refactor(structure): promote app to repo root + remove redundant workspace cruft
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
7101af9fd4
commit
36a4812ef3
@@ -0,0 +1,5 @@
|
||||
## Cloud env presence only
|
||||
CASAN_MODEL_PRIMARY=unset
|
||||
CASAN_MODEL_SECONDARY=unset
|
||||
ANTHROPIC_API_KEY=unset
|
||||
OPENAI_API_KEY=unset
|
||||
@@ -0,0 +1,6 @@
|
||||
## Git
|
||||
true
|
||||
?? docs/output/casan/phase3-evidence/
|
||||
?? docs/output/casan/phase3-push-to-90-plan.md
|
||||
?? docs/output/casan/phase3-security-hardening-plan.md
|
||||
main
|
||||
@@ -0,0 +1,28 @@
|
||||
## Linux OS
|
||||
Linux nguyenvanthanh 7.0.0-14-generic #14-Ubuntu SMP PREEMPT_DYNAMIC Mon Apr 13 11:09:53 UTC 2026 x86_64 GNU/Linux
|
||||
PRETTY_NAME="Ubuntu 26.04 LTS"
|
||||
NAME="Ubuntu"
|
||||
VERSION_ID="26.04"
|
||||
VERSION="26.04 (Resolute Raccoon)"
|
||||
VERSION_CODENAME=resolute
|
||||
ID=ubuntu
|
||||
ID_LIKE=debian
|
||||
HOME_URL="https://www.ubuntu.com/"
|
||||
SUPPORT_URL="https://help.ubuntu.com/"
|
||||
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
|
||||
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
|
||||
UBUNTU_CODENAME=resolute
|
||||
LOGO=ubuntu-logo
|
||||
|
||||
## Toolchain
|
||||
/usr/bin/node
|
||||
v22.23.1
|
||||
/usr/bin/npm
|
||||
11.17.0
|
||||
/usr/bin/python3
|
||||
Python 3.14.4
|
||||
/usr/local/bin/ollama
|
||||
ollama version is 0.30.11
|
||||
|
||||
## Ollama API
|
||||
{"models":[{"name":"ornith:9b","model":"ornith:9b","modified_at":"2026-06-30T12:38:15.184617998Z","size":5629110568,"digest":"a75697c145891910e312c95e4a9fc1ccb8653e5ef543b23b0403a4665b82fd91","details":{"parent_model":"","format":"gguf","family":"qwen35","families":["qwen35"],"parameter_size":"9.0B","quantization_level":"Q4_K_M","context_length":262144,"embedding_length":4096},"capabilities":["completion","tools","thinking"]},{"name":"gemma4:12b","model":"gemma4:12b","modified_at":"2026-06-27T11:01:19.182457309Z","size":7556508396,"digest":"4eb23ef187e2c5462566d6a1d3bbbc2f1346d0b4327cbb66d58fffbcc9b2b05c","details":{"parent_model":"","format":"gguf","family":"gemma4","families":["gemma4"],"parameter_size":"11.9B","quantization_level":"Q4_K_M","context_length":262144,"embedding_length":3840},"capabilities":["completion","tools","thinking","vision"]}]}
|
||||
@@ -0,0 +1,12 @@
|
||||
## macOS
|
||||
ProductName: macOS
|
||||
ProductVersion: 26.5.1
|
||||
BuildVersion: 25F80
|
||||
Darwin tainguens-MacBook-Pro.local 25.5.0 Darwin Kernel Version 25.5.0: Mon Apr 27 20:38:56 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6000 arm64
|
||||
|
||||
## Toolchain
|
||||
v24.12.0
|
||||
11.7.0
|
||||
Python 3.9.0
|
||||
GNU bash, version 3.2.57(1)-release (arm64-apple-darwin25)
|
||||
curl 8.7.1 (x86_64-apple-darwin25.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.68.1
|
||||
@@ -0,0 +1 @@
|
||||
npm_audit_high_exit=1
|
||||
@@ -0,0 +1,82 @@
|
||||
# npm audit report
|
||||
|
||||
@nestjs/core <=11.1.17
|
||||
Severity: moderate
|
||||
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') - https://github.com/advisories/GHSA-36xv-jgw5-4q75
|
||||
fix available via `npm audit fix --force`
|
||||
Will install @nestjs/core@11.1.27, which is a breaking change
|
||||
node_modules/@nestjs/core
|
||||
|
||||
esbuild <=0.24.2
|
||||
Severity: moderate
|
||||
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
|
||||
fix available via `npm audit fix --force`
|
||||
Will install vite@8.1.1, which is a breaking change
|
||||
node_modules/vite/node_modules/esbuild
|
||||
vite <=6.4.2
|
||||
Depends on vulnerable versions of esbuild
|
||||
node_modules/vite
|
||||
|
||||
file-type 13.0.0 - 21.3.1
|
||||
Severity: moderate
|
||||
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header - https://github.com/advisories/GHSA-5v7r-6r5c-r473
|
||||
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry - https://github.com/advisories/GHSA-j47w-4g3g-c36v
|
||||
fix available via `npm audit fix --force`
|
||||
Will install @nestjs/common@11.1.27, which is a breaking change
|
