gaps.d.ts.map +1 -0
- package/dist/eval/fixtures/healthcare/audit-gaps.js +90 -0
- package/dist/eval/fixtures/healthcare/audit-gaps.js.map +1 -0
- package/dist/eval/fixtures/healthcare/consent-bypass.d.ts +31 -0
- package/dist/eval/fixtures/healthcare/consent-bypass.d.ts.map +1 -0
- package/dist/eval/fixtures/healthcare/consent-bypass.js +61 -0
- package/dist/eval/fixtures/healthcare/consent-bypass.js.map +1 -0
- package/dist/eval/fixtures/healthcare/phi-in-logs.d.ts +24 -0
- package/dist/eval/fixtures/healthcare/phi-in-logs.d.ts.map +1 -0
- package/dist/eval/fixtures/healthcare/phi-in-logs.js +41 -0
- package/dist/eval/fixtures/healthcare/phi-in-logs.js.map +1 -0
- package/dist/evidence/collector.d.ts +21 -0
- package/dist/evidence/collector.d.ts.map +1 -0
- package/dist/evidence/collector.js +340 -0
- package/dist/evidence/collector.js.map +1 -0
- package/dist/evidence/index.d.ts +11 -0
- package/dist/evidence/index.d.ts.map +1 -0
- package/dist/evidence/index.js +12 -0
- package/dist/evidence/index.js.map +1 -0
- package/dist/evidence/store.d.ts +39 -0
- package/dist/evidence/store.d.ts.map +1 -0
- package/dist/evidence/store.js +173 -0
- package/dist/evidence/store.js.map +1 -0
- package/dist/evidence/types.d.ts +175 -0
- package/dist/evidence/types.d.ts.map +1 -0
- package/dist/evidence/types.js +9 -0
- package/dist/evidence/types.js.map +1 -0
- package/dist/exporters/checkmarx.d.ts +18 -0
- package/dist/exporters/checkmarx.d.ts.map +1 -0
- package/dist/exporters/checkmarx.js +203 -0
- package/dist/exporters/checkmarx.js.map +1 -0
- package/dist/exporters/index.d.ts +22 -0
- package/dist/exporters/index.d.ts.map +1 -0
- package/dist/exporters/index.js +41 -0
- package/dist/exporters/index.js.map +1 -0
- package/dist/exporters/snyk.d.ts +18 -0
- package/dist/exporters/snyk.d.ts.map +1 -0
- package/dist/exporters/snyk.js +119 -0
- package/dist/exporters/snyk.js.map +1 -0
- package/dist/exporters/sonarqube.d.ts +18 -0
- package/dist/exporters/sonarqube.d.ts.map +1 -0
- package/dist/exporters/sonarqube.js +125 -0
- package/dist/exporters/sonarqube.js.map +1 -0
- package/dist/exporters/types.d.ts +190 -0
- package/dist/exporters/types.d.ts.map +1 -0
- package/dist/exporters/types.js +9 -0
- package/dist/exporters/types.js.map +1 -0
- package/dist/frontier/index.d.ts +12 -0
- package/dist/frontier/index.d.ts.map +1 -0
- package/dist/frontier/index.js +12 -0
- package/dist/frontier/index.js.map +1 -0
- package/dist/frontier/orchestrator.d.ts +73 -0
- package/dist/frontier/orchestrator.d.ts.map +1 -0
- package/dist/frontier/orchestrator.js +312 -0
- package/dist/frontier/orchestrator.js.map +1 -0
- package/dist/frontier/providers/stub.d.ts +32 -0
- package/dist/frontier/providers/stub.d.ts.map +1 -0
- package/dist/frontier/providers/stub.js +66 -0
- package/dist/frontier/providers/stub.js.map +1 -0
- package/dist/frontier/types.d.ts +318 -0
- package/dist/frontier/types.d.ts.map +1 -0
- package/dist/frontier/types.js +27 -0
- package/dist/frontier/types.js.map +1 -0
- package/dist/history/index.d.ts +13 -0
- package/dist/history/index.d.ts.map +1 -0
- package/dist/history/index.js +15 -0
- package/dist/history/index.js.map +1 -0
- package/dist/history/store.d.ts +74 -0
- package/dist/history/store.d.ts.map +1 -0
- package/dist/history/store.js +399 -0
- package/dist/history/store.js.map +1 -0
- package/dist/history/types.d.ts +282 -0
- package/dist/history/types.d.ts.map +1 -0
- package/dist/history/types.js +41 -0
- package/dist/history/types.js.map +1 -0
- package/dist/history/verify.d.ts +44 -0
- package/dist/history/verify.d.ts.map +1 -0
- package/dist/history/verify.js +230 -0
- package/dist/history/verify.js.map +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +431 -18
- package/dist/index.js.map +1 -1
- package/dist/multimodel/index.d.ts +1 -0
- package/dist/multimodel/index.d.ts.map +1 -1
- package/dist/multimodel/index.js +2 -0
- package/dist/multimodel/index.js.map +1 -1
- package/dist/multimodel/leaderboard.d.ts +116 -0
- package/dist/multimodel/leaderboard.d.ts.map +1 -0
- package/dist/multimodel/leaderboard.js +262 -0
- package/dist/multimodel/leaderboard.js.map +1 -0
- package/dist/observability/otel.d.ts.map +1 -1
- package/dist/observability/otel.js +1 -3
- package/dist/observability/otel.js.map +1 -1
- package/dist/plugins/loader.js +1 -1
- package/dist/plugins/loader.js.map +1 -1
- package/dist/sbom/provenance.test.js +2 -2
- package/dist/sbom/provenance.test.js.map +1 -1
- package/dist/scanners/agent/agent-chain-analysis.d.ts +152 -0
- package/dist/scanners/agent/agent-chain-analysis.d.ts.map +1 -0
- package/dist/scanners/agent/agent-chain-analysis.js +438 -0
- package/dist/scanners/agent/agent-chain-analysis.js.map +1 -0
- package/dist/scanners/agent/manifest-audit.d.ts.map +1 -1
- package/dist/scanners/agent/manifest-audit.js +30 -18
