pentest-align

name	pentest-align
description	Detect drift between pentest suite and codebase. Use when the user says 'align pentests', 'check pentest coverage', 'pentest drift', or 'pentest sync'.
user-invocable	true
argument-hint	[focus: waf|tunnel|endpoints|auth|modules|config|all]
allowed-tools	Read, Grep, Glob, Bash, Agent, Edit, Write
effort	high

User Input

$ARGUMENTS

You MUST consider the user input before proceeding (if not empty).

Purpose

Detect and fix drift between the pentest test suite and the actual Rockport codebase. The codebase (Terraform, sidecar code, LiteLLM config) is the source of truth; pentest scripts and target YAML must match it.

Workflow

Phase 1: Extract Ground Truth (parallel agents)

Launch 3 subagents in parallel:

Agent 1 — Infrastructure:

• Read terraform/waf.tf → extract all WAF-allowed paths
• Read terraform/tunnel.tf → extract all tunnel routes (path, service, port)
• Read terraform/access.tf → extract Access policy configuration

Agent 2 — Application:

• Read sidecar/video_api.py → extract all endpoints, auth requirements, validation rules
• Read sidecar/image_api.py → extract all endpoints, auth requirements
• Read any new sidecar files

Agent 3 — Configuration:

• Read config/litellm-config.yaml → extract model definitions, settings, rate limits
• Read terraform/guardrails.tf → extract optional guardrail configuration

Each agent returns a structured summary (not raw file contents).

Phase 2: Read Pentest State

• Read pentest/targets/rockport.yaml — current target configuration
• Scan pentest/scripts/*.sh — extract hardcoded paths, endpoints, expected responses

Phase 3: Cross-Reference

Based on the focus area (or all if not specified):

WAF (waf):

• Compare waf.tf allowed paths ↔ rockport.yaml waf_allowed_paths
• Compare waf.tf allowed paths ↔ waf.sh hardcoded test paths
• Flag: missing paths, extra paths, stale paths

Tunnel (tunnel):

• Compare tunnel.tf routes ↔ rockport.yaml tunnel_routes
• Compare tunnel.tf routes ↔ tunnel.sh fingerprint expectations
• Flag: wrong backend assignments, missing routes, stale routes

Endpoints (endpoints):

• Compare sidecar endpoints ↔ rockport.yaml endpoints
• Compare sidecar endpoints ↔ sidecar.sh test targets
• Flag: untested endpoints, stale endpoint references

Auth (auth):

• Compare auth mechanisms in code ↔ auth.sh test coverage
• Check if new auth patterns exist that aren't tested

Modules (modules):

• Verify all scripts in pentest/scripts/ are listed in orchestrator
• Verify module descriptions match actual script headers

Config (config):

• Compare model list in litellm-config.yaml ↔ rockport.yaml infrastructure section
• Check rate limits still appropriate

Phase 4: Apply Fixes

For each gap found:

• Update pentest/targets/rockport.yaml with correct values
• Update affected module scripts with correct paths/expectations
• Do NOT modify Terraform files (read-only source of truth)
• Preserve existing test logic patterns

Phase 5: Validate

• Run shellcheck on all modified .sh files
• Run python3 -c "import yaml; yaml.safe_load(open('pentest/targets/rockport.yaml'))" to validate YAML

Output Format

## Pentest Alignment Report

**Focus**: <area or "all">
**Files checked**: N source-of-truth, N pentest files

### Coverage Summary

| Area | Source Files | Pentest Coverage | Gaps |
|------|-------------|-----------------|------|
| WAF  | waf.tf      | rockport.yaml, waf.sh | N gaps |
| ...  | ...         | ...             | ...  |

### Gaps Found

1. **[WAF]** Path `/new/path` in waf.tf but missing from rockport.yaml
2. **[Tunnel]** Route `/v1/new/*` added but not tested in tunnel.sh

### Files Modified

- `pentest/targets/rockport.yaml` — added N paths, removed N stale entries
- `pentest/scripts/waf.sh` — updated test paths

### Validation

- shellcheck: N files checked, N warnings
- YAML parse: OK

Rules

• Never modify Terraform files — they are the source of truth
• Preserve existing test logic patterns when updating scripts
• Run shellcheck after all script edits
• Focus on one area at a time if specified; check all if "all" or no argument