||||
node_modules/file-type
|
||||
@nestjs/common 10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2
|
||||
Depends on vulnerable versions of file-type
|
||||
node_modules/@nestjs/common
|
||||
|
||||
multer <=2.1.1
|
||||
Severity: high
|
||||
Multer vulnerable to Denial of Service via incomplete cleanup - https://github.com/advisories/GHSA-xf7r-hgr6-v32p
|
||||
Multer vulnerable to Denial of Service via resource exhaustion - https://github.com/advisories/GHSA-v52c-386h-88mc
|
||||
Multer Vulnerable to Denial of Service via Uncontrolled Recursion - https://github.com/advisories/GHSA-5528-5vmv-3xc2
|
||||
Multer vulnerable to Denial of Service via deeply nested field names - https://github.com/advisories/GHSA-72gw-mp4g-v24j
|
||||
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads - https://github.com/advisories/GHSA-3p4h-7m6x-2hcm
|
||||
fix available via `npm audit fix --force`
|
||||
Will install @nestjs/platform-express@11.1.27, which is a breaking change
|
||||
node_modules/multer
|
||||
@nestjs/platform-express <=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2
|
||||
Depends on vulnerable versions of body-parser
|
||||
Depends on vulnerable versions of express
|
||||
Depends on vulnerable versions of multer
|
||||
node_modules/@nestjs/platform-express
|
||||
|
||||
qs 6.11.1 - 6.15.1
|
||||
Severity: moderate
|
||||
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
|
||||
fix available via `npm audit fix --force`
|
||||
Will install @nestjs/platform-express@11.1.27, which is a breaking change
|
||||
node_modules/qs
|
||||
body-parser 1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2
|
||||
Depends on vulnerable versions of qs
|
||||
node_modules/body-parser
|
||||
express 4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1
|
||||
Depends on vulnerable versions of qs
|
||||
node_modules/express
|
||||
|
||||
tar <=7.5.15
|
||||
Severity: high
|
||||
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal - https://github.com/advisories/GHSA-34x7-hfp2-rc4v
|
||||
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
|
||||
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction - https://github.com/advisories/GHSA-83g3-92jg-28cx
|
||||
tar has Hardlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-qffp-2rhf-9h96
|
||||
node-tar Symlink Path Traversal via Drive-Relative Linkpath - https://github.com/advisories/GHSA-9ppj-qmqm-q256
|
||||
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
|
||||
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) - https://github.com/advisories/GHSA-vmf3-w455-68vh
|
||||
fix available via `npm audit fix`
|
||||
node_modules/tar
|
||||
@mapbox/node-pre-gyp <=1.0.11
|
||||
Depends on vulnerable versions of tar
|
||||
node_modules/@mapbox/node-pre-gyp
|
||||
|
||||
|
||||
12 vulnerabilities (7 moderate, 5 high)
|
||||
|
||||
To address issues that do not require attention, run:
|
||||
npm audit fix
|
||||
|
||||
To address all issues (including breaking changes), run:
|
||||
npm audit fix --force
|
||||
@@ -0,0 +1 @@
|
||||
npm_audit_json_exit=1
|
||||
@@ -0,0 +1,569 @@
|
||||
{
|
||||
"auditReportVersion": 2,
|
||||
"vulnerabilities": {
|
||||
"@mapbox/node-pre-gyp": {
|
||||
"name": "@mapbox/node-pre-gyp",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"tar"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=1.0.11",
|
||||
"nodes": [
|
||||
"node_modules/@mapbox/node-pre-gyp"
|
||||
],
|
||||
"fixAvailable": true
|
||||
},
|
||||
"@nestjs/common": {
|
||||
"name": "@nestjs/common",
|
||||
"severity": "moderate",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
"file-type"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/common"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/common",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nestjs/core": {
|
||||
"name": "@nestjs/core",
|
||||
"severity": "moderate",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
{
|
||||
"source": 1117063,
|
||||
"name": "@nestjs/core",
|
||||
"dependency": "@nestjs/core",
|
||||
