fable-heal

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Fable Heal

Automatically synthesize, apply, and verify security fixes for vulnerabilities detected by

fable-redteam

自动合成、应用并验证由

fable-redteam

检测到的漏洞的安全修复方案。

Purpose

目的

Bridge the gap between active vulnerability discovery and verified code remediation.

fable-heal

translates offensive security findings (SQL injection, BOLA/IDOR, CORS misconfigurations, missing security headers, sensitive file leaks, SSRF, JWT signature bypass, and LLM prompt injections) into concrete, tested, verified code patches with zero regressions.

弥合主动漏洞发现与经验证的代码修复之间的差距。

fable-heal

将攻击性安全测试发现的问题（SQL 注入、BOLA/IDOR、CORS 配置错误、缺失安全标头、敏感文件泄露、SSRF、JWT 签名绕过和 LLM 提示词注入）转化为具体、经过测试且已验证的代码补丁，并确保零回归。

When to Use

使用场景

```
fable-redteam
```
or security audits have identified vulnerabilities that need immediate code remediation.
Automatically generating TDD regression test suites to ensure security flaws stay closed in CI.
Applying surgical code patches in staging or local branches with atomic rollback protection.
Verifying whether candidate security patches successfully eliminate attack vectors.

```
fable-redteam
```
或安全审计已发现需要立即进行代码修复的漏洞。
自动生成 TDD 回归测试套件，确保安全缺陷在 CI 中持续保持已修复状态。
在 staging 分支或本地分支中应用精准代码补丁，并提供原子回滚保护。
验证候选安全补丁是否成功消除攻击向量。

When NOT to Use

不适用场景

Before vulnerabilities have been identified or reproduced (use
```
fable-redteam
```
or
```
fable-security
```
).
For general non-security application refactoring (use
```
fable-simplify
```
).
Direct production patching without human review or staging verification.

漏洞尚未被发现或复现之前（使用
```
fable-redteam
```
或
```
fable-security
```
）。
常规的非安全应用重构（使用
```
fable-simplify
```
）。
未经人工审核或 staging 环境验证而直接修补生产环境。

Inputs

输入

```
redteam_findings
```
: Array or file path of structured vulnerability findings from
```
fable-redteam
```
.
```
target
```
: Target HTTP/HTTPS endpoint or repository workspace.
```
dryRun
```
: When true, previews generated patches and unified diffs without modifying files.
```
autoApply
```
: When true, writes patches directly to matching codebase source files.
```
verify
```
: When true, re-runs attack vectors against the target to prove vulnerability resolution.

```
redteam_findings
```
：来自
```
fable-redteam
```
的结构化漏洞发现结果数组或文件路径。
```
target
```
：目标 HTTP/HTTPS 端点或代码仓库工作区。
```
dryRun
```
：为 true 时，预览生成的补丁和 unified diff，而不修改文件。
```
autoApply
```
：为 true 时，将补丁直接写入代码库中匹配的源代码文件。
```
verify
```
：为 true 时，对目标重新运行攻击向量，以证明漏洞已解决。

Expected Outputs

预期输出

```
security_patches
```
: Concrete code replacements with unified diffs.
```
test/security/redteam-healed.test.ts
```
: Executable Bun test suite asserting vulnerability closure.
```
.fable/heal-attestation.json
```
: Tamper-evident cryptographic SHA-256 attestation record.
```
.fable/LEDGER.md
```
: Updated work cards marked as remediated.

```
security_patches
```
：包含 unified diff 的具体代码替换内容。
```
test/security/redteam-healed.test.ts
```
：断言漏洞已修复的可执行 Bun 测试套件。
```
.fable/heal-attestation.json
```
：具备防篡改能力的密码学 SHA-256 证明记录。
```
.fable/LEDGER.md
```
：更新后并标记为已修复的工作卡。

Procedure

流程

Finding Ingestion: Load findings from
```
fable-redteam
```
, SARIF reports, or
```
.fable/redteam-findings.json
```
.
Strategy Selection: Map each finding category and CWE to its surgical remediation pattern:
- SQL Injection (CWE-89) -> Parameterized queries.
- IDOR/BOLA (CWE-639) -> Resource ownership verification guard.
- CORS Misconfiguration (CWE-942) -> Strict origin whitelist.
- Missing Security Headers (CWE-1021) -> Content-Security-Policy, HSTS, XFO headers.
- Sensitive Exposures (CWE-200) -> Route denial for
```
.env
```
  ,
```
.git
```
  , and secrets.
- SSRF (CWE-918) -> Outbound URL and IP validation blocking loopback and cloud metadata.
Patch Synthesis: Generate code transformations and compute unified diffs.
TDD Test Generation: Emit executable test assertions into
```
test/security/redteam-healed.test.ts
```
.
Atomic Application & Guard: If applied, write patches with automated backup. On syntax or compilation failure, trigger circuit-breaker rollback.
Closed-Loop Verification: If target is accessible, execute verification probes to confirm fix.
Attestation & Ledger Sealing: Record cryptographic SHA-256 seal and mark work cards closed.

