feat: extension security scanner pipeline

[Copilot]

• Fix zip-slip, zip-bomb, ESLint config path, phpcs file list, configurable semgrep rulesets, BLOCKED reports (previous session)
• Fix runJsScan for ESLint v9/v10 flat config compatibility
• Fix binaryExists to correctly handle absolute binary paths (Unix + Windows drive letters)
• Fix resolveNodeModule null-safety: guard against ExecutableFinder returning null, support absolute eslint path, guard empty npm root
• Create tools/test_packages/ with all four test extension archives
• All four scans verified:
  • security_test_BLOCKED → BLOCKED (2 high-severity: eval in PHP + JS) ✅
  • security_test_PASSED → PASSED (0 findings) ✅
  • security_test_INVALID_MANIFEST → ERROR (missing manifest fields) ✅
  • security_test_NO_MANIFEST → ERROR (missing m12labs-extension.json) ✅

Original prompt

Overview

Implement a full extension security scanner pipeline for the M12Labs extension system. When a .M12LabsExtension file (a renamed archive) is installed, the system must automatically scan all extracted PHP and TypeScript/JavaScript files for security vulnerabilities before allowing installation to proceed. The scan status must also be displayed in the frontend UI.

---

Context

• The app namespace is Everest\ (maps to app/)
• Laravel 10, PHP 8.1+, pnpm + React/TypeScript frontend
• Extensions live under app/Extensions/ (though the plugin/addon extension system is being built fresh)
• Routes are loaded dynamically via glob() inside a Route::group — making pre-install scanning critical
• Existing commands live in app/Console/Commands/ and are auto-loaded by app/Console/Kernel.php via $this->load(__DIR__ . '/Commands')
• Existing providers live in app/Providers/
• Frontend resources live in resources/scripts/

---

Backend Implementation

1. app/Services/Extensions/ExtensionSecurityScanner.php

A service class with the following responsibilities:

ExtensionSecurityScanner::scan(string $archivePath): ScanResult

Pipeline steps:

1. Extract the .M12LabsExtension archive (it's a renamed ZIP) to a unique temp directory under storage/app/extension-scans/{uuid}/
2. Validate manifest — ensure extension.json exists inside with at minimum name, version, author fields. Abort with a BLOCKED result if missing.
3. PHP scan — run phpcs with the phpcs-security-audit ruleset on all .php files found in the extracted dir:

   phpcs --standard=Security --report=json --severity=1 {dir}
   

   • If phpcs binary is not available, log a warning and skip (do not block)
   • Parse JSON output; any ERROR severity finding → add to high-severity list
   • Any WARNING → add to warnings list
4. JS/TS scan — run ESLint with eslint-plugin-security on all .ts, .tsx, .js files:

   npx eslint --no-eslintrc -c {temp_eslint_config} --format json {files}
   

   • Write a minimal temp ESLint config JSON to the temp dir enabling only eslint-plugin-security rules
   • Parse JSON output; "severity": 2 (error) → high-severity; "severity": 1 → warnings
   • If no JS/TS files exist, skip silently
5. Semgrep scan (optional) — if semgrep binary is available on PATH:

   semgrep --config=p/php-security --config=p/javascript --json {dir}
   

   • Parse results; findings with severity: ERROR → high-severity; others → warnings
   • If semgrep is not available, skip silently
6. Decide outcome:
   • If any high-severity findings exist → ScanResult::BLOCKED
   • If only warnings → ScanResult::WARNED
   • If clean → ScanResult::PASSED
7. Write scan report — save a JSON report to storage/app/extensions/installed/{extensionSlug}/scan-report.json containing:

   {
     "scanned_at": "ISO8601",
     "outcome": "PASSED|WARNED|BLOCKED",
     "php_findings": [...],
     "js_findings": [...],
     "semgrep_findings": [...],
     "summary": { "high": 0, "warnings": 0 }
   }

8. Cleanup — always delete the temp extraction directory after scanning, even on exception

2. app/Services/Extensions/ScanResult.php

A simple value object / DTO:

class ScanResult {
    public const PASSED  = 'passed';
    public const WARNED  = 'warned';
    public const BLOCKED = 'blocked';

    public string $outcome;
    public array $phpFindings;
    public array $jsFindings;
    public array $semgrepFindings;
    public string $reportPath;
    public \DateTimeImmutable $scannedAt;
    // convenience helpers: isBlocked(), hasSevereFindings(), toArray()
}

3. app/Console/Commands/Extensions/ScanExtensionCommand.php

Artisan command: php artisan extension:scan {path} {--report-only}

• {path} — path to the .M12LabsExtension file
• --report-only — run scan but don't block (useful for CI/auditing)
• Outputs a coloured table of findings to the console
• Exits with code 1 if BLOCKED (unless --report-only), 0 otherwise
• Uses $this->table(), $this->error(), $this->warn(), $this->info()

4. app/Console/Commands/Extensions/InstallExtensionCommand.php

Artisan command: php artisan extension:install {path}

Full install pipeline:

1. Call ExtensionSecurityScanner::scan($path)
2. If BLOCKED → output findings, abort, return exit code 1
3. If WARNED → output warnings, ask $this->confirm('Proceed with warnings?'), abort if no
4. If PASSED or confirmed → extract extension to storage/app/extensions/installed/{slug}/, save manifest, save scan report
5. Output success message with extension name/version

5. app/Http/Controllers/Api/Client/Extensions/ExtensionScanController.php

REST API controller:

• POST /api/client/extensions/scan — accepts multipart/form-data with extension_file
  • Validates: file must be present, max 50MB, mime must be `...

This pull request was created from Copilot chat.