patchi 0.7.5__py3-none-any.whl

patchi/core/security/red_team_engine.py

@@ -0,0 +1,1142 @@
+"""
+Red Team Engine — Orchestrates attack simulations and auto-fix verification.
+
+This is the core engine that:
+1. Loads attack scenarios from YAML
+2. Selects relevant scenarios based on project context
+3. Executes attacks safely (with safe_mode)
+4. Generates findings with exploit evidence
+5. Triggers auto-fix generation
+6. Verifies fixes by re-running attacks
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import time
+import uuid
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+from pathlib import Path
+
+import yaml
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+)
+from patchi.core.security.domain_loader import DomainLoader
+
+_log = logging.getLogger("patchi.security.red_team_engine")
+
+
+@dataclass
+class AttackStepResult:
+    """Result of a single attack step."""
+
+    step: int
+    action: str
+    success: bool
+    evidence: str = ""
+    response_data: dict = field(default_factory=dict)
+    error: str = ""
+    duration_ms: int = 0
+
+
+@dataclass
+class ScenarioResult:
+    """Result of running an attack scenario."""
+
+    scenario_id: str
+    scenario_name: str
+    status: str  # "success", "failed", "blocked", "skipped"
+    steps_completed: int
+    total_steps: int
+    step_results: list[AttackStepResult] = field(default_factory=list)
+    findings: list[Finding] = field(default_factory=list)
+    exploit_evidence: dict = field(default_factory=dict)
+    started_at: str = field(default_factory=lambda: datetime.now(UTC).isoformat())
+    completed_at: str = ""
+    duration_ms: int = 0
+
+
+@dataclass
+class RedTeamReport:
+    """Complete red team assessment report."""
+
+    assessment_id: str
+    project_root: str
+    scope: str
+    intensity: str
+    scenarios_run: list[ScenarioResult] = field(default_factory=list)
+    total_findings: int = 0
+    by_severity: dict[str, int] = field(default_factory=dict)
+    attack_tree: dict = field(default_factory=dict)
+    remediation_playbooks: list[str] = field(default_factory=list)
+    started_at: str = field(default_factory=lambda: datetime.now(UTC).isoformat())
+    completed_at: str = ""
+    duration_ms: int = 0
+
+
+class AttackExecutor:
+    """Executes individual attack steps with real Playwright/HTTP."""
+
+    def __init__(
+        self,
+        root: Path,
+        target_url: str = None,
+        safe_mode: bool = True,
+        on_progress: Callable[[str], None] = None,
+        evidence_dir: Path | None = None,
+    ):
+        self.root = root
+        self.target_url = target_url or "http://127.0.0.1:1612"
+        self.safe_mode = safe_mode
+        self.on_progress = on_progress or (lambda _: None)
+        self.session = None  # aiohttp session
+        self.browser = None  # Playwright browser
+        self._playwright = None
+        self._evidence_dir = evidence_dir or (root / ".patchi" / "evidence")
+        self._evidence_dir.mkdir(parents=True, exist_ok=True)
+        self._evidence: list[dict] = []
+        self._screenshot_count = 0
+
+    async def initialize(self):
+        """Initialize HTTP session and Playwright browser."""
+        # HTTP session
+        try:
+            import aiohttp
+
+            timeout = aiohttp.ClientTimeout(total=15)
+            self.session = aiohttp.ClientSession(timeout=timeout)
+        except ImportError:
+            _log.warning("aiohttp not available — HTTP attacks limited")
+
+        # Playwright browser
+        try:
+            from playwright.async_api import async_playwright
+
+            self._playwright = await async_playwright().start()
+            self.browser = await self._playwright.chromium.launch(
+                headless=True,
+                args=["--no-sandbox", "--disable-gpu", "--disable-dev-shm-usage"],
+            )
+            self.on_progress("  Browser initialized (headless Chromium)")
+        except ImportError:
+            _log.warning("Playwright not available — browser attacks limited")
+        except Exception as e:
+            _log.warning("Playwright launch failed: %s", e)
+
+    async def cleanup(self):
+        """Clean up resources."""
+        if self.session:
+            await self.session.close()
+        if self.browser:
+            await self.browser.close()
+        if self._playwright:
+            await self._playwright.stop()
+
+    # ── Evidence capture ────────────────────────────────────────────────────
+
+    async def _capture_screenshot(self, page, label: str) -> str | None:
+        """Take a screenshot and return its path."""
+        if not page:
+            return None
+        self._screenshot_count += 1
+        path = self._evidence_dir / f"{self._screenshot_count:04d}_{label}.png"
+        try:
+            await page.screenshot(path=str(path), full_page=False)
+            return str(path)
+        except Exception as e:
+            _log.warning("Screenshot failed: %s", e)
+            return None
+
+    def _record_evidence(self, step_num: int, action: str, evidence: dict) -> None:
+        """Record evidence for the report."""