- package/dist/scanners/agent/manifest-audit.js.map +1 -1
- package/dist/scanners/agent/payloads/index.d.ts +2 -1
- package/dist/scanners/agent/payloads/index.d.ts.map +1 -1
- package/dist/scanners/agent/payloads/index.js +25 -6
- package/dist/scanners/agent/payloads/index.js.map +1 -1
- package/dist/scanners/agent/prompt-injection-fuzzer.d.ts.map +1 -1
- package/dist/scanners/agent/prompt-injection-fuzzer.js +14 -0
- package/dist/scanners/agent/prompt-injection-fuzzer.js.map +1 -1
- package/dist/scanners/agent/types.d.ts +5 -5
- package/dist/scanners/agent/types.d.ts.map +1 -1
- package/dist/scanners/agent/types.js.map +1 -1
- package/dist/scanners/cache.d.ts +156 -0
- package/dist/scanners/cache.d.ts.map +1 -0
- package/dist/scanners/cache.js +462 -0
- package/dist/scanners/cache.js.map +1 -0
- package/dist/scanners/dependencies.d.ts.map +1 -1
- package/dist/scanners/dependencies.js +5 -6
- package/dist/scanners/dependencies.js.map +1 -1
- package/dist/scanners/gosec.d.ts.map +1 -1
- package/dist/scanners/gosec.js +47 -9
- package/dist/scanners/gosec.js.map +1 -1
- package/dist/scanners/healthcare.d.ts +29 -0
- package/dist/scanners/healthcare.d.ts.map +1 -0
- package/dist/scanners/healthcare.js +526 -0
- package/dist/scanners/healthcare.js.map +1 -0
- package/dist/scanners/index.d.ts +1 -0
- package/dist/scanners/index.d.ts.map +1 -1
- package/dist/scanners/index.js +33 -0
- package/dist/scanners/index.js.map +1 -1
- package/dist/scanners/index.test.js +6 -6
- package/dist/scanners/index.test.js.map +1 -1
- package/dist/scanners/secrets.js +4 -4
- package/dist/scanners/secrets.js.map +1 -1
- package/dist/scanners/semgrep.js +5 -5
- package/dist/scanners/semgrep.js.map +1 -1
- package/dist/scanners/types.d.ts +1 -1
- package/dist/scanners/types.d.ts.map +1 -1
- package/dist/scanners/types.js +1 -0
- package/dist/scanners/types.js.map +1 -1
- package/dist/scanners/typescript.test.js +1 -1
- package/dist/scanners/typescript.test.js.map +1 -1
- package/dist/telemetry/index.d.ts +10 -0
- package/dist/telemetry/index.d.ts.map +1 -0
- package/dist/telemetry/index.js +10 -0
- package/dist/telemetry/index.js.map +1 -0
- package/dist/telemetry/registry.d.ts +178 -0
- package/dist/telemetry/registry.d.ts.map +1 -0
- package/dist/telemetry/registry.js +297 -0
- package/dist/telemetry/registry.js.map +1 -0
- package/dist/telemetry/usage.d.ts +197 -0
- package/dist/telemetry/usage.d.ts.map +1 -0
- package/dist/telemetry/usage.js +244 -0
- package/dist/telemetry/usage.js.map +1 -0
- package/package.json +11 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,78 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.9.0] - 2026-05-01
|
|
9
|
+
|
|
10
|
+
### Added
|
|
11
|
+
|
|
12
|
+
#### Optimization Plan Modules
|
|
13
|
+
|
|
14
|
+
##### Corpus Expansion (P0)
|
|
15
|
+
- 7 new payload categories bringing total from 220 to 430+ payloads
|
|
16
|
+
- `multi-turn.json` - 30 payloads for context-building attacks across turns
|
|
17
|
+
- `context-manipulation.json` - 30 payloads for conversation history attacks
|
|
18
|
+
- `output-redirection.json` - 30 payloads for forcing specific outputs
|
|
19
|
+
- `token-smuggling.json` - 30 payloads exploiting tokenization boundaries
|
|
20
|
+
- `mcp-attacks.json` - 30 payloads for MCP protocol-specific vectors
|
|
21
|
+
- `tool-chaining.json` - 30 payloads for tool composition exploits
|
|
22
|
+
- `privilege-escalation.json` - 30 payloads for read→write escalation
|
|
23
|
+
- Updated corpus sizes: quick=100, standard=400, thorough=800, exhaustive=1500
|
|
24
|
+
|
|
25
|
+
##### Usage Telemetry (P0)
|
|
26
|
+
- `src/telemetry/usage.ts` - Event tracking with privacy controls
|
|
27
|
+
- `src/telemetry/registry.ts` - Persistent scan registry for analytics
|
|
28
|
+
- Opt-in telemetry for repo URL, org name, user email
|
|
29
|
+
- Analytics methods for dashboard and case study candidates
|
|
30
|
+
|
|
31
|
+
##### Badge Service (P0)
|
|
32
|
+
- `src/badge-service/index.ts` - HTTP handlers for badge serving
|
|
33
|
+
- Badge verification endpoint with Sigstore bundle support
|
|
34
|
+
- `generateBadgeEmbedCode()` for markdown/HTML embedding
|
|
35
|
+
- CertificationStorage interface with memory implementation
|
|
36
|
+
|
|
37
|
+
##### Frontier Model Interface (P1)
|
|
38
|
+
- `src/frontier/types.ts` - Interfaces for Mythos/GPT-5.5-Cyber integration
|
|
39
|
+
- `src/frontier/orchestrator.ts` - Multi-model orchestration with consensus
|
|
40
|
+
- `src/frontier/providers/stub.ts` - Test provider placeholder
|
|
41
|
+
- FrontierModelProvider interface with capabilities, cost estimation
|
|
42
|
+
- ExploitChain and ConsensusResult types
|
|
43
|
+
|
|
44
|
+
##### Data Flow Analysis (P1)
|
|
45
|
+
- `src/analysis/data-flow.ts` - Source→sink tracking for JS/TS/Python
|
|
46
|
+
- Pattern-based detection of user input sources (req.body, event.body, etc.)
