gitgalaxy 1.1.1__tar.gz → 1.1.2__tar.gz

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 1.1.1
+Version: 1.1.2
 Summary: A high-speed static analysis engine that sequences source code like DNA to map architectural risk and security threats.
 Author: Joe Esquibel
 License: PolyForm Noncommercial License 1.0.0

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/gitgalaxy/galaxyscope.py

@@ -90,6 +90,12 @@ def _init_worker(root_str: str, config: Dict[str, Any], ext_tally: Dict[str, int
         if lang_id not in splicer_cache:
             splicer_cache[lang_id] = LogicSplicer(lang_id, lang_defs, parent_logger=worker_logger)
 
+    # --- NEW: Decide the Rules of Engagement before booting the engines ---
+    if os.environ.get("GITGALAXY_DATA_DIR"):
+        active_policy = scanning_config.ThreatPolicy.get_policy("paranoid")
+    else:
+        active_policy = scanning_config.ThreatPolicy.get_policy("baseline")
+
     _worker_state.update({
         'root': root,
         'config': config,
@@ -103,7 +109,13 @@ def _init_worker(root_str: str, config: Dict[str, Any], ext_tally: Dict[str, int
         'detector': LanguageDetector(lang_defs, comm_defs),
         'prism': Prism(comm_defs, lang_defs, parent_logger=worker_logger),
         'splicer_cache': splicer_cache,
-        'word_tokenizer': re.compile(r'\b\w+\b') 
+        'word_tokenizer': re.compile(r'\b\w+\b'),
+        
+        # --- NEW: Boot the physics engines into worker memory ---
+        'chronometer': Chronometer(root, parent_logger=worker_logger),
+        'signal': SignalProcessor(aperture_config=config, parent_logger=worker_logger),
+        'security': SecurityLens(policy=active_policy)
+        # --------------------------------------------------------
     })
     
     _worker_state['guidestar'].align_telescope()
@@ -153,6 +165,12 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
     splicer_cache = _worker_state['splicer_cache']
     tokenizer = _worker_state['word_tokenizer']
     
+    # --- NEW: Extract the physics engines from worker memory ---
+    chronometer = _worker_state['chronometer']
+    signal = _worker_state['signal']
+    security = _worker_state['security']
+    # -----------------------------------------------------------
+    
     has_prior, intent_vector = guidestar.get_intent_status(full_path_str)
     observation = {"rel_path": rel_path, "status": "filtered", "reason": "Aperture block", "data": {}}
 
@@ -312,6 +330,16 @@ class Orchestrator:
         self.audit_recorder = AuditRecorder(parent_logger=logger)
         self.llm_recorder = LLMRecorder(parent_logger=logger)
         
+        # --- NEW: THE SMART THREAT SWITCH (MAIN THREAD) ---
+        if os.environ.get("GITGALAXY_DATA_DIR"):
+            logger.info("☣️ HAZMAT SANDBOX DETECTED: Engaging PARANOID threat thresholds.")
+            active_policy = scanning_config.ThreatPolicy.get_policy("paranoid")
+        else:
+            active_policy = scanning_config.ThreatPolicy.get_policy("baseline")
+
+        self.security_analyzer = SecurityLens(policy=active_policy)
+        # --------------------------------------------------
+        
         # State Arrays
         self.census: Set[str] = set()
         self.stem_map: Dict[str, str] = {}
@@ -731,6 +759,25 @@ class Orchestrator:
         """Pass 2: Universal Exposure Framework & Signal Processing."""
         logger.info("PASS_2: Calculating structural physics and Tiered Normalization.")
         
+        # ==============================================================
+        # NEW: CALCULATE FOLDER CONTEXTS (For Domain Ontologies)
+        # Tally the languages in every folder to find the dominant ecosystem
+        # ==============================================================
+        folder_tallies = {}
+        for rel_path, meta in self.cryolink.items():
+            folder = str(Path(rel_path).parent)
+            lang = meta.get("lang_id", "unknown")
+            
+            if folder not in folder_tallies:
+                folder_tallies[folder] = {}
+            folder_tallies[folder][lang] = folder_tallies[folder].get(lang, 0) + 1
+            
+        folder_dominant_langs = {}
+        for folder, tallies in folder_tallies.items():
+            if tallies:
+                # The language with the most files wins the neighborhood
+                folder_dominant_langs[folder] = max(tallies, key=tallies.get)
+                
         # --- NEW: CALCULATE THE GLOBAL TEST UMBRELLA ---
         total_loc = 0
         test_loc = 0
@@ -751,6 +798,15 @@ class Orchestrator:
 
         for rel_path, meta in self.cryolink.items():
             
+            # ---> NEW: INJECT THE FOLDER CONTEXT FOR THE SIGNAL PROCESSOR <---
+            folder = str(Path(rel_path).parent)
+            if "metadata" not in meta:
+                meta["metadata"] = {}
+                
+            # Grab the winning language for this folder (defaulting to the file's own language)
+            meta["metadata"]["folder_dominant_lang"] = folder_dominant_langs.get(folder, meta.get("lang_id", "unknown"))
+            # -----------------------------------------------------------------
+            
             meta["temporal_telemetry"] = self.chronometer.get_temporal_signals(rel_path)
             meta["authors"] = meta["temporal_telemetry"].get("authors", {})
             stem = Path(rel_path).stem.lower()
@@ -1079,15 +1135,20 @@ def main():
                         merged_langs[lang]['rules'].update(rules_patch)
                         logging.debug(f"   -> Patched '{lang}' geometry rules.")
 