+        evidence["step"] = step_num
+        evidence["action"] = action
+        evidence["timestamp"] = time.time()
+        self._evidence.append(evidence)
+
+    async def _run_pentest_tool(self, tool: str, step: dict, scenario: dict, context: dict) -> dict:
+        """Delegate to real PentestRegistry engines (nuclei/sqlmap/shannon etc)."""
+        try:
+            from patchi.core.security.pentest.registry import PentestRegistry
+
+            reg = PentestRegistry()
+            target = step.get("target") or step.get("url") or self.target_url
+            safe = step.get("safe_mode", self.safe_mode)
+            # shannon needs repo_root
+            extra = {"repo_root": str(self.root), "templates": step.get("templates"), "wordlist": step.get("wordlist"), "data": step.get("data")}
+            # Run in thread to avoid blocking event loop (subprocess)
+            import asyncio as _aio
+
+            res = await _aio.to_thread(reg.run, tool, target, safe, self._evidence_dir, extra)
+            out: dict = {"success": bool(res.success and not res.error and (res.findings or res.evidence)), "evidence": res.evidence or res.error, "data": {"tool": res.tool, "findings": res.findings, "raw": res.raw_output[:2000], "duration_ms": res.duration_ms}, "error": res.error}
+            # Count as success even if 0 findings but no error (target clean)
+            if res.success and not res.error and not res.findings:
+                out["success"] = True
+                out["evidence"] = f"{tool}: no findings (target clean or not vulnerable)"
+            return out
+        except Exception as exc:  # noqa: BLE001
+            return {"success": False, "error": f"pentest tool {tool} failed: {exc}"}
+
+    def get_evidence(self) -> list[dict]:
+        """Return all captured evidence."""
+        return list(self._evidence)
+
+    # ── Execute step ────────────────────────────────────────────────────────
+
+    async def execute_step(
+        self,
+        step: dict,
+        scenario: dict,
+        context: dict,
+    ) -> AttackStepResult:
+        """Execute a single attack step."""
+        start = time.monotonic()
+        step_num = step.get("step", 0)
+        action = step.get("action", "")
+        tool = step.get("tool", "")
+
+        self.on_progress(f"  Step {step_num}: {action} ({tool})")
+
+        try:
+            if tool == "fuzz_params":
+                result = await self._fuzz_params(step, scenario, context)
+            elif tool == "sql_payload":
+                result = await self._sql_payload(step, scenario, context)
+            elif tool == "http_request":
+                result = await self._http_request(step, scenario, context)
+            elif tool == "code_scan":
+                result = await self._code_scan(step, scenario, context)
+            elif tool == "browser_action":
+                result = await self._browser_action(step, scenario, context)
+            elif tool == "jwt_tool":
+                result = await self._jwt_tool(step, scenario, context)
+            elif tool in ("nuclei", "sqlmap", "dalfox", "ffuf", "zap", "shannon"):
+                result = await self._run_pentest_tool(tool, step, scenario, context)
+            else:
+                result = {"success": False, "error": f"Unknown tool: {tool}"}
+
+            self._record_evidence(
+                step_num,
+                action,
+                {
+                    "tool": tool,
+                    "success": result.get("success", False),
+                    "evidence": result.get("evidence", ""),
+                    "data": result.get("data", {}),
+                },
+            )
+
+            duration = int((time.monotonic() - start) * 1000)
+            return AttackStepResult(
+                step=step_num,
+                action=action,
+                success=result.get("success", False),
+                evidence=result.get("evidence", ""),
+                response_data=result.get("data", {}),
+                error=result.get("error", ""),
+                duration_ms=duration,
+            )
+        except Exception as e:
+            duration = int((time.monotonic() - start) * 1000)
+            return AttackStepResult(
+                step=step_num,
+                action=action,
+                success=False,
+                error=str(e),
+                duration_ms=duration,
+            )
+
+    # ── HTTP requests (real) ────────────────────────────────────────────────
+
+    async def _http_request(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Send real HTTP request with payload and capture response."""
