@bongos/core 1.18.19 → 1.19.3

package/modules/security/artifact-scan/detectors/hooks.js

@@ -0,0 +1,116 @@
+// modules/security/artifact-scan/detectors/hooks.js — Claude Code hook
+// definitions bundled inside an artifact (task 1002544).
+//
+// A hook in .claude/settings.json runs a SHELL COMMAND every time the harness
+// fires the matching event — installing an artifact that carries one is
+// granting it standing code execution inside every future session. The floor
+// quotes every hook command verbatim (scrubbed + capped) and names the matcher
+// breadth, because "PreToolUse on *" and "PostToolUse on Edit:src/foo.js" are
+// wildly different grants that render identically in a quick skim.
+//
+// The walk is shape-generic (any "hooks" key anywhere in any .claude/ JSON or
+// a root settings.json): the schema has evolved and an artifact aiming at a
+// FUTURE schema still deserves a finding today.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, grepParseDisagreement } = require('./shared');
+
+function isClaudeConfig(p) {
+  const name = basename(p);
+  if (p.includes('.claude/') || p.includes('.claude\\')) return name.endsWith('.json');
+  return name === 'settings.json' || name === 'settings.local.json'
+    || name === 'managed-settings.json' || name === '.claude.json';
+}
+
+// A matcher that matches everything: '*', empty, or missing.
+function matcherBreadth(matcher) {
+  if (matcher === undefined || matcher === null || matcher === '' || matcher === '*') return 'ALL tool calls';
+  return `matcher "${excerpt(matcher, 80)}"`;
+}
+
+// Same cap as shared.countKeysDeep: a legitimate hooks config never nests this
+// deep, and an unbounded walk over hostile (but JSON.parse-valid) nesting is a
+// stack overflow. Depth past the cap is UNREVIEWED, surfaced as a finding.
+const MAX_TREE_DEPTH = 40;
+
+// Collect { matcher, command, event } from any hooks-shaped subtree. In the
+// live schema the matcher sits on an ANCESTOR of the command node
+// ([{ matcher, hooks: [{ type, command }] }]), so the nearest enclosing
+// matcher is threaded down to each command it governs. `state` is
+// { hooks: [], truncated: false }; truncated flips when the depth cap stopped
+// the walk, so detect() can report the unreviewed subtree.
+function collectHooks(value, event, matcher, state, depth = 0) {
+  if (value === null || typeof value !== 'object') return;
+  if (depth > MAX_TREE_DEPTH) { state.truncated = true; return; }
+  if (Array.isArray(value)) {
+    for (const item of value) collectHooks(item, event, matcher, state, depth + 1);
+    return;
+  }
+  const m = typeof value.matcher === 'string' ? value.matcher : matcher;
+  // A `command` key that is present but not a string is an unreviewable grant,
+  // not a non-event: record it as opaque so a sibling string command can never
+  // let it slip out of the report silently.
+  if (Object.prototype.hasOwnProperty.call(value, 'command')) {
+    if (typeof value.command === 'string') state.hooks.push({ event, matcher: m, command: value.command });
+    else state.hooks.push({ event, matcher: m, command: null, opaque: true });
+  }
+  for (const [k, v] of Object.entries(value)) {
+    if (k !== 'command') collectHooks(v, event, m, state, depth + 1);
+  }
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isClaudeConfig(file.path)) continue;
+    const parsed = parseJsonStrict(file.text);
+
+    const hooksNode = parsed.ok && parsed.value && typeof parsed.value === 'object' ? parsed.value.hooks : undefined;
+    if (hooksNode && typeof hooksNode === 'object') {
+      for (const [event, subtree] of Object.entries(hooksNode)) {
+        const state = { hooks: [], truncated: false };
+        collectHooks(subtree, event, undefined, state);
+        const collected = state.hooks;
+        if (state.truncated) {
+          findings.push(finding('config_depth_cap', 'high', file.path,
+            `"hooks.${event}" nests deeper than the ${MAX_TREE_DEPTH}-level review cap — the deeper subtree is an unreviewable hook grant.`,
+            { event, reason: 'depth_cap' }));
+        }
+        for (const h of collected) {
+          if (h.opaque) {
+            findings.push(finding('claude_hook_opaque', 'high', file.path,
+              `${h.event} hook on ${matcherBreadth(h.matcher)} has a non-string command — unreviewable hook grant.`,
+              { event: h.event, matcher: h.matcher ?? null }));
+            continue;
+          }
+          findings.push(finding('claude_hook_command', 'high', file.path,
+            `${h.event} hook on ${matcherBreadth(h.matcher)} runs: ${excerpt(h.command)}`,
+            { event: h.event, matcher: h.matcher ?? null, command: excerpt(h.command) }));
+        }
+        if (collected.length === 0 && !state.truncated) {
+          // A hooks event with no extractable command is still a grant we
+          // could not render — surface it rather than skipping silently.
