wize-dev-kit 0.14.0 → 0.16.0

package/src/security-overlay/skills/wize-sec-recon/scripts/run-osv.js

@@ -1,227 +0,0 @@
-'use strict';
-
-// run-osv.js — SAST dependencies via osv-scanner (primary) or grype (fallback).
-// Auto-detects common manifest files in the project root and emits findings
-// into sast.md (composing with secrets from run-gitleaks.js).
-
-const path = require('node:path');
-const fs = require('node:fs');
-const { execFileSync } = require('node:child_process');
-
-const { filterArgs } = require('../../../_shared/allowlist.js');
-const { writePartial, loadPartial } = require('../../../_shared/partial.js');
-
-const MANIFEST_FILES = [
-  'package.json', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
-  'requirements.txt', 'Pipfile', 'Pipfile.lock', 'pyproject.toml', 'poetry.lock',
-  'go.mod', 'go.sum',
-  'Cargo.toml', 'Cargo.lock',
-  'composer.json', 'composer.lock',
-  'Gemfile', 'Gemfile.lock'
-];
-
-function detectManifests(root) {
-  const found = [];
-  for (const m of MANIFEST_FILES) {
-    if (fs.existsSync(path.join(root, m))) found.push(m);
-  }
-  return found;
-}
-
-function parseOsvReport(report) {
-  // osv-scanner JSON shape (simplified): { results: [{ packages: [{ package: {name, version}, vulnerabilities: [{id, severity, cvss: {score}}] }] }] }
-  const out = [];
-  const results = report && report.results ? report.results : [];
-  // Map a CVSS base score to a coarse severity label.
-  const sevFromScore = s => {
-    const n = parseFloat(s);
-    if (isNaN(n)) return null;
-    if (n === 0) return 'None';
-    if (n < 4) return 'Low';
-    if (n < 7) return 'Medium';
-    if (n < 9) return 'High';
-    return 'Critical';
-  };
-  for (const r of results) {
-    for (const p of (r.packages || [])) {
-      const name = p.package && p.package.name;
-      const version = p.package && p.package.version;
-      // osv-scanner v2 groups vulnerabilities and exposes a max_severity
-      // (CVSS) + aliases (CVE ids) per group. Prefer that; fall back to
-      // the raw vulnerabilities array for older shapes.
-      const groups = Array.isArray(p.groups) ? p.groups : [];
-      if (groups.length) {
-        for (const g of groups) {
-          const ids = g.aliases && g.aliases.length ? g.aliases : g.ids || [];
-          const cve = ids.find(x => /^CVE-/.test(x)) || ids[0] || '?';
-          const cvss = g.max_severity ? parseFloat(g.max_severity) : null;
-          out.push({ package: name, version, cve, severity: sevFromScore(g.max_severity) || 'UNKNOWN', cvss });
-        }
-      } else {
-        for (const v of (p.vulnerabilities || [])) {
-          const cve = v.id || '?';
-          const cvss = v.cvss && (typeof v.cvss === 'number' ? v.cvss : v.cvss.score);
-          out.push({ package: name, version, cve, severity: sevFromScore(cvss) || 'UNKNOWN', cvss });
-        }
-      }
-    }
-  }
-  return out;
-}
-
-function parseGrypeReport(report) {
-  // grype JSON shape: { matches: [{ artifact: {name, version}, vulnerability: {id, severity, cvss:[{metrics:{baseScore}}]} }] }
-  const out = [];
-  for (const m of (report && report.matches ? report.matches : [])) {
-    const name = m.artifact && m.artifact.name;
-    const version = m.artifact && m.artifact.version;
-    const v = m.vulnerability || {};
-    const cve = v.id || '?';
-    const severity = v.severity || 'UNKNOWN';
-    let cvss = null;
-    if (Array.isArray(v.cvss) && v.cvss[0] && v.cvss[0].metrics) {
-      cvss = v.cvss[0].metrics.baseScore;
-    } else if (typeof v.cvss === 'number') {
-      cvss = v.cvss;
-    }
-    out.push({ package: name, version, cve, severity, cvss });
-  }
-  return out;
-}
-
-function renderDepsSection(findings) {
-  if (!findings.length) return '_(nenhuma dep vulnerável encontrada)_';
-  return findings.map(f => {
-    const cvss = f.cvss != null ? ` cvss=${f.cvss}` : '';
-    return `- **${f.package}@${f.version || '?'}** \`${f.cve}\` severity=${f.severity}${cvss}`;
-  }).join('\n');
-}
-
-// runOsv({ securityDir, scope, active, execFn?, detectFn?, manifestRoot?, reportFilename? })
-async function runOsv(opts = {}) {
-  const sec = opts.securityDir;
-  const scope = opts.scope;
-  const active = opts.active === true;
-  // The project to scan is the parent of `.wize/security/`. Scripts run with
-  // cwd = the kit, so default to the target repo, not process.cwd().
