wpsecscan 2.6.0__tar.gz → 2.7.0__tar.gz

{wpsecscan-2.6.0/wpsecscan.egg-info → wpsecscan-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wpsecscan
-Version: 2.6.0
+Version: 2.7.0
 Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
 Author-email: Bryan <bryaninbangkok@gmail.com>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -730,7 +730,7 @@ Dynamic: license-file
 [![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
 [![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
 [![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
-[![checks](https://img.shields.io/badge/checks-268-brightgreen)](FEATURES.md)
+[![checks](https://img.shields.io/badge/checks-270-brightgreen)](FEATURES.md)
 [![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
 [![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
 [![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/README.md

@@ -6,7 +6,7 @@
 [![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
 [![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
 [![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
-[![checks](https://img.shields.io/badge/checks-268-brightgreen)](FEATURES.md)
+[![checks](https://img.shields.io/badge/checks-270-brightgreen)](FEATURES.md)
 [![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
 [![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
 [![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wpsecscan"
-version = "2.6.0"
+version = "2.7.0"
 description = "Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only."
 readme = "README.md"
 requires-python = ">=3.10"

wpsecscan-2.7.0/wpsecscan/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.7.0"

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/wpsecscan/__main__.py

@@ -397,6 +397,114 @@ async def _scan_one(target: str, args, console: Console):
         if not args.no_console:
             console.print(f"[green]✓[/green] Board 1-pager: [bold]{bp_p}[/bold]")
 
