patchi 0.7.5__py3-none-any.whl

patchi/core/security/pentest/nuclei_adapter.py

@@ -0,0 +1,50 @@
+"""Nuclei adapter — CVE/templates scan."""
+
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.nuclei")
+
+
+class NucleiTool(PentestTool):
+    name = "nuclei"
+    binary = "nuclei"
+    docker_image = "projectdiscovery/nuclei:latest"
+
+    def run(self, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        extra = extra or {}
+        templates = extra.get("templates", "cves")  # cves|exposures|misconfiguration
+        t0 = time.monotonic()
+        if shutil.which("nuclei"):
+            cmd = ["nuclei", "-u", target, "-t", templates, "-jsonl", "-silent", "-nc"]
+            if safe_mode:
+                cmd += ["-rate-limit", "10"]
+            def runner(c): return subprocess.run(c, capture_output=True, text=True, timeout=300)
+        elif shutil.which("docker"):
+            cmd = ["docker", "run", "--rm", "projectdiscovery/nuclei:latest", "-u", target, "-t", templates, "-jsonl", "-silent", "-nc"]
+            def runner(c): return subprocess.run(c, capture_output=True, text=True, timeout=300)
+        else:
+            return PentestResult(tool=self.name, success=False, error="nuclei not available (install nuclei or docker)")
+        try:
+            proc = runner(cmd)
+            dur = int((time.monotonic() - t0) * 1000)
+            findings: list[dict] = []
+            for line in proc.stdout.splitlines()[:200]:
+                try:
+                    j = json.loads(line)
+                    findings.append({"template": j.get("templateID",""), "name": j.get("info",{}).get("name",""), "severity": j.get("info",{}).get("severity",""), "host": j.get("host",""), "matcher": j.get("matcher-name","")})
+                except Exception:
+                    continue
+            return PentestResult(tool=self.name, success=True, evidence=f"nuclei {len(findings)} findings templates={templates}", findings=findings, raw_output=proc.stdout[:8000], duration_ms=dur)
+        except subprocess.TimeoutExpired:
+            return PentestResult(tool=self.name, success=False, error="nuclei timeout 5m", duration_ms=int((time.monotonic()-t0)*1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=str(exc), duration_ms=int((time.monotonic()-t0)*1000))

patchi/core/security/pentest/registry.py

@@ -0,0 +1,80 @@
+"""Pentest registry — which real tools are available and AI choice."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Any
+
+from patchi.core.security.pentest.base import PentestResult
+from patchi.core.security.pentest.dalfox_adapter import DalfoxTool
+from patchi.core.security.pentest.ffuf_adapter import FfufTool
+from patchi.core.security.pentest.nuclei_adapter import NucleiTool
+from patchi.core.security.pentest.shannon_adapter import ShannonTool
+from patchi.core.security.pentest.sqlmap_adapter import SqlmapTool
+from patchi.core.security.pentest.zap_adapter import ZapTool
+
+_log = logging.getLogger("patchi.pentest.registry")
+
+
+class PentestRegistry:
+    def __init__(self) -> None:
+        self._tools = {
+            "nuclei": NucleiTool(),
+            "sqlmap": SqlmapTool(),
+            "dalfox": DalfoxTool(),
+            "ffuf": FfufTool(),
+            "zap": ZapTool(),
+            "shannon": ShannonTool(),
+        }
+
+    def list(self) -> list[str]:
+        return list(self._tools.keys())
+
+    def available(self) -> dict[str, bool]:
+        return {k: v.is_available() for k, v in self._tools.items()}
+
+    def get(self, name: str):
+        return self._tools.get(name)
+
+    def run(self, name: str, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        tool = self.get(name)
+        if not tool:
+            return PentestResult(tool=name, success=False, error=f"unknown tool {name}")
+        if not tool.is_available():
+            return PentestResult(tool=name, success=False, error=f"{name} not available (install {tool.binary} or docker)")
+        return tool.run(target, safe_mode=safe_mode, workspace=workspace, extra=extra or {})
+
+    def ai_pick(self, context: dict[str, Any], available_only: bool = True) -> list[dict[str, Any]]:
+        """One LLM call to pick 1-3 tools. Fallback heuristic if offline."""
+        import os
+
+        if os.environ.get("PATCHI_OFFLINE"):
+            # heuristic: sqli→sqlmap, xss→dalfox, cve→nuclei
+            domains = " ".join(context.get("active_domains", [])).lower()
+            picks: list[dict] = []
+            if "sql" in domains or "injection" in domains:
+                picks.append({"tool": "sqlmap", "reason": "injection domain active"})
+            if "xss" in domains:
+                picks.append({"tool": "dalfox", "reason": "xss domain"})
+            if not picks or "cve" in domains:
+                picks.append({"tool": "nuclei", "reason": "cve surface"})
+            if context.get("target_url") and context.get("use_shannon"):
+                picks = [{"tool": "shannon", "reason": "full chain requested"}] + picks
+            return picks[:2]
+        try:
+            from patchi.core.ai.client import call_ai_structured
+
+            cfg = context.get("config", {})
+            avail = self.available()
+            prompt = f"CONTEXT: routes={context.get('routes', [])[:5]} domains={context.get('active_domains', [])} target={context.get('target_url','-')} available={avail}\nPick 1-3 tools from {list(self._tools.keys())} with reason. Need live target for dalfox/nuclei/sqlmap/zap/shannon. No target→only code_scan. Return JSON {{\"picks\":[{{\"tool\":\"nuclei\",\"reason\":\"\"}}]}}"
+            system = "You are Patchi Red Team Lead. Pick minimal real tools to prove exploitable findings. Prefer nuclei for CVE, sqlmap for SQLi, dalfox for XSS, shannon for full authenticated chain. No exploit, no report."
+            data = call_ai_structured(cfg, system, prompt, max_tokens=400, temperature=0.2)
+            if isinstance(data, dict) and isinstance(data.get("picks"), list):
+                return [p for p in data["picks"] if isinstance(p, dict) and p.get("tool") in self._tools][:3]
+        except Exception as exc:  # noqa: BLE001
+            _log.debug("ai_pick fallback: %s", exc)
+        # LLM failed — honor shannon intent if target+flag present
+        if context.get("use_shannon") and context.get("target_url"):
+            return [{"tool": "shannon", "reason": "fallback shannon requested"}]
+        return [{"tool": "nuclei", "reason": "fallback"}]