-  const manifestRoot = opts.manifestRoot
-    || (sec ? path.resolve(sec, '..', '..') : process.cwd());
-  const osvReportName = 'osv-report.json';
-  const grypeReportName = 'grype-report.json';
-
-  const execFn = opts.execFn || ((bin, args) => {
-    return execFileSync(bin, args, { encoding: 'utf8', timeout: 5 * 60 * 1000 });
-  });
-  const detectFn = opts.detectFn || require('../../../_shared/detect.js').detectTools;
-
-  const tools = detectFn(['osv-scanner', 'grype'], { cacheDir: sec });
-  const osvPresent = !!(tools['osv-scanner'] && tools['osv-scanner'].present);
-  const grypePresent = !!(tools.grype && tools.grype.present);
-
-  // No tools at all -> degraded.
-  if (!osvPresent && !grypePresent) {
-    mergeSast(sec, scope, active, tools, {
-      degraded: '- deps: osv-scanner e grype ausentes — instale um dos dois e re-rode.'
-    });
-    return { ok: true, partialStatus: 'incomplete', tool: null, findings: [] };
-  }
-
-  // Manifest detection: warn if the project root has no known manifest.
-  const manifests = detectManifests(manifestRoot);
-  if (manifests.length === 0) {
-    mergeSast(sec, scope, active, tools, {
-      degraded: `- deps: nenhum manifesto encontrado em ${manifestRoot} (procurando package.json, requirements.txt, go.mod, Cargo.toml, pyproject.toml, composer.json, Gemfile).`
-    });
-    return { ok: true, partialStatus: 'incomplete', tool: null, findings: [] };
-  }
-
-  // Pick tool. Prefer osv-scanner; fallback to grype.
-  let findings = [];
-  let tool = null;
-  if (osvPresent) {
-    tool = 'osv-scanner';
-    const reportPath = path.join(sec, osvReportName);
-    // osv-scanner v2 needs explicit lockfiles (`-L <path>`); recursive
-    // directory scan misses composer.lock/package-lock.json. We pass each
-    // detected lockfile we found. Non-zero exit = vulns found (success).