|
|
47
|
+
- Dangerous sink detection (SQL, command exec, eval, file write)
|
|
48
|
+
- Risky flow identification (untrusted source → sensitive sink without sanitizer)
|
|
49
|
+
- LLM context formatting for focused analysis
|
|
50
|
+
|
|
51
|
+
##### Agent Chain Analysis (P2)
|
|
52
|
+
- `src/scanners/agent/agent-chain-analysis.ts` - Multi-hop attack paths
|
|
53
|
+
- Trust boundary modeling between agents and MCP servers
|
|
54
|
+
- AgentGraph construction from MCP server configs
|
|
55
|
+
- Attack path detection with severity calculation
|
|
56
|
+
- Mermaid diagram generation for visualization
|
|
57
|
+
|
|
58
|
+
### Changed
|
|
59
|
+
- Extended PayloadCategory type with 7 new categories
|
|
60
|
+
- Updated FuzzerOptions corpus type to include "exhaustive"
|
|
61
|
+
- Increased test count from 2,332 to 2,484 across 104 test files
|
|
62
|
+
|
|
63
|
+
## [2.8.0] - 2026-04-29
|
|
64
|
+
|
|
65
|
+
### Added
|
|
66
|
+
|
|
67
|
+
#### Agent Batch Submit Tool
|
|
68
|
+
- New `agent_batch_submit` tool for submitting findings from subagent JSON output
|
|
69
|
+
- Solves MCP permission issues when certification agents run as subagents
|
|
70
|
+
- Accepts array of findings and optional summary in one call
|
|
71
|
+
- Updated certification command docs to recommend batch submit
|
|
72
|
+
|
|
73
|
+
### Fixed
|
|
74
|
+
|
|
75
|
+
#### CI/CD Improvements
|
|
76
|
+
- Lazy Stripe initialization to allow builds without `STRIPE_SECRET_KEY`
|
|
77
|
+
- Fixed TypeScript test timeout for CI environments
|
|
78
|
+
- Synced package-lock.json for CI compatibility
|
|
79
|
+
|
|
8
80
|
## [2.7.0] - 2026-04-26
|
|
9
81
|
|
|
10
82
|
### Added
|
package/README.md
CHANGED
|
@@ -2,14 +2,84 @@
|
|
|
2
2
|
|
|
3
3
|
Enterprise-grade security certification for codebases **and AI agent systems** with deterministic scanners, LLM-powered analysis, and signed attestations.
|
|
4
4
|
|
|
5
|
-

|
|
6
6
|

|
|
7
|
-

|
|
8
8
|

|
|
9
9
|

|
|
10
10
|
|
|
11
11
|
---
|
|
12
12
|
|
|
13
|
+
## What's New in v2.9.0
|
|
14
|
+
|
|
15
|
+
### Universal Audit-Defensible Compliance Reports
|
|
16
|
+
All 13 compliance frameworks now support audit-defensible report generation:
|
|
17
|
+
|
|
18
|
+
| Feature | Description |
|
|
19
|
+
|---------|-------------|
|
|
20
|
+
| **Evidence Bundle** | Cryptographically signed artifacts with Sigstore |
|
|
21
|
+
| **Audit Trail Verification** | Hash-chained integrity verification |
|
|
22
|
+
| **Attestation Section** | Framework-specific methodology and scope limitations |
|
|
23
|
+
|
|
24
|
+
**Supported Frameworks:**
|
|
25
|
+
- **Traditional:** SOC2, ISO27001, PCI-DSS, HIPAA, 42-CFR-PART-2, GDPR, NIST-800-53, CIS
|
|
26
|
+
- **AI/ML:** OWASP-LLM, NIST-AI-RMF, MITRE-ATLAS, EU-AI-ACT, ISO-42001
|
|
27
|
+
|
|
28
|
+
**New Tool Parameters:**
|
|
29
|
+
```json
|
|
30
|
+
{
|
|
31
|
+
"collect_evidence": true,
|
|
32
|
+
"verify_audit_trail": true,
|
|
33
|
+
"store_evidence": true,
|
|
34
|
+
"include_attestation": true
|
|
35
|
+
}
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
### Healthcare Compliance Bundle
|
|
39
|
+
Unified HIPAA + 42 CFR Part 2 assessment for healthcare organizations:
|
|
40
|
+
- Single-command assessment for both frameworks
|
|
41
|
+
- Cross-reference between HIPAA and SUD confidentiality requirements
|
|
42
|
+
- Combined evidence bundle for audit defensibility
|
|
43
|
+
|
|
44
|
+
### 42 CFR Part 2 Framework
|
|
45
|
+
New compliance framework for Substance Use Disorder (SUD) patient record confidentiality:
|
|
46
|
+
- 15 controls across consent, disclosure, and security categories
|
|
47
|
+
- Cross-mapping to HIPAA Security Rule
|
|
48
|
+
- Healthcare-specific attestation content
|
|
49
|
+
|
|
50
|
+
---
|
|
51
|
+
|
|
52
|
+
## What's New in v2.8.0
|
|
53
|
+
|
|
54
|
+
### Agent Batch Submit Tool
|
|
55
|
+
New tool for submitting findings from subagent JSON output:
|
|
56
|
+
- **`agent_batch_submit`** - Submit all findings in one call when agents run as subagents
|
|
57
|
+
- Fixes MCP permission issues when certification agents don't have direct tool access
|
|
58
|
+
- Updated certification orchestration docs
|
|
59
|
+
|
|
60
|
+
### CI/CD Improvements
|
|
61
|
+
- Lazy Stripe initialization for builds without env vars
|
|
62
|
+
- TypeScript test timeout fixes for CI environments
|
|
63
|
+
|
|
64
|
+
---
|
|
65
|
+
|
|
66
|
+
## What's New in v2.7.0
|
|
67
|
+
|
|
68
|
+
### Plan Enforcement
|
|
69
|
+
- Plan limits for free/pro/enterprise tiers
|
|
70
|
+
- Certification monthly limits enforced at API level
|
|
71
|
+
- Agent count limits based on subscription plan
|
|
72
|
+
- Compliance framework access gating
|
|
73
|
+
|
|
74
|
+
| Limit | Free | Pro | Enterprise |
