@goplus/agentguard 1.1.14 → 1.1.20

package/dist/feed/selfcheck.js

@@ -13,6 +13,7 @@ exports.safeRegexTest = safeRegexTest;
 exports.globMatch = globMatch;
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
+const glob_1 = require("glob");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const hash_js_1 = require("../utils/hash.js");
@@ -78,6 +79,15 @@ async function runSelfCheckForAdvisory(advisory, options = {}) {
     if (advisory.withdrawnAt) {
         return { advisoryId: advisory.id, matchedArtifacts: [], elapsedMs: 0, warnings };
     }
+    const matchers = getSelfCheckMatchers(advisory);
+    if (matchers.length === 0) {
+        return {
+            advisoryId: advisory.id,
+            matchedArtifacts: [],
+            elapsedMs: Date.now() - startedAt,
+            warnings,
+        };
+    }
     const artifacts = await listArtifactsForAdvisory(advisory, options, warnings);
     const cap = options.maxArtifacts ?? 500;
     const considered = artifacts.slice(0, cap);
@@ -86,7 +96,7 @@ async function runSelfCheckForAdvisory(advisory, options = {}) {
     }
     for (const artifact of considered) {
         try {
-            const m = await matchArtifact(artifact, advisory.affected);
+            const m = await matchArtifact(artifact, advisory.ecosystem, matchers);
             if (m)
                 matches.push(m);
         }
@@ -104,7 +114,7 @@ async function runSelfCheckForAdvisory(advisory, options = {}) {
 async function listArtifactsForAdvisory(advisory, options, warnings) {
     const overridePaths = advisory.selfCheck?.inspectPaths?.filter((p) => typeof p === 'string') ?? [];
     if (overridePaths.length > 0) {
-        return listExplicitArtifacts(overridePaths);
+        return listExplicitArtifacts(advisory.ecosystem, overridePaths, options);
     }
     switch (advisory.ecosystem) {
         case 'skill':
@@ -128,24 +138,28 @@ async function listArtifactsForAdvisory(advisory, options, warnings) {
             return [];
     }
 }
-async function listExplicitArtifacts(paths) {
-    const artifacts = [];
-    for (const path of paths) {
-        if (!(0, node_fs_1.existsSync)(path))
-            continue;
-        artifacts.push({
-            path,
-            name: (0, node_path_1.basename)(path),
-            bodyPath: firstExisting([
-                (0, node_path_1.join)(path, 'SKILL.md'),
-                (0, node_path_1.join)(path, 'openclaw.plugin.json'),
-                (0, node_path_1.join)(path, 'package.json'),
-                (0, node_path_1.join)(path, 'plugin.json'),
+async function listExplicitArtifacts(ecosystem, paths, options) {
+    const expanded = await expandInspectPaths(paths);
+    if (expanded.length === 0)
+        return [];
+    switch (ecosystem) {
+        case 'skill':
+            return (await listSkillDirs(expanded)).map((path) => ({
                 path,
-            ]) ?? path,
-        });
+                name: (0, node_path_1.basename)(path),
+                bodyPath: (0, node_path_1.join)(path, 'SKILL.md'),
+            }));
+        case 'plugin':
+            return listPluginArtifacts(expanded);
+        case 'prompt_injection':
+            return listPromptInjectionArtifacts({ ...options, promptInjectionRoots: expanded });
+        case 'mcp_server':
+        case 'supply_chain':
+        case 'url':
+            return listFileArtifacts(expanded);
+        default:
+            return [];
     }
-    return artifacts;
 }
 /** Enumerate every immediate subdirectory of `roots` that contains a SKILL.md. */
 async function listSkillDirs(roots) {
@@ -153,6 +167,11 @@ async function listSkillDirs(roots) {
     for (const root of roots) {
         if (!(0, node_fs_1.existsSync)(root))
             continue;
+        const rootManifest = (0, node_path_1.join)(root, 'SKILL.md');
+        if ((0, node_fs_1.existsSync)(rootManifest)) {
+            found.push(root);
+            continue;
+        }
         let entries;
         try {
             entries = await (0, promises_1.readdir)(root, { withFileTypes: true });
@@ -176,6 +195,18 @@ async function listPluginArtifacts(roots) {
     for (const root of roots) {
         if (!(0, node_fs_1.existsSync)(root))
             continue;
+        const rootManifest = firstExisting([
+            (0, node_path_1.join)(root, 'openclaw.plugin.json'),
+            (0, node_path_1.join)(root, 'package.json'),
+            (0, node_path_1.join)(root, '.claude-plugin', 'plugin.json'),
+            (0, node_path_1.join)(root, 'plugin.json'),