-    const LOCKFILES = ['composer.lock', 'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml',
-      'requirements.txt', 'Pipfile.lock', 'poetry.lock', 'go.sum', 'Cargo.lock', 'Gemfile.lock'];
-    const lockArgs = [];
-    for (const lf of LOCKFILES) {
-      if (fs.existsSync(path.join(manifestRoot, lf))) {
-        lockArgs.push('-L', path.join(manifestRoot, lf));
-      }
-    }
-    const args = lockArgs.length
-      ? filterArgs('osv-scanner', ['scan', 'source', ...lockArgs, '--format', 'json', '--output-file', reportPath])
-      : filterArgs('osv-scanner', ['scan', 'source', '-r', '--format', 'json', '--output-file', reportPath, manifestRoot]);
-    try {
-      execFn('osv-scanner', args, { timeout: 5 * 60 * 1000 });
-    } catch (_) { /* vulns found -> non-zero exit; report still written */ }
-    if (fs.existsSync(reportPath)) {
-      try { findings = parseOsvReport(JSON.parse(fs.readFileSync(reportPath, 'utf8'))); }
-      catch (_) { findings = []; }
-    }
-  } else if (grypePresent) {
-    tool = 'grype';
-    const reportPath = path.join(sec, grypeReportName);
-    const args = filterArgs('grype', ['dir:' + manifestRoot, '-o', 'json']);
-    execFn('grype', args, { timeout: 5 * 60 * 1000 });
-    if (fs.existsSync(reportPath)) {
-      try { findings = parseGrypeReport(JSON.parse(fs.readFileSync(reportPath, 'utf8'))); }
-      catch (_) { findings = []; }
-    }
-  }
-
-  mergeSast(sec, scope, active, tools, {
-    deps: renderDepsSection(findings)
-  });
-  return { ok: true, partialStatus: 'complete', tool, findings };
-}
-
-function mergeSast(sec, scope, active, tools, update) {
-  const existing = loadPartial({ securityDir: sec, phase: 'sast' });
-  const sections = {};
-  let mergedTools = Object.assign({}, tools);
-  if (existing) {
-    if (existing.body) {
-      const re = /## ([a-z_]+)\n\n([\s\S]*?)(?=\n## |$)/g;
-      let m;
-      while ((m = re.exec(existing.body)) !== null) {
-        sections[m[1]] = m[2].trim();
-      }
-    }
-    if (existing.frontmatter && existing.frontmatter.tools) {
-      mergedTools = Object.assign({}, existing.frontmatter.tools, tools);
-    }
-  }
-  if (update.degraded) {
-    sections.degraded_checks = sections.degraded_checks
-      ? sections.degraded_checks + '\n' + update.degraded
-      : update.degraded;
-  }
-  if (update.deps !== undefined) sections.deps = update.deps;
-  const status = sections.degraded_checks ? 'incomplete' : 'complete';
-  writePartial({
-    securityDir: sec,
-    phase: 'sast',
-    mode: active ? 'active' : 'passive',
-    scope,
-    status,
-    tools: mergedTools,
-    sections
-  });
-}
-
-module.exports = { runOsv, parseOsvReport, parseGrypeReport, detectManifests, MANIFEST_FILES };
-
-if (require.main === module) {
-  require('../../../_shared/cli-runner.js').runFromArgv({
-    fn: ({ securityDir, scopePath, active, manifestRoot, reportFilename } = {}) => {
-      const { loadScope } = require('../../../_shared/scope-gate.js');
-      const scope = loadScope(scopePath);
-      return runOsv({ securityDir, scope, active, manifestRoot, reportFilename });
-    },
-    argMap: { 'securityDir': 'securityDir', 'scope': 'scopePath', 'active': 'active', 'manifestRoot': 'manifestRoot', 'reportFilename': 'reportFilename' }
-  });
-}

package/src/security-overlay/skills/wize-sec-recon/scripts/run-recon.js

@@ -1,162 +0,0 @@
-'use strict';
-
-// run-recon.js — the nmap portion of the wize-sec-recon skill.
-// SAST (gitleaks, osv/grype) is implemented in E05 and lives in
-// scripts/run-sast.js (sibling). The orchestrator (wize-sec-pentest) and
-// any caller can invoke either script directly; this file only handles
-// recon.
-
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-
-const { assertTargetInScope, ScopeError } = require('../../../_shared/scope-gate.js');
-const { filterArgs } = require('../../../_shared/allowlist.js');
-const { writePartial } = require('../../../_shared/partial.js');
-
-// Default argument list for nmap. filterArgs() will drop anything not in
-// the tool-allowlist, so this list is intentionally explicit and minimal.
-function defaultArgs(active) {
-  const args = ['-Pn', '-T4'];
-  if (active) args.push('-sV');
-  else args.push('-sn'); // passive: ping scan only — no port scan, no service detection.