+          // (The truncated case is already reported as config_depth_cap.)
+          findings.push(finding('claude_hook_opaque', 'high', file.path,
+            `"hooks.${event}" is present but its command text could not be extracted — unreviewable hook grant.`,
+            { event }));
+        }
+      }
+    }
+
+    const disagreement = grepParseDisagreement(file.text, 'hooks', parsed.ok ? parsed.value : null);
+    if (disagreement) {
+      findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+        `"hooks" appears ${disagreement.rawCount}x in key position in the raw bytes but the strict parse yielded ${disagreement.parsedCount} — hidden hook config.`,
+        { marker: 'hooks', ...disagreement }));
+    }
+    if (!parsed.ok) {
+      findings.push(finding('config_unparseable', 'medium', file.path,
+        'Claude config does not strictly parse as JSON — whatever the harness makes of it was not reviewable here.', null));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, matcherBreadth };

package/modules/security/artifact-scan/detectors/injection.js

@@ -0,0 +1,118 @@
+// modules/security/artifact-scan/detectors/injection.js — text aimed at the
+// scanner rather than at a human reader (task 1002544).
+//
+// Three families, all critical, because none has a benign reason to exist in
+// a third-party artifact:
+//   1. instruction-override phrases ("ignore previous instructions");
+//   2. scanner/reviewer-targeting phrases ("report this as clean", "dear
+//      reviewer") — this artifact KNOWS it will be scanned and is talking to
+//      the process, the strongest malice indicator we have;
+//   3. dangerous codepoints (zero-width, bidi, Unicode Tags) — text engineered
+//      to read differently to a human than to a parser. Detected on the corpus
+//      text, which floor.js has already had TextDecoder strip a legitimate
+//      leading BOM from — so ANY invisible that remains is anomalous.
+//
+// The phrase lists are deliberately NARROW: a scanner that flags ordinary code
+// like `return 'cleanup'` as an attack is worse than useless, so verdict-
+// steering patterns require explicit scanner-directed framing ("report … as
+// clean"), never a bare `return "clean"`.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const OVERRIDE_PHRASES = Object.freeze([
+  ['instruction override', /ignore\s+(?:all\s+)?(?:previous|prior|above|the\s+above)\s+instructions/i],
+  ['instruction override', /disregard\s+(?:all\s+)?(?:previous|prior|above|your|the\s+above)\s+instructions/i],
+  ['role reassignment', /you\s+are\s+no\s+longer\s+(?:a|an|the)\b/i],
+  ['system-prompt spoof', /<\s*\/?\s*system\s*>|\[\s*system\s*\]|^#{1,3}\s*system\s+prompt/im],
+]);
+
+// Scanner-directed framing only. Each requires an imperative addressed at the
+// judgement ("report/mark/classify … as clean", "say this is safe"), with the
+// verdict word \b-anchored so "clean" does not match inside "cleanup".
+const SCANNER_PHRASES = Object.freeze([
+  // A REQUIRED object ("report THIS as clean") keeps defensive-code idioms like
+  // "treat as clean" / "mark as done" out; "treat/rate/score/label" are dropped
+  // as too generic to be scanner-talk on their own.