+    # C49 — per-finding share link
+    if getattr(args, "share_finding", None):
+        try:
+            cid, idx_str = args.share_finding.split("#", 1)
+            idx = int(idx_str)
+            from .reporters import share_link as _sl
+            share_p = out_dir / f"{stem}-{cid}-{idx}.share.json"
+            _sl.write(report, cid, idx, share_p)
+            if not args.no_console:
+                console.print(f"[green]✓[/green] Share-link: [bold]{share_p}[/bold]")
+        except (ValueError, Exception) as e:  # noqa: BLE001
+            console.print(f"[yellow]--share-finding failed: {e}[/yellow]")
+
+    # C54 — risk-score forecast
+    if getattr(args, "risk_forecast", False):
+        from .reporters import risk_forecast as _rf
+        fc = _rf.forecast(report.target)
+        if not args.no_console:
+            console.print(f"[cyan]{_rf.render_text(fc)}[/cyan]")
+        (out_dir / f"{stem}-forecast.json").write_text(
+            __import__("json").dumps(fc, indent=2), encoding="utf-8",
+        )
+
+    # C55 — finding heatmap SVG
+    if getattr(args, "heatmap_svg", False):
+        from .reporters import finding_heatmap as _fh
+        hm_p = out_dir / f"{stem}-heatmap.svg"
+        _fh.write(report.target, hm_p)
+        if not args.no_console:
+            console.print(f"[green]✓[/green] Finding heatmap SVG: [bold]{hm_p}[/bold]")
+
+    # C53 — xlsx with pre-built pivot tables
+    if getattr(args, "xlsx_pivot", False):
+        from .reporters import xlsx_pivot as _xp
+        xp_p = out_dir / f"{stem}-pivot.xlsx"
+        _xp.write(report, xp_p)
+        if not args.no_console:
+            console.print(f"[green]✓[/green] xlsx with pivots: [bold]{xp_p}[/bold]")
+
+    # C56 — OpenVEX export
+    if getattr(args, "vex_export", False):
+        from .reporters import vex_export as _vex
+        vex_p = out_dir / f"{stem}-vex.json"
+        _vex.write(report, vex_p)
+        if not args.no_console:
+            console.print(f"[green]✓[/green] OpenVEX: [bold]{vex_p}[/bold]")
+
+    # C59 — D3FEND mapping
+    if getattr(args, "d3fend_mapping", False):
+        from .reporters import d3fend_mapping as _d3
+        d3_p = out_dir / f"{stem}-d3fend.html"
+        _d3.write(report, d3_p)
+        if not args.no_console:
+            console.print(f"[green]✓[/green] D3FEND mapping: [bold]{d3_p}[/bold]")
+
+    # C60 — GDPR DSR-ready user-data report
+    if getattr(args, "gdpr_dsr_report", False):
+        from .reporters import gdpr_dsr_report as _gdpr
+        g_p = out_dir / f"{stem}-dsr.md"
+        _gdpr.write(report, g_p)
+        if not args.no_console:
+            console.print(f"[green]✓[/green] GDPR DSR report: [bold]{g_p}[/bold]")
+
+    # C57 — executive TL;DR
+    if getattr(args, "executive_tldr", False):
+        from .reporters import executive_tldr as _et
+        t_p = out_dir / f"{stem}-tldr.txt"
+        _et.write(report, t_p)
+        if not args.no_console:
+            console.print(f"[cyan]TL;DR:[/cyan] {_et.build(report)}")
+
+    # C50 — one-liner patches alongside auto-PR script
+    if getattr(args, "auto_pr_patches", False):
+        from . import auto_pr as _ap
+        patches_dir = out_dir / f"{stem}-patches"
+        n = _ap.write_one_liner_patches(report, patches_dir,
+                                          min_sev=getattr(args, "push_min_sev", "medium"))
+        if not args.no_console:
+            if n:
+                console.print(f"[green]✓[/green] Auto-PR one-liner patches: {n} files in {patches_dir}")
+            else:
+                console.print("[yellow]--auto-pr-patches: no eligible one-liner findings or AI backend missing[/yellow]")
+
+    # C51 — Confluence / Notion live page sync
+    if getattr(args, "live_sync", None):
+        from .reporters import live_sync as _ls
+        backends = (args.live_sync or "").lower()
+        if backends in ("confluence", "both"):
+            # Best body = the HTML report if available, else a tiny summary
+            html_body = ""
+            try:
+                html_body = (out_dir / f"{stem}.html").read_text(encoding="utf-8")
+            except OSError:
+                html_body = f"<p>WPSecScan score: {report.risk_score}/100 at {report.scanned_at}</p>"
+            ok, msg = _ls.sync_confluence(html_body)
+            if not args.no_console:
+                console.print(f"[cyan]live-sync confluence: {msg}[/cyan]")
+        if backends in ("notion", "both"):
+            text = (
+                f"WPSecScan — {report.target}\n"
+                f"Scanned: {report.scanned_at}\n"
+                f"Risk score: {report.risk_score}/100\n"
+                f"Findings: {len(report.all_findings)}"
+            )
+            ok, msg = _ls.sync_notion(text)
+            if not args.no_console:
+                console.print(f"[cyan]live-sync notion: {msg}[/cyan]")
+
     # #61 — live SIEM forwarders (Splunk HEC / Datadog Logs / Loki / Beats)
     if (getattr(args, "siem_splunk", None) or getattr(args, "siem_datadog", None)
             or getattr(args, "siem_loki", None) or getattr(args, "siem_beats", None)
@@ -852,6 +960,14 @@ def _apply_config_and_profile(parser, args) -> None:
 