patchi/core/security/pentest/shannon_adapter.py

@@ -0,0 +1,107 @@
+"""Shannon adapter — Option 2: external npx, not vendored (AGPL-clean)."""
+
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+import subprocess
+import time
+import uuid
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.shannon")
+
+
+class ShannonTool(PentestTool):
+    name = "shannon"
+    binary = "npx"
+    docker_image = "ghcr.io/keygraphhq/shannon-worker:latest"
+    requires_target = True
+
+    def is_available(self) -> bool:
+        if not shutil.which("npx"):
+            return False
+        if not shutil.which("docker"):
+            _log.debug("shannon: docker not found — still available via npx")
+        return True
+
+    def run(
+        self,
+        target: str,
+        safe_mode: bool = True,
+        workspace: Path | None = None,
+        extra: dict | None = None,
+    ) -> PentestResult:
+        extra = extra or {}
+        repo_root = extra.get("repo_root")
+        if not repo_root:
+            return PentestResult(tool=self.name, success=False, error="repo_root required for shannon")
+        repo_root = Path(repo_root)
+        ws = workspace or (repo_root / ".patchi" / "shannon" / uuid.uuid4().hex[:8])
+        ws.mkdir(parents=True, exist_ok=True)
+        t0 = time.monotonic()
+        # SAFETY: shannon mutates target — never run without explicit target + non-prod
+        if not target or target.strip() in ("", "http://", "https://"):
+            return PentestResult(tool=self.name, success=False, error="target URL required")
+        cmd = [
+            "npx",
+            "@keygraph/shannon@latest",
+            "start",
+            "-u",
+            target,
+            "-r",
+            str(repo_root),
+            "--workspace",
+            str(ws),
+            "--format",
+            "sarif",
+        ]
+        if safe_mode:
+            cmd += ["--safe-mode"]
+        _log.info("shannon: %s", " ".join(cmd))
+        try:
+            proc = subprocess.run(
+                cmd,
+                capture_output=True,
+                text=True,
+                timeout=5400,  # 90m max (shannon 1-1.5h docs)
+            )
+            dur = int((time.monotonic() - t0) * 1000)
+            raw = (proc.stdout + proc.stderr)[:20000]
+            # Parse SARIF
+            findings: list[dict] = []
+            sarif_files = list(ws.rglob("*.sarif")) + list(ws.rglob("*.json"))
+            for sf in sarif_files:
+                try:
+                    data = json.loads(sf.read_text(encoding="utf-8"))
+                    # SARIF 2.1.0: runs[].results[]
+                    for run in data.get("runs", []):
+                        for res in run.get("results", []):
+                            findings.append(
+                                {
+                                    "ruleId": res.get("ruleId", ""),
+                                    "message": res.get("message", {}).get("text", "")[:400],
+                                    "level": res.get("level", "warning"),
+                                    "locations": res.get("locations", [])[:2],
+                                }
+                            )
+                except Exception as exc:  # noqa: BLE001
+                    _log.debug("shannon sarif parse %s failed: %s", sf, exc)
+            ok = proc.returncode == 0
+            ev = f"shannon {'ok' if ok else 'fail'} rc={proc.returncode} findings={len(findings)} ws={ws}"
+            return PentestResult(
+                tool=self.name,
+                success=ok,
+                evidence=ev,
+                findings=findings[:50],
+                raw_output=raw[:12000],
+                duration_ms=dur,
+                error="" if ok else raw[:500],
+            )
+        except subprocess.TimeoutExpired:
+            return PentestResult(tool=self.name, success=False, error="shannon timeout 90m", duration_ms=int((time.monotonic() - t0) * 1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=str(exc), duration_ms=int((time.monotonic() - t0) * 1000))