|
|
75
|
+
|-------|------|-----|------------|
|
|
76
|
+
| Certifications/month | 3 | 50 | Unlimited |
|
|
77
|
+
| Projects | 2 | 20 | Unlimited |
|
|
78
|
+
| Agents | 3 | 7 | All |
|
|
79
|
+
| Frameworks | SOC2 | SOC2, HIPAA, NIST | All |
|
|
80
|
+
|
|
81
|
+
---
|
|
82
|
+
|
|
13
83
|
## What's New in v2.5.0
|
|
14
84
|
|
|
15
85
|
### Mythos-Class Security Scanners 🔬
|
|
@@ -231,8 +301,16 @@ Measure scanner accuracy with labeled test fixtures:
|
|
|
231
301
|
### Installation
|
|
232
302
|
|
|
233
303
|
```bash
|
|
234
|
-
npm
|
|
235
|
-
|
|
304
|
+
# npm
|
|
305
|
+
npm install vaspera
|
|
306
|
+
|
|
307
|
+
# pnpm (use -w flag for workspace root)
|
|
308
|
+
pnpm install -w vaspera
|
|
309
|
+
|
|
310
|
+
# yarn
|
|
311
|
+
yarn add vaspera
|
|
312
|
+
|
|
313
|
+
# From source
|
|
236
314
|
git clone https://github.com/RCOLKITT/hardening-mcp.git
|
|
237
315
|
cd hardening-mcp
|
|
238
316
|
npm install && npm run build
|
|
@@ -356,13 +434,14 @@ Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
|
|
|
356
434
|
| `consensus_models` | List model configurations |
|
|
357
435
|
| `consensus_clear` | Clear recorded results |
|
|
358
436
|
|
|
359
|
-
### Compliance Mapping (v2.0.0)
|
|
437
|
+
### Compliance Mapping (v2.0.0, enhanced v2.9.0)
|
|
360
438
|
|
|
361
439
|
| Tool | Description |
|
|
362
440
|
|------|-------------|
|
|
363
|
-
| `compliance_report` | Generate compliance report for a framework |
|
|
364
|
-
| `compliance_multi_report` | Generate report for multiple frameworks |
|
|
441
|
+
| `compliance_report` | Generate compliance report for a framework (audit-defensible) |
|
|
442
|
+
| `compliance_multi_report` | Generate report for multiple frameworks (audit-defensible) |
|
|
365
443
|
| `compliance_controls` | List controls for a framework |
|
|
444
|
+
| `healthcare_compliance` | Unified HIPAA + 42 CFR Part 2 assessment (v2.9.0) |
|
|
366
445
|
|
|
367
446
|
### SBOM & Provenance (v2.0.0)
|
|
368
447
|
|
|
@@ -613,6 +692,31 @@ You: "Generate GDPR compliance report"
|
|
|
613
692
|
→ Returns control status with gap analysis
|
|
614
693
|
```
|
|
615
694
|
|
|
695
|
+
### Audit-Defensible Compliance Report (v2.9.0)
|
|
696
|
+
|
|
697
|
+
```
|
|
698
|
+
You: "Generate audit-defensible SOC 2 report"
|
|
699
|
+
→ Claude calls compliance_report with:
|
|
700
|
+
- framework: "SOC2"
|
|
701
|
+
- collect_evidence: true
|
|
702
|
+
- verify_audit_trail: true
|
|
703
|
+
- include_attestation: true
|
|
704
|
+
→ Collects cryptographically signed evidence bundle
|
|
705
|
+
→ Verifies hash-chain integrity of audit trail
|
|
706
|
+
→ Generates report with attestation methodology
|
|
707
|
+
→ Returns audit-ready documentation
|
|
708
|
+
```
|
|
709
|
+
|
|
710
|
+
### Healthcare Compliance Assessment (v2.9.0)
|
|
711
|
+
|
|
712
|
+
```
|
|
713
|
+
You: "Run healthcare compliance assessment"
|
|
714
|
+
→ Claude calls healthcare_compliance
|
|
715
|
+
→ Assesses both HIPAA and 42 CFR Part 2 frameworks
|
|
716
|
+
→ Generates unified report with cross-references
|
|
717
|
+
→ Collects evidence bundle for audit defensibility
|
|
718
|
+
```
|
|
719
|
+
|
|
616
720
|
### Sigstore Signing (v2.1.1)
|
|
617
721
|
|
|
618
722
|
```
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"api.test.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/agents/adversary/tactics/api.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}
|
|
@@ -0,0 +1,369 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Tests for API Security Tactics Module
|
|
3
|
+
*/
|
|
4
|
+
import { describe, it, expect } from "vitest";
|
|
5
|
+
import { apiTactic } from "../../../../agents/adversary/tactics/api.js";
|
|
6
|
+
import { createFileContext } from "../../../../agents/adversary/tactics/index.js";
|
|
7
|
+
const mockConfig = {
|
|
8
|
+
model: "claude-sonnet-4-20250514",
|
|
9
|
+
aggressiveness: "passive",
|
|
10
|
+
focusAreas: ["api"],
|
|
11
|
+
maxAnalysisTime: 60000,
|
|
12
|
+
generatePoC: false,
|
|
13
|
+
};
|
|
14
|
+
describe("API Security Tactics", () => {
|
|
15
|
+
describe("Module Registration", () => {
|
|
16
|
+
it("has correct focus area", () => {
|
|
17
|
+
expect(apiTactic.focusArea).toBe("api");
|
|
18
|
+
});
|
|
19
|
+
it("has correct name and description", () => {
|
|
20
|
+
expect(apiTactic.name).toBe("API Security");
|
|
21
|
+
expect(apiTactic.description).toContain("IDOR");
|
|
22
|
+
expect(apiTactic.description).toContain("BOLA");
|
|
23
|
+
});
|
|
24
|
+
it("has patterns defined", () => {
|
|
25
|
+
expect(apiTactic.patterns.length).toBeGreaterThan(0);
|
|
26
|
+
});
|
|
27
|
+
it("returns relevant file patterns", () => {
|
|
28
|
+
const patterns = apiTactic.getRelevantFilePatterns();
|
|
29
|
+