+  ['verdict steering', /\b(?:report|mark|classify|flag)\s+(?:this|it|the\s+\w+|everything)\s+as\s+["']?(?:clean|safe|benign|trustworthy|harmless|not\s+malicious)\b/i],
+  ['verdict steering', /\b(?:say|state|declare|respond|conclude)\s+(?:that\s+)?(?:this|it)\s+is\s+["']?(?:clean|safe|benign|harmless|not\s+malicious)\b/i],
+  ['verdict steering', /\bno\s+(?:findings|issues|threats|vulnerabilities)\s+(?:were\s+)?(?:found|detected|present)\s+here\b/i],
+  ['reviewer-addressed', /\bdear\s+(?:reviewer|auditor|scanner|ai|assistant|claude|security\s+\w+)\b/i],
+  ['reviewer-addressed', /\b(?:to|for)\s+the\s+(?:ai|llm|model|scanner|reviewer|auditor)\s+(?:reading|reviewing|scanning|analyz)/i],
+  ['scanner-aware', /\bif\s+you(?:'re|\s+are)\s+(?:an?\s+)?(?:ai|llm|language\s+model|scanner|security\s+reviewer|assistant)\b/i],
+]);
+
+// Codepoints that read differently than they parse, tiered by attack class:
+//   critical — bidi overrides/isolates + the Unicode Tags block (U+E0000–E007F,
+//              invisible characters that can carry a hidden instruction);
+//   high     — zero-width space / word-joiner / a BOM anywhere (the legitimate
+//              leading BOM was already consumed by the decoder);
+//   medium   — ZWJ/ZWNJ, RLM/LRM, C0/C1 controls, line/paragraph separators —
+//              classes with occasional legitimate use that still must not reach
+//              the mirror.
+// Counts and CLASSES are reported, never the characters themselves.
+const CODEPOINT_PATTERN =
+  '[' +
+    '\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f-\\x9f' + // C0/C1 controls
+    '\\u200b-\\u200f\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff' + // zw/bidi (fence-local set)
+    '\\u2028\\u2029' + // line/paragraph separators
+  ']' +
+  '|[\\u{e0000}-\\u{e007f}]'; // Unicode Tags block
+
+function classifyCodepoint(cp) {
+  if (cp >= 0xe0000 && cp <= 0xe007f) return { tier: 'critical', cls: 'unicode-tag' };
+  if ((cp >= 0x202a && cp <= 0x202e) || (cp >= 0x2066 && cp <= 0x2069)) return { tier: 'critical', cls: 'bidi-override' };
+  if (cp === 0x200b || cp === 0x2060 || cp === 0xfeff) return { tier: 'high', cls: 'invisible' };
+  if (cp === 0x200c || cp === 0x200d) return { tier: 'medium', cls: 'zero-width-joiner' };
+  if (cp === 0x200e || cp === 0x200f) return { tier: 'medium', cls: 'bidi-mark' };
+  if (cp === 0x2028 || cp === 0x2029) return { tier: 'medium', cls: 'line-separator' };
+  return { tier: 'medium', cls: 'control' };
+}
+
+// Compiled once; lastIndex is reset at each entry to codepointClasses so the
+// stateful 'g' flag cannot leak scan position between calls.