+        if not self.session:
+            return {"success": False, "error": "No HTTP session"}
+
+        url = step.get("url", self.target_url)
+        method = step.get("method", "GET").upper()
+        payloads = step.get("payloads", [])
+        headers = step.get("headers", {})
+        data = step.get("data", {})
+
+        # Apply payloads to URL params or form data
+        if payloads:
+            for _i, payload in enumerate(payloads[:5]):  # cap at 5
+                test_url = url
+                test_data = dict(data)
+
+                # Inject payload into URL params
+                if "?" in test_url:
+                    test_url += f"&input={payload}"
+                else:
+                    test_url += f"?input={payload}"
+
+                # Also inject into form data
+                if test_data:
+                    for key in list(test_data.keys()):
+                        test_data[key] = payload
+
+                try:
+                    async with self.session.request(
+                        method, test_url, headers=headers, json=test_data if test_data else None
+                    ) as resp:
+                        body = await resp.text()
+                        # Check for SQL error messages
+                        error_indicators = [
+                            "sql syntax",
+                            "mysql",
+                            "sqlite",
+                            "postgresql",
+                            "ora-",
+                            "unquoted parameter",
+                            "microsoft ole db",
+                            "odbc",
+                            "jdbc",
+                            "syntax error",
+                        ]
+                        has_error = any(ind in body.lower() for ind in error_indicators)
+
+                        if has_error:
+                            return {
+                                "success": True,
+                                "evidence": f"SQL error reflected with payload: {payload[:50]}",
+                                "data": {
+                                    "payload": payload,
+                                    "status": resp.status,
+                                    "error_reflection": body[:200],
+                                },
+                            }
+                except Exception as e:
+                    _log.debug("HTTP request failed: %s", e)
+                    continue
+
+        # No payloads — just send a normal request
+        try:
+            async with self.session.request(method, url, headers=headers) as resp:
+                body = await resp.text()
+                return {
+                    "success": resp.status < 400,
+                    "evidence": f"HTTP {method} {url} → {resp.status} ({len(body)} bytes)",
+                    "data": {
+                        "status": resp.status,
+                        "headers": dict(resp.headers),
+                        "body_preview": body[:500],
+                    },
+                }
+        except Exception as e:
+            return {"success": False, "error": str(e)}
+
+    async def _fuzz_params(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Fuzz parameters to find injection points."""
+        if not self.session:
+            return {"success": False, "error": "No HTTP session"}
+
+        payloads = step.get("payloads", [])
+        if self.safe_mode:
+            payloads = [
+                p
+                for p in payloads
+                if not any(
+                    d in p.upper() for d in ["DROP", "DELETE", "UPDATE", "INSERT", "EXEC", "SYSTEM"]
+                )
+            ]
+
+        url = step.get("url", self.target_url)
+        findings = []
+
+        for payload in payloads[:10]:  # cap at 10
+            try:
+                test_url = f"{url}?fuzz={payload}"
+                async with self.session.get(test_url) as resp:
+                    body = await resp.text()
+                    # Check for error reflection, stack traces, or interesting responses
+                    if resp.status >= 500:
+                        findings.append(
+                            {"payload": payload, "status": resp.status, "type": "server_error"}
+                        )
+                    elif any(
+                        kw in body.lower() for kw in ["traceback", "exception", "stack trace"]
+                    ):
+                        findings.append(
+                            {"payload": payload, "status": resp.status, "type": "info_disclosure"}
+                        )
+                    elif payload in body:  # payload reflected in response
+                        findings.append(
+                            {"payload": payload, "status": resp.status, "type": "reflected"}
+                        )
+            except Exception:
+                continue
+
+        return {
+            "success": True,
+            "evidence": f"Fuzzed {len(payloads)} payloads, found {len(findings)} interesting responses",
+            "data": {"findings": findings, "tested": len(payloads)},
+        }
+
+    async def _sql_payload(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Execute SQL injection payload and check for error reflection."""
+        if not self.session:
+            return {"success": False, "error": "No HTTP session"}
+
+        url = step.get("url", self.target_url)
+        payloads = step.get(
+            "payloads",
+            [
+                "' OR '1'='1",
+                "' OR 1=1--",
+                "admin'--",
+                "' UNION SELECT NULL--",
+                "1; DROP TABLE users--",
+            ],
+        )
+
+        sql_indicators = [
+            "sql syntax",
+            "mysql",
+            "sqlite",
+            "postgresql",
+            "ora-",
+            "unquoted",
+            "microsoft ole db",
+            "odbc",
+            "warning.*mysql",
+            "unclosed quotation mark",
+        ]
+
+        results = []
+        for payload in payloads:
+            try:
+                test_url = f"{url}?id={payload}"
+                async with self.session.get(test_url) as resp:
+                    body = await resp.text()
+                    has_sql_error = any(ind in body.lower() for ind in sql_indicators)
+                    results.append(
+                        {
+                            "payload": payload,
+                            "status": resp.status,
+                            "sql_error": has_sql_error,
+                            "response_preview": body[:200] if has_sql_error else "",
+                        }
+                    )
+                    if has_sql_error:
+                        return {
+                            "success": True,
+                            "evidence": f"SQL injection confirmed: {payload} → SQL error reflected",
+                            "data": {"results": results, "confirmed": True},
+                        }
+            except Exception:
+                continue
+
+        return {
+            "success": True,
+            "evidence": f"Tested {len(payloads)} SQL payloads, no error reflection found",
+            "data": {"results": results, "confirmed": False},
+        }
+
+    # ── Browser automation (real Playwright) ────────────────────────────────
+
+    async def _browser_action(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Execute real browser automation with Playwright."""
