@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/checks/agent-surface/config.mjs

@@ -0,0 +1,223 @@
+// Auto-run configuration (table row 5) and MCP server definitions (row 6).
+import path from 'node:path';
+import { clip, fetchAndRun, lineOf, parseJsonc } from './patterns.mjs';
+
+const LIFECYCLE = ['preinstall', 'install', 'postinstall', 'prepare'];
+const DEVCONTAINER_KEYS = ['initializeCommand', 'onCreateCommand', 'updateContentCommand', 'postCreateCommand', 'postStartCommand', 'postAttachCommand'];
+const HOOK_KEYS = new Set(['command', 'commands', 'run', 'script', 'install', 'start', 'setup', 'notify', 'cmd']);
+
+const esc = (s) => JSON.stringify(String(s)).slice(1, -1);
+const strings = (v) => (typeof v === 'string' ? [v] : Array.isArray(v) ? v.flatMap(strings) : v && typeof v === 'object' ? Object.values(v).flatMap(strings) : []);
+
+/** One auto-run entry: Critical when it fetches or decodes and then executes, otherwise listed as info. */
+function autoRun({ kind, name, command, line }) {
+  const hit = fetchAndRun(command);
+  const where = `${kind} "${name}"`;
+  if (hit) {
+    return {
+      rule: 'autorun-fetch-exec', key: `${kind}:${name}`, severity: 'critical', line,
+      title: `Auto-run ${kind} downloads or decodes content and runs it`,
+      description: `${where} runs automatically (on folder open, container start, agent event, git hook or install) and ${hit.via === 'download' ? 'downloads' : 'decodes'} content then executes it ("${hit.fetch}" ... "${hit.exec}"). A hostile repository uses this to run code the moment it is opened or installed.`,
+      evidence: clip(command),
+      fix: `Remove the download-and-run command from ${where}. Run reviewed, pinned scripts that are committed to the repository instead.`,
+    };
+  }
+  return {
+    rule: 'autorun-present', key: `${kind}:${name}`, severity: 'info', line,
+    title: `Auto-run ${kind} is configured`,
+    description: `${where} runs automatically. It does not download or decode content and then run it. Listed so a reviewer sees what executes without being asked.`,
+    evidence: clip(command), fix: 'No change needed unless the command is unexpected.',
+  };
+}
+
+function taskCommands(task) {
+  const parts = [task.command, ...(Array.isArray(task.args) ? task.args.map((a) => (typeof a === 'string' ? a : a?.value)) : [])];
+  for (const os of ['windows', 'linux', 'osx']) if (task[os]) parts.push(task[os].command, ...(task[os].args ?? []));
+  return parts.filter((p) => typeof p === 'string').join(' ');
+}
+
+function hookCommands(node, out = []) {
+  if (Array.isArray(node)) { for (const n of node) hookCommands(n, out); return out; }
+  if (!node || typeof node !== 'object') return out;
+  for (const [k, v] of Object.entries(node)) {
+    if (k === 'mcpServers' || k === 'servers') continue; // MCP launches are row 6
+    if (HOOK_KEYS.has(k)) {
+      const joined = typeof v === 'string' ? v : Array.isArray(v) && v.every((x) => typeof x === 'string') ? v.join(' ') : null;
+      const args = Array.isArray(node.args) && k === 'command' ? ` ${node.args.filter((a) => typeof a === 'string').join(' ')}` : '';
+      if (joined !== null) out.push(joined + args);
+      else for (const s of strings(v)) out.push(s);
+    } else hookCommands(v, out);
+  }
+  return out;
+}
+
+/** Line-based pass over TOML or shell text: every logical line (backslash continuations joined) is one command. */
+function scriptLines(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    let line = lines[i];
+    const start = i + 1;
+    while (/\\\s*$/.test(line) && i + 1 < lines.length) line = `${line.replace(/\\\s*$/, ' ')}${lines[++i]}`;
+    if (line.trim() && !line.trim().startsWith('#')) out.push({ line: start, text: line });