 
 def main() -> None:
+    # F83 (v2.7.0): enable VT-mode ANSI on legacy cmd.exe / PowerShell so
+    # rich's colours render natively (no-op on macOS / Linux + on modern
+    # Windows Terminal where VT is already on).
+    try:
+        from .cli_extras import enable_win_ansi
+        enable_win_ansi()
+    except ImportError:
+        pass
     # ---- Subcommand dispatch (round-60): keep before argparse so existing
     # `wpsecscan <url>` invocations stay backward-compatible. The list of
     # subcommand names is centralised in SUBCOMMAND_NAMES so it can never
@@ -1014,6 +1130,8 @@ def main() -> None:
                    help="G90: predict P(false-positive) per finding from the operator's "
                         "snooze history; decorates extra.fp_score on every finding. "
                         "No-op when ~/.wpsecscan/snoozes.json is empty.")
+    p.add_argument("--quiet", "-q", dest="no_console", action="store_true",
+                   help="F82: alias for --no-console; suppress per-check console output.")
     p.add_argument("--tldr", action="store_true",
                    help="Item #81: print a one-line summary (score/worst-sev/finding-count) "
                         "to stdout and suppress all other output. Exit code = worst severity "
@@ -1053,6 +1171,36 @@ def main() -> None:
     p.add_argument("--board-1pager", action="store_true",
                    help="#52: write a single-landscape-page board-room risk dashboard "
                         "(three big numbers, three sentences, three actions to ratify).")
+    p.add_argument("--share-finding", default=None, metavar="CHECK_ID#INDEX",
+                   help="C49: write a per-finding share-link JSON-LD blob with HMAC signature. "
+                        "Example: --share-finding headers#0 writes the first finding from "
+                        "the 'headers' check.")
+    p.add_argument("--live-sync", default=None, metavar="confluence|notion|both",
+                   help="C51: push the agency dashboard to Confluence and/or Notion on each "
+                        "scan. Reads WPSECSCAN_CONFLUENCE_* and WPSECSCAN_NOTION_* env vars.")
+    p.add_argument("--risk-forecast", action="store_true",
+                   help="C54: print a 30/60/90-day risk-score projection from snapshot history.")
+    p.add_argument("--heatmap-svg", action="store_true",
+                   help="C55: write a per-finding heatmap SVG showing presence across recent scans.")
+    p.add_argument("--xlsx-pivot", action="store_true",
+                   help="C53: write an .xlsx with pre-built pivot sheets (by-severity, "
+                        "by-check, severity×check_id heatmap).")
+    p.add_argument("--vex-export", action="store_true",
+                   help="C56: write an OpenVEX 0.2 document mapping CVE findings to "
+                        "affected/fixed/not_affected status. Complements --sbom.")
+    p.add_argument("--d3fend-mapping", action="store_true",
+                   help="C59: write an HTML view grouping findings by MITRE D3FEND "
+                        "defensive-technique ID.")
+    p.add_argument("--gdpr-dsr-report", action="store_true",
+                   help="C60: write a markdown SAR/DSR-ready audit-trail of findings "
+                        "that touched user-data fields.")
+    p.add_argument("--executive-tldr", action="store_true",
+                   help="C57: print + write a deterministic 3-sentence executive "
+                        "summary suitable for an email subject/body.")
+    p.add_argument("--auto-pr-patches", action="store_true",
+                   help="C50: ALONGSIDE the existing --auto-pr-repo gh-command script, "
+                        "write unified-diff .patch files for one-liner fixes "
+                        "(.htaccess / wp-config.php / header.php). Needs AI backend.")
     p.add_argument("--print-openapi", action="store_true",
                    help="#53: print the OpenAPI 3.1 schema for the WPSecScan JSON output to "
                         "stdout, then exit. Pipe to openapi-typescript / openapi-generator to "
@@ -1101,8 +1249,28 @@ def main() -> None:
                    help="Diff scan-in-progress against the most recent saved snapshot older than WINDOW "
                         "(e.g. `7d`, `24h`, `2w`). Composes with the scan; outputs the delta after the scan completes.")
     p.add_argument("--debug", action="store_true", help="Verbose logging to ~/.wpsecscan/logs/")
-    p.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    # K124 — third-party audit link in --version output
+    try:
+        from .trust_v27 import third_party_audit_url as _audit_url
+        _audit = _audit_url()
+    except ImportError:
+        _audit = ""
+    p.add_argument(
+        "--version", action="version",
+        version=(f"%(prog)s {__version__}"
+                 + (f"\nThird-party audit: {_audit}" if _audit else "")),
+    )
+    p.add_argument("--deterministic", action="store_true",
+                   help="K125: pin all randomness so two runs of the same target "
+                        "produce byte-identical reports.")
     args = p.parse_args()
+    # K125 — apply deterministic seed BEFORE any other module fires.
+    if getattr(args, "deterministic", False):
+        try:
+            from .trust_v27 import set_deterministic_seed
+            set_deterministic_seed()
+        except ImportError:
+            pass
 