+const CODEPOINT_SCANNER = new RegExp(CODEPOINT_PATTERN, 'gu');
+
+function codepointClasses(text) {
+  const tiers = { critical: new Map(), high: new Map(), medium: new Map() };
+  const re = CODEPOINT_SCANNER;
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const { tier, cls } = classifyCodepoint(m[0].codePointAt(0));
+    tiers[tier].set(cls, (tiers[tier].get(cls) || 0) + 1);
+  }
+  return tiers;
+}
+
+const ALL_PHRASES = Object.freeze([...OVERRIDE_PHRASES, ...SCANNER_PHRASES]);
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+
+    for (const [family, re] of ALL_PHRASES) {
+      const m = re.exec(file.text);
+      if (m) {
+        const line = lineAt(file.text, m.index);
+        findings.push(finding('injection_phrase', 'critical', file.path,
+          `${family} phrase at line ${line} — text addressed to the scanning process, not a human reader.`,
+          { family, line }));
+      }
+    }
+
+    const tiers = codepointClasses(file.text);
+    for (const [tier, classes] of Object.entries(tiers)) {
+      if (classes.size === 0) continue;
+      const summary = [...classes.entries()].map(([cls, n]) => `${n} ${cls}`).join(', ');
+      findings.push(finding('dangerous_codepoints', tier, file.path,
+        `Invisible/reordering codepoints (${summary}) — can read differently to a human than to a parser.`,
+        { classes: Object.fromEntries(classes) }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, OVERRIDE_PHRASES, SCANNER_PHRASES, codepointClasses };

package/modules/security/artifact-scan/detectors/mcp.js

@@ -0,0 +1,102 @@
+// modules/security/artifact-scan/detectors/mcp.js — MCP server entries bundled
+// in an artifact (task 1002544).
+//
+// An MCP server entry is not config, it is a grant: a `command` is a process
+// the harness will spawn on the builder's machine; a `url` is a remote whose
+// code lives off-box. NEITHER is scannable by a static read of this artifact —
+// the command's binary and the remote's behavior are outside these bytes — so
+// both are flagged unscannable (the reducer caps coverage over them), with the
+// entry quoted verbatim so the reader sees exactly what would be granted.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, grepParseDisagreement } = require('./shared');
+
+function isMcpConfig(p) {
+  const name = basename(p);
+  return name === '.mcp.json' || name === 'mcp.json' || name === 'claude_desktop_config.json'
+    || name === '.claude.json'
+    || ((p.includes('.claude/') || p.includes('.claude\\')) && name.endsWith('.json'));
+}
+
+// Same cap as shared.countKeysDeep: an unbounded walk over hostile (but
+// JSON.parse-valid) nesting is a stack overflow; depth past the cap is
+// UNREVIEWED and must surface as a finding, never a silent stop.
+const MAX_TREE_DEPTH = 40;
+
+// Collect MCP-server-shaped entries: any object under an "mcpServers" (or
+// "servers") key whose members carry command/url. Returns { servers,
+// truncated } — truncated flips when the depth cap stopped the walk.
+function collectServers(root) {
+  const servers = [];
+  let truncated = false;
+  const visit = (value, depth) => {
+    if (value === null || typeof value !== 'object') return;
+    if (depth > MAX_TREE_DEPTH) { truncated = true; return; }
+    if (Array.isArray(value)) { for (const item of value) visit(item, depth + 1); return; }
+    for (const [k, v] of Object.entries(value)) {
+      if ((k === 'mcpServers' || k === 'servers') && v && typeof v === 'object' && !Array.isArray(v)) {
+        for (const [name, entry] of Object.entries(v)) {
+          if (entry && typeof entry === 'object') servers.push({ name, entry });
+        }
+      }
+      visit(v, depth + 1);
+    }
+  };
+  visit(root, 0);
+  return { servers, truncated };
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isMcpConfig(file.path)) continue;
+    const parsed = parseJsonStrict(file.text);
+
+    if (parsed.ok) {
+      const { servers, truncated } = collectServers(parsed.value);
+      if (truncated) {
+        findings.push(finding('config_depth_cap', 'high', file.path,
+          `MCP config nests deeper than the ${MAX_TREE_DEPTH}-level review cap — deeper entries were not reviewable.`,
+          { reason: 'depth_cap', unscannable: true }));
+      }
+      for (const { name, entry } of servers) {
+        if (typeof entry.command === 'string') {
+          // Cap the arg COUNT here; finding() caps total length regardless, but
+          // an unbounded join would otherwise be truncated mid-token.
