core-runtime 0.1.1__py3-none-any.whl

body/evaluators/security_evaluator.py

@@ -0,0 +1,393 @@
+# src/body/evaluators/security_evaluator.py
+
+"""
+SecurityEvaluator - Identifies security risks and vulnerabilities.
+
+Constitutional Alignment:
+- Phase: AUDIT (Quality assessment and pattern detection)
+- Authority: POLICY (Enforces data.security.no_raw_secrets and security rules)
+- Purpose: Evaluate security posture of code and operations
+- Boundary: Read-only analysis, no mutations
+
+This component EVALUATES security, does not FIX vulnerabilities.
+Remediation happens in subsequent phases based on evaluation results.
+
+Security Dimensions:
+1. **Secrets**: API keys, passwords, tokens in code
+2. **Injection**: SQL injection, command injection risks
+3. **Authentication**: Auth bypass, weak credentials
+4. **Authorization**: Permission checks, access control
+5. **Data**: Sensitive data exposure, encryption
+
+Usage:
+    evaluator = SecurityEvaluator()
+    result = await evaluator.execute(
+        file_path="src/services/user.py",
+        code_content=code
+    )
+
+    if not result.ok:
+        print(f"Security issues: {result.data['vulnerabilities']}")
+"""
+
+from __future__ import annotations
+
+import re
+import time
+from typing import Any, ClassVar
+
+from body.evaluators.base_evaluator import BaseEvaluator
+
+# from shared.component_primitive import Component, ComponentPhase, ComponentResult
+from shared.component_primitive import ComponentResult
+from shared.logger import getLogger
+
+
+logger = getLogger(__name__)
+
+
+# ID: 38cbc2dd-3201-428c-bd8a-9001d5236768
+class SecurityEvaluator(BaseEvaluator):
+    """
+    Evaluates security posture and identifies vulnerabilities.
+
+    Security Checks:
+    - secrets_exposure: Hardcoded API keys, passwords
+    - sql_injection: Unsafe SQL query construction
+    - command_injection: Unsafe shell command construction
+    - path_traversal: Directory traversal vulnerabilities
+    - insecure_deserialization: Pickle, eval() usage
+    - weak_crypto: MD5, SHA1, weak algorithms
+    - sensitive_data_logging: PII in logs
+
+    Severity Levels:
+    - critical: Immediate security risk (secrets exposure, SQL injection)
+    - high: Significant risk (command injection, weak crypto)
+    - medium: Potential risk (insecure patterns)
+    - low: Security concern (missing validations)
+
+    Output provides:
+    - Binary security status (ok: True/False)
+    - List of vulnerabilities with severity
+    - Security score (0.0-1.0)
+    - Risk assessment
+    - Remediation guidance
+    """
+
+    # Regex patterns for security checks
+    PATTERNS: ClassVar[dict[str, list[str]]] = {
+        "api_keys": [
+            r"(sk-[a-zA-Z0-9]{32,})",  # Generic API key
+            r"(AI[a-zA-Z0-9]{32,})",  # Anthropic/Ollama pattern
+            r"(ghp_[a-zA-Z0-9]{36})",  # GitHub token
+            r"(xox[baprs]-[a-zA-Z0-9-]{10,})",  # Slack token
+        ],
+        "passwords": [
+            r"PASSWORD\s*=\s*['\"][^'\"]+['\"]",
+            r"password\s*:\s*['\"][^'\"]+['\"]",
+            r"pwd\s*=\s*['\"][^'\"]+['\"]",
+        ],
+        "sql_unsafe": [
+            r"execute\([^)]*%[^)]*\)",  # String formatting in execute
+            r"execute\([^)]*\+[^)]*\)",  # String concatenation
+            r"execute\([^)]*f['\"]",  # F-string in execute
+        ],
+        "command_unsafe": [
+            r"os\.system\([^)]*\+",  # String concat in os.system
+            r"subprocess\.(run|call|Popen)\([^)]*\+",  # Unsafe subprocess
+            r"shell=True",  # Shell=True without validation
+        ],
+        "eval_usage": [
+            r"\beval\(",
+            r"\bexec\(",
+            r"pickle\.loads?\(",
+        ],
+        "weak_crypto": [
+            r"hashlib\.md5\(",
+            r"hashlib\.sha1\(",
+            r"random\.random\(",  # Weak random for security
+        ],
+    }
+
+    # ID: 486b01bb-c6e6-493f-a19a-bf0d7a0ed3d8
+    async def execute(
+        self,
+        file_path: str | None = None,
+        code_content: str | None = None,
+        check_scope: list[str] | None = None,
+        **kwargs: Any,
+    ) -> ComponentResult:
+        """
+        Evaluate security posture of code.