+        if not self.browser:
+            return {"success": False, "error": "Browser not available"}
+
+        action_type = step.get("action_type", "navigate")
+        url = step.get("url", self.target_url)
+        selector = step.get("selector", "")
+        value = step.get("value", "")
+
+        page = await self.browser.new_page()
+        evidence = {"url": url, "action": action_type}
+
+        try:
+            if action_type == "navigate":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                evidence["title"] = await page.title()
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"nav_{step.get('step', 0)}"
+                )
+
+            elif action_type == "click":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                if selector:
+                    await page.click(selector)
+                    await page.wait_for_load_state("domcontentloaded")
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"click_{step.get('step', 0)}"
+                )
+
+            elif action_type == "fill":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                if selector and value:
+                    await page.fill(selector, value)
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"fill_{step.get('step', 0)}"
+                )
+
+            elif action_type == "fill_and_submit":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                if selector and value:
+                    await page.fill(selector, value)
+                    # Try to find and click submit button
+                    submit = await page.query_selector(
+                        "button[type=submit], input[type=submit], button:has-text('Login'), button:has-text('Submit')"
+                    )
+                    if submit:
+                        await submit.click()
+                        await page.wait_for_load_state("domcontentloaded")
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"submit_{step.get('step', 0)}"
+                )
+                evidence["final_url"] = page.url
+
+            elif action_type == "check_auth_bypass":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                # Check if we can access protected resource without auth
+                content = await page.content()
+                has_login_form = bool(await page.query_selector("input[type=password]"))
+                has_dashboard = any(
+                    kw in content.lower() for kw in ["dashboard", "welcome", "logout", "admin"]
+                )
+                evidence["has_login_form"] = has_login_form
+                evidence["has_dashboard"] = has_dashboard
+                evidence["bypassed"] = has_dashboard and not has_login_form
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"bypass_{step.get('step', 0)}"
+                )
+
+            elif action_type == "screenshot":
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"capture_{step.get('step', 0)}"
+                )
+                evidence["title"] = await page.title()
+
+            elif action_type == "intercept_requests":
+                captured_requests = []
+
+                async def on_request(request):
+                    captured_requests.append(
+                        {
+                            "method": request.method,
+                            "url": request.url,
+                            "headers": dict(request.headers),
+                        }
+                    )
+
+                page.on("request", on_request)
+                await page.goto(url, wait_until="domcontentloaded", timeout=10000)
+                await page.wait_for_timeout(2000)  # let requests settle
+                evidence["captured_requests"] = captured_requests[:20]
+                evidence["request_count"] = len(captured_requests)
+                evidence["screenshot"] = await self._capture_screenshot(
+                    page, f"intercept_{step.get('step', 0)}"
+                )
+
+            else:
+                evidence["error"] = f"Unknown browser action: {action_type}"
+
+            return {
+                "success": True,
+                "evidence": f"Browser {action_type} on {url}",
+                "data": evidence,
+            }
+
+        except Exception as e:
+            evidence["error"] = str(e)
+            return {
+                "success": False,
+                "evidence": f"Browser action failed: {e}",
+                "data": evidence,
+            }
+        finally:
+            await page.close()
+
+    # ── Code scan (static) ──────────────────────────────────────────────────
+
+    async def _code_scan(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Scan codebase for vulnerability patterns."""
+        patterns = step.get("patterns", [])
+        findings = []
+
+        for py_file in sorted(self.root.rglob("*.py")):
+            if ".patchi" in str(py_file) or "__pycache__" in str(py_file):
+                continue
+            try:
+                content = py_file.read_text(encoding="utf-8", errors="ignore")
+            except OSError:
+                continue
+
+            for pattern in patterns:
+                if pattern.lower() in content.lower():
+                    # Find the line
+                    for i, line in enumerate(content.splitlines(), 1):
+                        if pattern.lower() in line.lower():
+                            findings.append(
+                                {
+                                    "file": str(py_file.relative_to(self.root)),
+                                    "line": i,
+                                    "pattern": pattern,
+                                    "context": line.strip()[:100],
+                                }
+                            )
+                            break
+
+        return {
+            "success": True,
+            "evidence": f"Scanned for {len(patterns)} patterns, found {len(findings)} matches",
+            "data": {"findings": findings[:20]},
+        }
+
+    # ── JWT tool ────────────────────────────────────────────────────────────
+
+    async def _jwt_tool(self, step: dict, scenario: dict, context: dict) -> dict:
+        """Manipulate JWT tokens for auth testing."""