patchi/core/security/pentest/sqlmap_adapter.py

@@ -0,0 +1,56 @@
+"""Sqlmap adapter — SQLi confirmation."""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.sqlmap")
+
+
+class SqlmapTool(PentestTool):
+    name = "sqlmap"
+    binary = "sqlmap"
+    docker_image = "paoloo/sqlmap:latest"
+
+    def run(self, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        extra = extra or {}
+        data = extra.get("data", "")  # POST body if needed
+        t0 = time.monotonic()
+        # Build base command
+        base = ["sqlmap", "-u", target, "--batch", "--risk", "1", "--level", "1", "--parse-errors"]
+        if safe_mode:
+            base += ["--technique", "BEUS"]  # no destructive DROP etc, handled by sqlmap risk 1
+        if data:
+            base += ["--data", data]
+        if shutil.which("sqlmap"):
+            cmd = base
+        elif shutil.which("docker"):
+            cmd = ["docker", "run", "--rm", "paoloo/sqlmap:latest"] + base[1:]
+        else:
+            return PentestResult(tool=self.name, success=False, error="sqlmap not available")
+        try:
+            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
+            dur = int((time.monotonic()-t0)*1000)
+            out = proc.stdout + proc.stderr
+            findings=[]
+            # Simple signal: sqlmap reports "is vulnerable" or lists DBMS
+            low = out.lower()
+            if "is vulnerable" in low or "parameter" in low and "vulnerable" in low:
+                findings.append({"type": "sqli", "target": target, "evidence": "sqlmap reports vulnerable"})
+            if "back-end dbms" in low:
+                # extract line
+                for line in out.splitlines():
+                    if "back-end dbms" in line.lower():
+                        findings.append({"type": "dbms-fingerprint", "detail": line.strip()[:200]})
+                        break
+            return PentestResult(tool=self.name, success=True, evidence=f"sqlmap {len(findings)} signals", findings=findings, raw_output=out[:8000], duration_ms=dur)
+        except subprocess.TimeoutExpired:
+            return PentestResult(tool=self.name, success=False, error="sqlmap timeout 5m", duration_ms=int((time.monotonic()-t0)*1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=str(exc), duration_ms=int((time.monotonic()-t0)*1000))