expect(patterns).toContain("**/api/**");
|
|
30
|
+
expect(patterns).toContain("**/routes/**");
|
|
31
|
+
expect(patterns).toContain("**/controllers/**");
|
|
32
|
+
expect(patterns).toContain("**/graphql/**");
|
|
33
|
+
});
|
|
34
|
+
it("provides LLM prompt enhancement", () => {
|
|
35
|
+
const prompt = apiTactic.getPromptEnhancement();
|
|
36
|
+
expect(prompt).toContain("IDOR");
|
|
37
|
+
expect(prompt).toContain("BOLA");
|
|
38
|
+
expect(prompt).toContain("GraphQL");
|
|
39
|
+
expect(prompt).toContain("Mass Assignment");
|
|
40
|
+
});
|
|
41
|
+
});
|
|
42
|
+
describe("IDOR Detection", () => {
|
|
43
|
+
it("detects direct ID usage without authorization", async () => {
|
|
44
|
+
const code = `
|
|
45
|
+
router.get('/api/posts/:id', async (req, res) => {
|
|
46
|
+
const post = await Post.findById(req.params.id);
|
|
47
|
+
res.json(post);
|
|
48
|
+
});
|
|
49
|
+
`;
|
|
50
|
+
const file = createFileContext("/test", "/test/api/routes.ts", code);
|
|
51
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
52
|
+
const idorFinding = findings.find((f) => f.patternId === "idor-direct-id");
|
|
53
|
+
expect(idorFinding).toBeDefined();
|
|
54
|
+
expect(idorFinding?.severity).toBe("high");
|
|
55
|
+
expect(idorFinding?.cweIds).toContain("CWE-639");
|
|
56
|
+
});
|
|
57
|
+
it("detects file path IDOR", async () => {
|
|
58
|
+
const code = `
|
|
59
|
+
app.get('/download', async (req, res) => {
|
|
60
|
+
const data = await fs.readFile(req.query.path);
|
|
61
|
+
res.send(data);
|
|
62
|
+
});
|
|
63
|
+
`;
|
|
64
|
+
const file = createFileContext("/test", "/test/api/download.ts", code);
|
|
65
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
66
|
+
const fileFinding = findings.find((f) => f.patternId === "idor-file-path");
|
|
67
|
+
expect(fileFinding).toBeDefined();
|
|
68
|
+
expect(fileFinding?.severity).toBe("critical");
|
|
69
|
+
});
|
|
70
|
+
it("skips test files", async () => {
|
|
71
|
+
const code = `
|
|
72
|
+
const testPost = await Post.findById(req.params.id);
|
|
73
|
+
`;
|
|
74
|
+
const file = createFileContext("/test", "/test/api/routes.test.ts", code);
|
|
75
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
76
|
+
expect(findings.length).toBe(0);
|
|
77
|
+
});
|
|
78
|
+
});
|
|
79
|
+
describe("BOLA Detection", () => {
|
|
80
|
+
it("detects missing object-level authorization on read", async () => {
|
|
81
|
+
const code = `
|
|
82
|
+
async function getOrder(req, res) {
|
|
83
|
+
const order = await Order.findOne({ id: req.params.id })
|
|
84
|
+
.then(order => res.json(order));
|
|
85
|
+
}
|
|
86
|
+
`;
|
|
87
|
+
const file = createFileContext("/test", "/test/api/orders.ts", code);
|
|
88
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
89
|
+
const bolaFinding = findings.find((f) => f.patternId === "bola-missing-authz");
|
|
90
|
+
expect(bolaFinding).toBeDefined();
|
|
91
|
+
expect(bolaFinding?.severity).toBe("high");
|
|
92
|
+
});
|
|
93
|
+
it("detects BOLA on update operations", async () => {
|
|
94
|
+
const code = `
|
|
95
|
+
router.put('/posts/:id', async (req, res) => {
|
|
96
|
+
await Post.update({ id: req.params.id }, req.body);
|
|
97
|
+
res.json({ success: true });
|
|
98
|
+
});
|
|
99
|
+
`;
|
|
100
|
+
const file = createFileContext("/test", "/test/api/posts.ts", code);
|
|
101
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
102
|
+
const updateFinding = findings.find((f) => f.patternId === "bola-update-no-check");
|
|
103
|
+
expect(updateFinding).toBeDefined();
|
|
104
|
+
expect(updateFinding?.severity).toBe("critical");
|
|
105
|
+
});
|
|
106
|
+
it("detects BOLA on delete operations", async () => {
|
|
107
|
+
const code = `
|
|
108
|
+
async deletePost(req, res) {
|
|
109
|
+
await Post.delete(req.params.id);
|
|
110
|
+
res.sendStatus(204);
|
|
111
|
+
}
|
|
112
|
+
`;
|
|
113
|
+
const file = createFileContext("/test", "/test/api/posts.ts", code);
|
|
114
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
115
|
+
const deleteFinding = findings.find((f) => f.patternId === "bola-delete-no-check");
|
|
116
|
+
expect(deleteFinding).toBeDefined();
|
|
117
|
+
expect(deleteFinding?.severity).toBe("critical");
|
|
118
|
+
});
|
|
119
|
+
});
|
|
120
|
+
describe("GraphQL Detection", () => {
|
|
121
|
+
it("detects missing depth limit", async () => {
|
|
122
|
+
const code = `
|
|
123
|
+
const server = new ApolloServer({
|
|
124
|
+
typeDefs,
|
|
125
|
+
resolvers,
|
|
126
|
+
});
|
|
127
|
+
`;
|
|
128
|
+
const file = createFileContext("/test", "/test/graphql/server.ts", code);
|
|
129
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
130
|
+
const depthFinding = findings.find((f) => f.patternId === "graphql-no-depth-limit");
|
|
131
|
+
expect(depthFinding).toBeDefined();