+        action = step.get("jwt_action", "decode")
+        token = step.get("token", "")
+
+        try:
+            import base64
+            import json as _json
+
+            if action == "decode" and token:
+                # Decode JWT without verification
+                parts = token.split(".")
+                if len(parts) >= 2:
+                    # Decode payload
+                    payload = parts[1] + "=" * (4 - len(parts[1]) % 4)
+                    decoded = _json.loads(base64.urlsafe_b64decode(payload))
+                    return {
+                        "success": True,
+                        "evidence": f"JWT decoded: {list(decoded.keys())}",
+                        "data": {
+                            "header": _json.loads(base64.urlsafe_b64decode(parts[0] + "==")),
+                            "payload": decoded,
+                        },
+                    }
+
+            elif action == "alg_none":
+                # Try to forge token with alg:none
+                if token:
+                    parts = token.split(".")
+                    if len(parts) >= 3:
+                        forged = parts[0] + "." + parts[1] + "."
+                        return {
+                            "success": True,
+                            "evidence": "Forged JWT with alg:none (test if server accepts)",
+                            "data": {"forged_token": forged[:100]},
+                        }
+
+            return {"success": False, "error": f"Unknown JWT action: {action}"}
+
+        except Exception as e:
+            return {"success": False, "error": str(e)}
+
+
+class RedTeamEngine:
+    """
+    Main Red Team Engine.
+
+    Orchestrates attack scenarios, manages execution, and produces reports.
+    """
+
+    def __init__(
+        self,
+        root: Path,
+        target_url: str = None,
+        safe_mode: bool = True,
+        on_progress: Callable[[str], None] = None,
+    ):
+        self.root = root
+        self.target_url = target_url
+        self.safe_mode = safe_mode
+        self.on_progress = on_progress or (lambda _: None)
+        self.scenarios_dir = root / "patchi" / "core" / "security" / "attack_scenarios"
+        self._scenarios_cache: dict[str, dict] = {}
+        self.domain_loader = DomainLoader(root)
+
+    def _load_scenarios(self) -> dict[str, dict]:
+        """Load all attack scenarios from YAML files."""
+        if self._scenarios_cache:
+            return self._scenarios_cache
+
+        scenarios = {}
+        if self.scenarios_dir.exists():
+            for yaml_file in self.scenarios_dir.glob("*.yaml"):
+                try:
+                    with open(yaml_file) as f:
+                        data = yaml.safe_load(f)
+                    if data and "scenarios" in data:
+                        for scenario in data["scenarios"]:
+                            scenarios[scenario["id"]] = scenario
+                except Exception as e:
+                    _log.warning(f"Failed to load scenarios from {yaml_file}: {e}")
+
+        self._scenarios_cache = scenarios
+        return scenarios
+
+    def select_scenarios(
+        self,
+        project_context: dict,
+        scope: str = "full",
+        intensity: str = "active",
+        forced_scenarios: list[str] = None,
+    ) -> list[dict]:
+        """Select relevant attack scenarios based on project context."""
+        all_scenarios = self._load_scenarios()
+        forced_scenarios = forced_scenarios or []
+
+        # Get active security domains
+        project_context.get("active_security_domains", [])
+        frameworks = [f.get("name", "").lower() for f in project_context.get("frameworks", [])]
+        component_type = project_context.get("component_type", "")
+
+        # Score scenarios
+        # Active domains use compound ids ("injection-sql"); scenario categories
+        # are simple tokens ("injection", "sql"). Match on both the full id and
+        # its hyphen-split parts so a domain activates its whole family.