     # #33 / #34 — merge config file + named profile into args BEFORE any
     # downstream code reads them. CLI args always win over file / profile
@@ -1481,6 +1649,25 @@ SUBCOMMAND_HELP: tuple[tuple[str, str], ...] = (
     ("mobile-api",           "installable PWA + REST for phones (item #80)"),
     # v2.6.0
     ("kev URL",              "CISA KEV-only fast scan (item #67)"),
+    # v2.7.0
+    ("compare-portfolios OLD NEW", "diff two sites.json portfolios (item #61)"),
+    ("changelog URL",        "human-readable site-change log (--since DATE, item #63)"),
+    ("replay HAR.json",      "browse a recorded HTTP Archive (item #64)"),
+    ("freeze URL",           "snapshot a site as .tar.gz for offline compare (item #65)"),
+    ("attest URL",           "Sigstore-signed scan attestation, --keyless (item #66)"),
+    ("compliance audit URL", "single-framework gap analysis, --framework F (item #68)"),
+    ("tournament URL A B",   "bake-off two scan configs (item #62)"),
+    ("ai-agent URL",         "AI-recommended follow-up probes (item #69)"),
+    ("triage interactive URL", "TUI walk-through of recent findings (item #70)"),
+    ("rotation N LIST",      "split portfolio into N daily-bucket cron entries (item #71)"),
+    ("install-completion",   "install shell completion to the right rc path (item #86)"),
+    ("replay-prompt URL",    "TUI walking high-sev findings (item #85)"),
+    ("undo",                 "print the last config-mutating action + revert command (item #87)"),
+    ("worker",               "Redis-queue distributed-scan worker (item #110)"),
+    ("learn",                "interactive tutorial mode, no scan (item #116)"),
+    ("audio-summary URL",    "TTS MP3 of the exec summary (item #118)"),
+    ("marketplace",          "marketplace list/search/install/verify/stars/authors/leaderboard (L126-L130)"),
+    ("submit-cve SLUG CVE",  "queue community CVE-DB contribution (L129)"),
 )
 
 SUBCOMMAND_NAMES: tuple[str, ...] = tuple(
@@ -1568,6 +1755,60 @@ def _dispatch_subcommand(cmd: str, args: list[str]) -> None:
         _cmd_mobile_api(args)
     elif cmd == "kev":
         _cmd_kev(args)
+    elif cmd == "compare-portfolios":
+        from .workflow_cmds import cmd_compare_portfolios
+        cmd_compare_portfolios(args)
+    elif cmd == "changelog":
+        from .workflow_cmds import cmd_changelog
+        cmd_changelog(args)
+    elif cmd == "replay":
+        from .workflow_cmds import cmd_replay
+        cmd_replay(args)
+    elif cmd == "freeze":
+        from .workflow_cmds import cmd_freeze
+        cmd_freeze(args)
+    elif cmd == "attest":
+        from .workflow_cmds import cmd_attest
+        cmd_attest(args)
+    elif cmd == "compliance":
+        from .workflow_cmds import cmd_compliance_audit
+        cmd_compliance_audit(args)
+    elif cmd == "tournament":
+        from .workflow_cmds import cmd_tournament
+        cmd_tournament(args)
+    elif cmd == "ai-agent":
+        from .workflow_cmds import cmd_ai_agent
+        cmd_ai_agent(args)
+    elif cmd == "triage":
+        from .workflow_cmds import cmd_triage
+        cmd_triage(args)
+    elif cmd == "rotation":
+        from .workflow_cmds import cmd_rotation
+        cmd_rotation(args)
+    elif cmd == "install-completion":
+        from .cli_extras import cmd_install_completion
+        cmd_install_completion(args)
+    elif cmd == "replay-prompt":
+        from .cli_extras import cmd_replay_prompt
+        cmd_replay_prompt(args)
+    elif cmd == "undo":
+        from .cli_extras import cmd_undo
+        cmd_undo(args)
+    elif cmd == "worker":
+        from .perf_v27 import cmd_worker
+        cmd_worker(args)
+    elif cmd == "learn":
+        from .edu_v27 import cmd_learn
+        cmd_learn(args)
+    elif cmd == "audio-summary":
+        from .edu_v27 import cmd_audio_summary
+        cmd_audio_summary(args)
+    elif cmd == "marketplace":
+        from .marketplace_v27 import cmd_marketplace
+        cmd_marketplace(args)
+    elif cmd == "submit-cve":
+        from .marketplace_v27 import cmd_submit_cve
+        cmd_submit_cve(args)
     else:
         print(f"unknown subcommand: {cmd}", file=sys.stderr)
         sys.exit(2)

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/wpsecscan/ai_assist.py

@@ -210,6 +210,100 @@ def fix_pr_body(finding) -> str:
                 system=sys_msg, max_tokens=500)
 