|
|
132
|
+
expect(depthFinding?.severity).toBe("medium");
|
|
133
|
+
expect(depthFinding?.cweIds).toContain("CWE-770");
|
|
134
|
+
});
|
|
135
|
+
it("detects missing cost analysis", async () => {
|
|
136
|
+
const code = `
|
|
137
|
+
const server = new GraphQLServer({
|
|
138
|
+
schema,
|
|
139
|
+
});
|
|
140
|
+
`;
|
|
141
|
+
const file = createFileContext("/test", "/test/graphql/server.ts", code);
|
|
142
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
143
|
+
const costFinding = findings.find((f) => f.patternId === "graphql-no-cost-analysis");
|
|
144
|
+
expect(costFinding).toBeDefined();
|
|
145
|
+
});
|
|
146
|
+
it("detects introspection enabled", async () => {
|
|
147
|
+
const code = `
|
|
148
|
+
const server = new ApolloServer({
|
|
149
|
+
schema,
|
|
150
|
+
introspection: true,
|
|
151
|
+
});
|
|
152
|
+
`;
|
|
153
|
+
const file = createFileContext("/test", "/test/graphql/server.ts", code);
|
|
154
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
155
|
+
const introspectionFinding = findings.find((f) => f.patternId === "graphql-introspection-prod");
|
|
156
|
+
expect(introspectionFinding).toBeDefined();
|
|
157
|
+
expect(introspectionFinding?.severity).toBe("low");
|
|
158
|
+
});
|
|
159
|
+
});
|
|
160
|
+
describe("Mass Assignment Detection", () => {
|
|
161
|
+
it("detects object spread with user input", async () => {
|
|
162
|
+
const code = `
|
|
163
|
+
async createUser(req, res) {
|
|
164
|
+
const user = await User.create({ ...req.body });
|
|
165
|
+
res.json(user);
|
|
166
|
+
}
|
|
167
|
+
`;
|
|
168
|
+
const file = createFileContext("/test", "/test/api/users.ts", code);
|
|
169
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
170
|
+
const massFinding = findings.find((f) => f.patternId === "mass-assignment-spread");
|
|
171
|
+
expect(massFinding).toBeDefined();
|
|
172
|
+
expect(massFinding?.severity).toBe("high");
|
|
173
|
+
expect(massFinding?.cweIds).toContain("CWE-915");
|
|
174
|
+
});
|
|
175
|
+
it("detects Object.assign with unfiltered input", async () => {
|
|
176
|
+
const code = `
|
|
177
|
+
function updateProfile(req, res) {
|
|
178
|
+
Object.assign(user, req.body);
|
|
179
|
+
user.save();
|
|
180
|
+
}
|
|
181
|
+
`;
|
|
182
|
+
const file = createFileContext("/test", "/test/api/profile.ts", code);
|
|
183
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
184
|
+
const assignFinding = findings.find((f) => f.patternId === "mass-assignment-assign");
|
|
185
|
+
expect(assignFinding).toBeDefined();
|
|
186
|
+
expect(assignFinding?.severity).toBe("high");
|
|
187
|
+
});
|
|
188
|
+
it("detects ORM mass assignment", async () => {
|
|
189
|
+
const code = `
|
|
190
|
+
router.post('/users', async (req, res) => {
|
|
191
|
+
const user = await User.create(req.body);
|
|
192
|
+
res.json(user);
|
|
193
|
+
});
|
|
194
|
+
`;
|
|
195
|
+
const file = createFileContext("/test", "/test/api/users.ts", code);
|
|
196
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
197
|
+
const ormFinding = findings.find((f) => f.patternId === "mass-assignment-orm");
|
|
198
|
+
expect(ormFinding).toBeDefined();
|
|
199
|
+
});
|
|
200
|
+
});
|
|
201
|
+
describe("Rate Limiting Detection", () => {
|
|
202
|
+
it("detects missing rate limit on endpoint", async () => {
|
|
203
|
+
const code = `
|
|
204
|
+
app.post('/api/login', async (req, res) => {
|
|
205
|
+
const user = await authenticate(req.body);
|
|
206
|
+
res.json({ token: user.token });
|
|
207
|
+
});
|
|
208
|
+
`;
|
|
209
|
+
const file = createFileContext("/test", "/test/api/auth.ts", code);
|
|
210
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
211
|
+
const rateFinding = findings.find((f) => f.patternId === "api-no-rate-limit");
|
|
212
|
+
expect(rateFinding).toBeDefined();
|
|
213
|
+
expect(rateFinding?.severity).toBe("medium");
|
|
214
|
+
expect(rateFinding?.cweIds).toContain("CWE-770");
|
|
215
|
+
});
|
|
216
|
+
it("detects expensive operation without limit", async () => {
|
|
217
|
+
const code = `
|
|
218
|
+
const process = async (req, res) => {
|
|
219
|
+
const data = await processLargeDataset();
|
|
220
|
+
const report = computeComplexAnalysis(data);
|
|
221
|
+
res.json(report);
|
|
222
|
+
};
|
|
223
|
+
`;
|
|
224
|
+
const file = createFileContext("/test", "/test/api/reports.ts", code);
|
|
225
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
226
|
+
const expensiveFinding = findings.find((f) => f.patternId === "api-expensive-no-limit");
|
|
227
|
+
expect(expensiveFinding).toBeDefined();
|
|
228
|
+
expect(expensiveFinding?.severity).toBe("high");
|
|
229
|
+
});
|
|
230
|
+
});
|
|
231
|
+
describe("Data Exposure Detection", () => {
|
|
232
|
+
it("detects full object return", async () => {