-        # =========================================================
-        # --- NEW: SECURITY LENS INTEGRATION ---
-        # =========================================================
-        logging.info("🛡️ SECURITY LENS ACTIVE: Passively monitoring for Threat Signatures.")
-        lens = SecurityLens(parent_logger=logging.getLogger())
-        
-        # Unconditionally inject the 'sec_' prefixed observers into the registry
-        merged_langs = lens.arm_lens(merged_langs)
-        # =========================================================
+        # --- THE SMART THREAT SWITCH ---
+        # If the engine detects the Docker airlock environment variable, it goes into full lockdown.
+        if os.environ.get("GITGALAXY_DATA_DIR"):
+            # We are in the sandbox. Engage Paranoid Mode.
+            active_policy = scanning_config.ThreatPolicy.get_policy("paranoid")
+            # Optional: Print a cool warning so you know it worked in the logs
+            logging.getLogger("GalaxyScope").info("☣️ HAZMAT SANDBOX DETECTED: Engaging PARANOID threat thresholds.")
+        else:
+            # Normal developer scan. Engage Baseline Mode.
+            active_policy = scanning_config.ThreatPolicy.get_policy("baseline")
+
+        # Boot the lens with the chosen policy
+        security_lens = SecurityLens(policy=active_policy)
+        # -------------------------------
         
         # ---------------------------------------------------------
         # 3. Assemble the Final Configuration

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/gitgalaxy/gitgalaxy_standards_v1.py

@@ -21,6 +21,36 @@ Contains:
 
 """
 
+class ThreatPolicy:
+    """Defines the threshold at which a structural anomaly becomes a critical threat."""
+    
+    PROFILES = {
+        # The Baseline: For standard, internal development where some low-level logic is expected.
+        "baseline": {
+            "secrets_risk_threshold": 0.001,      # 0.1% density
+            "hidden_malware_threshold": 0.60,     # 60% density
+            "logic_bomb_threshold": 0.50,         # 50% density
+            "injection_surface_threshold": 0.65,  # 65% density
+            "memory_corruption_threshold": 0.60   # 60% density
+        },
+        
+        # The Hazmat Suit: For scanning unknown PyPI/npm packages in a quarantine sandbox.
+        "paranoid": {
+            "secrets_risk_threshold": 0.0001,     # Any trace is critical
+            "hidden_malware_threshold": 0.15,     # 15% density trips the wire
+            "logic_bomb_threshold": 0.20,         # 20% density
+            "injection_surface_threshold": 0.25,  # 25% density
+            "memory_corruption_threshold": 0.10   # 10% density
+        }
+    }
+
+    @staticmethod
+    def get_policy(mode="baseline"):
+        """Returns the specific threat thresholds based on the deployment mode."""
+        return ThreatPolicy.PROFILES.get(mode, ThreatPolicy.PROFILES["baseline"])
+
+#
+
 
 # ------------------------------------------------------------------------------
 # 1. OPTICAL LAYER (Consumed by aperture.py & guidestar_lens.py)
@@ -10402,6 +10432,50 @@ RISK_EQUATION_TUNING = {
     }
 }
 
+# ------------------------------------------------------------------------------
+# 4.6 LANGUAGE SECURITY PROFILES (The Context vs. Entity Matrix)
+# Defines domain ontologies to cure the "Apollo Paradox" and detect Trojan Horses.
+# ------------------------------------------------------------------------------
+LANGUAGE_SECURITY_PROFILES = {
+    "ECOSYSTEMS": {
+        # Bare metal, embedded, and legacy mainframe. Pointer math and direct OS hooks are native.
+        "systems": {
+            "c", "cpp", "rust", "assembly", "agc_assembly", "zig", "cobol", 
+            "fortran", "micropython", "objective-c"
+        },
+        # High DOM flux, UI components, and massive string manipulation. Highly vulnerable to XSS.
+        "web": {
+            "javascript", "typescript", "html", "css", "php", "ruby", 
+            "dart", "livecode"
+        },
+        # Deployment, orchestration, and scripting. OS execution is the literal purpose.
+        "infra": {
+            "shell", "powershell", "dockerfile", "yaml", "makefile", "m4", 
+            "xml", "json", "toml", "sqlite", "csv", "plaintext"
+        },
+        # Data processing, APIs, and strict-typed object orientation. 
+        "backend": {
+            "python", "java", "go", "csharp", "kotlin", "scala", "scheme", 
+            "tcl", "matlab", "perl", "haskell", "lua", "apex", "swift"
+        }
+    },
+    
+    # Baseline multipliers applied when the file MATCHES its neighborhood's dominant ecosystem
+    "NATIVE_WEIGHTS": {
+        "systems": {"memory": 0.1, "logic_bomb": 0.2, "flux": 1.0, "injection": 1.0}, # Pointer math is normal
+        "web":     {"memory": 1.0, "logic_bomb": 1.0, "flux": 0.3, "injection": 2.0}, # DOM flux is normal, XSS is deadly
+        "infra":   {"memory": 1.0, "logic_bomb": 0.0, "flux": 1.0, "injection": 1.0}, # OS commands are literally the point
+        "backend": {"memory": 1.5, "logic_bomb": 1.0, "flux": 1.5, "injection": 1.5}  # Standard aggressive baseline
+    },
+    
+    # Aggressive penalties applied when the file is an ALIEN in its neighborhood
+    "ALIEN_WEIGHTS": {
+        "systems_in_web": {"memory": 5.0, "logic_bomb": 3.0}, # C code hiding in a JS app = Trojan
+        "infra_in_web":   {"logic_bomb": 4.0},                # Shell script hiding in a JS app = Backdoor
+        "web_in_systems": {"flux": 3.0}                       # JS embedded in C firmware = Bizarre architecture
+    }
+}
+
 # ------------------------------------------------------------------------------
 # 5. SCHEMA & EXPORT REGISTRY (Consumed by recorders & SQLite)
 # ------------------------------------------------------------------------------

