ajmallesh
b208949345
- Move error-handling, git-manager, prompt-manager, queue-validation, and reporting into src/services/ - Delete src/constants.ts — relocate AGENT_VALIDATORS and MCP_AGENT_MAPPING into session-manager.ts alongside agent definitions - Delete src/utils/output-formatter.ts — absorb filterJsonToolCalls and getAgentPrefix into ai/output-formatters.ts - Extract ActivityLogger interface into src/types/activity-logger.ts to break temporal/ → services circular dependency - Consolidate VulnType, ExploitationDecision into types/agents.ts and SessionMetadata into types/audit.ts - Remove dead timingResults/costResults globals from utils/metrics.ts and all consumers
72 lines
2.4 KiB
TypeScript
72 lines
2.4 KiB
TypeScript
// Copyright (C) 2025 Keygraph, Inc.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License version 3
|
|
// as published by the Free Software Foundation.
|
|
|
|
/**
|
|
* Exploitation Checker Service
|
|
*
|
|
* Pure domain logic for determining whether exploitation should run.
|
|
* Reads queue file, parses JSON, returns decision.
|
|
*
|
|
* No Temporal dependencies - this is pure business logic.
|
|
*/
|
|
|
|
import {
|
|
validateQueueSafe,
|
|
type VulnType,
|
|
type ExploitationDecision,
|
|
} from './queue-validation.js';
|
|
import { isOk } from '../types/result.js';
|
|
import type { ActivityLogger } from '../types/activity-logger.js';
|
|
|
|
/**
|
|
* Service for checking exploitation queue decisions.
|
|
*
|
|
* Determines whether an exploit agent should run based on
|
|
* the vulnerability analysis deliverables and queue files.
|
|
*/
|
|
export class ExploitationCheckerService {
|
|
/**
|
|
* Check if exploitation should run for a given vulnerability type.
|
|
*
|
|
* Reads the vulnerability queue file and returns the decision.
|
|
* This is pure domain logic - reads queue file, parses JSON, returns decision.
|
|
*
|
|
* @param vulnType - Type of vulnerability (injection, xss, auth, ssrf, authz)
|
|
* @param repoPath - Path to the repository containing deliverables
|
|
* @param logger - ActivityLogger for structured logging
|
|
* @returns ExploitationDecision indicating whether to exploit
|
|
* @throws PentestError if validation fails and is retryable
|
|
*/
|
|
async checkQueue(vulnType: VulnType, repoPath: string, logger: ActivityLogger): Promise<ExploitationDecision> {
|
|
const result = await validateQueueSafe(vulnType, repoPath);
|
|
|
|
if (isOk(result)) {
|
|
const decision = result.value;
|
|
logger.info(
|
|
`${vulnType}: ${decision.shouldExploit ? `${decision.vulnerabilityCount} vulnerabilities found` : 'no vulnerabilities, skipping exploitation'}`
|
|
);
|
|
return decision;
|
|
}
|
|
|
|
// Validation failed - check if we should retry or skip
|
|
const error = result.error;
|
|
if (error.retryable) {
|
|
// Re-throw retryable errors so caller can handle retry
|
|
logger.warn(`${vulnType}: ${error.message} (retryable)`);
|
|
throw error;
|
|
}
|
|
|
|
// Non-retryable error - skip exploitation gracefully
|
|
logger.warn(`${vulnType}: ${error.message}, skipping exploitation`);
|
|
return {
|
|
shouldExploit: false,
|
|
shouldRetry: false,
|
|
vulnerabilityCount: 0,
|
|
vulnType,
|
|
};
|
|
}
|
|
}
|