+
+        Args:
+            file_path: Path to file being evaluated
+            code_content: Code to analyze (if not reading from file)
+            check_scope: Specific checks to run (default: all)
+            **kwargs: Additional context
+
+        Returns:
+            ComponentResult with security assessment
+        """
+        start_time = time.time()
+
+        # Default to all checks
+        scope = check_scope or [
+            "secrets_exposure",
+            "sql_injection",
+            "command_injection",
+            "insecure_deserialization",
+            "weak_crypto",
+        ]
+
+        # Collect vulnerabilities
+        vulnerabilities = []
+
+        if code_content:
+            if "secrets_exposure" in scope:
+                vulnerabilities.extend(self._check_secrets(code_content, file_path))
+
+            if "sql_injection" in scope:
+                vulnerabilities.extend(
+                    self._check_sql_injection(code_content, file_path)
+                )
+
+            if "command_injection" in scope:
+                vulnerabilities.extend(
+                    self._check_command_injection(code_content, file_path)
+                )
+
+            if "insecure_deserialization" in scope:
+                vulnerabilities.extend(
+                    self._check_insecure_deserialization(code_content, file_path)
+                )
+
+            if "weak_crypto" in scope:
+                vulnerabilities.extend(self._check_weak_crypto(code_content, file_path))
+
+        # Calculate security score
+        security_score = self._calculate_score(vulnerabilities)
+
+        # Determine if security is acceptable
+        # Critical or High vulnerabilities = fail
+        blocking_vulns = [
+            v for v in vulnerabilities if v["severity"] in ["critical", "high"]
+        ]
+        ok = len(blocking_vulns) == 0
+
+        logger.info(
+            "SecurityEvaluator: %s (score: %.2f, %d vulnerabilities)",
+            "PASS" if ok else "FAIL",
+            security_score,
+            len(vulnerabilities),
+        )
+
+        return ComponentResult(
+            component_id=self.component_id,
+            ok=ok,
+            phase=self.phase,
+            data={
+                "vulnerabilities": vulnerabilities,
+                "security_score": security_score,
+                "risk_level": self._assess_risk(vulnerabilities),
+                "check_scope": scope,
+            },
+            confidence=security_score,
+            next_suggested="security_remediation" if vulnerabilities else None,
+            metadata={
+                "file_path": file_path,
+                "critical_count": len(
+                    [v for v in vulnerabilities if v["severity"] == "critical"]
+                ),
+                "high_count": len(
+                    [v for v in vulnerabilities if v["severity"] == "high"]
+                ),
+                "medium_count": len(
+                    [v for v in vulnerabilities if v["severity"] == "medium"]
+                ),
+            },
+            duration_sec=time.time() - start_time,
+        )
+
+    # ID: 33fc128d-2634-4561-8930-3459a8d757cc
+    def _check_secrets(self, code: str, file_path: str | None) -> list[dict[str, Any]]:
+        """Check for hardcoded secrets (API keys, passwords)."""