+        domain_tokens: set[str] = set()
+        for d in project_context.get("active_security_domains", []):
+            domain_tokens.update(str(d).lower().split("-"))
+
+        scored = []
+        for scenario_id, scenario in all_scenarios.items():
+            score = 0
+
+            # Domain match (full id beats individual token)
+            sid_lower = scenario_id.lower()
+            for d in project_context.get("active_security_domains", []):
+                if str(d).lower() == sid_lower:
+                    score += 15
+                    break
+
+            category = scenario.get("category", "")
+            subcategory = scenario.get("subcategory", "")
+            if category and category in domain_tokens:
+                score += 6
+            if subcategory and subcategory in domain_tokens:
+                score += 8  # subcategory is a precise match — weight it highest
+
+            # Framework match
+            for fw in frameworks:
+                if fw in scenario_id.lower() or fw in category:
+                    score += 3
+
+            # Component type match
+            if component_type:
+                if "frontend" in component_type and "xss" in scenario_id:
+                    score += 5
+                if "backend" in component_type and "sqli" in scenario_id:
+                    score += 5
+                if "backend" in component_type and "sql" in subcategory:
+                    score += 5
+                if "api" in component_type and "auth" in scenario_id:
+                    score += 5
+
+            # Scope filter
+            if scope == "api" and "browser" in scenario_id:
+                score -= 10
+            if scope == "web" and "sql" in scenario_id:
+                score -= 5
+
+            # Intensity filter
+            if intensity == "passive" and scenario.get("severity") == "critical":
+                score -= 5
+
+            # Forced scenarios get high score
+            if scenario_id in forced_scenarios:
+                score += 100
+
+            if score > 0:
+                scored.append((score, scenario))
+
+        # Sort by score
+        scored.sort(key=lambda x: x[0], reverse=True)
+
+        # Limit based on intensity
+        max_scenarios = {"passive": 10, "active": 25, "aggressive": 50}.get(intensity, 25)
+        selected = [s for _, s in scored[:max_scenarios]]
+
+        _log.info(f"Selected {len(selected)} scenarios for {scope}/{intensity} assessment")
+        return selected
+
+    async def run_assessment(
+        self,
+        project_context: dict,
+        scope: str = "full",
+        intensity: str = "active",
+        forced_scenarios: list[str] = None,
+        max_scenarios: int = None,
+    ) -> RedTeamReport:
+        """Run a complete red team assessment."""
+        assessment_id = f"rt-{uuid.uuid4().hex[:8]}"
+        start_time = time.monotonic()
+
+        self.on_progress(f"🎯 Starting Red Team Assessment: {assessment_id}")
+        self.on_progress(
+            f"   Scope: {scope} | Intensity: {intensity} | Safe Mode: {self.safe_mode}"
+        )
+
+        # Select scenarios
+        scenarios = self.select_scenarios(project_context, scope, intensity, forced_scenarios)
+        if max_scenarios:
+            scenarios = scenarios[:max_scenarios]
+
+        self.on_progress(f"📋 Selected {len(scenarios)} attack scenarios")
+
+        # Initialize executor
+        evidence_dir = self.root / ".patchi" / "evidence" / assessment_id
+        executor = AttackExecutor(
+            self.root,
+            target_url=self.target_url,
+            safe_mode=self.safe_mode,
+            on_progress=self.on_progress,
+            evidence_dir=evidence_dir,
+        )
+        await executor.initialize()
+
+        report = RedTeamReport(
+            assessment_id=assessment_id,
+            project_root=str(self.root),
+            scope=scope,
+            intensity=intensity,
+        )
+
+        try:
+            # Run scenarios
+            for i, scenario in enumerate(scenarios):
+                self.on_progress(f"⚔️  Scenario {i + 1}/{len(scenarios)}: {scenario['name']}")
+
+                result = await self._run_scenario(scenario, executor, project_context)
+                report.scenarios_run.append(result)
+
+                # Count findings
+                report.total_findings += len(result.findings)
+                for finding in result.findings:
+                    sev = finding.severity.value
+                    report.by_severity[sev] = report.by_severity.get(sev, 0) + 1
+
+                # Collect remediation playbooks
+                playbook = scenario.get("remediation_playbook")
+                if playbook and playbook not in report.remediation_playbooks:
+                    report.remediation_playbooks.append(playbook)
+
+            # Capture evidence from executor
+            report.exploit_evidence = {
+                "screenshots": len(
+                    [e for e in executor.get_evidence() if e.get("data", {}).get("screenshot")]
+                ),
+                "total_steps": len(executor.get_evidence()),
+                "evidence_dir": str(executor._evidence_dir),
+                "evidence": executor.get_evidence()[:50],
+            }
+
+        finally:
+            await executor.cleanup()
+
+        report.completed_at = datetime.now(UTC).isoformat()
+        report.duration_ms = int((time.monotonic() - start_time) * 1000)
+
+        self.on_progress(
+            f"✅ Assessment complete: {report.total_findings} findings in {report.duration_ms}ms"
+        )
+
+        # Save report
+        await self._save_report(report)
+
+        return report
+
+    async def _run_scenario(
+        self,
+        scenario: dict,
+        executor: AttackExecutor,
+        project_context: dict,
+    ) -> ScenarioResult:
+        """Run a single attack scenario."""