+  }
+  return out;
+}
+
+export function autoRunIssues(rel, text) {
+  const base = path.posix.basename(rel);
+  const out = [];
+  const json = () => parseJsonc(text);
+  if (/(^|\/)\.vscode\/tasks\.json$/.test(rel)) {
+    for (const t of json()?.tasks ?? []) {
+      if (t?.runOptions?.runOn !== 'folderOpen') continue;
+      const command = taskCommands(t);
+      out.push(autoRun({ kind: 'VS Code folderOpen task', name: t.label ?? t.command ?? 'task', command, line: lineOf(text, esc(t.command ?? 'folderOpen')) }));
+    }
+  } else if (/(^|\/)\.devcontainer(\/.*)?\/[^/]+\.json$|(^|\/)\.devcontainer\.json$/.test(rel)) {
+    const doc = json() ?? {};
+    for (const key of DEVCONTAINER_KEYS) {
+      if (doc[key] === undefined) continue;
+      const command = (typeof doc[key] === 'object' && !Array.isArray(doc[key]) ? Object.values(doc[key]).map((v) => strings(v).join(' ')) : [strings(doc[key]).join(' ')]).join(' ; ');
+      out.push(autoRun({ kind: 'devcontainer lifecycle command', name: key, command, line: lineOf(text, `"${key}"`) }));
+    }
+  } else if (/(^|\/)(\.claude\/settings[^/]*\.json|\.gemini\/settings\.json|\.cursor\/(?!rules\/)[^/]+\.json|\.codex\/[^/]+\.json)$/.test(rel)) {
+    const kind = rel.includes('.claude/') ? 'Claude Code hook' : rel.includes('.gemini/') ? 'Gemini CLI hook' : rel.includes('.codex/') ? 'Codex hook' : 'Cursor hook';
+    for (const command of [...new Set(hookCommands(json()))]) out.push(autoRun({ kind, name: clip(command, 60), command, line: lineOf(text, esc(command)) }));
+  } else if (/(^|\/)\.codex\/[^/]+\.toml$/.test(rel)) {
+    let skip = false;
+    for (const { line, text: l } of scriptLines(text)) {
+      const header = /^\s*\[+([^\]]+)\]+/.exec(l);
+      if (header) { skip = header[1].trim().startsWith('mcp_servers'); continue; }
+      const kv = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+)$/.exec(l);
+      if (!skip && kv && (HOOK_KEYS.has(kv[1]) || /hook/i.test(kv[1]))) out.push(autoRun({ kind: 'Codex hook', name: kv[1], command: kv[2], line }));
+    }
+  } else if (/(^|\/)\.(husky|githooks)\/(?!_\/)[^/]+$/.test(rel)) {
+    const kind = rel.includes('.husky/') ? 'Husky git hook' : 'git hook';
+    const lines = scriptLines(text).filter((l) => !l.text.startsWith('#!'));
+    const all = lines.map((l) => l.text).join('\n');
+    const bad = lines.filter((l) => fetchAndRun(l.text));
+    if (bad.length) for (const l of bad) out.push(autoRun({ kind, name: `${base}:${l.line}`, command: l.text, line: l.line }));
+    else if (all.trim()) out.push(autoRun({ kind, name: base, command: lines[0].text, line: lines[0].line }));
+  } else if (base === 'package.json') {
+    const scripts = json()?.scripts;
+    for (const key of LIFECYCLE) {
+      if (typeof scripts?.[key] === 'string') out.push(autoRun({ kind: 'package.json lifecycle script', name: key, command: scripts[key], line: lineOf(text, `"${key}"`) }));
+    }
+  }
+  return out;
+}
+
+// ---- MCP servers ----
+const LOCAL_HOST = /^(localhost|127\.0\.0\.1|\[::1\]|::1|[^.]+\.localhost)$/i;
+const VALUE_FLAGS = new Set(['-p', '--package', '--from', '-c', '--call', '--registry', '--cache', '--userconfig', '--with', '--python', '--index-url']);
+const EXACT_NPM = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$/;
+const EXACT_PY = /^\d+(?:\.\d+)+(?:[0-9A-Za-z.+!-]*)$/;
+
+/** Package spec the launcher runs, or null when the command is not a package launcher. */
+function launchedPackage(tokens) {
+  let t = tokens.map(String);
+  if (/^cmd(\.exe)?$/i.test(path.basename(t[0] ?? '')) && /^\/[ck]$/i.test(t[1] ?? '')) t = t.slice(2);
+  if (/^(ba|z)?sh$/.test(path.basename(t[0] ?? '')) && t[1] === '-c') t = String(t[2] ?? '').split(/\s+/);