-  return args;
-}
-
-// Parse a greppable nmap stdout into a markdown list. We only care about
-// lines that look like `PORT/PROTO  SERVICE  VERSION`. Ports whose service
-// nmap could not fingerprint (`?`, unknown, tcpwrapped, or empty version)
-// are flagged for manual investigation — an unidentified open port is a
-// medium-priority unknown, not just inventory.
-function parseNmapGreppable(stdout) {
-  const lines = String(stdout || '').split('\n');
-  const out = [];
-  for (const line of lines) {
-    const m = line.match(/^(\d+\/[a-z]+)\s+(\S+)\s+(.*)$/);
-    if (!m) continue;
-    const port = m[1];
-    const service = m[2];
-    const version = m[3].trim();
-    const unidentified = /\?$/.test(service) || /^(unknown|tcpwrapped)$/i.test(service) || version === '';
-    if (unidentified) {
-      out.push(`- **${port}** \`${service}\` — ⚠️ serviço não identificado. **Investigar:** \`lsof -i :${port.split('/')[0]}\` · \`docker ps\` · \`ss -tulpn | grep ${port.split('/')[0]}\``);
-    } else {
-      out.push(`- **${port}** \`${service}\` — ${version}`);
-    }
-  }
-  return out.join('\n');
-}
-
-// runRecon({ securityDir, scope, target, active, execFn?, detectFn? }) ->
-//   { ok, partialStatus, mode }
-// dependencies are injectable for tests.
-async function runRecon(opts = {}) {
-  const sec = opts.securityDir;
-  const scope = opts.scope;
-  const target = opts.target;
-  const active = opts.active === true;
-
-  const execFn = opts.execFn || ((bin, args, opt) => {
-    return execFileSync(bin, args, { encoding: 'utf8', timeout: 60_000 });
-  });
-  const detectFn = opts.detectFn || require('../../../_shared/detect.js').detectTools;
-
-  // Gate — propagates ScopeError if scope is invalid.
-  const tools = detectFn(['nmap'], { cacheDir: sec });
-  const nmapTool = tools.nmap || { present: false };
-
-  // 1. nmap missing -> degraded partial, exit 0.
-  if (!nmapTool.present) {
-    writePartial({
-      securityDir: sec,
-      phase: 'recon',
-      mode: active ? 'active' : 'passive',
-      scope,
-      status: 'incomplete',
-      tools,
-      sections: {
-        degraded_checks: 'nmap ausente — instale nmap e re-rode a fase para resultados completos.'
-      }
-    });
-    return { ok: true, partialStatus: 'incomplete', mode: active ? 'active' : 'passive' };
-  }
-
-  // 2. target out of scope -> degraded partial, ok=false (gate refused).
-  const inScope = assertTargetInScope(scope, { host: target }, { refusalsDir: sec });
-  if (!inScope) {
-    writePartial({
-      securityDir: sec,
-      phase: 'recon',
-      mode: active ? 'active' : 'passive',
-      scope,
-      status: 'incomplete',
-      tools,
-      sections: {
-        degraded_checks: `target ${target} recusado pelo gate (host not in allowlist) — ver .wize/security/.refusals.log`
-      }
-    });
-    return { ok: false, partialStatus: 'incomplete', mode: active ? 'active' : 'passive' };
-  }
-
-  // 3. happy path: filterArgs + execFile.