"title": "@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')",
|
||||
"url": "https://github.com/advisories/GHSA-36xv-jgw5-4q75",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-74"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 6.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L"
|
||||
},
|
||||
"range": "<=11.1.17"
|
||||
}
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=11.1.17",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/core"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/core",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nestjs/platform-express": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"severity": "high",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
"body-parser",
|
||||
"express",
|
||||
"multer"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/platform-express"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"body-parser": {
|
||||
"name": "body-parser",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"qs"
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
|
||||
"nodes": [
|
||||
"node_modules/body-parser"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"esbuild": {
|
||||
"name": "esbuild",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1102341,
|
||||
"name": "esbuild",
|
||||
"dependency": "esbuild",
|
||||
"title": "esbuild enables any website to send any requests to the development server and read the response",
|
||||
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-346"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
||||
},
|
||||
"range": "<=0.24.2"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"vite"
|
||||
],
|
||||
"range": "<=0.24.2",
|
||||
"nodes": [
|
||||
"node_modules/vite/node_modules/esbuild"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "vite",
|
||||
"version": "8.1.1",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"express": {
|
||||
"name": "express",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"qs"
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
|
||||
"nodes": [
|
||||
"node_modules/express"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"file-type": {
|
||||
"name": "file-type",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1114301,
|
||||
"name": "file-type",
|
||||
"dependency": "file-type",
|
||||
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
|
||||
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-835"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=13.0.0 <21.3.1"
|
||||
},
|
||||
{
|
||||
"source": 1114726,
|
||||
"name": "file-type",
|
||||
"dependency": "file-type",
|
||||
"title": "file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry",
|
||||
"url": "https://github.com/advisories/GHSA-j47w-4g3g-c36v",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-400",
|
||||
"CWE-409"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=20.0.0 <=21.3.1"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/common"
|
||||
],
|
||||
"range": "13.0.0 - 21.3.1",
|
||||
"nodes": [
|
||||
"node_modules/file-type"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/common",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"multer": {
|
||||
"name": "multer",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1113635,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via incomplete cleanup",
|
||||
"url": "https://github.com/advisories/GHSA-xf7r-hgr6-v32p",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-459"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.0"
|
||||
},
|
||||
{
|
||||
"source": 1113636,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via resource exhaustion",
|
||||
"url": "https://github.com/advisories/GHSA-v52c-386h-88mc",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-772"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.0"
|
||||
},
|
||||
{
|
||||
"source": 1113996,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
|
||||
"url": "https://github.com/advisories/GHSA-5528-5vmv-3xc2",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-674"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.1"
