"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.securityProbeRules = void 0;
const CyberRedTeamAgent_1 = require("../../agents/implementations/CyberRedTeamAgent");
const path_1 = __importDefault(require("path"));
/**
 * The Red-Team Probe rule triggers the CyberRedTeamAgent to perform
 * an offensive analysis of the identified attack surface.
 *
 * This rule ONLY runs if the --red-team flag is provided.
 */
const redTeamRule = {
    id: "security/red-team-probe",
    name: "Agentic Red-Team Probe",
    category: "security",
    severity: "error",
    description: "Launches an AI-driven offensive security probe to identify exploit scenarios.",
    help: "Review the exploit scenarios and reproduction scripts provided in the diagnostics.",
    appliesTo: ["node", "nextjs", "turbo"],
    async check(ctx) {
        // This is an expensive rule, only run if explicitly requested
        if (!ctx.redTeam)
            return [];
        const diagnostics = [];
        // Recon: Find attack surface files
        const allFiles = await ctx.findFiles(/\.(ts|tsx|js|jsx|prisma)$/);
        // Tier 0 filtering logic (synced with ProjectScanner)
        const tier0Files = allFiles.filter(f => /auth|api|session|token|crypto|password|encrypt|decrypt|sign|verify|jwt|credential|permission|role|access|admin|internal|upload|download|exec|spawn|fork|eval|Function/i.test(f));
        if (tier0Files.length === 0)
            return [];
        // Limit to top 10 most interesting files to manage latency/cost
        const targetFiles = tier0Files.slice(0, 10);
        // Get Living Brain context for grounding the probe
        const context = (await ctx.readJson(".mycontext/context.json")) ||
            (await ctx.readJson("context.json")) || {};
        // Execute the agent
        const agent = new CyberRedTeamAgent_1.CyberRedTeamAgent();
        const result = await agent.run({
            targetFiles: targetFiles.map(f => path_1.default.join(ctx.root, f)),
            context
        });
        // Convert agent output to doctor diagnostics
        for (const vuln of result.vulnerabilities) {
            // Normalize path back to relative from the target file returned by agent
            const relPath = vuln.location.file.startsWith(ctx.root)
                ? path_1.default.relative(ctx.root, vuln.location.file)
                : vuln.location.file;
            diagnostics.push({
                ruleId: this.id,
                filePath: relPath,
                line: vuln.location.line,
                severity: vuln.severity === "critical" || vuln.severity === "high" ? "error" : "warning",
                message: `[${vuln.type}] ${vuln.description}\n\nEXPLOIT SCENARIO:\n${vuln.exploitScenario}`,
                help: `Reproduction Steps:\n${vuln.reproSteps.map((s, i) => `${i + 1}. ${s}`).join("\n")}\n\nRepro Script:\n${vuln.reproScript || "N/A"}`,
                autoFixable: false
            });
        }
        return diagnostics;
    }
};
exports.securityProbeRules = [redTeamRule];
//# sourceMappingURL=security-probes.js.map