-  const args = filterArgs('nmap', [...defaultArgs(active), target]);
-  const out = execFn('nmap', args, { timeout: 60_000 });
-  const portsText = parseNmapGreppable(out && out.stdout ? out.stdout : out);
-  const body = portsText || '_(nmap returned no parseable ports)_';
-
-  writePartial({
-    securityDir: sec,
-    phase: 'recon',
-    mode: active ? 'active' : 'passive',
-    scope,
-    status: 'complete',
-    tools,
-    sections: { open_ports: body }
-  });
-  return { ok: true, partialStatus: 'complete', mode: active ? 'active' : 'passive' };
-}
-
-// --- CLI entrypoint ------------------------------------------------------
-
-function parseArgv(argv) {
-  const out = { active: false, securityDir: null, scopePath: null, target: null };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--active') out.active = true;
-    else if (a === '--target' && argv[i + 1]) { out.target = argv[i + 1]; i++; }
-    else if (a.startsWith('--target=')) out.target = a.slice('--target='.length);
-    else if (a === '--scope' && argv[i + 1]) { out.scopePath = argv[i + 1]; i++; }
-    else if (a.startsWith('--scope=')) out.scopePath = a.slice('--scope='.length);
-    else if (a === '--securityDir' && argv[i + 1]) { out.securityDir = argv[i + 1]; i++; }
-    else if (a.startsWith('--securityDir=')) out.securityDir = a.slice('--securityDir='.length);
-  }
-  if (!out.securityDir) out.securityDir = path.join(process.cwd(), '.wize', 'security');
-  if (!out.scopePath) out.scopePath = path.join(process.cwd(), '.wize', 'security', 'scope.md');
-  if (!out.target) {
-    // Default to scope.md dast_target.url host if available.
-    out.target = 'localhost';
-  }
-  return out;
-}
-
-async function main() {
-  const args = parseArgv(process.argv.slice(2));
-  const { loadScope } = require('../../../_shared/scope-gate.js');
-  const scope = loadScope(args.scopePath);
-  const r = await runRecon({
-    securityDir: args.securityDir,
-    scope,
-    target: args.target,
-    active: args.active
-  });
-  console.log(`recon: partial_status=${r.partialStatus} mode=${r.mode}`);
-  process.exit(r.ok ? 0 : 1);
-}
-
-if (require.main === module) {
-  main().catch(err => {
-    console.error('✖ wize-sec-recon:', err && err.message ? err.message : err);
-    process.exit(2);
-  });
-}
-
-module.exports = { runRecon, defaultArgs, parseNmapGreppable };

package/src/security-overlay/skills/wize-sec-recon/skill.md

@@ -1,37 +0,0 @@
----
-
-code: wize-sec-recon
-description: "Use quando o scope de segurança estiver autorizado e precisar executar reconhecimento passivo (nmap) nos alvos."
-name: wize-sec-recon
-overlay: security
-module: security-overlay
-owner: wize-sec-red-teamer  # Natasha Romanoff
-status: ready
----
-
-# wize-sec-recon — Recon (nmap)
-
-Runs nmap against the targets in the `scope.md` allowlist and writes `recon.md`. **Default passive** (ping scan only); `--active` enables `-sV` service detection.
-
-## Usage
-
-```bash
-/wize-sec-recon
-/wize-sec-recon --active
-/wize-sec-recon --target=staging.example.internal
-```
-
-## Behavior
-
-- Loads `.wize/security/scope.md` first; aborts loudly on invalid scope (HASH_MISMATCH / MISSING_FIELDS).
-- Detects nmap via `command -v`. If absent, writes a `partial_status: incomplete` recon.md with a `degraded_checks` section and exits 0 — the pipeline continues.
-- Calls `assertTargetInScope` for the target. Out-of-scope targets produce an `incomplete` partial and a refusal entry in `.refusals.log`; nmap is **not** invoked.
-- Active vs passive flag set is recorded in the partial's `mode:` frontmatter.
-- The SAST portion of recon (gitleaks, osv/grype) is implemented in a sibling script `scripts/run-sast.js` and is invoked separately or by the orchestrator — see E05.
-
-## Output
-
-- `.wize/security/recon.md` — partial with `## open_ports` (or `## degraded_checks` on missing tool / out-of-scope target).
-- `.wize/security/.refusals.log` — appended on out-of-scope targets.
-
-Exits 0 on success or graceful degradation; 1 when the gate refused the target; 2 on scope error.