|
|
233
|
+
const code = `
|
|
234
|
+
router.get('/users/:id', async (req, res) => {
|
|
235
|
+
const user = await User.findById(req.params.id);
|
|
236
|
+
res.json(user);
|
|
237
|
+
});
|
|
238
|
+
`;
|
|
239
|
+
const file = createFileContext("/test", "/test/api/users.ts", code);
|
|
240
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
241
|
+
const exposureFinding = findings.find((f) => f.patternId === "api-full-object-return");
|
|
242
|
+
expect(exposureFinding).toBeDefined();
|
|
243
|
+
expect(exposureFinding?.severity).toBe("medium");
|
|
244
|
+
expect(exposureFinding?.cweIds).toContain("CWE-200");
|
|
245
|
+
});
|
|
246
|
+
it("detects SELECT * queries", async () => {
|
|
247
|
+
const code = `
|
|
248
|
+
const users = await db.query('SELECT * FROM users WHERE id = ?', [userId]);
|
|
249
|
+
`;
|
|
250
|
+
const file = createFileContext("/test", "/test/api/users.ts", code);
|
|
251
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
252
|
+
const selectFinding = findings.find((f) => f.patternId === "api-all-fields-select");
|
|
253
|
+
expect(selectFinding).toBeDefined();
|
|
254
|
+
});
|
|
255
|
+
it("detects sensitive fields in response", async () => {
|
|
256
|
+
const code = `
|
|
257
|
+
res.json({
|
|
258
|
+
id: user.id,
|
|
259
|
+
email: user.email,
|
|
260
|
+
password: user.password,
|
|
261
|
+
token: user.apiToken
|
|
262
|
+
});
|
|
263
|
+
`;
|
|
264
|
+
const file = createFileContext("/test", "/test/api/auth.ts", code);
|
|
265
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
266
|
+
const sensitiveFinding = findings.find((f) => f.patternId === "api-sensitive-fields");
|
|
267
|
+
expect(sensitiveFinding).toBeDefined();
|
|
268
|
+
expect(sensitiveFinding?.severity).toBe("high");
|
|
269
|
+
});
|
|
270
|
+
});
|
|
271
|
+
describe("PoC Generation", () => {
|
|
272
|
+
it("generates IDOR PoC", async () => {
|
|
273
|
+
const finding = {
|
|
274
|
+
id: "test-idor",
|
|
275
|
+
patternId: "idor-direct-id",
|
|
276
|
+
file: "api/posts.ts",
|
|
277
|
+
line: 10,
|
|
278
|
+
};
|
|
279
|
+
const poc = await apiTactic.generatePoC(finding);
|
|
280
|
+
expect(poc).toBeDefined();
|
|
281
|
+
expect(poc?.steps.length).toBeGreaterThan(0);
|
|
282
|
+
expect(poc?.safeTestInstructions).toContain("test account");
|
|
283
|
+
});
|
|
284
|
+
it("generates BOLA PoC", async () => {
|
|
285
|
+
const finding = {
|
|
286
|
+
id: "test-bola",
|
|
287
|
+
patternId: "bola-missing-authz",
|
|
288
|
+
file: "api/orders.ts",
|
|
289
|
+
line: 15,
|
|
290
|
+
};
|
|
291
|
+
const poc = await apiTactic.generatePoC(finding);
|
|
292
|
+
expect(poc).toBeDefined();
|
|
293
|
+
expect(poc?.steps.length).toBeGreaterThan(0);
|
|
294
|
+
expect(poc?.expectedResult).toContain("ownership");
|
|
295
|
+
});
|
|
296
|
+
it("generates GraphQL depth limit PoC", async () => {
|
|
297
|
+
const finding = {
|
|
298
|
+
id: "test-graphql",
|
|
299
|
+
patternId: "graphql-no-depth-limit",
|
|
300
|
+
file: "graphql/server.ts",
|
|
301
|
+
line: 20,
|
|
302
|
+
};
|
|
303
|
+
const poc = await apiTactic.generatePoC(finding);
|
|
304
|
+
expect(poc).toBeDefined();
|
|
305
|
+
expect(poc?.payload).toContain("nested");
|
|
306
|
+
});
|
|
307
|
+
it("generates mass assignment PoC", async () => {
|
|
308
|
+
const finding = {
|
|
309
|
+
id: "test-mass",
|
|
310
|
+
patternId: "mass-assignment-spread",
|
|
311
|
+
file: "api/users.ts",
|
|
312
|
+
line: 25,
|
|
313
|
+
};
|
|
314
|
+
const poc = await apiTactic.generatePoC(finding);
|
|
315
|
+
expect(poc).toBeDefined();
|
|
316
|
+
expect(poc?.expectedResult).toContain("assignment");
|
|
317
|
+
});
|
|
318
|
+
it("returns null for unsupported pattern", async () => {
|
|
319
|
+
const finding = {
|
|
320
|
+
id: "test-unknown",
|
|
321
|
+
patternId: "unknown-pattern",
|
|
322
|
+
file: "test.ts",
|
|
323
|
+
line: 1,
|
|
324
|
+
};
|
|
325
|
+
const poc = await apiTactic.generatePoC(finding);
|
|
326
|
+
expect(poc).toBeNull();
|
|
327
|
+
});
|
|
328
|
+
});
|
|
329
|
+
describe("Pattern Coverage", () => {
|
|
330
|
+
it("covers all CWEs mentioned in requirements", () => {
|
|
331
|
+
const cwes = apiTactic.patterns.map((p) => p.cwe);
|
|
332
|
+
expect(cwes).toContain("CWE-639"); // IDOR
|
|
333
|
+
expect(cwes).toContain("CWE-284"); // BOLA
|
|
334
|
+
expect(cwes).toContain("CWE-770"); // GraphQL complexity
|
|
335
|
+
expect(cwes).toContain("CWE-915"); // Mass assignment
|
|
336
|
+
expect(cwes).toContain("CWE-200"); // Data exposure
|
|
337
|
+
});
|
|
338
|
+
it("has reasonable severity distribution", () => {
|
|
339
|
+
const critical = apiTactic.patterns.filter((p) => p.severity === "critical").length;
|
|
340
|
+
const high = apiTactic.patterns.filter((p) => p.severity === "high").length;