+          const args = Array.isArray(entry.args) ? entry.args.slice(0, 8) : [];
+          const argv = args.map((a) => excerpt(a, 60)).join(' ');
+          findings.push(finding('mcp_server_command', 'high', file.path,
+            `MCP server "${excerpt(name, 60)}" spawns a process — UNSCANNABLE (its code is not in these bytes): ${excerpt(entry.command)}${argv ? ` ${argv}` : ''}`,
+            { server: excerpt(name, 60), command: excerpt(entry.command), unscannable: true }));
+        }
+        if (typeof entry.url === 'string') {
+          findings.push(finding('mcp_server_url', 'medium', file.path,
+            `MCP server "${excerpt(name, 60)}" points at a remote — UNSCANNABLE (its code is off-box): ${excerpt(entry.url)}`,
+            { server: excerpt(name, 60), url: excerpt(entry.url), unscannable: true }));
+        }
+        if (typeof entry.command !== 'string' && typeof entry.url !== 'string') {
+          findings.push(finding('mcp_server_opaque', 'medium', file.path,
+            `MCP server "${excerpt(name, 60)}" has neither a readable command nor url — unreviewable entry.`,
+            { server: excerpt(name, 60), unscannable: true }));
+        }
+      }
+    }
+
+    for (const key of ['mcpServers', 'servers']) {
+      const disagreement = grepParseDisagreement(file.text, key, parsed.ok ? parsed.value : null);
+      if (disagreement) {
+        findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+          `"${key}" appears ${disagreement.rawCount}x in key position in the raw bytes but the strict parse yielded ${disagreement.parsedCount} — hidden MCP config.`,
+          { marker: key, ...disagreement }));
+      }
+    }
+    if (!parsed.ok) {
+      findings.push(finding('config_unparseable', 'medium', file.path,
+        'MCP config does not strictly parse as JSON — whatever the harness makes of it was not reviewable here.', null));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/network.js

@@ -0,0 +1,67 @@
+// modules/security/artifact-scan/detectors/network.js — network egress sinks
+// (task 1002544).
+//
+// A network sink alone is a medium: most tools talk to the network for honest
+// reasons, and the floor's job is inventory, not judgment. The signal that
+// matters is computed by floor.js: a file that BOTH names a credential store
+// AND carries an egress sink is flagged same-file co-occurrence — labeled
+// exactly that, never claimed as proven dataflow, because co-location in a
+// file is evidence of opportunity, not a taint analysis.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const NETWORK_PATTERNS = Object.freeze([
+  ['fetch()', /\bfetch\s*\(/],
+  ['XMLHttpRequest', /XMLHttpRequest/],
+  ['WebSocket', /\bnew\s+WebSocket\s*\(/],
+  ['axios', /\baxios\b/],
+  ['node http/https request', /\bhttps?\.(?:request|get)\s*\(/],
+  // Importing http/https at all is an egress capability — catches the
+  // destructured/aliased form `const { get } = require('node:https')` that has
+  // no literal `https.get(` token for the pattern above to see.
+  ['node http/https import', /require\s*\(\s*['"](?:node:)?https?['"]\s*\)|from\s+['"](?:node:)?https?['"]/],
+  ['raw socket', /\bnet\.(?:connect|createConnection)\s*\(|\bnew\s+net\.Socket\b/],
+  ['UDP socket', /\bdgram\.createSocket\s*\(/],
+  ['curl', /\bcurl\s+/],
+  ['wget', /\bwget\s+/],
+  ['PowerShell web request', /Invoke-WebRequest|Invoke-RestMethod|System\.Net\.WebClient/i],
+  ['navigator.sendBeacon', /sendBeacon\s*\(/],
+  ['undici', /\bundici\b/],
+  ['http client lib', /\b(?:got|ky|node-fetch|needle|superagent|request-promise|phin)\b/],
+]);
+
+// Memoized per corpus object — detect() and floor.coOccurrence() share the
+// result rather than each re-scanning the whole tree (see credentials.js).