+            (0, node_path_1.join)(root, 'index.js'),
+            (0, node_path_1.join)(root, 'index.ts'),
+        ]);
+        if (rootManifest) {
+            found.push({ path: root, name: (0, node_path_1.basename)(root), bodyPath: rootManifest });
+            continue;
+        }
         let entries;
         try {
             entries = await (0, promises_1.readdir)(root, { withFileTypes: true });
@@ -224,6 +255,26 @@ async function listPromptInjectionArtifacts(options) {
     const plugins = await listPluginArtifacts(roots);
     return dedupeArtifacts([...skills, ...plugins]);
 }
+async function expandInspectPaths(paths) {
+    const expanded = [];
+    for (const rawPath of paths) {
+        const pattern = expandHomeDir(rawPath);
+        if (!pattern)
+            continue;
+        if (hasGlobMagic(pattern)) {
+            const matches = await (0, glob_1.glob)(pattern, { absolute: true, nodir: false });
+            for (const match of matches) {
+                if ((0, node_fs_1.existsSync)(match))
+                    expanded.push(match);
+            }
+            continue;
+        }
+        const resolved = (0, node_path_1.isAbsolute)(pattern) ? pattern : (0, node_path_1.resolve)(pattern);
+        if ((0, node_fs_1.existsSync)(resolved))
+            expanded.push(resolved);
+    }
+    return dedupePaths(expanded);
+}
 function firstExisting(paths) {
     for (const path of paths) {
         if ((0, node_fs_1.existsSync)(path))
@@ -231,6 +282,21 @@ function firstExisting(paths) {
     }
     return null;
 }
+function expandHomeDir(path) {
+    if (!path.startsWith('~'))
+        return path;
+    if (path === '~')
+        return (0, node_os_1.homedir)();
+    if (path.startsWith('~/'))
+        return (0, node_path_1.join)((0, node_os_1.homedir)(), path.slice(2));
+    return path;
+}
+function hasGlobMagic(path) {
+    return /[*?[\]{}]/.test(path);
+}
+function dedupePaths(paths) {
+    return [...new Set(paths)];
+}
 function dedupeArtifacts(artifacts) {
     const seen = new Set();
     const result = [];
@@ -243,11 +309,11 @@ function dedupeArtifacts(artifacts) {
     return result;
 }
 /**
- * Match one local artifact against an advisory's affected[] matchers.
- * Returns the first match found (per matcher precedence: hash > regex > name).
+ * Match one local artifact against an advisory matcher set.
+ * Returns the first match found (per matcher precedence: hash > version > regex > name).
  * Returns null when nothing matched.
  */
-async function matchArtifact(artifact, affected) {
+async function matchArtifact(artifact, ecosystem, affected) {
     const bodyPath = artifact.bodyPath ?? artifact.path;
     let localHash = null;
     const wantsHash = affected.some((m) => m.sha256);
@@ -260,14 +326,21 @@ async function matchArtifact(artifact, affected) {
         }
     }
     let body = null;
-    const wantsBody = affected.some((m) => m.bodyRegex || m.urlPattern || m.domainExact);
+    const wantsBody = affected.some((m) => m.bodyRegex || m.urlPattern || m.domainExact || m.namePattern || m.versionRange);
     if (wantsBody) {
         body = await readArtifactBody(artifact, bodyPath);
     }
+    const coordinates = body !== null ? extractPackageCoordinates(artifact, ecosystem, body) : [];
     for (const matcher of affected) {
+        if (!matcherMatchesCoordinateSet(matcher, artifact, coordinates)) {
+            continue;
+        }
         if (matcher.sha256 && localHash && matcher.sha256.toLowerCase() === localHash.toLowerCase()) {
             return { path: artifact.path, matchedBy: 'sha256', hash: localHash };
         }
+        if (matcher.versionRange && coordinates.some((candidate) => versionSatisfiesRange(candidate.version, matcher.versionRange))) {
+            return { path: artifact.path, matchedBy: 'versionRange' };
+        }
         if (matcher.bodyRegex && body !== null) {
             if (safeRegexTest(matcher.bodyRegex, body)) {
                 return { path: artifact.path, matchedBy: 'bodyRegex' };
@@ -279,9 +352,12 @@ async function matchArtifact(artifact, affected) {
         if (matcher.domainExact && body !== null && bodyContainsDomain(body, matcher.domainExact)) {
             return { path: artifact.path, matchedBy: 'domainExact' };
         }
-        if (matcher.namePattern && globMatch(matcher.namePattern, artifact.name)) {
+        if (matcher.namePattern) {
             return { path: artifact.path, matchedBy: 'namePattern' };
         }
+        if (matcher.sha256 || matcher.versionRange || matcher.bodyRegex || matcher.urlPattern || matcher.domainExact) {