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/gitgalaxy/llm_recorder.py

@@ -200,7 +200,7 @@ class LLMRecorder:
         lines.append("> Most scores use a Sigmoid curve based on density (Hits / LOC) to prevent massive files from mathematically hiding their flaws.")
         lines.append("> ")
         lines.append("> 1. **Cognitive Load Exposure:** Measures the mental effort required for a developer to read and understand the file. `Density(Branches + (Flux * 2) + Async/Danger)` mitigated by `Doc Coverage`. High scores indicate a high density of decision-making, conditional branching, and complex state management packed into a small area.")
-        lines.append("> 2. **Safety Risk Exposure:** Measures structural integrity and resilience against runtime errors. `Net Exposure = (Danger + Safety_Neg + Flux) - (Safety + Tests + Docs)`. High scores mean risky operations (dynamic execution, type bypasses, unhandled mutations) exceed defensive guardrails (try/catch blocks, type checks, assertions). **Breach Cap:** If danger density is too high, the score is mathematically floored to a high-risk state regardless of defense.")
+        lines.append("> 2. **Safety Risk Exposure:** Measures structural integrity and resilience against runtime errors. `Net Exposure = (Danger + Safety_Neg + Flux) - (Safety + Tests + Docs)`. High scores mean risky operations (dynamic execution, type bypasses, unhandled mutations) exceed defensive guardrails (try/catch blocks, type checks, assertions). **Breach Cap:** If danger density is too high, the score is mathematically floored to a high-risk state regardless of defense. A value of near 30 is near minimum floor as gitglaxay tests for testing file pairs, testing folders but not actually their contents.")
         lines.append("> 3. **Tech Debt Exposure:** Measures the density of developer-annotated structural stress. `Density(TODOs [1x] + FIXMEs/Hacks [3x] + Empty Stubs [0.5x])`. High scores indicate a high volume of temporary workarounds, fragile logic, and incomplete implementations relative to the file size.")
         lines.append("> 4. **Verification (Testing) Risk Exposure:** Measures the density of unit testing and programmatic assertions. Evaluates `Test Density` + `Sibling Bonus` (if a dedicated test file exists). High scores (100% risk) mean the logic lacks internal test coverage and has no dedicated sibling test file, increasing the risk of silent failures during refactoring. **Mass Penalty:** Files over 300 LOC get an automatic risk penalty because massive files are inherently harder to test completely.")
         lines.append("> 5. **API Risk Exposure:** Measures the public surface area of a module. `Ratio(API Hits / Total Functions & Classes)`. Weighted by logarithmic volume. High scores indicate that a large percentage of the file's functions and classes are explicitly exported or publicly accessible by external systems.")