|
||||
},
|
||||
{
|
||||
"source": 1121089,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via deeply nested field names",
|
||||
"url": "https://github.com/advisories/GHSA-72gw-mp4g-v24j",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-400"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
},
|
||||
"range": ">=1.0.0 <2.2.0"
|
||||
},
|
||||
{
|
||||
"source": 1121091,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
|
||||
"url": "https://github.com/advisories/GHSA-3p4h-7m6x-2hcm",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-459"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=2.0.0-alpha.1 <2.2.0"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "<=2.1.1",
|
||||
"nodes": [
|
||||
"node_modules/multer"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"qs": {
|
||||
"name": "qs",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1119502,
|
||||
"name": "qs",
|
||||
"dependency": "qs",
|
||||
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
|
||||
"url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-476"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=6.11.1 <=6.15.1"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"body-parser",
|
||||
"express"
|
||||
],
|
||||
"range": "6.11.1 - 6.15.1",
|
||||
"nodes": [
|
||||
"node_modules/qs"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"tar": {
|
||||
"name": "tar",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1112659,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
|
||||
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-59"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 8.2,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
|
||||
},
|
||||
"range": "<7.5.7"
|
||||
},
|
||||
{
|
||||
"source": 1113300,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
|
||||
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.2"
|
||||
},
|
||||
{
|
||||
"source": 1113375,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
|
||||
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 7.1,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
|
||||
},
|
||||
"range": "<7.5.8"
|
||||
},
|
||||
{
|
||||
"source": 1114200,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
|
||||
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-59"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.9"
|
||||
},
|
||||
{
|
||||
"source": 1114302,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
|
||||
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.10"
|
||||
},
|
||||
{
|
||||
"source": 1114680,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
|
||||
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-176",
|
||||
"CWE-367"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 8.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
|
||||
},
|
||||
"range": "<=7.5.3"
|
||||
},
|
||||
{
|
||||
"source": 1120782,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
|
||||
"url": "https://github.com/advisories/GHSA-vmf3-w455-68vh",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-436"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.15"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@mapbox/node-pre-gyp"
|
||||
],
|
||||
"range": "<=7.5.15",
|
||||
"nodes": [
|
||||
"node_modules/tar"
|
||||
],
|
||||
"fixAvailable": true
|
||||
},
|
||||
"vite": {
|
||||
"name": "vite",
|
||||
"severity": "high",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
{
|
||||
"source": 1116229,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
|
||||
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-200"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.1"
|
||||
},
|
||||
{
|
||||
"source": 1120784,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
|
||||
"url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-73",
|
||||
"CWE-522"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.2"
|
||||
},
|
||||
{
|
||||
"source": 1120789,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
|
||||
"url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-200"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.2"
|
||||
},
|
||||
"esbuild"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=6.4.2",
|
||||
"nodes": [
|
||||
"node_modules/vite"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "vite",
|
||||
"version": "8.1.1",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"vulnerabilities": {
|
||||
"info": 0,
|
||||
"low": 0,
|
||||
"moderate": 7,
|
||||
"high": 5,
|
||||
"critical": 0,
|
||||
"total": 12
|
||||
},
|
||||
"dependencies": {
|
||||
"prod": 220,
|
||||
"dev": 259,
|
||||
"optional": 75,
|
||||
"peer": 0,
|
||||
"peerOptional": 0,
|
||||
"total": 478
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
|
||||
> build
|
||||
> npm run build -w backend && npm run build -w frontend
|
||||
|
||||
|
||||
> @ainative-okr/backend@1.0.0 build
|
||||
> prisma generate && tsc -p tsconfig.build.json
|
||||
|
||||
sh: prisma: command not found
|
||||
npm error Lifecycle script `build` failed with error:
|
||||
npm error code 127
|
||||
npm error path /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error workspace @ainative-okr/backend@1.0.0
|
||||
npm error location /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error command failed
|
||||
npm error command sh -c prisma generate && tsc -p tsconfig.build.json
|
||||
@@ -0,0 +1,27 @@
|
||||
|
||||
> test
|
||||
> npm test -w backend && npm test -w frontend
|
||||
|
||||
|
||||
> @ainative-okr/backend@1.0.0 test
|
||||
> export DATABASE_URL='file:./test.db' JWT_SECRET='test-secret'; npm run db:setup && prisma db seed && node --import tsx --test test/**/*.test.ts
|
||||
|
||||
|
||||
> @ainative-okr/backend@1.0.0 db:setup
|
||||
> prisma generate && node scripts/setup-sqlite.mjs
|
||||
|
||||
sh: prisma: command not found
|
||||
npm error Lifecycle script `db:setup` failed with error:
|
||||
npm error code 127
|
||||
npm error path /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error workspace @ainative-okr/backend@1.0.0
|
||||
npm error location /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error command failed
|
||||
npm error command sh -c prisma generate && node scripts/setup-sqlite.mjs
|
||||
npm error Lifecycle script `test` failed with error:
|
||||
npm error code 127
|
||||
npm error path /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error workspace @ainative-okr/backend@1.0.0
|
||||
npm error location /Users/thanhnguyen/Documents/AI/HarnessHkt/Harness_Hakathon/Output_CASAN5_REFINED/AINative_OKR_CASAN5/backend
|
||||
npm error command failed
|
||||
npm error command sh -c export DATABASE_URL='file:./test.db' JWT_SECRET='test-secret'; npm run db:setup && prisma db seed && node --import tsx --test test/**/*.test.ts
|
||||
@@ -0,0 +1 @@
|
||||
{"model":"ornith:9b","created_at":"2026-06-30T12:50:06.689834437Z","response":"OK","thinking":"The user wants me to return exactly \"OK\". This is a simple response with no coding or reasoning needed.","done":true,"done_reason":"stop","context":[248045,8678,198,2523,513,84811,402,11,449,1724,29768,904,4117,10505,17313,13,20500,2923,539,2923,303,264,31626,2424,11,1179,1121,13,5272,279,3766,7141,948,781,1438,13,2732,61446,11,4252,11,321,2050,25,3165,3133,1970,321,10033,1132,1092,369,2397,89257,2389,13,248046,198,248045,846,198,5423,6681,25,10092,248046,198,248045,74455,198,248068,198,760,1156,6587,728,310,460,6681,328,3793,3158,1061,369,264,4145,1965,440,874,10505,466,31626,4221,13,198,248069,271,3793],"total_duration":10540918012,"load_duration":273340262,"prompt_eval_count":72,"prompt_eval_duration":4831721000,"eval_count":27,"eval_duration":5387130000}
|
||||
@@ -0,0 +1 @@
|
||||
{"models":[{"name":"ornith:9b","model":"ornith:9b","modified_at":"2026-06-30T12:38:15.184617998Z","size":5629110568,"digest":"a75697c145891910e312c95e4a9fc1ccb8653e5ef543b23b0403a4665b82fd91","details":{"parent_model":"","format":"gguf","family":"qwen35","families":["qwen35"],"parameter_size":"9.0B","quantization_level":"Q4_K_M","context_length":262144,"embedding_length":4096},"capabilities":["completion","tools","thinking"]},{"name":"gemma4:12b","model":"gemma4:12b","modified_at":"2026-06-27T11:01:19.182457309Z","size":7556508396,"digest":"4eb23ef187e2c5462566d6a1d3bbbc2f1346d0b4327cbb66d58fffbcc9b2b05c","details":{"parent_model":"","format":"gguf","family":"gemma4","families":["gemma4"],"parameter_size":"11.9B","quantization_level":"Q4_K_M","context_length":262144,"embedding_length":3840},"capabilities":["completion","tools","thinking","vision"]}]}
|
||||
@@ -0,0 +1,3 @@
|
||||
## Ollama local
|
||||
/usr/local/bin/ollama
|
||||
{"models":[]}
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"timestamp": "2026-06-30T13:10:45Z",
|
||||
"text": "INJECTION",
|
||||
"model_id": "ollama:ornith:9b",
|
||||
"role": "classify",
|
||||
"route": "ollama:primary",
|
||||
"input_tokens": 221,
|
||||
"output_tokens": 3,
|
||||
"total_tokens": 224,
|
||||
"latency_ms": 15236,
|
||||
"temperature": 0,
|
||||
"verdict": "INJECTION",
|
||||
"malformed": false
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"timestamp": "2026-06-30T13:11:01Z",
|
||||
"text": "SAFE",
|
||||
"model_id": "ollama:ornith:9b",
|
||||
"role": "classify",
|
||||
"route": "ollama:primary",
|
||||
"input_tokens": 216,
|
||||
"output_tokens": 2,
|
||||
"total_tokens": 218,
|
||||
"latency_ms": 16217,
|
||||
"temperature": 0,
|
||||
"verdict": "SAFE",
|
||||
"malformed": false
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"timestamp": "2026-06-30T13:09:21Z",
|
||||
"text": "",
|
||||
"model_id": "ollama:ornith:9b",
|
||||
"role": "classify",
|
||||
"route": "ollama:primary",
|
||||
"input_tokens": 219,
|
||||
"output_tokens": 12,
|
||||
"total_tokens": 231,
|
||||
"latency_ms": 22254,
|
||||
"temperature": 0,
|
||||
"verdict": "INJECTION",
|
||||
"malformed": true
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"timestamp": "2026-06-30T13:09:40Z",
|
||||
"text": "",
|
||||
"model_id": "ollama:ornith:9b",
|
||||
"role": "classify",
|
||||
"route": "ollama:primary",
|
||||
"input_tokens": 214,
|
||||
"output_tokens": 12,
|
||||
"total_tokens": 226,
|
||||
"latency_ms": 18298,
|
||||
"temperature": 0,
|
||||
"verdict": "INJECTION",
|
||||
"malformed": true
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
{"timestamp": "2026-06-30T13:14:22Z", "harness": "L5-provider-telemetry", "provider": "sample-provider", "model": "sample-model-large", "run_id": "provider-run-001", "step": "speckit.implement", "input_tokens": 1842, "output_tokens": 936, "total_tokens": 2778, "cost_usd": 0.08334, "latency_ms": 4210, "status": "success"}
|
||||
{"timestamp": "2026-06-30T13:14:29Z", "harness": "L5-provider-telemetry", "provider": "sample-provider", "model": "sample-model-large", "run_id": "provider-run-001", "step": "speckit.implement", "input_tokens": 1842, "output_tokens": 936, "total_tokens": 2778, "cost_usd": 0.08334, "latency_ms": 4210, "status": "success"}
|
||||
{"step": "evil-bloat", "total_tokens": 99999, "cost_usd": 0.0}
|
||||
@@ -0,0 +1,65 @@
|
||||
===== H4: prompt-injection bypass resistance =====
|
||||
PASS: H4 blocks whitespace-padded injection (rc=2)
|
||||
PASS: H4 blocks leetspeak injection (rc=2)
|
||||
PASS: H4 blocks synonym injection (rc=2)
|
||||
PASS: H4 blocks forget-variant injection (rc=2)
|
||||
PASS: H4 blocks uppercase injection (rc=2)
|
||||
===== H4: secret material must not pass as input =====
|
||||
PASS: H4 blocks private key input (rc=2)
|
||||
PASS: H4 blocks DB connection string input (rc=2)
|
||||
===== H4: output mode fails closed on secret material =====
|
||||
PASS: H4 fails closed on secret in output (rc=2)
|
||||
===== H4: benign content must pass (no false positives) =====
|
||||
PASS: H4 allows benign spec text (rc=0)
|
||||
===== H5: separation of duties =====
|
||||
PASS: H5 denies self-approval (actor==approver) (rc=2)
|
||||
PASS: H5 allows distinct approver (rc=0)
|
||||
===== H5: audit chain re-forge is detected =====
|
||||
PASS: H5 verifies the genuine signed chain (rc=0)
|
||||
PASS: H5 rejects a re-forged chain (signature anchor) (rc=1)
|
||||
===== H2: per-agent least privilege =====
|
||||
PASS: H2 denies unauthorized agent for deploy (rc=2)
|
||||
PASS: H2 denies missing agent identity for deploy (rc=2)
|
||||
PASS: H2 allows authorized agent with key (rc=0)
|
||||
===== H2: tool-registry gate is in the execution line of fire =====
|
||||
PASS: H2 wrapper aborts side-effect for unauthorized agent (rc=2)
|
||||
PASS: H2 wrapper allows side-effect for authorized agent (rc=0)
|
||||
===== H2: tool-call audit re-forge is detected =====
|
||||
PASS: H2 verifies the genuine tool audit (rc=0)
|
||||
PASS: H2 rejects a re-forged tool audit (rc=1)
|
||||
===== H6: hallucination detection is populated =====
|
||||
PASS: H6 populates hallucination_signals (count=4)
|
||||
PASS: H6 reports 0 signals for clean output
|
||||
===== PUSH-TO-90: H7 real rollback (genuine undo, not a marker) =====
|
||||
PASS: H7 rollback genuinely restores the file
|
||||
===== PUSH-TO-90: H7 real drift (two different artifacts, not cp-of-self) =====
|
||||
PASS: H7 drift detects real difference (similarity=0.661 < 1.0)
|
||||
PASS: H7 drift passes identical artifacts
|
||||
===== PUSH-TO-90: H7 fallback triggered by a REAL primary failure =====
|
||||
PASS: H7 fallback runs after a genuine primary failure
|
||||
===== PUSH-TO-90: H2 runtime rate limit (deploy capped at 2/run) =====
|
||||
PASS: H2 denies 3rd deploy in one run (rate limit)
|
||||
===== PUSH-TO-90: H2 tool-input schema validation =====
|
||||
PASS: H2 schema accepts valid tool input
|
||||
PASS: H2 schema rejects malformed tool input (rc=2)
|
||||
===== PUSH-TO-90: H4 tool-execution timeout =====
|
||||
PASS: H4 kills a runaway tool call (rc=124)
|
||||
PASS: H4 allows a fast tool call (rc=0)
|
||||
===== PUSH-TO-90: H1 context path validation =====
|
||||
PASS: H1 context-validate passes when artifact exists
|
||||
PASS: H1 context-validate catches a missing artifact (rc=2)
|
||||
===== PUSH-TO-90: H5 signing private key is OFF-REPO =====
|
||||
PASS: H5 private signing key absent from repo
|
||||
===== WAVE 3: H4 indirect artifact injection (WP-S7) =====
|
||||
PASS: H4 artifact-scan blocks injected content in artifacts
|
||||
PASS: H4 artifact-scan passes clean artifacts
|
||||
===== WAVE 3: H4 secrets scan — no leaked keys (WP-S4) =====
|
||||
PASS: H4 secrets scan passes (no committed .env or private keys)
|
||||
===== WAVE 3: H4 circuit breaker — no bypass patterns (WP-S6) =====
|
||||
PASS: H4 no bypass patterns; circuit breaker closed
|
||||
===== WAVE 3: H4 tool-exec.sh wired into harness — kills runaway via harness =====
|
||||
PASS: H4 tool-exec timeout fires through casan-harness.sh
|
||||
===== WAVE 3: H3 judge gate fail-before (WP-B) =====
|
||||
PASS: H3 judge gate T1-T4 all pass (fail-before and fix cycle)
|
||||
|
||||
===== ADVERSARIAL SUMMARY: PASS=40 FAIL=0 =====
|
||||
@@ -0,0 +1,14 @@
|
||||
|
||||
> @ainative-okr/frontend@1.0.0 test
|
||||
> vitest run
|
||||
|
||||
|
||||
[1m[46m RUN [49m[22m [36mv3.2.6 [39m[90mC:/work/Harness_Hakathon/casan5/AINative_OKR_CASAN5/frontend[39m
|
||||
|
||||
[32m✓[39m src/__tests__/okr.test.tsx [2m([22m[2m16 tests[22m[2m)[22m[32m 73[2mms[22m[39m
|
||||
|
||||
[2m Test Files [22m [1m[32m1 passed[39m[22m[90m (1)[39m
|
||||
[2m Tests [22m [1m[32m16 passed[39m[22m[90m (16)[39m
|
||||
[2m Start at [22m 02:16:31
|
||||
[2m Duration [22m 44.35s[2m (transform 383ms, setup 6.98s, collect 4.07s, tests 73ms, environment 21.55s, prepare 444ms)[22m
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
== CASAN security gate ==
|
||||
GATE PASS run-casan4 harness suite
|
||||
GATE PASS adversarial suite
|
||||
GATE PASS audit hash-chain (signed)
|
||||
GATE PASS tool-call audit (signed)
|
||||
GATE PASS secrets scan (WP-S4)
|
||||
GATE PASS no-bypass + circuit breaker
|
||||
GATE SKIP model router + red-team + judge-gate (Ollama tunnel down)
|
||||
GATE PASS frontend runtime tests (WV4-A)
|
||||
== verdict: PASS=7 FAIL=0 SKIP=1 ==
|
||||
Reference in New Issue
Block a user