+            continue;
+        }
     }
     return null;
 }
@@ -327,6 +403,377 @@ function containsBareDomain(body, domain) {
     const re = new RegExp(`(^|[^A-Za-z0-9.-])${escaped}([^A-Za-z0-9.-]|$)`, 'i');
     return re.test(body);
 }
+function getSelfCheckMatchers(advisory) {
+    if (advisory.selfCheck && Array.isArray(advisory.selfCheck.matchers)) {
+        return advisory.selfCheck.matchers.filter(isMatcherLike).map((matcher) => ({
+            namePattern: matcher.namePattern,
+            sha256: matcher.sha256,
+            versionRange: matcher.versionRange,
+            bodyRegex: matcher.bodyRegex,
+            urlPattern: matcher.urlPattern,
+            domainExact: matcher.domainExact,
+        }));
+    }
+    return Array.isArray(advisory.affected) ? advisory.affected.filter(isMatcherLike) : [];
+}
+function isMatcherLike(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const matcher = value;
+    return [
+        'namePattern',
+        'sha256',
+        'versionRange',
+        'bodyRegex',
+        'urlPattern',
+        'domainExact',
+    ].some((key) => typeof matcher[key] === 'string' && matcher[key].length > 0);
+}
+function matcherMatchesCoordinateSet(matcher, artifact, coordinates) {
+    const needsCoordinate = Boolean(matcher.namePattern || matcher.versionRange);
+    if (!needsCoordinate)
+        return true;
+    const candidates = dedupeCoordinates([
+        ...coordinates,
+        { name: artifact.name, version: undefined },
+        { name: stripExtension(artifact.name), version: undefined },
+    ]);
+    return candidates.some((candidate) => {
+        if (matcher.namePattern && !globMatch(matcher.namePattern, candidate.name)) {
+            return false;
+        }
+        if (matcher.versionRange && !versionSatisfiesRange(candidate.version, matcher.versionRange)) {
+            return false;
+        }
+        return true;
+    });
+}
+function extractPackageCoordinates(artifact, ecosystem, body) {
+    const coordinates = [
+        ...extractManifestCoordinate(artifact, body),
+        ...extractSupplyChainCoordinates(artifact, ecosystem, body),
+    ];
+    return dedupeCoordinates(coordinates);
+}
+function extractManifestCoordinate(artifact, body) {
+    const json = tryParseJson(body);
+    if (json && typeof json === 'object' && !Array.isArray(json)) {
+        const name = typeof json.name === 'string' ? json.name : artifact.name;
+        const version = typeof json.version === 'string' ? json.version : undefined;
+        return [{ name, version }];
+    }
+    const skillName = body.match(/^\s*name:\s*["']?([^\n"']+)["']?\s*$/im)?.[1]?.trim();
+    const skillVersion = body.match(/^\s*version:\s*["']?([^\n"']+)["']?\s*$/im)?.[1]?.trim();
+    if (skillName || skillVersion) {
+        return [{
+                name: skillName || artifact.name,
+                version: skillVersion,
+            }];
+    }
+    return [];
+}
+function extractSupplyChainCoordinates(artifact, ecosystem, body) {
+    if (ecosystem !== 'supply_chain')
+        return [];
+    const filename = (0, node_path_1.basename)(artifact.path);
+    switch (filename) {
+        case 'package.json':
+            return extractPackageJsonDependencies(body);
+        case 'package-lock.json':
+        case 'npm-shrinkwrap.json':
+            return extractPackageLockDependencies(body);
+        case 'requirements.txt':
+            return extractRequirementsDependencies(body);
+        case 'Cargo.toml':
+            return extractCargoTomlDependencies(body);
+        case 'Cargo.lock':
+            return extractCargoLockDependencies(body);
+        case 'go.mod':
+            return extractGoModDependencies(body);
+        case 'go.sum':
+            return extractGoSumDependencies(body);
+        default:
+            return [];
+    }
+}
+function extractPackageJsonDependencies(body) {
+    const json = tryParseJson(body);
+    if (!json || typeof json !== 'object' || Array.isArray(json))
+        return [];
+    const fields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies', 'overrides', 'resolutions'];
+    const coordinates = [];
+    for (const field of fields) {
+        const deps = json[field];
+        if (!deps || typeof deps !== 'object' || Array.isArray(deps))
+            continue;
+        for (const [name, rawVersion] of Object.entries(deps)) {
+            if (typeof rawVersion !== 'string')
+                continue;
+            coordinates.push({ name, version: normalizeVersionCandidate(rawVersion) ?? rawVersion.trim() });