gitgalaxy-1.1.2/gitgalaxy/security_lens.py

@@ -0,0 +1,174 @@
+import re
+
+class SecurityLens:
+    """
+    The GitGalaxy Physics Engine for Threat Detection.
+    Measures raw structural realities (Regex Hits) and compares them 
+    against dynamically injected Policy Thresholds.
+    """
+    
+    def __init__(self, policy=None):
+        # ------------------------------------------------------------------
+        # DYNAMIC POLICY INJECTION
+        # The lens no longer makes the rules. It receives its thresholds 
+        # from gitgalaxy_standards.ThreatPolicy. If none is provided, it 
+        # defaults to a safe baseline.
+        # ------------------------------------------------------------------
+        self.policy = policy or {
+            "secrets_risk_threshold": 0.001,
+            "hidden_malware_threshold": 0.60,
+            "logic_bomb_threshold": 0.50,
+            "injection_surface_threshold": 0.65,
+            "memory_corruption_threshold": 0.60
+        }
+
+        # ------------------------------------------------------------------
+        # RAW SENSORS (The Physics Engine)
+        # These remain untouched. They strictly measure structural reality.
+        # ------------------------------------------------------------------
+        self.THREAT_SIGNATURES = {
+            # 1. THE GLASSWORM (Obfuscation & Heat Signatures)
+            "heat_triggers": re.compile(
+                r'\b(?:atob|btoa|base64_decode|base64_encode|gzuncompress|str_rot13)\b|'
+                r'\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|'
+                r'(?:\w{15,}[ \t]*=[ \t]*["\'][A-Za-z0-9+/]{40,}={0,2}["\'])|'
+                r'[\u200B-\u200D\uFEFF\u200E\u200F\u202A-\u202E]', # Invisible Unicode
+                re.I
+            ),
+
+            # 2. THE TROJAN (Identity Masking & Safety Bypasses)
+            "safety_neg": re.compile(
+                r'\b(?:atob|btoa|base64_decode|gzinflate|gzuncompress|str_rot13|urldecode)[ \t]*\([ \t]*(?:atob|btoa|base64_decode|gzinflate|gzuncompress|str_rot13|urldecode)\b|'
+                r'\b(?:auto_prepend_file|auto_append_file)\b|'
+                r'\b(?:ini_set|ini_restore|putenv)[ \t]*\([ \t]*["\'](?:disable_functions|safe_mode|open_basedir|allow_url_fopen)["\'][ \t]*,[ \t]*["\']?(?:0|off|false|)["\']?\)|'
+                r'\b(?:disable_functions|safe_mode|open_basedir)\b[ \t]*=[ \t]*(?:off|0|false|""|\'\')|'
+                r'process\.env\.NODE_TLS_REJECT_UNAUTHORIZED[ \t]*=[ \t]*["\']?0["\']?|'
+                r'\b(?:verify|strictSSL|rejectUnauthorized|CURLOPT_SSL_VERIFYPEER)[ \t]*[=:,][ \t]*(?:False|false|0)\b',
+                re.I
+            ),
+
+            # 3. EXFILTRATION VECTORS (System Gravity)
+            "io": re.compile(
+                r'\b(?:fetch|XMLHttpRequest|WebSocket|http\.request|https\.request|requests\.(?:post|put|get)|urllib\.request\.urlopen)\b\s*\(|'
+                r'\b(?:curl_exec|fsockopen|pfsockopen|stream_socket_client|file_get_contents)\b\s*\(|'
+                r'\b(?:dns_get_record|gethostbyname|socket\.gethostbyname|resolve(?:4|6|Cname|Txt)?)\b\s*\(|'
+                r'(?:https?|ftp|tcp|udp|wss?):\/\/(?:(?:\d{1,3}\.){3}\d{1,3}|\[[0-9a-fA-F:]+\]|.*?\.(?:ngrok\.io|ngrok-free\.app|localtunnel\.me|pastebin\.com|workers\.dev|s3\.amazonaws\.com|requestbin\.net|pipedream\.net))',
+                re.I | re.X
+            ),
+
+            # 4. THE EXECUTIONER (Dynamic Payloads)
+            "danger": re.compile(
+                r'\b(?:eval|Function|setTimeout|setInterval)\b\s*\(\s*(?:atob|base64|["\']|`)|'
+                r'\b(?:document\.write|location\.replace|assert|create_function|passthru|shell_exec|system)\b|'
+                r'child_process\.(?:exec|spawn|fork)|'
+                r'(?:window|global|this|globalThis)\[[ \t]*(?:["\'][a-zA-Z]["\'][ \t]*\+[ \t]*){1,15}["\'][a-zA-Z]["\'][ \t]*\][ \t]*\(|'
+                r'\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*\(\s*\$_(?:POST|GET|COOKIE|REQUEST|HEADERS)|'
+                r'getattr\s*\(\s*__import__\s*\(|__builtins__\[|Assembly\.Load\s*\(',
+                re.I | re.X
+            ),
+
+            # 5. ENVIRONMENT POISONING (State Flux)
+            "flux": re.compile(
+                r'\b[A-Za-z0-9_]+\.prototype\.[A-Za-z0-9_]+[ \t]*=|'
+                r'\.__proto__[ \t]*=[ \t]*[{a-zA-Z]|'
+                r'\b(?:window|global|globalThis|document)\.(?:fetch|eval|setTimeout|setInterval|Promise|console|JSON)[ \t]*=|'
+                r'\$(?:GLOBALS|_(?:SERVER|GET|POST|COOKIE|REQUEST|ENV|SESSION))\[[^\]]+\][ \t]*=[ \t]*[^=]|'
+                r'\bextract[ \t]*\([ \t]*\$(?:_(?:GET|POST|REQUEST|COOKIE)|GLOBALS)\b|'