+  const exe = path.basename(t[0] ?? '').replace(/\.(cmd|exe|ps1)$/i, '');
+  let rest;
+  let ecosystem = 'npm';
+  if (exe === 'npx' || exe === 'bunx' || exe === 'pnpx') rest = t.slice(1);
+  else if (exe === 'pnpm' && t[1] === 'dlx') rest = t.slice(2);
+  else if (exe === 'uvx') { rest = t.slice(1); ecosystem = 'pypi'; } else return null;
+  let explicit = null;
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    const eq = /^(--package|--from)=(.+)$/.exec(a);
+    if (eq) { explicit = eq[2]; break; }
+    if (a === '-p' || a === '--package' || a === '--from') { explicit = rest[i + 1]; break; }
+    if (VALUE_FLAGS.has(a)) { i++; continue; }
+    if (a.startsWith('-')) continue;
+    return { spec: a, ecosystem };
+  }
+  return explicit ? { spec: explicit, ecosystem } : null;
+}
+
+/** Returns { name, version, exact } for a package spec; null for paths, URLs and other non-registry specs. */
+export function parseSpec(spec, ecosystem) {
+  if (/^(\.{0,2}[\\/]|[A-Za-z]:|file:|git\+|https?:|github:|\w+:\/\/)/.test(spec)) return null;
+  if (ecosystem === 'pypi') {
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(?:(==|@)(.+))?$/.exec(spec);
+    if (!m) return null;
+    return { name: m[1], version: m[3] ?? '', exact: !!m[3] && m[3] !== 'latest' && EXACT_PY.test(m[3]) };
+  }
+  const at = spec.indexOf('@', 1);
+  const name = at < 0 ? spec : spec.slice(0, at);
+  const version = at < 0 ? '' : spec.slice(at + 1);
+  return { name, version, exact: EXACT_NPM.test(version) };
+}
+
+function mcpServerIssues({ name, command, args, urls, line, file }) {
+  const out = [];
+  const pkg = command ? launchedPackage([command, ...(args ?? [])]) : null;
+  const parsed = pkg ? parseSpec(pkg.spec, pkg.ecosystem) : null;
+  if (parsed && !parsed.exact) {
+    out.push({
+      rule: 'mcp-unpinned', key: `mcp:${name}`, severity: 'medium', line,
+      title: `MCP server "${name}" launches ${parsed.version === 'latest' ? 'the @latest version of ' : 'an unpinned version of '}${parsed.name}`,
+      description: `${file} starts this MCP server with "${clip(`${command} ${(args ?? []).join(' ')}`, 120)}" without an exact version, so every start can run different code from the registry. A compromised release runs with the agent's access.`,
+      evidence: clip(`${command} ${(args ?? []).join(' ')}`),
+      fix: `Pin an exact version, for example ${parsed.name}@<exact version>${pkg.ecosystem === 'pypi' ? ' (or ==<version>)' : ''}.`,
+    });
+  }
+  for (const url of urls) {
+    let u;
+    try { u = new URL(url); } catch { continue; }
+    if (u.protocol === 'http:' && !LOCAL_HOST.test(u.hostname)) {
+      out.push({
+        rule: 'mcp-plain-http', key: `mcp:${name}:http`, severity: 'high', line,
+        title: `MCP server "${name}" uses a plain HTTP remote`,
+        description: `${file} connects to ${u.origin} over http://, so anyone on the network path can read or change the tool calls and results the agent exchanges with it.`,
+        evidence: clip(url), fix: 'Use an https:// endpoint, or run the server locally and connect to localhost.',
+      });
+    }
+  }
+  return out;
+}
+
+export function mcpIssues(rel, text) {
+  const out = [];
+  if (/(^|\/)\.codex\/config\.toml$/.test(rel)) {
+    const servers = new Map();
+    const lines = text.split(/\r?\n/);
+    let current = null;
+    for (let i = 0; i < lines.length; i++) {
+      const l = lines[i].trim();
+      const header = /^\[\s*mcp_servers\s*\.\s*(?:"([^"]+)"|'([^']+)'|([^\s\].]+))\s*\]$/.exec(l);
+      if (header) { current = { name: header[1] ?? header[2] ?? header[3], line: i + 1, args: [], urls: [] }; servers.set(current.name, current); continue; }
+      if (/^\[/.test(l)) { current = null; continue; }
+      if (!current) continue;