+        scenario_id = scenario["id"]
+        start_time = time.monotonic()
+
+        result = ScenarioResult(
+            scenario_id=scenario_id,
+            scenario_name=scenario["name"],
+            status="running",
+            total_steps=len(scenario.get("attack_steps", [])),
+        )
+
+        steps = scenario.get("attack_steps", [])
+        context = {"scenario": scenario, "project_context": project_context}
+
+        for step in steps:
+            step_result = await executor.execute_step(step, scenario, context)
+            result.step_results.append(step_result)
+            result.steps_completed += 1
+
+            if not step_result.success and step.get("required", True):
+                result.status = "failed"
+                break
+
+        if result.status == "running":
+            result.status = "success"
+
+        # Generate findings from successful steps
+        result.findings = self._generate_findings(scenario, result)
+
+        # Collect exploit evidence
+        result.exploit_evidence = self._collect_evidence(scenario, result)
+
+        result.completed_at = datetime.now(UTC).isoformat()
+        result.duration_ms = int((time.monotonic() - start_time) * 1000)
+
+        return result
+
+    def _generate_findings(self, scenario: dict, result: ScenarioResult) -> list[Finding]:
+        """Generate findings from scenario results."""
+        findings = []
+
+        if result.status != "success":
+            return findings
+
+        # Create finding based on scenario
+        finding = Finding(
+            agent="RedTeamEngine",
+            type=scenario.get("category", "attack"),
+            severity=Severity(scenario.get("severity", "high")),
+            file="",
+            line=0,
+            message=f"{scenario['name']}: {scenario.get('description', '')}",
+            detail=f"Attack scenario {scenario['id']} completed successfully. Steps: {result.steps_completed}/{result.total_steps}",
+            cwe=scenario.get("cwe", ""),
+            suggestion=f"Apply remediation playbook: {scenario.get('remediation_playbook', 'manual review')}",
+            extra={
+                "owasp": scenario.get("owasp", ""),
+                "remediation_playbook": scenario.get("remediation_playbook", ""),
+                "tags": scenario.get("tags", []),
+                "scenario_id": scenario["id"],
+            },
+        )
+        findings.append(finding)
+
+        # Add findings for each successful step with evidence
+        for step_result in result.step_results:
+            if step_result.success and step_result.evidence:
+                step_finding = Finding(
+                    agent="RedTeamEngine",
+                    type=f"{scenario.get('category', 'attack')}.step",
+                    severity=Severity.MEDIUM,
+                    file="",
+                    line=0,
+                    message=f"Step {step_result.step} ({step_result.action}): {step_result.evidence}",
+                    detail=f"Attack step evidence: {step_result.evidence}",
+                    tags=["evidence", "step"],
+                )
+                findings.append(step_finding)
+
+        return findings
+
+    def _collect_evidence(self, scenario: dict, result: ScenarioResult) -> dict:
+        """Collect exploit evidence for reporting."""
+        return {
+            "scenario_id": scenario["id"],
+            "steps": [
+                {
+                    "step": sr.step,
+                    "action": sr.action,
+                    "success": sr.success,
+                    "evidence": sr.evidence,
+                    "duration_ms": sr.duration_ms,
+                }
+                for sr in result.step_results
+            ],
+            "detection_signatures": scenario.get("detection_signatures", []),
+            "verification_method": scenario.get("verification", []),
+        }
+
+    async def _save_report(self, report: RedTeamReport):
+        """Save report to memory and file."""
+        from patchi.core import memory as mem
+
+        # Save to scan results
+        mem.save_scan_result(
+            "RedTeamEngine",
+            {
+                "assessment_id": report.assessment_id,
+                "findings": [f.to_dict() for sr in report.scenarios_run for f in sr.findings],
+                "summary": {
+                    "total_findings": report.total_findings,
+                    "by_severity": report.by_severity,
+                    "scenarios_run": len(report.scenarios_run),
+                    "duration_ms": report.duration_ms,
+                },
+            },
+            self.root,
+        )
+
+        # Save detailed report as JSON
+        report_path = self.root / ".patchi" / "reports" / f"redteam_{report.assessment_id}.json"
+        report_path.parent.mkdir(parents=True, exist_ok=True)
+
+        import json
+
+        report_data = {
+            "assessment_id": report.assessment_id,
+            "project_root": report.project_root,
+            "scope": report.scope,
+            "intensity": report.intensity,
+            "started_at": report.started_at,
+            "completed_at": report.completed_at,
+            "duration_ms": report.duration_ms,
+            "total_findings": report.total_findings,
+            "by_severity": report.by_severity,
+            "scenarios": [
+                {
+                    "id": sr.scenario_id,
+                    "name": sr.scenario_name,
+                    "status": sr.status,
+                    "steps_completed": sr.steps_completed,
+                    "total_steps": sr.total_steps,
+                    "findings": [f.to_dict() for f in sr.findings],
+                    "evidence": sr.exploit_evidence,
+                    "duration_ms": sr.duration_ms,
+                }
+                for sr in report.scenarios_run
+            ],
+            "remediation_playbooks": report.remediation_playbooks,
+        }
+
+        try:
+            report_path.write_text(json.dumps(report_data, indent=2))
+        except Exception as e:
+            _log.warning(f"Failed to save red team report: {e}")
+
+    async def verify_fixes(
+        self,
+        patch_ids: list[str],
+        project_context: dict,
+    ) -> dict:
+        """Verify fixes by re-running relevant attack scenarios."""
+        self.on_progress(f"🔍 Verifying {len(patch_ids)} fixes...")
+
+        # Get findings associated with patches
+        from patchi.core.fix.patch import list_patches
+
+        patches = list_patches(self.root)
+
+        for patch_id in patch_ids:
+            patch = next((p for p in patches if p.get("id") == patch_id), None)
+            if patch:
+                # Related findings wiring: deferred to post-assessment correlation
+                _log.debug("patch %s found for re-assessment", patch_id)
+
+        # For now, run a focused assessment
+        verification_report = await self.run_assessment(
+            project_context,
+            scope="targeted",
+            intensity="active",
+            max_scenarios=10,
+        )
+
+        verified = 0
+        for sr in verification_report.scenarios_run:
+            if sr.status != "success":
+                verified += 1
+
+        return {
+            "verified_fixes": verified,
+            "total_patches": len(patch_ids),
+            "verification_report_id": verification_report.assessment_id,
+            "remaining_vulnerabilities": verification_report.total_findings,
+        }
+
+
+# Convenience function for CLI
+async def run_red_team(
+    root: Path,
+    target_url: str = None,
+    safe_mode: bool = True,
+    scope: str = "full",
+    intensity: str = "active",
+    on_progress: Callable[[str], None] = None,
+) -> RedTeamReport:
+    """Run a red team assessment."""
+    # Get project context from brain
+    from patchi.core import memory as mem
+
+    brain = mem.get_brain(root)
+
+    project_context = {
+        "project_purpose": brain.get("project_purpose", ""),
+        "project_domain": brain.get("project_domain", ""),
+        "frameworks": brain.get("frameworks", []),
+        "active_security_domains": brain.get("active_security_domains", []),
+        "component_type": brain.get("component_type", ""),
+    }
+
+    engine = RedTeamEngine(root, target_url, safe_mode, on_progress)
+    return await engine.run_assessment(project_context, scope, intensity)
+
+
+# Agent wrapper for integration with Patchi's agent system
+@register
+class RedTeamEngineAgent(BaseAgent):
+    """Red Team Engine as a Patchi agent."""
+
+    name = "RedTeamEngineAgent"
+    group = AgentGroup.SECURITY
+    timeout = 600  # 10 minutes
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Get project context from brain
+        project_context = {
+            "project_purpose": inp.brain.get("project_purpose", ""),
+            "project_domain": inp.brain.get("project_domain", ""),
+            "frameworks": inp.brain.get("frameworks", []),
+            "active_security_domains": inp.brain.get("active_security_domains", []),
+            "component_type": inp.brain.get("component_type", ""),
+        }
+
+        # Get config
+        target_url = inp.extra.get("target_url")
+        safe_mode = inp.extra.get("safe_mode", True)
+        scope = inp.extra.get("scope", "full")
+        intensity = inp.extra.get("intensity", "active")
+
+        # Run assessment
+        async def run():
+            engine = RedTeamEngine(
+                inp.root,
+                target_url=target_url,
+                safe_mode=safe_mode,
+                on_progress=lambda m: result.add_log(m),
+            )
+            return await engine.run_assessment(project_context, scope, intensity)
+
+        try:
+            loop = asyncio.get_event_loop()
+        except RuntimeError:
+            loop = asyncio.new_event_loop()
+            asyncio.set_event_loop(loop)
+
+        report = loop.run_until_complete(run())
+
+        # Add findings to result
+        for sr in report.scenarios_run:
+            for finding in sr.findings:
+                result.add_finding(finding)
+
+        result.data["red_team_report"] = {
+            "assessment_id": report.assessment_id,
+            "total_findings": report.total_findings,
+            "by_severity": report.by_severity,
+            "scenarios_run": len(report.scenarios_run),
+            "remediation_playbooks": report.remediation_playbooks,
+        }