+                r'\b__builtins__\[[^\]]+\][ \t]*=|'
+                r'\bsys\.modules\[[^\]]+\][ \t]*=',
+                re.I
+            ),
+
+            # 6. SHADOW LOGIC (Necrosis / Graveyard)
+            "graveyard": re.compile(
+                r'(?://|#|--)[^\n]*?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp)\b|'
+                r'/\*(?:(?!\*/).){0,500}?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp)\b',
+                re.I
+            ),
+            
+            # 7. SUB-ATOMIC DECRYPTION (Bitwise Hits)
+            "bitwise_hits": re.compile(
+                r'\b\w+[ \t]*=[ \t]*(?:\w+[ \t]*\^[ \t]*\w+[ \t]*){2,20}|'
+                r'(?:\w+\[[^\]\n]{1,50}\][ \t]*\^[ \t]*=?[ \t]*(?:0x[0-9a-fA-F]+|\d+|\w+)[ \t]*;[ \t]*){3,20}', 
+                re.I
+            ),
+            
+            # 8. SHADOW IMPORTS (The Switcharoo / Steganography)
+            "shadow_imports": re.compile(
+                r'\b(?:require|include|import|require_once|include_once|source|load|dofile)\b\s*\(?\s*'
+                r'["\'][^"\']+\.(?:png|jpg|jpeg|gif|ico|pdf|zip|tar|dat|tmp|log|txt|csv|wav|mp3)["\']',
+                re.I
+            ),
+            
+            # 9. UNICODE SMUGGLING (Homoglyphs & Typosquatting)
+            "homoglyphs": re.compile(
+                r'\b(?:import|from|require|include|require_once|fetch|XMLHttpRequest)\b'
+                r'[^\n]*?(?:[\u0400-\u04FF]|'       
+                r'[\u0370-\u03FF]|'                 
+                r'[\u1D400-\u1D7FF]|'               
+                r'\u3164)',                         
+                re.I
+            ), 
+            
+            # 10. THE VAULT DOOR (Credential & Secret Leaks)
+            "private_info": re.compile(
+                r"\b(password|secret|token|api[_-]?key|client[_-]?secret|credentials|private[_-]?key|auth[_-]?token)\b[ \t]*(?:[:=]|=>)[ \t]*[\"'][A-Za-z0-9\-_+/=]{16,}[\"']",
+                re.I
+            ),
+            
+            # 11. RAW MEMORY OVERRIDES (From previous context)
+            "memory_corruption": re.compile(
+                r'\b(?:malloc|calloc|realloc|free|memcpy|memset|memmove|strcpy|strcat|sprintf)\b\s*\(|'
+                r'\b(?:asm|__asm__|__asm)\b\s*[\(\{]',
+                re.I
+            )
+        }
+
+    def scan_content(self, file_content, total_loc):
+        """
+        Scans raw text and returns the raw hits for the engine to aggregate.
+        """
+        hits = {key: len(pattern.findall(file_content)) for key, pattern in self.THREAT_SIGNATURES.items()}
+        return hits
+
+    def evaluate_risk(self, aggregated_hits, total_loc):
+        """
+        Takes the raw physics hits, calculates the density, and checks 
+        if it breaches the dynamically injected policy thresholds.
+        """
+        # Prevent division by zero
+        loc_safe = total_loc if total_loc > 0 else 1
+        
+        exposures = {}
+        
+        # 1. Hidden Malware Risk (Combines heat, bitwise math, and shadow imports)
+        malware_hits = aggregated_hits.get("heat_triggers", 0) + aggregated_hits.get("bitwise_hits", 0) + aggregated_hits.get("shadow_imports", 0) + aggregated_hits.get("homoglyphs", 0)
+        malware_density = malware_hits / loc_safe
+        if malware_density >= self.policy["hidden_malware_threshold"]:
+            exposures["Hidden Malware Risk"] = malware_density
+
+        # 2. Logic Bomb / Sabotage Risk
+        sabotage_hits = aggregated_hits.get("graveyard", 0) + (aggregated_hits.get("danger", 0) * 1.5)
+        sabotage_density = sabotage_hits / loc_safe
+        if sabotage_density >= self.policy["logic_bomb_threshold"]:
+            exposures["Logic Bomb Risk"] = sabotage_density
+
+        # 3. Data Injection Risk
+        injection_hits = aggregated_hits.get("io", 0) + aggregated_hits.get("danger", 0) + aggregated_hits.get("flux", 0)
+        injection_density = injection_hits / loc_safe
+        if injection_density >= self.policy["injection_surface_threshold"]:
+            exposures["Data Injection Risk"] = injection_density
+
+        # 4. Memory Corruption Risk
+        memory_hits = aggregated_hits.get("memory_corruption", 0)
+        memory_density = memory_hits / loc_safe
+        if memory_density >= self.policy["memory_corruption_threshold"]:
+            exposures["Memory Corruption Risk"] = memory_density
+
+        # 5. Secrets Risk (Highly sensitive)
+        secrets_hits = aggregated_hits.get("private_info", 0)
+        secrets_density = secrets_hits / loc_safe
+        if secrets_density >= self.policy["secrets_risk_threshold"]:
+            exposures["Secrets Leak Risk"] = secrets_density
+
+        return exposures