patchi/core/security/pentest/zap_adapter.py

@@ -0,0 +1,52 @@
+"""ZAP adapter — active scan via zap-api (optional, needs daemon)."""
+
+from __future__ import annotations
+
+import logging
+import time
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.zap")
+
+
+class ZapTool(PentestTool):
+    name = "zap"
+    binary = "zap.sh"
+    docker_image = "ghcr.io/zaproxy/zaproxy:stable"
+
+    def is_available(self) -> bool:
+        # ZAP needs daemon at http://127.0.0.1:8090 or docker
+        try:
+            import urllib.request
+            urllib.request.urlopen("http://127.0.0.1:8090", timeout=2)
+            return True
+        except Exception as _exc:
+            _log.debug("zap daemon not reachable: %s", _exc)
+        return super().is_available()
+
+    def run(self, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        t0 = time.monotonic()
+        try:
+            import json as _json
+            import urllib.request
+            # Quick spider + active scan via ZAP API if daemon
+            base = "http://127.0.0.1:8090/JSON"
+            # open URL
+            urllib.request.urlopen(f"{base}/core/action/accessUrl/?url={target}", timeout=10).read()
+            time.sleep(2)
+            # active scan
+            scan = _json.loads(urllib.request.urlopen(f"{base}/ascan/action/scan/?url={target}&recurse=true", timeout=30).read())
+            scan_id = scan.get("scan")
+            # poll
+            for _ in range(30):
+                time.sleep(5)
+                st = _json.loads(urllib.request.urlopen(f"{base}/ascan/view/status/?scanId={scan_id}", timeout=10).read())
+                if int(st.get("status", 0)) >= 100:
+                    break
+            alerts = _json.loads(urllib.request.urlopen(f"{base}/core/view/alerts/?baseurl={target}", timeout=10).read())
+            findings = [{"alert": a.get("alert",""), "risk": a.get("risk",""), "url": a.get("url","")} for a in alerts.get("alerts", [])[:20]]
+            return PentestResult(tool=self.name, success=True, evidence=f"zap {len(findings)} alerts", findings=findings, duration_ms=int((time.monotonic()-t0)*1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=f"zap not available: {exc}", duration_ms=int((time.monotonic()-t0)*1000))