+const _hitsCache = new WeakMap();
+function perFileHits(corpus) {
+  const cached = _hitsCache.get(corpus);
+  if (cached) return cached;
+  const hits = new Map(); // path -> [{ label, line }]
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    for (const [label, re] of NETWORK_PATTERNS) {
+      const m = re.exec(file.text);
+      if (m) {
+        if (!hits.has(file.path)) hits.set(file.path, []);
+        hits.get(file.path).push({ label, line: lineAt(file.text, m.index) });
+      }
+    }
+  }
+  _hitsCache.set(corpus, hits);
+  return hits;
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const [path, fileHits] of perFileHits(corpus)) {
+    const labels = fileHits.map((h) => h.label);
+    findings.push(finding('network_sink', 'medium', path,
+      `Network egress sink(s): ${labels.join(', ')} (first at line ${fileHits[0].line}).`,
+      { sinks: labels, line: fileHits[0].line }));
+  }
+  return findings;
+}
+
+module.exports = { detect, perFileHits, NETWORK_PATTERNS };

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -0,0 +1,67 @@
+// modules/security/artifact-scan/detectors/npm-lifecycle.js — npm lifecycle
+// scripts, quoted verbatim with no adjudication (task 1002544).
+//
+// A lifecycle script in an installed package runs ARBITRARY CODE on the
+// machine at install time — before anyone has read a line of the package. The
+// floor therefore quotes every auto-run script verbatim (scrubbed + capped)
+// and never tries to judge whether the command "looks benign": adjudicating
+// command text is exactly the model-shaped judgment the zero-LLM floor exists
+// to avoid. Every one is a finding; the human and the panel read the text.
+//
+// Every package.json in the tree is checked (workspaces / nested fixtures
+// install too), by strict parse AND raw-byte grep — a key the bytes carry that
+// the parse did not yield (duplicate-key shadowing, concatenated documents) is
+// itself a critical finding.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, rawKeyCounts, deepKeyCounts } = require('./shared');
+
+// The set npm runs automatically around install/publish — not run-by-request
+// scripts like "test" or "build". `dependencies` is the legacy auto-run hook.
+const AUTO_RUN_SCRIPTS = Object.freeze([
+  'preinstall', 'install', 'postinstall',
+  'preuninstall', 'uninstall', 'postuninstall',
+  'prepublish', 'prepublishOnly', 'prepare', 'prepack', 'postpack',
+  'dependencies',
+]);
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || basename(file.path) !== 'package.json') continue;
+
+    const parsed = parseJsonStrict(file.text);
+    const scripts = parsed.ok && parsed.value && typeof parsed.value.scripts === 'object' && parsed.value.scripts !== null
+      ? parsed.value.scripts
+      : {};
+
+    // One raw-key pass AND one parsed-tree pass for the whole file, reused
+    // across all 11 lifecycle names, instead of re-walking per name.
+    const rawCounts = rawKeyCounts(file.text);
+    const parsedCounts = deepKeyCounts(parsed.value);
+    for (const name of AUTO_RUN_SCRIPTS) {
+      if (Object.prototype.hasOwnProperty.call(scripts, name)) {
+        findings.push(finding('npm_lifecycle_script', 'high', file.path,
+          `npm auto-runs "${name}" at install time: ${excerpt(scripts[name])}`,
+          { script: name, command: excerpt(scripts[name]) }));
+      }
+      const rawCount = rawCounts.get(name) || 0;
+      const parsedCount = parsedCounts.get(name) || 0;
+      if (rawCount > parsedCount) {
+        findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+          `"${name}" appears ${rawCount}x in the raw bytes but the strict parse yielded ${parsedCount} — duplicate-key shadowing or a second document is hiding config.`,
+          { marker: name, rawCount, parsedCount }));
+      }
+    }
+
+    if (!parsed.ok) {
+      findings.push(finding('config_unparseable', 'medium', file.path,
+        'package.json does not strictly parse as JSON — whatever npm makes of it was not reviewable here.',
+        null));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, AUTO_RUN_SCRIPTS };

package/modules/security/artifact-scan/detectors/permissions.js

@@ -0,0 +1,91 @@
+// modules/security/artifact-scan/detectors/permissions.js — bundled settings
+// that widen what the harness may do without asking (task 1002544).