|
|
341
|
+
const medium = apiTactic.patterns.filter((p) => p.severity === "medium").length;
|
|
342
|
+
expect(critical).toBeGreaterThan(0);
|
|
343
|
+
expect(high).toBeGreaterThan(0);
|
|
344
|
+
expect(medium).toBeGreaterThan(0);
|
|
345
|
+
});
|
|
346
|
+
});
|
|
347
|
+
describe("False Positive Handling", () => {
|
|
348
|
+
it("skips comments", async () => {
|
|
349
|
+
const code = `
|
|
350
|
+
// const post = await Post.findById(req.params.id);
|
|
351
|
+
/*
|
|
352
|
+
* await User.update(req.params.id, req.body);
|
|
353
|
+
*/
|
|
354
|
+
`;
|
|
355
|
+
const file = createFileContext("/test", "/test/api/test.ts", code);
|
|
356
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
357
|
+
expect(findings.length).toBe(0);
|
|
358
|
+
});
|
|
359
|
+
it("skips mock/fixture files", async () => {
|
|
360
|
+
const code = `
|
|
361
|
+
const user = await User.create({ ...req.body });
|
|
362
|
+
`;
|
|
363
|
+
const file = createFileContext("/test", "/test/mocks/user-fixture.ts", code);
|
|
364
|
+
const findings = await apiTactic.analyzeFile(file, mockConfig);
|
|
365
|
+
expect(findings.length).toBe(0);
|
|
366
|
+
});
|
|
367
|
+
});
|
|
368
|
+
});
|
|
369
|
+
//# sourceMappingURL=api.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"api.test.js","sourceRoot":"","sources":["../../../../../src/__tests__/agents/adversary/tactics/api.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAGlF,MAAM,UAAU,GAAoB;IAClC,KAAK,EAAE,0BAA0B;IACjC,cAAc,EAAE,SAAS;IACzB,UAAU,EAAE,CAAC,KAAK,CAAC;IACnB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,uBAAuB,EAAE,CAAC;YACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;YAC3E,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC;YAC3E,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAChC,MAAM,IAAI,GAAG;;OAEZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,oBAAoB,CAAC,CAAC;YAC/E,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;YACnF,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;YACnF,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC;YACpF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,GAAG;;;;OAIZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,0BAA0B,CAAC,CAAC;YACrF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,4BAA4B,CAAC,CAAC;YAChG,MAAM,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC;YACnF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC;YACrF,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC;YAC/E,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC;YAC9E,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,IAAI,GAAG;;;;;;OAMZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC;YACxF,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC;YACvF,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,IAAI,GAAG;;OAEZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,uBAAuB,CAAC,CAAC;YACpF,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,IAAI,GAAG;;;;;;;OAOZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;YACtF,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,OAAO,GAAQ;gBACnB,EAAE,EAAE,WAAW;gBACf,SAAS,EAAE,gBAAgB;gBAC3B,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,EAAE;aACT,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,OAAO,GAAQ;gBACnB,EAAE,EAAE,WAAW;gBACf,SAAS,EAAE,oBAAoB;gBAC/B,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,EAAE;aACT,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAQ;gBACnB,EAAE,EAAE,cAAc;gBAClB,SAAS,EAAE,wBAAwB;gBACnC,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,EAAE;aACT,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,OAAO,GAAQ;gBACnB,EAAE,EAAE,WAAW;gBACf,SAAS,EAAE,wBAAwB;gBACnC,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,EAAE;aACT,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,OAAO,GAAQ;gBACnB,EAAE,EAAE,cAAc;gBAClB,SAAS,EAAE,iBAAiB;gBAC5B,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,CAAC;aACR,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAElD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;YAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB;YACxD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;YACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;YACpF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;YAEhF,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,GAAG;;;;;OAKZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,IAAI,GAAG;;OAEZ,CAAC;YAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,EAAE,IAAI,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAE/D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"llm.test.d.ts","sourceRoot":"","sources":["../../../../../src/__tests__/agents/adversary/tactics/llm.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}
|