+        }
+    }
+    return coordinates;
+}
+function extractPackageLockDependencies(body) {
+    const json = tryParseJson(body);
+    if (!json || typeof json !== 'object' || Array.isArray(json))
+        return [];
+    const coordinates = [];
+    const root = json;
+    collectPackageLockDeps(root.dependencies, coordinates);
+    if (root.packages && typeof root.packages === 'object' && !Array.isArray(root.packages)) {
+        for (const [packagePath, meta] of Object.entries(root.packages)) {
+            if (!meta || typeof meta !== 'object' || Array.isArray(meta))
+                continue;
+            const pkg = meta;
+            const version = typeof pkg.version === 'string' ? pkg.version : undefined;
+            const name = typeof pkg.name === 'string'
+                ? pkg.name
+                : packagePath.startsWith('node_modules/')
+                    ? packagePath.slice('node_modules/'.length)
+                    : '';
+            if (name)
+                coordinates.push({ name, version });
+        }
+    }
+    return coordinates;
+}
+function collectPackageLockDeps(node, coordinates) {
+    if (!node || typeof node !== 'object' || Array.isArray(node))
+        return;
+    for (const [name, meta] of Object.entries(node)) {
+        if (!meta || typeof meta !== 'object' || Array.isArray(meta))
+            continue;
+        const pkg = meta;
+        const version = typeof pkg.version === 'string' ? pkg.version : undefined;
+        coordinates.push({ name, version });
+        collectPackageLockDeps(pkg.dependencies, coordinates);
+    }
+}
+function extractRequirementsDependencies(body) {
+    const coordinates = [];
+    for (const line of body.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const match = trimmed.match(/^([A-Za-z0-9_.-]+)\s*(?:==|>=|<=|~=|!=|>|<)\s*([A-Za-z0-9+_.-]+)/);
+        if (match) {
+            coordinates.push({ name: match[1], version: normalizeVersionCandidate(match[2]) ?? match[2] });
+        }
+    }
+    return coordinates;
+}
+function extractCargoTomlDependencies(body) {
+    const coordinates = [];
+    let inDependencies = false;
+    for (const line of body.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('[')) {
+            inDependencies = /^\[(?:workspace\.)?(?:target\.[^.\]]+\.)?(?:dev-|build-)?dependencies\]/.test(trimmed);
+            continue;
+        }
+        if (!inDependencies || !trimmed || trimmed.startsWith('#'))
+            continue;
+        const match = trimmed.match(/^([A-Za-z0-9_.-]+)\s*=\s*(?:\{\s*version\s*=\s*"([^"]+)"[^}]*\}|"([^"]+)")/);
+        if (match) {
+            coordinates.push({ name: match[1], version: normalizeVersionCandidate(match[2] || match[3]) ?? (match[2] || match[3]) });
+        }
+    }
+    return coordinates;
+}
+function extractCargoLockDependencies(body) {
+    const coordinates = [];
+    const re = /\[\[package\]\][\s\S]*?name = "([^"]+)"[\s\S]*?version = "([^"]+)"/g;
+    for (const match of body.matchAll(re)) {
+        coordinates.push({ name: match[1], version: normalizeVersionCandidate(match[2]) ?? match[2] });
+    }
+    return coordinates;
+}
+function extractGoModDependencies(body) {
+    const coordinates = [];
+    for (const line of body.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const match = trimmed.match(/^(?:require\s+)?(\S+)\s+v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);
+        if (match) {
+            coordinates.push({ name: match[1], version: normalizeVersionCandidate(match[2]) ?? match[2] });
+        }
+    }
+    return coordinates;
+}
+function extractGoSumDependencies(body) {
+    const coordinates = [];
+    for (const line of body.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const match = trimmed.match(/^(\S+)\s+v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/);
+        if (match) {
+            coordinates.push({ name: match[1], version: normalizeVersionCandidate(match[2]) ?? match[2] });
+        }
+    }
+    return coordinates;
+}
+function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+}
+function stripExtension(name) {
+    const extension = (0, node_path_1.extname)(name);
+    return extension ? name.slice(0, -extension.length) : name;
+}
+function dedupeCoordinates(coordinates) {
+    const seen = new Set();
+    const result = [];
+    for (const coordinate of coordinates) {
+        const normalizedName = coordinate.name.trim();
+        if (!normalizedName)
+            continue;