 
+def evidence_summary(finding) -> str:
+    """G91 (v2.7.0) — one-sentence summary of finding.evidence.
+
+    For long evidence (raw JS-library version list etc.), produces a
+    summary line the reporter shows above the raw evidence.
+    """
+    import os as _os
+    if _os.environ.get("WPSECSCAN_NO_AI") or not is_configured():
+        return ""
+    if not finding.evidence or len(finding.evidence) < 80:
+        return ""
+    sys_msg = (
+        "Summarise the following WPSecScan finding evidence in EXACTLY ONE "
+        "sentence (max 30 words). State the concrete observation; no "
+        "speculation. Output the sentence only — no preface."
+    )
+    return llm(finding.evidence[:2000], system=sys_msg, max_tokens=60).strip()
+
+
+def threat_model_js(js_bundle: str) -> str:
+    """G92 (v2.7.0) — AI threat-model the given JS bundle."""
+    import os as _os
+    if _os.environ.get("WPSECSCAN_NO_AI") or not is_configured():
+        return ""
+    if not js_bundle:
+        return ""
+    sys_msg = (
+        "You are a defensive security engineer. Read the JS code below and "
+        "list every attack surface it EXPOSES to a remote attacker: API "
+        "endpoints, auth tokens in localStorage, innerHTML/eval usages, "
+        "third-party CDN/script-src dependencies. Bullet points, ranked by "
+        "severity. Max 250 words."
+    )
+    return llm(js_bundle[:8000], system=sys_msg, max_tokens=600)
+
+
+def answer_compliance_question(question: str, report_dict: dict) -> str:
+    """G93 (v2.7.0) — answer a compliance question from the scan JSON."""
+    import json as _json
+    import os as _os
+    if _os.environ.get("WPSECSCAN_NO_AI") or not is_configured():
+        return ""
+    sys_msg = (
+        "You are a compliance auditor. Given a JSON wpsecscan scan report, "
+        "answer the question with a single Yes/No/Partial verdict, then a "
+        "one-paragraph rationale citing specific check_ids from the report. "
+        "If the report doesn't contain the relevant evidence, say so."
+    )
+    slim = {
+        "target": report_dict.get("target"),
+        "scanned_at": report_dict.get("scanned_at"),
+        "risk_score": report_dict.get("risk_score"),
+        "summary": report_dict.get("summary"),
+        "results": [{
+            "check_id": r.get("check_id"),
+            "findings": [{"severity": f.get("severity"), "title": f.get("title")}
+                          for f in (r.get("findings") or [])],
+        } for r in (report_dict.get("results") or [])],
+    }
+    prompt = f"Report:\n{_json.dumps(slim, indent=2)[:8000]}\n\nQuestion: {question}"
+    return llm(prompt, system=sys_msg, max_tokens=400)
+
+
+def changelog_narrator(old_report: dict, new_report: dict) -> str:
+    """G94 (v2.7.0) — natural-language summary of what changed between
+    two scan reports."""
+    import json as _json
+    import os as _os
+    if _os.environ.get("WPSECSCAN_NO_AI") or not is_configured():
+        return ""
+    sys_msg = (
+        "You are a security analyst. Write a SHORT (3-5 sentence) prose "
+        "summary of how this WordPress install changed between two "
+        "wpsecscan reports. Mention only NET-NEW issues, fixes, and "
+        "score deltas. Plain prose, no bullets, no tables."
+    )
+    def _slim(rep: dict) -> dict:
+        return {
+            "scanned_at": rep.get("scanned_at"),
+            "risk_score": rep.get("risk_score"),
+            "summary": rep.get("summary"),
+            "findings": [
+                (r.get("check_id"), f.get("severity"), f.get("title"))
+                for r in (rep.get("results") or [])
+                for f in (r.get("findings") or [])
+            ],
+        }
+    prompt = (
+        "OLD:\n" + _json.dumps(_slim(old_report))[:3000] + "\n\n"
+        "NEW:\n" + _json.dumps(_slim(new_report))[:3000]
+    )
+    return llm(prompt, system=sys_msg, max_tokens=400)
+
+
 def fix_pr_diff(finding) -> str:
     """G89 (v2.6.0) — draft a unified-diff patch alongside the PR body.
 

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/wpsecscan/auto_pr.py

@@ -169,3 +169,52 @@ def write_script(report: ScanReport, path, *, repo: str, min_sev: str = "medium"
         _act.emit("artifact", f"auto-PR script: {len(fixes)} fix(es) → {Path(path).name}")
     except ImportError:
         pass
+
+
+# C50 (v2.7.0) — for one-liner fixes (.htaccess / wp-config.php / header.php),
+# write a unified-diff patch alongside the shell script so the operator can
+# `git apply` directly instead of pasting `gh` commands.
+
+_ONE_LINER_HINT_FILES = ("wp-config.php", ".htaccess", "wp-content/themes/*/header.php",
+                          "wp-content/themes/*/functions.php")
+
+
+def _looks_like_one_liner(finding) -> bool:
+    """Heuristic: the remediation field references a single config file?"""
+    rem = (finding.remediation or "").lower()
+    return any(p.split("/")[-1].lower() in rem for p in _ONE_LINER_HINT_FILES)
+
+
+def write_one_liner_patches(report: ScanReport, out_dir, *, min_sev: str = "medium") -> int:
+    """C50 — for each one-liner-fixable finding, ask the AI to draft a
+    unified diff + write `<out_dir>/<check_id>-<idx>-fix.patch`. Returns
+    the count of patches written. No-op if no AI backend or no matches."""
+    from pathlib import Path
+    try:
+        from . import ai_assist as _ai
+    except ImportError:
+        return 0
+    if not _ai.is_configured():
+        return 0
+    out_dir = Path(out_dir)
+    out_dir.mkdir(parents=True, exist_ok=True)
+    sev_rank = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
+    min_n = sev_rank.get(min_sev, 2)
+    n = 0
+    for r in report.results:
+        for idx, f in enumerate(r.findings):
+            if sev_rank.get(f.severity, 0) < min_n:
+                continue
+            if not _looks_like_one_liner(f):
+                continue
+            diff = _ai.fix_pr_diff(f)
+            if not diff or len(diff) < 30:
+                continue
+            patch_path = out_dir / f"{r.check_id}-{idx}-fix.patch"
+            body_path  = out_dir / f"{r.check_id}-{idx}-fix.md"
+            patch_path.write_text(diff + "\n", encoding="utf-8")
+            body = _ai.fix_pr_body(f)
+            if body:
+                body_path.write_text(body + "\n", encoding="utf-8")
+            n += 1
+    return n

{wpsecscan-2.6.0 → wpsecscan-2.7.0}/wpsecscan/checks/__init__.py

@@ -296,6 +296,10 @@ from .rest_schema_field_leak import check as rest_schema_field_leak
 from .block_style_variations_url import check as block_style_variations_url
 from .companion_v13 import check as companion_v13
 from .host_platform_detect import check as host_platform_detect
+from .companion_v14 import check as companion_v14
+from .trellis_yaml_audit import check as trellis_yaml_audit
+from .headless_vercel_netlify_detect import check as headless_vercel_netlify_detect
+from .perf_of_target import check as perf_of_target
 
 # Authenticated — only when creds are provided
 from .authenticated import check as authenticated
@@ -586,6 +590,10 @@ ALL_CHECKS = [
     ("block_style_variations_url","Block-style URL-prop SSRF (O145)", block_style_variations_url, False),
     ("companion_v13",            "Companion v1.3 endpoint consumers (B36-B47)", companion_v13, False),
     ("host_platform_detect",     "Host stack / platform fingerprint (N136/N139/N140)", host_platform_detect, False),
+    ("companion_v14",            "Companion v1.4 endpoint consumers (B38-B45)", companion_v14, False),
+    ("trellis_yaml_audit",       "Roots Trellis YAML exposure (N137)", trellis_yaml_audit, False),
+    ("headless_vercel_netlify_detect", "Headless WP on Vercel/Netlify with reachable REST (N138)", headless_vercel_netlify_detect, False),
+    ("perf_of_target",           "Operational perf audit: TTFB / Lighthouse / DB-queries / cache-hit / cold-start (P146-P150)", perf_of_target, False),
     # ---- Round-58 aggressive checks ----
     ("wp_query_sqli",            "WP_Query/wpdb-specific SQLi (#4)", wp_query_sqli, True),
     ("http2_smuggling",          "HTTP/2 CRLF smuggling probe (#24)", http2_smuggling, True),