+      const kv = /^([A-Za-z_]+)\s*=\s*(.*)$/.exec(l);
+      if (!kv) continue;
+      let value = kv[2];
+      while (/^\[/.test(value) && (value.match(/\[/g) ?? []).length > (value.match(/\]/g) ?? []).length && i + 1 < lines.length) value += ` ${lines[++i].trim()}`;
+      const strs = [...value.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2]);
+      if (kv[1] === 'command') current.command = strs[0];
+      else if (kv[1] === 'args') current.args = strs;
+      else if (kv[1] === 'url') current.urls.push(strs[0]);
+    }
+    for (const s of servers.values()) out.push(...mcpServerIssues({ ...s, file: rel }));
+    return out;
+  }
+  const doc = parseJsonc(text);
+  for (const holder of [doc?.mcpServers, doc?.servers, doc?.mcp?.servers]) {
+    if (!holder || typeof holder !== 'object') continue;
+    for (const [name, s] of Object.entries(holder)) {
+      if (!s || typeof s !== 'object') continue;
+      const urls = [s.url, s.httpUrl, s.serverUrl].filter((u) => typeof u === 'string');
+      const command = typeof s.command === 'string' ? s.command : null;
+      const args = Array.isArray(s.args) ? s.args.filter((a) => typeof a === 'string') : [];
+      out.push(...mcpServerIssues({ name, command, args, urls, line: lineOf(text, `"${name}"`), file: rel }));
+    }
+  }
+  return out;
+}
+
+export const isMcpFile = (rel) => /(^|\/)(\.mcp\.json|\.cursor\/mcp\.json|\.vscode\/mcp\.json|\.gemini\/settings\.json|\.codex\/config\.toml)$/.test(rel);
+export const isAutoRunFile = (rel) => /(^|\/)(\.vscode\/tasks\.json|\.devcontainer\.json|\.claude\/settings[^/]*\.json|\.gemini\/settings\.json|\.codex\/[^/]+\.(json|toml)|\.cursor\/(?!rules\/)[^/]+\.json|package\.json)$/.test(rel)
+  || /(^|\/)\.devcontainer\/(.*\/)?[^/]+\.json$/.test(rel) || /(^|\/)\.(husky|githooks)\/(?!_\/)[^/]+$/.test(rel);

package/dist/security-runtime/src/checks/agent-surface/index.mjs

@@ -0,0 +1,113 @@
+// agent-surface (REQ-017): what a hostile repository can use against a developer's coding agent or machine.
+// Hidden Unicode, auto-run configuration that downloads and runs content, MCP servers launching unpinned or plain-HTTP packages,
+// and instruction files that direct agents to fetch and run code, read credentials, or follow hidden instructions.
+// Custom code, no external tool. Reads files only: nothing in the scanned repository is ever executed.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { gitFileLists } from '../_lib/gitfiles.mjs';
+import { autoRunIssues, isAutoRunFile, isMcpFile, mcpIssues } from './config.mjs';
+import { instructionIssues, isInstructionFile } from './instructions.mjs';
+import { scanUnicode } from './unicode.mjs';
+
+export const id = 'agent-surface';
+export const title = 'Agent and developer-environment surface';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = ['scan', 'deep', 'release'];
+export const timeoutSec = 600;
+
+const MAX_BYTES = 10 * 1024 * 1024;
+const SKIP_SEGMENTS = new Set(['node_modules', '.git', '.vsg', '.pnpm-store']);
+const LOCKFILES = new Set(['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'poetry.lock', 'Pipfile.lock', 'uv.lock', 'Cargo.lock', 'go.sum', 'composer.lock', 'Gemfile.lock']);
+const DOC_EXT = /\.(md|mdx|markdown|txt|rst|mdc)$/i;
+const CONFIG_EXT = /\.(json|jsonc|ya?ml|toml|ini|cfg|conf|env|properties)$/i;
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+
+export const applies = () => true;
+
+/** "lockfile" (hidden Unicode only), "sensitive" (instruction, config and documentation files) or "code". */
+export function classify(rel) {
+  const b = base(rel);
+  if (LOCKFILES.has(b)) return 'lockfile';
+  if (isInstructionFile(rel) || isAutoRunFile(rel) || isMcpFile(rel) || DOC_EXT.test(b) || CONFIG_EXT.test(b) || b.startsWith('.')