+        vulnerabilities = []
+
+        # Check API keys
+        for pattern in self.PATTERNS["api_keys"]:
+            matches = re.finditer(pattern, code)
+            for match in matches:
+                vulnerabilities.append(
+                    {
+                        "type": "secrets_exposure",
+                        "severity": "critical",
+                        "message": "Hardcoded API key detected",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "matched_text": match.group(0)[:10] + "...",  # Redact
+                        "remediation": "Store secrets in database using SecretsService",
+                    }
+                )
+
+        # Check passwords
+        for pattern in self.PATTERNS["passwords"]:
+            matches = re.finditer(pattern, code, re.IGNORECASE)
+            for match in matches:
+                vulnerabilities.append(
+                    {
+                        "type": "secrets_exposure",
+                        "severity": "critical",
+                        "message": "Hardcoded password detected",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "remediation": "Use SecretService.get_secret() for password retrieval",
+                    }
+                )
+
+        return vulnerabilities
+
+    # ID: 6dcecf50-1498-4274-87c5-a804d273fe1b
+    def _check_sql_injection(
+        self, code: str, file_path: str | None
+    ) -> list[dict[str, Any]]:
+        """Check for SQL injection vulnerabilities."""
+        vulnerabilities = []
+
+        for pattern in self.PATTERNS["sql_unsafe"]:
+            matches = re.finditer(pattern, code)
+            for match in matches:
+                vulnerabilities.append(
+                    {
+                        "type": "sql_injection",
+                        "severity": "critical",
+                        "message": "Potential SQL injection vulnerability",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "code_snippet": match.group(0),
+                        "remediation": "Use parameterized queries with text() binding or ORM methods",
+                    }
+                )
+
+        return vulnerabilities
+
+    # ID: 78cc9f10-458f-4b1b-935e-4d273b1ffbb5
+    def _check_command_injection(
+        self, code: str, file_path: str | None
+    ) -> list[dict[str, Any]]:
+        """Check for command injection vulnerabilities."""
+        vulnerabilities = []
+
+        for pattern in self.PATTERNS["command_unsafe"]:
+            matches = re.finditer(pattern, code)
+            for match in matches:
+                severity = "critical" if "shell=True" in match.group(0) else "high"
+                vulnerabilities.append(
+                    {
+                        "type": "command_injection",
+                        "severity": severity,
+                        "message": "Potential command injection vulnerability",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "code_snippet": match.group(0),
+                        "remediation": "Use list arguments instead of string concatenation; avoid shell=True",
+                    }
+                )
+
+        return vulnerabilities
+
+    # ID: 5c43ccb9-1e8b-4c61-b74b-fb92395896f8
+    def _check_insecure_deserialization(
+        self, code: str, file_path: str | None
+    ) -> list[dict[str, Any]]:
+        """Check for insecure deserialization (eval, exec, pickle)."""
+        vulnerabilities = []
+
+        for pattern in self.PATTERNS["eval_usage"]:
+            matches = re.finditer(pattern, code)
+            for match in matches:
+                func_name = match.group(0).split("(")[0]
+                vulnerabilities.append(
+                    {
+                        "type": "insecure_deserialization",
+                        "severity": "high",
+                        "message": f"Unsafe deserialization using {func_name}",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "code_snippet": match.group(0),
+                        "remediation": f"Avoid {func_name}; use safe alternatives like ast.literal_eval or json",
+                    }
+                )
+
+        return vulnerabilities
+
+    # ID: 23ef335e-2536-46b4-9bdd-44b3bb300180
+    def _check_weak_crypto(
+        self, code: str, file_path: str | None
+    ) -> list[dict[str, Any]]:
+        """Check for weak cryptographic algorithms."""