patchi/core/security/plan_auditor.py

@@ -0,0 +1,276 @@
+"""
+Plan Auditor Agent — audits a Patchi checkout against build plan specs.
+
+Only runs when the scanned root actually contains the Patchi package (a
+`patchi/core/security` tree); against any third-party project the checks are
+meaningless — every Patchi-internal path it references is absent by
+construction, so emitting them would fabricate CRITICAL/HIGH findings.
+
+Checks that:
+- All agents registered in BUILD_PLAN.md are actually registered
+- All CLI commands exist and are wired up
+- All security scan types work
+- All test files exist for new modules
+- Health score components are wired correctly
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    list_agents,
+    register,
+)
+
+
+@register
+class PlanAuditorAgent(BaseAgent):
+    """Audits codebase against BUILD_PLAN.md specifications."""
+
+    name = "PlanAuditorAgent"
+    group = AgentGroup.GUARD
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        root = inp.root
+
+        # This agent audits PATCHI ITSELF against its build plan (registered
+        # agents, CLI wiring, Patchi-internal modules). Every check below is
+        # meaningless when the scanned project is not a Patchi checkout — the
+        # paths it references simply cannot exist in a third-party codebase,
+        # so emitting them would fabricate CRITICAL/HIGH findings about a
+        # project it isn't auditing. Skip unless a Patchi package is present.
+        if not (root / "patchi" / "core" / "security").is_dir():
+            return
+
+        # Check 1: All security agents registered
+        self._check_security_agents(root, result)
+
+        # Check 2: All CLI commands wired
+        self._check_cli_commands(root, result)
+
+        # Check 3: New modules exist
+        self._check_new_modules(root, result)
+
+        # Check 4: Test coverage for new modules
+        self._check_test_coverage(root, result)
+
+        # Check 5: Health score wiring
+        self._check_health_wiring(root, result)
+
+    def _check_security_agents(self, root: Path, result: AgentResult) -> None:
+        """Verify all registered security agents are imported in security_agents.py."""
+        expected_agents = [
+            a.name
+            for a in list_agents()
+            if a.group == AgentGroup.SECURITY or a.name == "PlanAuditorAgent"
+        ]
+
+        sec_file = root / "patchi" / "core" / "security" / "security_agents.py"
+        if not sec_file.exists():
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="plan_audit",
+                    severity=Severity.CRITICAL,
+                    file="patchi/core/security/security_agents.py",
+                    message="security_agents.py not found",
+                )
+            )
+            return
+
+        try:
+            content = sec_file.read_text(encoding="utf-8")
+        except OSError:
+            return
+        for agent_name in expected_agents:
+            if agent_name not in content:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="plan_audit",
+                        severity=Severity.HIGH,
+                        file="patchi/core/security/security_agents.py",
+                        message=f"Agent '{agent_name}' not imported in security_agents.py",
+                    )
+                )
+
+        # Check __all__ includes all agents
+        all_match = re.search(r"__all__\s*=\s*\[(.*?)\]", content, re.DOTALL)
+        if all_match:
+            all_text = all_match.group(1)
+            for agent_name in expected_agents:
+                if f"'{agent_name}'" not in all_text and f'"{agent_name}"' not in all_text:
+                    result.add_finding(
+                        Finding(
+                            agent=self.name,
+                            type="plan_audit",
+                            severity=Severity.MEDIUM,
+                            file="patchi/core/security/security_agents.py",
+                            message=f"Agent '{agent_name}' not in __all__",
+                        )
+                    )
+
+    def _check_cli_commands(self, root: Path, result: AgentResult) -> None:
+        """Verify all CLI commands exist."""
+        expected_commands = [
+            "init",
+            "scan",
+            "status",
+            "fix",
+            "review",
+            "patch",
+            "undo",
+            "queue",
+            "memory",
+            "key",
+            "agents",
+            "watch",
+            "mode",
+            "restrict",
+            "notify",
+            "web",
+            "doctor",
+            "model",
+            "report",
+            "hosted",
+            "test",
+            "security",
+            "explain",
+            "blast",
+            "trend",
+            "audit",
+            "learn",
+            "chat",
+            "settings",
+            "access",
+            "ai",
+            "help",
+        ]
+
+        cmd_dir = root / "patchi" / "cli" / "commands"
+        if not cmd_dir.exists():
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="plan_audit",
+                    severity=Severity.CRITICAL,
+                    file="patchi/cli/commands/",
+                    message="Commands directory not found",
+                )
+            )
+            return
+
+        existing = {f.stem for f in cmd_dir.glob("*.py")}
+        for cmd in expected_commands:
+            expected_file = f"{cmd}_cmd" if cmd != "init" else "init"
+            if expected_file not in existing:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="plan_audit",
+                        severity=Severity.HIGH,
+                        file=f"patchi/cli/commands/{expected_file}.py",
+                        message=f"CLI command '{cmd}' not found",
+                    )
+                )
+
+    def _check_new_modules(self, root: Path, result: AgentResult) -> None:
+        """Verify new security modules exist."""
+        expected_modules = [
+            "orchestrator.py",
+            "secrets_guard.py",
+            "supply_chain.py",
+            "iac_scanner.py",
+            "policy_engine.py",
+            "cve_monitor.py",
+            "red_team_agent.py",
+        ]
+
+        sec_dir = root / "patchi" / "core" / "security"
+        for mod in expected_modules:
+            if not (sec_dir / mod).exists():
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="plan_audit",
+                        severity=Severity.HIGH,
+                        file=f"patchi/core/security/{mod}",
+                        message=f"New module '{mod}' not found",
+                    )
+                )
+
+        # Check security_test_agent
+        test_dir = root / "patchi" / "core" / "testing"
+        if not (test_dir / "security_test_agent.py").exists():
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="plan_audit",
+                    severity=Severity.HIGH,
+                    file="patchi/core/testing/security_test_agent.py",
+                    message="SecurityTestAgent module not found",
+                )
+            )
+
+    def _check_test_coverage(self, root: Path, result: AgentResult) -> None:
+        """Verify tests exist for new modules."""
+        test_file = root / "tests" / "test_new_security_agents.py"
+        if not test_file.exists():
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="plan_audit",
+                    severity=Severity.HIGH,
+                    file="tests/test_new_security_agents.py",
+                    message="New security agent tests not found",
+                )
+            )
+        else:
+            try:
+                content = test_file.read_text(encoding="utf-8")
+            except OSError:
+                return
+            test_count = content.count("def test_")
+            if test_count < 20:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="plan_audit",
+                        severity=Severity.MEDIUM,
+                        file="tests/test_new_security_agents.py",
+                        message=f"Only {test_count} tests in new security agent test file (expected 20+)",
+                    )
+                )
+
+    def _check_health_wiring(self, root: Path, result: AgentResult) -> None:
+        """Verify health score references new agents."""
+        health_file = root / "patchi" / "core" / "health.py"
+        if not health_file.exists():
+            return
+
+        try:
+            content = health_file.read_text(encoding="utf-8")
+        except OSError:
+            return
+        # Check that security agents list includes new agents
+        new_agents = ["InjectionAgent", "AuthZAgent", "CryptoAgent", "NetworkAgent", "PrivacyAgent"]
+        for agent in new_agents:
+            if agent not in content:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="plan_audit",
+                        severity=Severity.MEDIUM,
+                        file="patchi/core/health.py",
+                        message=f"Health score doesn't reference '{agent}'",
+                    )
+                )