发现结果导入： 从
```
fable-redteam
```
、SARIF 报告或
```
.fable/redteam-findings.json
```
加载发现结果。
策略选择： 将每种发现类别和 CWE 映射到对应的精准修复模式：
- SQL 注入（CWE-89）-> 参数化查询。
- IDOR/BOLA（CWE-639）-> 资源所有权验证防护。
- CORS 配置错误（CWE-942）-> 严格的 origin 白名单。
- 缺失安全标头（CWE-1021）-> Content-Security-Policy、HSTS 和 XFO 标头。
- 敏感信息暴露（CWE-200）-> 拒绝访问
```
.env
```
  、
```
.git
```
  和 secrets 的路由。
- SSRF（CWE-918）-> 出站 URL 与 IP 验证，阻止访问 loopback 和云元数据地址。
补丁合成： 生成代码转换并计算 unified diff。
TDD 测试生成： 将可执行的测试断言输出到
```
test/security/redteam-healed.test.ts
```
。
原子应用与防护： 应用补丁时先执行自动备份。发生语法或编译失败时，触发熔断器回滚。
闭环验证： 如果目标可访问，则执行验证探针以确认修复。
证明与账本封存： 记录密码学 SHA-256 封存值，并将工作卡标记为已关闭。

Decision Rules

决策规则

If syntax check or typecheck fails on a candidate patch, trigger rollback immediately via circuit breaker.
Always generate executable TDD regression test suite before sealing remediation.
Never modify files in
```
dryRun
```
mode; only emit unified diffs and previews.
When target endpoint is live and verification is requested, probe target to prove vulnerability closure before completing.
Record SHA-256 cryptographic attestation in
```
.fable/heal-attestation.json
```
for all applied patches.

如果候选补丁的语法检查或类型检查失败，立即通过熔断器触发回滚。
在封存修复之前，始终生成可执行的 TDD 回归测试套件。
在
```
dryRun
```
模式下绝不修改文件；仅输出 unified diff 和预览内容。
当目标端点在线且请求验证时，在完成前探测目标，以证明漏洞已修复。
对所有已应用的补丁，将密码学 SHA-256 证明记录到
```
.fable/heal-attestation.json
```
。

Constraints

约束

Do not apply patches without automated rollback circuit breaker in place.
Do not bypass verification tests when closing active security work cards.
Patches must be surgical and preserve existing application business logic and comments.

未部署自动回滚熔断器时，不得应用补丁。
关闭活跃安全工作卡时，不得绕过验证测试。
补丁必须精准，并保留现有应用的业务逻辑和注释。

Tool Policy

工具策略

Use native AST patching and regex transformers from
```
src/core/redteam/heal.ts
```
.
Run Bun test runner (
```
bun test
```
) to execute generated regression test suites.
Use native SHA-256 crypto for cryptographic attestation generation.

使用
```
src/core/redteam/heal.ts
```
中的原生 AST 补丁工具和正则转换器。
使用 Bun 测试运行器（
```
bun test
```
）执行生成的回归测试套件。
使用原生 SHA-256 密码学功能生成密码学证明。

Evidence Requirements

证据要求

Synthesized patches must provide exact file paths, strategy name, and unified diffs.
Applied patches require syntax verification and automated regression test generation in
```
test/security/redteam-healed.test.ts
```
.
Cryptographic healing attestation at
```
.fable/heal-attestation.json
```
verifying integrity of all applied patches.

合成的补丁必须提供准确的文件路径、策略名称和 unified diff。
已应用的补丁必须通过语法验证，并在
```
test/security/redteam-healed.test.ts
```
中自动生成回归测试。
在
```
.fable/heal-attestation.json
```
中提供密码学修复证明，以验证所有已应用补丁的完整性。

Failure Handling

失败处理

If a candidate patch produces invalid syntax or type errors, immediately rollback changes via the circuit breaker.
If regression tests fail, revert applied patches and flag finding for manual developer review.
If target server is unavailable during closed-loop verification, mark verification as pending without blocking patch application.

如果候选补丁产生无效语法或类型错误，立即通过熔断器回滚变更。
如果回归测试失败，则撤销已应用的补丁，并将该发现标记为需要开发人员手动审核。
如果闭环验证期间目标服务器不可用，则将验证标记为待处理，但不阻止补丁应用。

Completion Criteria

完成标准

All identified vulnerability findings mapped to remediation strategies.
Unified diffs and patches synthesized for vulnerable targets.
TDD regression test suite generated and passing in
```
test/security/redteam-healed.test.ts
```
.
Cryptographic attestation recorded in
```
.fable/heal-attestation.json
```
.
Remediation status recorded in
```
.fable/LEDGER.md
```
.

所有已识别的漏洞发现均已映射到相应的修复策略。
已为存在漏洞的目标合成 unified diff 和补丁。
已在
```
test/security/redteam-healed.test.ts
```
中生成 TDD 回归测试套件且测试通过。
密码学证明已记录到
```
.fable/heal-attestation.json
```
。
修复状态已记录到
```
.fable/LEDGER.md
```
。