+        vulnerabilities = []
+
+        for pattern in self.PATTERNS["weak_crypto"]:
+            matches = re.finditer(pattern, code)
+            for match in matches:
+                algo = match.group(0)
+                vulnerabilities.append(
+                    {
+                        "type": "weak_crypto",
+                        "severity": "high",  # Weak crypto is a real security issue
+                        "message": f"Weak cryptographic algorithm: {algo}",
+                        "file_path": file_path,
+                        "pattern": pattern,
+                        "code_snippet": match.group(0),
+                        "remediation": "Use SHA256 or better; use secrets.token_bytes() for random",
+                    }
+                )
+
+        return vulnerabilities
+
+    # ID: ad6da84d-5870-4c55-ae35-5c18f895587d
+    def _calculate_score(self, vulnerabilities: list[dict[str, Any]]) -> float:
+        """
+        Calculate security score (0.0-1.0).
+
+        Score decreases based on vulnerability severity:
+        - critical: -0.4 per vuln
+        - high: -0.2 per vuln
+        - medium: -0.1 per vuln
+        - low: -0.05 per vuln
+        """
+        score = 1.0
+
+        severity_penalties = {
+            "critical": 0.4,
+            "high": 0.2,
+            "medium": 0.1,
+            "low": 0.05,
+        }
+
+        for vuln in vulnerabilities:
+            penalty = severity_penalties.get(vuln["severity"], 0.1)
+            score -= penalty
+
+        return max(0.0, round(score, 2))
+
+    # ID: e0a92afc-1159-479c-a204-6324a0197a91
+    def _assess_risk(self, vulnerabilities: list[dict[str, Any]]) -> str:
+        """
+        Assess overall risk level.
+
+        Returns: "critical" | "high" | "medium" | "low" | "none"
+        """
+        if not vulnerabilities:
+            return "none"
+
+        severities = [v["severity"] for v in vulnerabilities]
+
+        if "critical" in severities:
+            return "critical"
+        if "high" in severities:
+            return "high"
+        if "medium" in severities:
+            return "medium"
+        return "low"

body/flows/__init__.py

@@ -0,0 +1,33 @@
+# src/body/flows/__init__.py
+"""
+Constitutional Flow layer — composition primitives between AtomicActions and Workers.
+
+Flows are declared in .intent/flows/*.yaml and loaded by FlowRegistry at
+first access. No Flow is hardcoded here.
+
+Constitutional alignment: CORE-Flow.md
+
+Hierarchy:
+    AtomicAction  — does exactly one thing
+          ↓ composes into
+    Flow          — named, ordered sequence of AtomicActions or Flows
+          ↓ invoked by
+    Worker        — constitutional officer that decides when and why
+"""
+
+from __future__ import annotations
+
+from body.flows.executor import FlowExecutor
+from body.flows.registry import FlowDefinition, FlowStep, StepKind, flow_registry
+from body.flows.result import FlowResult, StepResult
+
+
+__all__ = [
+    "FlowDefinition",
+    "FlowExecutor",
+    "FlowResult",
+    "FlowStep",
+    "StepKind",
+    "StepResult",
+    "flow_registry",
+]

body/flows/executor.py

@@ -0,0 +1,275 @@
+# src/body/flows/executor.py
+"""
+FlowExecutor — the Body-layer dispatcher for constitutional Flows.
+
+Mirrors ActionExecutor in structure and governance contract. Resolves
+a flow_id to its FlowDefinition, executes each step in declaration order
+via ActionExecutor (for AtomicAction steps) or recursively via
+FlowExecutor (for nested Flow steps), and returns a FlowResult.
+
+Constitutional alignment: CORE-Flow.md §6
+
+Key invariants enforced here:
+- write=False is propagated to every step without exception.
+- A required step failure halts execution immediately.
+- An optional step failure is recorded and execution continues.
+- FlowExecutor never posts to the Blackboard — that is Worker territory.
+- FlowExecutor never creates Proposals — that is Worker territory.
+"""
+
+from __future__ import annotations
+
+import time
+from typing import TYPE_CHECKING, Any
+
+from body.flows.registry import FlowStep, StepKind, flow_registry
+from body.flows.result import FlowResult, StepResult
+from shared.logger import getLogger
+
+
+if TYPE_CHECKING:
+    from shared.context import CoreContext
+
+
+logger = getLogger(__name__)
+
+
+# ID: ebd9a0de-3e90-4c97-af3a-49847598fda8
+class FlowExecutor:
+    """
+    Universal execution gateway for constitutional Flows.
+
+    Architecture:
+    - Resolves flow_id from FlowRegistry
+    - Dispatches AtomicAction steps via ActionExecutor
+    - Dispatches nested Flow steps recursively via FlowExecutor
+    - Propagates write=False to every step unconditionally
+    - Halts on required step failure; continues on optional step failure
+    - Returns FlowResult — never raises
+
+    Usage:
+        executor = FlowExecutor(core_context)
+        result = await executor.execute("flow.fix_code", write=True)
+    """
+
+    def __init__(self, core_context: CoreContext) -> None:
+        self._core_context = core_context
+        self._registry = flow_registry
+
+    # ID: 6896dd9d-063b-4c19-86e5-246b28738651
+    async def execute(
+        self,
+        flow_id: str,
+        write: bool = False,
+        **params: Any,
+    ) -> FlowResult:
+        """
+        Execute a Flow by flow_id.
+
+        Args:
+            flow_id: The registered flow_id to execute.
+            write:   Dry-run flag. Propagated to every step unchanged.
+                     write=False means no step may mutate state.
+            **params: Runtime parameters merged with each step's static
+                      params. Step static params are overridden by caller
+                      params of the same key.
+
+        Returns:
+            FlowResult — always. Never raises.
+        """
+        start = time.time()
+
+        # 1. Resolve flow from registry
+        definition = self._registry.get(flow_id)
+        if not definition:
+            logger.error("FlowExecutor: flow_id not found in registry: %s", flow_id)
+            return FlowResult(
+                flow_id=flow_id,
+                ok=False,
+                steps=[],
+                duration_sec=time.time() - start,
+            )
+
+        logger.info(
+            "FlowExecutor: executing flow '%s' (%d steps, write=%s)",
+            flow_id,
+            len(definition.steps),
+            write,
+        )
+
+        # 2. Execute steps in declaration order
+        step_results: list[StepResult] = []
+
+        for step in definition.steps:
+            step_result = await self._execute_step(
+                step, write=write, caller_params=params
+            )
+            step_results.append(step_result)
+
+            if not step_result.ok and step.required:
+                # Required step failed — halt and return immediately
+                logger.error(
+                    "FlowExecutor: required step '%s' failed in flow '%s' — halting",
+                    step.ref_id,
+                    flow_id,
+                )
+                return FlowResult(
+                    flow_id=flow_id,
+                    ok=False,
+                    steps=step_results,
+                    duration_sec=time.time() - start,
+                )
+
+            if not step_result.ok and not step.required:
+                logger.warning(
+                    "FlowExecutor: optional step '%s' failed in flow '%s' — continuing",
+                    step.ref_id,
+                    flow_id,
+                )
+
+        duration = time.time() - start
+        all_required_passed = all(s.ok for s in step_results if s.required)
+
+        logger.info(
+            "FlowExecutor: flow '%s' complete in %.2fs — ok=%s",
+            flow_id,
+            duration,
+            all_required_passed,
+        )
+
+        return FlowResult(
+            flow_id=flow_id,
+            ok=all_required_passed,
+            steps=step_results,
+            duration_sec=duration,
+        )
+
+    # ID: 5ead0cc7-b5bc-4c9c-8d23-242ebf238e24
+    async def _execute_step(
+        self,
+        step: FlowStep,
+        write: bool,
+        caller_params: dict[str, Any],
+    ) -> StepResult:
+        """
+        Execute a single step — dispatches to ActionExecutor or
+        recursively to FlowExecutor depending on step.kind.
+
+        write=False is enforced unconditionally — a step cannot
+        escalate to write mode even if its static params request it.
+        """
+        # Merge params: static step params first, then caller params.
+        # step.consumes governs caller-param forwarding. None means "forward
+        # all caller params" (the safe default — silent swallow is a worse
+        # failure mode than an unexpected-kwarg TypeError in a governed
+        # system; see issue #445). A tuple restricts forwarding to those
+        # keys (explicit allowlist). An empty tuple drops everything
+        # explicitly. Static params always pass through. Caller-supplied
+        # keys override static params on conflict.
+        if step.consumes is None:
+            filtered_caller: dict[str, Any] = dict(caller_params)
+        else:
+            filtered_caller = {
+                k: v for k, v in caller_params.items() if k in step.consumes
+            }
+        merged_params = {**step.params, **filtered_caller}
+
+        step_start = time.time()
+
+        if step.kind == StepKind.ACTION:
+            return await self._execute_action_step(
+                step, write, merged_params, step_start
+            )
+        elif step.kind == StepKind.FLOW:
+            return await self._execute_flow_step(step, write, merged_params, step_start)
+        else:
+            # Defensive — StepKind is an enum, this should never fire
+            logger.error(
+                "FlowExecutor: unknown step kind '%s' for step '%s'",
+                step.kind,
+                step.ref_id,
+            )
+            return StepResult(
+                ref_id=step.ref_id,
+                required=step.required,
+                ok=False,
+                data={"error": f"Unknown step kind: {step.kind}"},
+                duration_sec=time.time() - step_start,
+                kind=str(step.kind),
+            )
+
+    # ID: cb8eea14-5b0e-4d2b-bcb6-ebd45ab9d14f
+    async def _execute_action_step(
+        self,
+        step: FlowStep,
+        write: bool,
+        params: dict[str, Any],
+        step_start: float,
+    ) -> StepResult:
+        """Dispatch an AtomicAction step via ActionExecutor."""
+        from body.atomic.executor import ActionExecutor
+
+        executor = ActionExecutor(self._core_context)
+
+        try:
+            action_result = await executor.execute(step.ref_id, write=write, **params)
+            return StepResult(
+                ref_id=step.ref_id,
+                required=step.required,
+                ok=action_result.ok,
+                data=action_result.data
+                if isinstance(action_result.data, dict)
+                else {"result": str(action_result.data)},
+                duration_sec=action_result.duration_sec,
+                kind="action",
+            )
+        except Exception as exc:
+            logger.error(
+                "FlowExecutor: action step '%s' raised: %s",
+                step.ref_id,
+                exc,
+                exc_info=True,
+            )
+            return StepResult(
+                ref_id=step.ref_id,
+                required=step.required,
+                ok=False,
+                data={"error": str(exc)},
+                duration_sec=time.time() - step_start,
+                kind="action",
+            )
+
+    # ID: 28e9c338-d7ad-49a5-95de-e91edb324989
+    async def _execute_flow_step(
+        self,
+        step: FlowStep,
+        write: bool,
+        params: dict[str, Any],
+        step_start: float,
+    ) -> StepResult:
+        """Dispatch a nested Flow step recursively via FlowExecutor."""
+        try:
+            nested_result = await self.execute(step.ref_id, write=write, **params)
+            return StepResult(
+                ref_id=step.ref_id,
+                required=step.required,
+                ok=nested_result.ok,
+                data=nested_result.data,
+                duration_sec=nested_result.duration_sec,
+                kind="flow",
+            )
+        except Exception as exc:
+            logger.error(
+                "FlowExecutor: nested flow step '%s' raised: %s",
+                step.ref_id,
+                exc,
+                exc_info=True,
+            )
+            return StepResult(
+                ref_id=step.ref_id,
+                required=step.required,
+                ok=False,
+                data={"error": str(exc)},
+                duration_sec=time.time() - step_start,
+                kind="flow",
+            )