+        const key = `${normalizedName}\u0000${coordinate.version ?? ''}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push({ name: normalizedName, version: coordinate.version?.trim() });
+    }
+    return result;
+}
+function versionSatisfiesRange(version, range) {
+    if (!range)
+        return true;
+    const parsedVersion = parseSemver(version);
+    if (!parsedVersion)
+        return false;
+    const comparators = parseComparators(range);
+    if (comparators.length === 0)
+        return false;
+    return comparators.every((comparator) => compareSemver(parsedVersion, comparator.version, comparator.operator));
+}
+function normalizeVersionCandidate(value) {
+    if (!value)
+        return null;
+    const exact = value.trim().match(/^v?(\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/);
+    return exact ? exact[1] : null;
+}
+function parseSemver(input) {
+    if (!input)
+        return null;
+    const match = input.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!match)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2] ?? '0'),
+        patch: Number(match[3] ?? '0'),
+        prerelease: match[4],
+    };
+}
+function parseComparators(range) {
+    const trimmed = range.trim();
+    if (!trimmed || trimmed === '*')
+        return [];
+    if (trimmed.startsWith('^')) {
+        const base = parseSemver(trimmed.slice(1));
+        if (!base)
+            return [];
+        return [
+            { operator: '>=', version: base },
+            { operator: '<', version: caretUpperBound(base) },
+        ];
+    }
+    if (trimmed.startsWith('~')) {
+        const base = parseSemver(trimmed.slice(1));
+        if (!base)
+            return [];
+        return [
+            { operator: '>=', version: base },
+            { operator: '<', version: { major: base.major, minor: base.minor + 1, patch: 0 } },
+        ];
+    }
+    const wildcard = parseWildcardRange(trimmed);
+    if (wildcard)
+        return wildcard;
+    const tokens = trimmed.split(/[\s,]+/).filter(Boolean);
+    const comparators = [];
+    for (const token of tokens) {
+        const match = token.match(/^(<=|>=|<|>|=)?(.+)$/);
+        if (!match)
+            return [];
+        const operator = (match[1] ?? '=');
+        const version = parseSemver(match[2]);
+        if (!version)
+            return [];
+        comparators.push({ operator, version });
+    }
+    return comparators;
+}
+function parseWildcardRange(range) {
+    const match = range.match(/^v?(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?$/i);
+    if (!match)
+        return null;
+    if (![match[2], match[3]].some((part) => part && /^(x|\*)$/i.test(part))) {
+        return null;
+    }
+    const major = Number(match[1]);
+    const minorPart = match[2];
+    const patchPart = match[3];
+    if (!minorPart || /^(x|\*)$/i.test(minorPart)) {
+        return [
+            { operator: '>=', version: { major, minor: 0, patch: 0 } },
+            { operator: '<', version: { major: major + 1, minor: 0, patch: 0 } },
+        ];
+    }
+    const minor = Number(minorPart);
+    if (!patchPart || /^(x|\*)$/i.test(patchPart)) {
+        return [
+            { operator: '>=', version: { major, minor, patch: 0 } },
+            { operator: '<', version: { major, minor: minor + 1, patch: 0 } },
+        ];
+    }
+    return null;
+}
+function caretUpperBound(version) {
+    if (version.major > 0) {
+        return { major: version.major + 1, minor: 0, patch: 0 };
+    }
+    if (version.minor > 0) {
+        return { major: 0, minor: version.minor + 1, patch: 0 };
+    }
+    return { major: 0, minor: 0, patch: version.patch + 1 };
+}
+function compareSemver(left, right, operator) {
+    const order = semverCompare(left, right);
+    switch (operator) {
+        case '<':
+            return order < 0;
+        case '<=':
+            return order <= 0;
+        case '>':
+            return order > 0;
+        case '>=':
+            return order >= 0;
+        case '=':
+            return order === 0;
+    }
+}
+function semverCompare(left, right) {
+    for (const key of ['major', 'minor', 'patch']) {
+        const delta = left[key] - right[key];
+        if (delta !== 0)
+            return delta;
+    }
+    if (!left.prerelease && !right.prerelease)
+        return 0;
+    if (!left.prerelease)
+        return 1;
+    if (!right.prerelease)
+        return -1;
+    return left.prerelease.localeCompare(right.prerelease);
+}
 /**
  * Defense against catastrophic backtracking and malformed regex coming
  * from upstream advisory data: