skillctl-secure 0.28.0__py3-none-any.whl

skillctl/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.28.0"

skillctl/__main__.py

@@ -0,0 +1,5 @@
+from skillctl.entrypoint import run
+
+
+if __name__ == "__main__":
+    raise SystemExit(run())

skillctl/authcontrols.py

@@ -0,0 +1,165 @@
+from __future__ import annotations
+import ast, json, re
+from pathlib import Path
+
+PY_AUTH_DECORATORS = (
+    "login_required", "permission_required", "user_passes_test",
+    "jwt_required", "roles_required", "roles_accepted",
+    "admin_required", "auth_required", "requires_auth"
+)
+PY_AUTH_MIXINS = (
+    "LoginRequiredMixin", "PermissionRequiredMixin", "UserPassesTestMixin"
+)
+FASTAPI_MARKERS = (
+    "Depends(", "Security(", "OAuth2PasswordBearer", "HTTPBearer",
+    "APIKeyHeader", "APIKeyCookie", "APIKeyQuery"
+)
+CLAIM_WORDS = ("role", "roles", "scope", "scopes", "tenant", "tenant_id", "sub", "subject", "permissions")
+
+EXPRESS_AUTH_NAMES = re.compile(
+    r'(?i)\b(auth|authenticate|authorize|authorization|requireauth|requireadmin|'
+    r'checkrole|checkscope|permission|rbac|acl|jwt|verifytoken|verifyjwt)\b'
+)
+
+def _name(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        parts=[]
+        cur=node
+        while isinstance(cur, ast.Attribute):
+            parts.append(cur.attr); cur=cur.value
+        if isinstance(cur, ast.Name): parts.append(cur.id)
+        return ".".join(reversed(parts))
+    if isinstance(node, ast.Call):
+        return _name(node.func)
+    return ""
+
+def _segment(lines,node):
+    try:
+        s=max(1,getattr(node,"lineno",1));e=min(len(lines),getattr(node,"end_lineno",s))
+        return "\n".join(lines[s-1:e])
+    except Exception:
+        return ""
+
+def analyze_python(path:Path, rel:str)->dict:
+    try:
+        text=path.read_text(errors="replace")
+        tree=ast.parse(text)
+    except Exception:
+        return {"path":rel,"controls":[]}
+    lines=text.splitlines()
+    controls=[]
+
+    classes={}
+    for cls in [n for n in tree.body if isinstance(n,ast.ClassDef)]:
+        bases=[_name(x) for x in cls.bases]
+        matches=[b for b in bases if any(m in b for m in PY_AUTH_MIXINS)]
+        if matches:
+            classes[cls.name]=matches
+            controls.append({
+                "kind":"django-auth-mixin","path":rel,"line":getattr(cls,"lineno",0),
+                "class":cls.name,"controls":matches,"confidence":"high"
+            })
+
+    for fn in [n for n in ast.walk(tree) if isinstance(n,(ast.FunctionDef,ast.AsyncFunctionDef))]:
+        decorators=[_name(d) for d in fn.decorator_list]
+        auth_decs=[d for d in decorators if any(marker in d for marker in PY_AUTH_DECORATORS)]
+        if auth_decs:
+            controls.append({
+                "kind":"python-auth-decorator","path":rel,"line":getattr(fn,"lineno",0),
+                "function":fn.name,"controls":auth_decs,"confidence":"high"
+            })
+
+        fn_src=_segment(lines,fn)
+        if any(marker in fn_src for marker in FASTAPI_MARKERS):
+            controls.append({
+                "kind":"fastapi-security-dependency","path":rel,"line":getattr(fn,"lineno",0),
+                "function":fn.name,"controls":[m for m in FASTAPI_MARKERS if m in fn_src],"confidence":"medium"
+            })
+
+        # Claims / principal based checks.
+        lower=fn_src.lower()
+        claim_hits=[]
+        for word in CLAIM_WORDS:
+            if re.search(rf'(?i)(current_user|g\.user|request\.user|claims?|payload|token|principal).{{0,80}}\b{re.escape(word)}\b', fn_src, re.S):
+                claim_hits.append(word)
+        if claim_hits:
+            controls.append({
+                "kind":"claims-authorization-check","path":rel,"line":getattr(fn,"lineno",0),
+                "function":fn.name,"claims":sorted(set(claim_hits)),"confidence":"medium"
+            })
+
+        # Explicit object/tenant comparisons.