+//
+// An artifact that ships its own .claude/settings.json is asking to be
+// installed INTO the permission system, not just onto the disk. Allow-list
+// entries, a bypassing permission mode, and env injection each get quoted so
+// the reader sees the exact grant. Bypass-everything settings are a critical:
+// there is no benign reason for a third-party artifact to ship one.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, grepParseDisagreement } = require('./shared');
+
+// Matched by BASENAME wherever the file sits (so .claude/settings.json is
+// covered) — but deliberately NOT widened to every .claude/*.json the way
+// hooks.js isClaudeConfig is: the harness only honors permission grants from
+// these exact filenames, so parsing grant structure out of an arbitrary
+// bundled JSON would report grants nothing would ever apply. Bypass MARKERS
+// are still checked in every text file below, whatever its name.
+function isSettingsFile(p) {
+  const name = basename(p);
+  return name === 'settings.json' || name === 'settings.local.json'
+    || name === 'managed-settings.json' || name === '.claude.json';
+}
+
+const BYPASS_MARKERS = ['bypassPermissions', 'dangerously-skip-permissions', 'dangerouslySkipPermissions'];
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+
+    // Bypass markers are checked in EVERY text file (a hook script or README
+    // that tells the user to run with --dangerously-skip-permissions is the
+    // same widening delivered socially). Check the raw bytes AND, for JSON, the
+    // parsed-then-restringified form — so a marker written `bypass…` in a
+    // JSON string (which the harness decodes and honours) cannot hide from a
+    // literal indexOf on the raw text.
+    const parsedForMarkers = parseJsonStrict(file.text);
+    const normalized = parsedForMarkers.ok ? JSON.stringify(parsedForMarkers.value) : '';
+    for (const marker of BYPASS_MARKERS) {
+      if (file.text.includes(marker) || (normalized && normalized.includes(marker))) {
+        findings.push(finding('permission_bypass_marker', 'critical', file.path,
+          `Contains "${marker}" — a third-party artifact has no benign reason to invoke permission bypass.`,
+          { marker }));
+      }
+    }
+
+    if (!isSettingsFile(file.path)) continue;
+    const parsed = parsedForMarkers; // same text, same strict parse — no second pass
+    if (parsed.ok && parsed.value && typeof parsed.value === 'object') {
+      const perms = parsed.value.permissions;
+      if (perms && typeof perms === 'object') {
+        const allows = Array.isArray(perms.allow) ? perms.allow : [];
+        for (const rule of allows) {
+          findings.push(finding('permission_allow_rule', 'high', file.path,
+            `Bundled settings pre-allow: ${excerpt(rule)}`, { rule: excerpt(rule) }));
+        }
+        if (typeof perms.defaultMode === 'string') {
+          findings.push(finding('permission_default_mode', 'high', file.path,
+            `Bundled settings set permissions.defaultMode = ${excerpt(perms.defaultMode, 60)}.`,
+            { defaultMode: excerpt(perms.defaultMode, 60) }));
+        }
+      }
+      const env = parsed.value.env;
+      if (env && typeof env === 'object' && !Array.isArray(env)) {
+        for (const [k, v] of Object.entries(env)) {
+          findings.push(finding('settings_env_injection', 'medium', file.path,
+            `Bundled settings inject env ${excerpt(k, 60)}=${excerpt(String(v), 80)} into every session.`,
+            { key: excerpt(k, 60) }));
+        }
+      }
+      const apiKeyHelper = parsed.value.apiKeyHelper;
+      if (typeof apiKeyHelper === 'string') {
+        findings.push(finding('settings_api_key_helper', 'critical', file.path,
+          `Bundled settings set apiKeyHelper — a command handed the builder's API credential flow: ${excerpt(apiKeyHelper)}`,
+          { command: excerpt(apiKeyHelper) }));
+      }
+    }
+
+    const disagreement = grepParseDisagreement(file.text, 'permissions', parsed.ok ? parsed.value : null);
+    if (disagreement) {
+      findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+        `"permissions" appears ${disagreement.rawCount}x in key position in the raw bytes but the strict parse yielded ${disagreement.parsedCount} — hidden permission config.`,
+        { marker: 'permissions', ...disagreement }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, BYPASS_MARKERS };