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/gitgalaxy/signal_processor.py

@@ -78,8 +78,68 @@ class SignalProcessor:
         self.risk_tuning = getattr(config, "RISK_EQUATION_TUNING", {})
         self.is_paranoid = self.config.get("PARANOID_MODE", False) 
         
-        self.logger.info(f"Signal Processor Online | 13-Point Risk Schema loaded.")
+        # ======================================================================
+        # THE CONTEXT VS. ENTITY MATRIX (Domain Ontologies)
+        # ======================================================================
+        # We now fetch this dynamically from gitgalaxy_standards_v1.py instead of hardcoding it!
+        security_profiles = getattr(config, "LANGUAGE_SECURITY_PROFILES", {})
+        self.ECOSYSTEMS = security_profiles.get("ECOSYSTEMS", {})
+        self.NATIVE_WEIGHTS = security_profiles.get("NATIVE_WEIGHTS", {})
+        self.ALIEN_WEIGHTS = security_profiles.get("ALIEN_WEIGHTS", {})
+        
+        self.logger.info(f"Signal Processor Online | Context-Aware Security Profiles loaded.")
+        
+        # Aggressive penalties applied when the file is an ALIEN in its neighborhood
+        self.ALIEN_WEIGHTS = {
+            "systems_in_web": {"memory": 5.0, "logic_bomb": 3.0}, # C code hiding in a JS app = Trojan
+            "infra_in_web":   {"logic_bomb": 4.0},                # Shell script hiding in a JS app = Backdoor
+            "web_in_systems": {"flux": 3.0}                       # JS embedded in C firmware = Bizarre architecture
+        }
+        
+        self.logger.info(f"Signal Processor Online | Context-Aware Risk Schema loaded.")
+    
+    def _get_context_multipliers(self, file_lang: str, folder_lang: str) -> Dict[str, float]:
+        """
+        Calculates risk multipliers by comparing a file's language to its neighborhood.
+        Prevents the 'Apollo Paradox' and catches 'Trojan Horse' entities.
+        """
+        # Default multipliers if no specific context rules apply
+        multipliers = {"memory": 1.0, "logic_bomb": 1.0, "flux": 1.0, "injection": 1.0}
+        
+        file_lang = file_lang.lower()
+        folder_lang = folder_lang.lower() if folder_lang else file_lang
+
+        # Determine the ecosystem of the specific File
+        file_eco = "backend" # Default fallback
+        for eco, langs in self.ECOSYSTEMS.items():
+            if file_lang in langs:
+                file_eco = eco
+                break
+                
+        # Determine the ecosystem of the surrounding Folder
+        folder_eco = "backend"
+        for eco, langs in self.ECOSYSTEMS.items():
+            if folder_lang in langs:
+                folder_eco = eco
+                break
+
+        # SCENARIO 1: The Entity matches the Context (Native)
+        if file_eco == folder_eco:
+            return self.NATIVE_WEIGHTS.get(file_eco, multipliers)
+
+        # SCENARIO 2: The Entity is an Alien (Context Mismatch)
+        alien_key = f"{file_eco}_in_{folder_eco}"
+        alien_penalties = self.ALIEN_WEIGHTS.get(alien_key, {})
+        
+        # Apply standard weights of the file, but overwrite with severe alien penalties
+        base_weights = self.NATIVE_WEIGHTS.get(file_eco, multipliers).copy()
+        base_weights.update(alien_penalties)
+        
+        if alien_penalties:
+            self.logger.warning(f"👽 ALIEN ENTITY DETECTED: {file_lang} file hiding in a {folder_eco} neighborhood. Applying severe penalties: {alien_penalties}")
 
+        return base_weights
+    
     def _calculate_silo_risk(self, authors: dict) -> float:
         """
         Calculates the 'Bus Factor' risk of a file.
@@ -173,8 +233,13 @@ class SignalProcessor:
             fc = self.TIER_VARS[tier]["fc"]
             irc = self.TIER_VARS[tier]["irc"]
             
-            # Environmental Context
+            # Environmental Context (Path-based overrides)
             mp_map = self._get_locational_multipliers(rel_path)
+            
+            # ---> NEW: Context vs. Entity Ontology Matrix <---
+            # Fetch the folder's dominant language (Assumes your upstream parser injects this)
+            folder_lang = meta.get("metadata", {}).get("folder_dominant_lang", lang_id)
+            eco_mp = self._get_context_multipliers(lang_id, folder_lang)
 
             self.logger.debug(f"[{rel_path}] Physics Calc | Lang: {lang_id} (Fc: {fc:.2f}, Irc: {irc})")
 
@@ -223,9 +288,9 @@ class SignalProcessor:
                 "civil_war":      self._calc_civil_war(equations),
                 # --- THE SECURITY & VULNERABILITY LENSES ---
                 "obscured_payload":  self._calc_obscured_payload(loc, equations, mp_map.get("obscured", 1.0)),
-                "logic_bomb":        self._calc_logic_bomb(loc, equations, mp_map.get("logic_bomb", 1.0)),
-                "injection_surface": self._calc_injection_surface(loc, equations, mp_map.get("injection", 1.0)),
-                "memory_corruption": self._calc_memory_corruption(loc, equations, mp_map.get("memory", 1.0), lang_id), 
+                "logic_bomb":        self._calc_logic_bomb(loc, equations, mp_map.get("logic_bomb", 1.0) * eco_mp.get("logic_bomb", 1.0)),
+                "injection_surface": self._calc_injection_surface(loc, equations, mp_map.get("injection", 1.0) * eco_mp.get("injection", 1.0)),
+                "memory_corruption": self._calc_memory_corruption(loc, equations, mp_map.get("memory", 1.0) * eco_mp.get("memory", 1.0), lang_id), 
                 "secrets_risk":      self._calc_secrets_risk(loc, equations, mp_map.get("secrets", 1.0))
             }
             

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/gitgalaxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 1.1.1
+Version: 1.1.2
 Summary: A high-speed static analysis engine that sequences source code like DNA to map architectural risk and security threats.
 Author: Joe Esquibel
 License: PolyForm Noncommercial License 1.0.0

{gitgalaxy-1.1.1 → gitgalaxy-1.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gitgalaxy"
-version = "1.1.1"
+version = "1.1.2"
 authors = [
   { name="Joe Esquibel" },
 ]

gitgalaxy-1.1.1/gitgalaxy/security_lens.py

@@ -1,181 +0,0 @@
-import re
-import copy
-import logging
-from typing import Dict, Any
-
-# ==============================================================================
-# GitGalaxy Security Lens (Passive Threat Observer)
-# Protocol: Glassworm, Trojan, and Exfiltration Hunting
-# ==============================================================================
-
-class SecurityLens:
-    """
-    PURPOSE: 
-    Acts as a Passive Observer within the GitGalaxy Physics Engine. 
-    It runs alongside the standard architectural audit, silently collecting 
-    malicious intent, obfuscation, and exfiltration metrics into RAM.
-    
-    MECHANISM:
-    Injects high-priority threat signatures into the primary language rulesets
-    using a 'sec_' prefix. This ensures standard metrics (like tech debt) are 
-    calculated normally, while security anomalies are passively cached for later extraction.
-    """
-
-    def __init__(self, parent_logger: logging.Logger = None):
-        self.logger = parent_logger.getChild("security_lens") if parent_logger else logging.getLogger("security_lens")
-        self.logger.setLevel(logging.INFO)
-
-        # ======================================================================
-        # THE THREAT REGISTRY (Security Overlay V2 - O(N) Safe)
-        # ======================================================================
-        self.THREAT_SIGNATURES = {
-            # ------------------------------------------------------------------
-            # 1. THE GLASSWORM (Obfuscation & Heat Signatures)
-            # Targets decoding functions, massive blobs, and invisible steganography.
-            # ------------------------------------------------------------------
-            "heat_triggers": re.compile(
-                r'\b(?:atob|btoa|base64_decode|base64_encode|gzuncompress|str_rot13)\b|'
-                r'\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|'
-                r'(?:\w{15,}[ \t]*=[ \t]*["\'][A-Za-z0-9+/]{40,}={0,2}["\'])|'
-                r'[\u200B-\u200D\uFEFF\u200E\u200F\u202A-\u202E]', # Invisible Unicode
-                re.I
-            ),
-
-            # ------------------------------------------------------------------
-            # 2. THE TROJAN (Identity Masking & Safety Bypasses)
-            # Targets cross-algorithm double-decoding and runtime security downgrades.
-            # ------------------------------------------------------------------
-            "safety_neg": re.compile(
-                r'\b(?:atob|btoa|base64_decode|gzinflate|gzuncompress|str_rot13|urldecode)[ \t]*\([ \t]*(?:atob|btoa|base64_decode|gzinflate|gzuncompress|str_rot13|urldecode)\b|'
-                r'\b(?:auto_prepend_file|auto_append_file)\b|'
-                r'\b(?:ini_set|ini_restore|putenv)[ \t]*\([ \t]*["\'](?:disable_functions|safe_mode|open_basedir|allow_url_fopen)["\'][ \t]*,[ \t]*["\']?(?:0|off|false|)["\']?\)|'
-                r'\b(?:disable_functions|safe_mode|open_basedir)\b[ \t]*=[ \t]*(?:off|0|false|""|\'\')|'
-                r'process\.env\.NODE_TLS_REJECT_UNAUTHORIZED[ \t]*=[ \t]*["\']?0["\']?|'
-                r'\b(?:verify|strictSSL|rejectUnauthorized|CURLOPT_SSL_VERIFYPEER)[ \t]*[=:,][ \t]*(?:False|false|0)\b',
-                re.I
-            ),
-
-            # ------------------------------------------------------------------
-            # 3. EXFILTRATION VECTORS (System Gravity)
-            # Targets dynamic outbound connections, tunneling proxies, and DNS exfiltration.
-            # ------------------------------------------------------------------
-            "io": re.compile(
-                r'\b(?:fetch|XMLHttpRequest|WebSocket|http\.request|https\.request|requests\.(?:post|put|get)|urllib\.request\.urlopen)\b\s*\(|'
-                r'\b(?:curl_exec|fsockopen|pfsockopen|stream_socket_client|file_get_contents)\b\s*\(|'
-                r'\b(?:dns_get_record|gethostbyname|socket\.gethostbyname|resolve(?:4|6|Cname|Txt)?)\b\s*\(|'
-                r'(?:https?|ftp|tcp|udp|wss?):\/\/(?:(?:\d{1,3}\.){3}\d{1,3}|\[[0-9a-fA-F:]+\]|.*?\.(?:ngrok\.io|ngrok-free\.app|localtunnel\.me|pastebin\.com|workers\.dev|s3\.amazonaws\.com|requestbin\.net|pipedream\.net))',
-                re.I | re.X
-            ),
-
-            # ------------------------------------------------------------------
-            # 4. THE EXECUTIONER (Dynamic Payloads)
-            # HARDENED: Unbounded repetitions clamped to prevent ReDoS on minified code.
-            # ------------------------------------------------------------------
-            "danger": re.compile(
-                r'\b(?:eval|Function|setTimeout|setInterval)\b\s*\(\s*(?:atob|base64|["\']|`)|'
-                r'\b(?:document\.write|location\.replace|assert|create_function|passthru|shell_exec|system)\b|'
-                r'child_process\.(?:exec|spawn|fork)|'
-                # Clamped string concatenation to {1,15} to kill exponential backtracking
-                r'(?:window|global|this|globalThis)\[[ \t]*(?:["\'][a-zA-Z]["\'][ \t]*\+[ \t]*){1,15}["\'][a-zA-Z]["\'][ \t]*\][ \t]*\(|'
-                r'\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*\(\s*\$_(?:POST|GET|COOKIE|REQUEST|HEADERS)|'
-                r'getattr\s*\(\s*__import__\s*\(|__builtins__\[|Assembly\.Load\s*\(',
-                re.I | re.X
-            ),
-
-            # ------------------------------------------------------------------
-            # 5. ENVIRONMENT POISONING (State Flux)
-            # Targets prototype pollution, native function hooking, and global overrides.
-            # ------------------------------------------------------------------
-            "flux": re.compile(
-                r'\b[A-Za-z0-9_]+\.prototype\.[A-Za-z0-9_]+[ \t]*=|'
-                r'\.__proto__[ \t]*=[ \t]*[{a-zA-Z]|'
-                r'\b(?:window|global|globalThis|document)\.(?:fetch|eval|setTimeout|setInterval|Promise|console|JSON)[ \t]*=|'
-                r'\$(?:GLOBALS|_(?:SERVER|GET|POST|COOKIE|REQUEST|ENV|SESSION))\[[^\]]+\][ \t]*=[ \t]*[^=]|'
-                r'\bextract[ \t]*\([ \t]*\$(?:_(?:GET|POST|REQUEST|COOKIE)|GLOBALS)\b|'
-                r'\b__builtins__\[[^\]]+\][ \t]*=|'
-                r'\bsys\.modules\[[^\]]+\][ \t]*=',
-                re.I
-            ),
-
-            # ------------------------------------------------------------------
-            # 6. SHADOW LOGIC (Necrosis / Graveyard)
-            # O(N) SAFE: Fast block scanning bounded to 500 chars to prevent ReDoS.
-            # ------------------------------------------------------------------
-            "graveyard": re.compile(
-                r'(?://|#|--)[^\n]*?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp)\b|'
-                r'/\*(?:(?!\*/).){0,500}?\b(?:http|bash|curl|wget|eval|base64|nc\s+-e|/dev/tcp)\b',
-                re.I
-            ),
-            
-            # ------------------------------------------------------------------
-            # 7. SUB-ATOMIC DECRYPTION (Bitwise Hits)
-            # HARDENED: Replaced .*? with bounded character exclusions. 
-            # ------------------------------------------------------------------
-            "bitwise_hits": re.compile(
-                # Clamped to {2,20} and {3,20} to prevent infinite runaway loops on data arrays
-                r'\b\w+[ \t]*=[ \t]*(?:\w+[ \t]*\^[ \t]*\w+[ \t]*){2,20}|'
-                r'(?:\w+\[[^\]\n]{1,50}\][ \t]*\^[ \t]*=?[ \t]*(?:0x[0-9a-fA-F]+|\d+|\w+)[ \t]*;[ \t]*){3,20}', 
-                re.I
-            ),
-            # ------------------------------------------------------------------
-            # 8. SHADOW IMPORTS (The Switcharoo / Steganography)
-            # Targets legitimate code attempting to import, require, or execute
-            # payloads hidden inside non-executable media or data files.
-            # ------------------------------------------------------------------
-            "shadow_imports": re.compile(
-                r'\b(?:require|include|import|require_once|include_once|source|load|dofile)\b\s*\(?\s*'
-                r'["\'][^"\']+\.(?:png|jpg|jpeg|gif|ico|pdf|zip|tar|dat|tmp|log|txt|csv|wav|mp3)["\']',
-                re.I
-            ),
-            # ------------------------------------------------------------------
-            # 9. UNICODE SMUGGLING (Homoglyphs & Typosquatting)
-            # Targets look-alike characters (Cyrillic, Greek, Hangul Filler) 
-            # used to hijack legitimate imports or disguise network requests.
-            # ------------------------------------------------------------------
-            "homoglyphs": re.compile(
-                r'\b(?:import|from|require|include|require_once|fetch|XMLHttpRequest)\b'
-                r'[^\n]*?(?:[\u0400-\u04FF]|'       # Cyrillic (e.g., false 'a', 'e', 'o')
-                r'[\u0370-\u03FF]|'                 # Greek
-                r'[\u1D400-\u1D7FF]|'               # Math Alphanumerics
-                r'\u3164)',                         # Hangul Filler (Invisible whitespace)
-                re.I
-            ), 
-            # ------------------------------------------------------------------
-            # 10. THE VAULT DOOR (Credential & Secret Leaks)
-            # Universal RHS-aware secret detection. Demands string literals 
-            # of at least 16 characters to prevent false positives on booleans/ints.
-            # ------------------------------------------------------------------
-            "private_info": re.compile(
-                r"\b(password|secret|token|api[_-]?key|client[_-]?secret|credentials|private[_-]?key|auth[_-]?token)\b[ \t]*(?:[:=]|=>)[ \t]*[\"'][A-Za-z0-9\-_+/=]{16,}[\"']",
-                re.I
-            ),
-        }
-        
-    def arm_lens(self, base_registry: Dict[str, Any], target_languages: list = None) -> Dict[str, Any]:
-        """
-        Injects the threat signatures as PASSIVE OBSERVERS into the registry.
-        They will be scanned by the Splicer and cached in RAM, but will NOT destroy 
-        the standard architectural calculations.
-        """
-        self.logger.info("Arming Security Lens: Injecting Passive Observers into Registry...")
-        
-        secure_registry = copy.deepcopy(base_registry)
-        
-        if not target_languages:
-            target_languages = ['javascript', 'typescript', 'php', 'python', 'ruby', 'shell', 'powershell']
-
-        for lang in target_languages:
-            if lang in secure_registry and 'rules' in secure_registry[lang]:
-                rules = secure_registry[lang]['rules']
-                
-                # --- PASSIVE OBSERVER INJECTION ---
-                for dimension, threat_regex in self.THREAT_SIGNATURES.items():
-                    # By prefixing with "sec_", we preserve the original "io" or "danger" rules
-                    # The Splicer automatically scans any key in this dictionary, meaning
-                    # these hits will quietly accumulate in the file's 'equations' output in RAM.
-                    rules[f"sec_{dimension}"] = threat_regex
-                    
-                self.logger.debug(f"Passive Security Sensors attached to '{lang}'.")
-
-        self.logger.info(f"Passive Security Lens active across {len(target_languages)} ecosystems.")
-        return secure_registry