+        object_guard_patterns = [
+            r'\b(?:current_user|request\.user|g\.user|principal)\.id\s*[=!]=',
+            r'\btenant_id\s*[=!]=',
+            r'\bowner_id\s*[=!]=',
+            r'\baccount_id\s*[=!]=',
+            r'\buser_id\s*[=!]=\s*(?:current_user|request\.user|g\.user|principal)\.id',
+            r'\b(?:authorize|can_access|has_permission|check_permission|is_allowed)\s*\(',
+        ]
+        hits=[p for p in object_guard_patterns if re.search(p,lower)]
+        if hits:
+            controls.append({
+                "kind":"object-authorization-guard","path":rel,"line":getattr(fn,"lineno",0),
+                "function":fn.name,"patterns":hits,"confidence":"high"
+            })
+
+    return {"path":rel,"controls":controls}
+
+def analyze_express(path:Path, rel:str)->dict:
+    try:text=path.read_text(errors="replace")
+    except Exception:return {"path":rel,"controls":[]}
+    controls=[]
+    route_rx=re.compile(
+        r'(?is)\b(?:app|router)\.(get|post|put|patch|delete|use)\s*\((.*?)\)\s*;?'
+    )
+    for m in route_rx.finditer(text):
+        body=m.group(2)
+        # The first argument is usually path; middleware follows.
+        if EXPRESS_AUTH_NAMES.search(body):
+            line=text[:m.start()].count("\n")+1
+            controls.append({
+                "kind":"express-auth-middleware","path":rel,"line":line,
+                "method":m.group(1).upper(),
+                "evidence":body[:500],
+                "confidence":"medium"
+            })
+
+    # JWT claim/role checks anywhere in file.
+    for rx,kind in [
+        (re.compile(r'(?i)\b(req\.user|req\.auth|jwt|claims?|payload).{0,100}\b(role|roles|scope|permissions|tenant)\b'),"express-claims-check"),
+        (re.compile(r'(?i)\b(jwt\.verify|jsonwebtoken\.verify|verifyToken|verifyJwt)\b'),"express-jwt-verification"),
+    ]:
+        for m in rx.finditer(text):
+            controls.append({
+                "kind":kind,"path":rel,"line":text[:m.start()].count("\n")+1,
+                "evidence":m.group(0)[:300],"confidence":"medium"
+            })
+    return {"path":rel,"controls":controls}
+
+def analyze_target(target:Path, canonical_files:list[str]|None=None)->dict:
+    target=Path(target).resolve()
+    files=canonical_files or [str(p.relative_to(target)) for p in target.rglob("*") if p.is_file()]
+    result={"schema_version":1,"controls":[]}
+    for rel in files:
+        p=target/rel
+        if not p.is_file(): continue
+        low=rel.lower()
+        if low.endswith(".py"):
+            result["controls"].extend(analyze_python(p,rel)["controls"])
+        elif low.endswith((".js",".jsx",".ts",".tsx")):
+            result["controls"].extend(analyze_express(p,rel)["controls"])
+    return result
+
+def controls_for_function(auth_data:dict,path:str,function:str)->list[dict]:
+    return [
+        c for c in auth_data.get("controls",[])
+        if c.get("path")==path and (not c.get("function") or c.get("function")==function)
+    ]
+
+def write_auth_controls(target:Path,evidence:dict,path:Path)->dict:
+    data=analyze_target(target,evidence.get("canonical_files"))
+    Path(path).write_text(json.dumps(data,indent=2)+"\n")
+    return data

skillctl/benchmark.py

@@ -0,0 +1,150 @@
+from __future__ import annotations
+import json, re
+from pathlib import Path
+from dataclasses import dataclass, asdict
+import yaml
+
+SEV = {"info":0, "low":1, "medium":2, "high":3, "critical":4}
+
+@dataclass
+class FindingScore:
+    id: str
+    detected: bool
+    evidence: bool
+    severity_score: float
+    confidence_match: bool
+    matched_finding: str = ""
+    notes: str = ""
+
+def _norm(s): return str(s or "").strip().lower()
+
+def _load_structured(workspace: Path):
+    p=workspace/"70-biso"/"findings.json"
+    if not p.exists(): return []
+    try:
+        data=json.loads(p.read_text())
+        return data.get("findings",[]) if data.get("schema_version")==1 else []
+    except Exception:
+        return []
+
+def _reports(workspace):
+    files=[p for p in workspace.rglob("*.md") if p.is_file()]
+    text="\n".join(p.read_text(errors="replace") for p in files)
+    return text,files
+
+def _terms(f):
+    blob=" ".join([
+        str(f.get("title","")),
+        " ".join(f.get("concepts",[]) or []),
+        " ".join(f.get("attack_path",[]) or []),
+        str(f.get("business_impact","")),
+        str(f.get("required_action","")),
+    ]).lower()
+    return blob
+
+def _match(expected, actual):
+    blob=_terms(actual)
+    concepts=[x.lower() for x in expected.get("concepts_any",[])]
+    req=[x.lower() for x in expected.get("required_terms",[])]
+    evidence_blob=" ".join(
+        f"{e.get('path','')} {e.get('lines','')} {e.get('note','')}"
+        for e in actual.get("evidence",[]) or []
+    ).lower()
+    req_hits=sum(1 for x in req if x in blob or x in evidence_blob)
+    concept_hit=any(x in blob for x in concepts) if concepts else True
+    return req_hits + (2 if concept_hit else 0)
+
+def _severity_score(expected, actual):
+    e=SEV.get(_norm(expected),-1); a=SEV.get(_norm(actual),-1)
+    if e<0 or a<0:return 0.0
+    if a==e:return 1.0
+    if a>e:return 0.9  # conservative overrating: nearly full credit, flagged for review
+    if a==e-1:return 0.5
+    return 0.0
+
+def evaluate(workspace:Path, answer_key:Path):
+    key=yaml.safe_load(answer_key.read_text())
+    structured=_load_structured(workspace)
+    prose,files=_reports(workspace)
+    scores=[]; used=set()
+
+    for exp in key["expected_findings"]:
+        best=None;bestscore=0;besti=-1
+        for i,f in enumerate(structured):
+            if i in used:continue
+            s=_match(exp,f)
+            if s>bestscore:bestscore=s;best=f;besti=i
+        detected=best is not None and bestscore>=3
+        if detected:used.add(besti)
+
+        # prose fallback only for detection if structured output absent/missed
+        if not detected:
+            low=prose.lower()
+            req=all(x.lower() in low for x in exp.get("required_terms",[]))
+            concept=any(x.lower() in low for x in exp.get("concepts_any",[]))
+            detected=req and concept
+
+        evidence=False; sevscore=0.0; conf=False; matched=""
+        if best is not None and bestscore>=3:
+            evpaths=[_norm(e.get("path")) for e in best.get("evidence",[]) or []]
+            evidence=any(any(_norm(want) in p for p in evpaths) for want in exp.get("evidence_any",[]))
+            sevscore=_severity_score(exp.get("severity"),best.get("severity"))
+            conf=_norm(best.get("confidence"))==_norm(exp.get("confidence"))
+            matched=str(best.get("id",""))
+        scores.append(FindingScore(exp["id"],detected,evidence,sevscore,conf,matched))
+
+    low=prose.lower()
+    forbidden=[]
+    for nf in key.get("expected_non_findings",[]):
+        for claim in nf.get("forbidden_claims",[]):
+            if claim.lower() in low:forbidden.append({"id":nf["id"],"claim":claim})
+
+    final=workspace/"70-biso"/"security-review.md"
+    disposition=False
+    if final.exists():
+        ft=final.read_text(errors="replace").upper()
+        disposition=any(x.upper() in ft for x in key["security_properties"]["expected_final_disposition_any"])
+
+    n=len(scores)
+    detected=sum(x.detected for x in scores)
+    evidence=sum(x.evidence for x in scores)
+    sev=sum(x.severity_score for x in scores)
+    conf=sum(x.confidence_match for x in scores)
+    summary={
+        "expected_findings":n,
+        "detected":detected,
+        "recall":round(detected/n,3),
+        "evidence_accuracy":round(evidence/n,3),
+        "severity_score":round(sev/n,3),
+        "confidence_match_rate":round(conf/n,3),
+        "forbidden_claims":len(forbidden),
+        "disposition_acceptable":disposition,
+        "structured_findings":len(structured),
+        "unmatched_structured_findings":max(0,len(structured)-len(used))
+    }
+    return {"benchmark":key["benchmark"],"summary":summary,"findings":[asdict(x) for x in scores],"forbidden_hits":forbidden}
+
+def render_markdown(result):
+    s=result["summary"]
+    rows="\n".join(
+        f"| {f['id']} | {'✓' if f['detected'] else '✗'} | {'✓' if f['evidence'] else '✗'} | "
+        f"{f['severity_score']:.1f} | {'✓' if f['confidence_match'] else '✗'} | {f['matched_finding'] or '-'} |"
+        for f in result["findings"]
+    )
+    return f"""# Benchmark Results — Evaluator 2.0
+
+- Expected findings: {s['expected_findings']}
+- Detected: {s['detected']}
+- Recall: {s['recall']:.1%}
+- Evidence accuracy: {s['evidence_accuracy']:.1%}
+- Severity score: {s['severity_score']:.1%}
+- Confidence match rate: {s['confidence_match_rate']:.1%}
+- Structured findings emitted: {s['structured_findings']}
+- Unmatched structured findings: {s['unmatched_structured_findings']}
+- Unsupported forbidden claims: {s['forbidden_claims']}
+- Final disposition acceptable: {s['disposition_acceptable']}
+
+| Expected | Detected | Evidence | Severity credit | Confidence | Matched finding |
+| --- | --- | --- | ---: | --- | --- |
+{rows}
+"""

skillctl/browsercontrols.py

@@ -0,0 +1,200 @@
+from __future__ import annotations
+import json, re
+from pathlib import Path
+
+SECURITY_HEADERS = {
+    "content-security-policy": "csp",
+    "content-security-policy-report-only": "csp-report-only",
+    "strict-transport-security": "hsts",
+    "x-content-type-options": "x-content-type-options",
+    "referrer-policy": "referrer-policy",
+    "permissions-policy": "permissions-policy",
+    "cross-origin-opener-policy": "coop",
+    "cross-origin-resource-policy": "corp",
+    "cross-origin-embedder-policy": "coep",
+    "x-frame-options": "x-frame-options",
+}
+
+def _read(path: Path) -> str:
+    try:
+        return path.read_text(errors="replace")
+    except Exception:
+        return ""
+
+def analyze_html(path: Path, rel: str) -> dict:
+    text = _read(path)
+    controls = []
+    scripts = []
+    iframes = []
+
+    for m in re.finditer(r'(?is)<meta[^>]+http-equiv=["\']([^"\']+)["\'][^>]+content=["\']([^"\']*)["\']', text):
+        name = m.group(1).strip().lower()
+        if name in SECURITY_HEADERS:
+            controls.append({
+                "kind": SECURITY_HEADERS[name],
+                "path": rel,
+                "line": text[:m.start()].count("\n") + 1,
+                "value": m.group(2)[:500],
+                "confidence": "high"
+            })
+
+    for m in re.finditer(r'(?is)<script\b([^>]*)>', text):
+        attrs = m.group(1)
+        srcm = re.search(r'(?i)\bsrc=["\']([^"\']+)["\']', attrs)
+        if not srcm:
+            continue
+        src = srcm.group(1)
+        sri = re.search(r'(?i)\bintegrity=["\']([^"\']+)["\']', attrs)
+        cross = re.search(r'(?i)\bcrossorigin(?:=["\']([^"\']*)["\'])?', attrs)
+        scripts.append({
+            "path": rel,
+            "line": text[:m.start()].count("\n") + 1,
+            "src": src,
+            "external": src.startswith(("http://", "https://", "//")),
+            "integrity_present": bool(sri),
+            "crossorigin_present": bool(cross),
+        })
+
+    for m in re.finditer(r'(?is)<iframe\b([^>]*)>', text):
+        attrs = m.group(1)
+        srcm = re.search(r'(?i)\bsrc=["\']([^"\']+)["\']', attrs)
+        sandbox = re.search(r'(?i)\bsandbox(?:=["\']([^"\']*)["\'])?', attrs)
+        allow = re.search(r'(?i)\ballow=["\']([^"\']+)["\']', attrs)
+        iframes.append({
+            "path": rel,
+            "line": text[:m.start()].count("\n") + 1,
+            "src": srcm.group(1) if srcm else "",
+            "sandbox_present": bool(sandbox),
+            "sandbox_value": (sandbox.group(1) or "") if sandbox else "",
+            "allow": allow.group(1) if allow else "",
+        })
+
+    return {"controls": controls, "scripts": scripts, "iframes": iframes}
+
+def analyze_code(path: Path, rel: str) -> dict:
+    text = _read(path)
+    low = text.lower()
+    controls = []
+    cookies = []
+    cors = []
+    framework = []
+
+    # Generic response-header assignments.
+    for header, kind in SECURITY_HEADERS.items():
+        for m in re.finditer(re.escape(header), low):
+            controls.append({
+                "kind": kind,
+                "path": rel,
+                "line": text[:m.start()].count("\n") + 1,
+                "value": "",
+                "confidence": "medium"
+            })
+
+    # CORS frameworks/config.
+    patterns = [
+        (r'(?i)\bCORS\s*\(', "flask-cors"),
+        (r'(?i)\bcors\s*\(', "express-cors"),
+        (r'(?i)\bAccess-Control-Allow-Origin\b', "cors-header"),
+    ]
+    for pat, kind in patterns:
+        for m in re.finditer(pat, text):
+            line = text[:m.start()].count("\n") + 1
+            snippet = text[m.start():m.start()+350]
+            wildcard = "*" in snippet
+            credentials = bool(re.search(r'(?i)(supports_credentials|credentials)\s*[:=]\s*(true|True)', snippet))
+            cors.append({
+                "kind": kind,
+                "path": rel,
+                "line": line,
+                "wildcard_observed": wildcard,
+                "credentials_observed": credentials,
+                "evidence": snippet[:300]
+            })
+
+    # Security middleware/frameworks.
+    framework_patterns = [
+        (r'(?i)\bTalisman\s*\(', "flask-talisman"),
+        (r'(?i)\bhelmet\s*\(', "express-helmet"),
+        (r'(?i)\bsecure_headers\b', "secure-headers"),
+    ]
+    for pat, kind in framework_patterns:
+        for m in re.finditer(pat, text):
+            framework.append({
+                "kind": kind,
+                "path": rel,
+                "line": text[:m.start()].count("\n") + 1,
+                "confidence": "medium"
+            })
+
+    # Cookie security settings.
+    cookie_markers = [
+        ("secure", r'(?i)\bsecure\s*[:=]\s*(true|True)'),
+        ("httponly", r'(?i)\bhttponly\s*[:=]\s*(true|True)'),
+        ("samesite", r'(?i)\bsamesite\s*[:=]\s*["\']?(strict|lax|none)'),
+    ]
+    if re.search(r'(?i)(set_cookie|res\.cookie|session_cookie)', text):
+        flags = {}
+        for name, pat in cookie_markers:
+            m = re.search(pat, text)
+            flags[name] = m.group(1).lower() if m and name == "samesite" else bool(m)
+        cookies.append({
+            "path": rel,
+            "line": 1,
+            "secure": flags.get("secure", False),
+            "httponly": flags.get("httponly", False),
+            "samesite": flags.get("samesite", False),
+            "confidence": "medium"
+        })
+
+    return {"controls": controls, "cookies": cookies, "cors": cors, "framework": framework}
+
+def analyze_target(target: Path, canonical_files: list[str] | None = None) -> dict:
+    target = Path(target).resolve()
+    files = canonical_files or [str(p.relative_to(target)) for p in target.rglob("*") if p.is_file()]
+    result = {
+        "schema_version": 1,
+        "headers": [],
+        "cookies": [],
+        "cors": [],
+        "framework_controls": [],
+        "scripts": [],
+        "iframes": [],
+        "summary": {}
+    }
+
+    for rel in files:
+        p = target / rel
+        if not p.is_file():
+            continue
+        low = rel.lower()
+        if low.endswith((".html", ".htm")):
+            h = analyze_html(p, rel)
+            result["headers"].extend(h["controls"])
+            result["scripts"].extend(h["scripts"])
+            result["iframes"].extend(h["iframes"])
+        elif low.endswith((".py", ".js", ".jsx", ".ts", ".tsx", ".conf", ".nginx", ".yaml", ".yml")):
+            c = analyze_code(p, rel)
+            result["headers"].extend(c["controls"])
+            result["cookies"].extend(c["cookies"])
+            result["cors"].extend(c["cors"])
+            result["framework_controls"].extend(c["framework"])
+
+    kinds = {x["kind"] for x in result["headers"]}
+    result["summary"] = {
+        "csp_observed": "csp" in kinds,
+        "csp_report_only_observed": "csp-report-only" in kinds,
+        "hsts_observed": "hsts" in kinds,
+        "x_frame_options_observed": "x-frame-options" in kinds,
+        "external_script_count": sum(1 for x in result["scripts"] if x.get("external")),
+        "external_scripts_without_sri": sum(1 for x in result["scripts"] if x.get("external") and not x.get("integrity_present")),
+        "iframe_count": len(result["iframes"]),
+        "unsandboxed_iframe_count": sum(1 for x in result["iframes"] if not x.get("sandbox_present")),
+        "cors_entry_count": len(result["cors"]),
+        "cookie_entry_count": len(result["cookies"]),
+    }
+    return result
+
+def write_browser_controls(target: Path, evidence: dict, path: Path) -> dict:
+    data = analyze_target(target, evidence.get("canonical_files"))
+    path.write_text(json.dumps(data, indent=2) + "\n")
+    return data

skillctl/bulk_cli.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+from typing import List
+
+import typer
+from rich.table import Table
+
+from .bulk_plan import build_bulk_install_plan
+from .cli import app, console, manager
+from .cli_contract import deterministic_json
+
+
+@app.command("bulk-plan")
+def bulk_plan_cmd(
+    ctx: typer.Context,
+    skills: List[str] = typer.Argument(..., help="One or more catalog skills to plan together."),
+    json_output: bool = typer.Option(False, "--json", help="Emit the complete machine-readable aggregate plan."),
+):
+    """Preview a fail-closed multi-skill install plan without mutating the toolbox."""
+    m = manager(ctx.obj["manifest"])
+    plan = build_bulk_install_plan(m, skills)
+
+    if json_output:
+        typer.echo(deterministic_json(plan), nl=False)
+        return
+
+    console.print(
+        f"[bold]Bulk install plan[/bold]  environment={plan['environment']}  "
+        f"gate=[bold]{plan['gate']}[/bold]  requested={len(plan['requested'])}  "
+        f"mutations={plan['mutation_count']}"
+    )
+    table = Table("Step", "Skill", "Action", "Gate", "Trust", "Audit", "Required by", "Destination")
+    for index, step in enumerate(plan["steps"], 1):
+        audit = step["audit"]
+        audit_label = (
+            "ERROR" if audit.get("error") else
+            f"HIGH:{audit.get('high', 0)}" if audit.get("high") else
+            "checked" if audit.get("checked") else "unknown"
+        )
+        table.add_row(
+            str(index),
+            str(step["skill"]),
+            str(step["action"]),
+            str(step["gate"]),
+            str(step["trust_state"]),
+            audit_label,
+            ", ".join(step.get("required_by", [])),
+            str(step["destination"]),
+        )
+    console.print(table)
+
+    if plan["gate_reasons"]:
+        console.print("\n[bold]Gate reasons[/bold]")
+        for reason in plan["gate_reasons"]:
+            console.print(f"• {reason}")
+
+    console.print("\n[bold]Observed aggregate intent[/bold]")
+    for statement in plan.get("intent", {}).get("statements", []):
+        console.print(f"• {statement}")
+
+    console.print(
+        "[dim]Read-only aggregate plan: shared dependencies are deduplicated; no install, state, lockfile, runtime-binding, or catalog mutation was performed.[/dim]"
+    )
+
+
+__all__ = ["bulk_plan_cmd"]