+    || /(^|\/)\.(claude|cursor|codex|gemini|vscode|devcontainer|husky|githooks|github)\//.test(rel)) return 'sensitive';
+  return 'code';
+}
+
+async function candidateFiles(ctx) {
+  const walked = listFiles(ctx.repo);
+  const lists = await gitFileLists(ctx);
+  let files;
+  let source;
+  if (lists && lists.tracked.length + lists.untracked.length > 0) {
+    // tracked and untracked-not-ignored files, plus config paths that exist even when ignored (e.g. .claude/settings.local.json)
+    files = new Set([...lists.tracked, ...lists.untracked]);
+    for (const f of walked) if (isAutoRunFile(f) || isMcpFile(f) || isInstructionFile(f)) files.add(f);
+    source = 'git ls-files';
+  } else {
+    files = new Set(walked);
+    source = 'directory walk';
+  }
+  const outRel = ctx.out ? path.relative(ctx.repo, ctx.out).split(path.sep).join('/') : '';
+  const underOut = (f) => outRel && !outRel.startsWith('..') && !path.isAbsolute(outRel) && (f === outRel || f.startsWith(`${outRel}/`));
+  const nested = (ctx.nestedRepos ?? []).map((n) => `${n.path}/`);
+  const inNested = (f) => nested.some((n) => f.startsWith(n));
+  return { source, files: [...files].filter((f) => !f.split('/').some((s) => SKIP_SEGMENTS.has(s)) && !underOut(f) && !inNested(f)).sort() };
+}
+
+function readText(repo, rel, skipped) {
+  const full = path.join(repo, rel);
+  let st;
+  try { st = fs.lstatSync(full); } catch { return null; }
+  if (!st.isFile()) return null; // symlinks are never followed
+  if (st.size > MAX_BYTES) { skipped.push({ file: rel, reason: 'over 10 MB' }); return null; }
+  let buf;
+  try { buf = fs.readFileSync(full); } catch { return null; }
+  if (buf.subarray(0, 8000).includes(0)) return null; // binary
+  return buf.toString('utf8');
+}
+
+const UNICODE_TITLES = {
+  'tag-characters': ['Hidden Unicode tag characters', 'Unicode tag characters (U+E0000 to U+E007F) are invisible in editors and reviews but are read by language models, so they can carry a hidden prompt.', 'Delete the characters. Review how they got in: they are almost never legitimate outside emoji flag sequences.'],
+  'bidi-controls': ['Hidden bidirectional control characters', 'Bidirectional controls reorder how text is displayed, so what a reviewer reads differs from what is executed or sent to an agent (the "Trojan Source" technique).', 'Delete the control characters.'],
+  'zero-width': ['Hidden zero-width characters', 'Zero-width characters are invisible, so they can hide text, split keywords past filters or encode data that a reviewer cannot see.', 'Delete the characters unless they are intentional, and then accept the finding with a reason.'],
+  'variation-selectors': ['Hidden variation selectors', 'Variation selectors outside emoji are invisible and can encode hidden data.', 'Delete the characters.'],
+};
+const LOCKFILE_RULES = new Set(['tag-characters', 'bidi-controls']);
+
+export async function run(ctx) {
+  const { source, files } = await candidateFiles(ctx);
+  const skipped = [];
+  const findings = [];
+  const add = (rel, f) => findings.push({
+    category: 'agent-surface', confidence: 'high', tool: 'vsg', refs: [], ...f, ruleId: f.ruleId ?? f.rule, key: f.key ?? f.rule,
+    location: { file: rel, line: f.line },
+  });
+  let scanned = 0;
+  for (const rel of files) {
+    const text = readText(ctx.repo, rel, skipped);
+    if (text === null) continue;
+    scanned++;
+    const kind = classify(rel);
+    for (const u of scanUnicode(text, kind === 'code' ? 'code' : 'sensitive')) {
+      if (kind === 'lockfile' && !LOCKFILE_RULES.has(u.rule)) continue;
+      const [t, why, fix] = UNICODE_TITLES[u.rule];
+      add(rel, { rule: u.rule, severity: u.severity, line: u.line, title: `${t} in ${rel}`, description: `${u.count} occurrence(s). ${why}`, evidence: u.evidence, fix });
+    }
+    if (kind === 'lockfile') continue;
+    const issues = [];
+    if (isAutoRunFile(rel)) issues.push(...autoRunIssues(rel, text));
+    if (isMcpFile(rel)) issues.push(...mcpIssues(rel, text));
+    if (isInstructionFile(rel)) issues.push(...instructionIssues(rel, text));
+    for (const i of issues) add(rel, i);
+  }
+  const oversized = skipped.filter((s) => s.reason === 'over 10 MB');
+  return {
+    status: 'ran',
+    reason: oversized.length ? `${oversized.length} file(s) over 10 MB were skipped (${oversized.slice(0, 3).map((s) => s.file).join(', ')}${oversized.length > 3 ? ', ...' : ''})` : '',
+    findings,
+    evidence: { fileSource: source, filesListed: files.length, filesScanned: scanned, skipped },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/agent-surface/instructions.mjs

@@ -0,0 +1,87 @@
+// Instruction files (table row 7): text that directs an agent to fetch and run code, read or send credentials, or follow hidden instructions.
+import { clip, fetchAndRun } from './patterns.mjs';
+
+export const isInstructionFile = (rel) => /(^|\/)(AGENTS\.md|CLAUDE\.md|GEMINI\.md|SKILL\.md|\.cursorrules|\.windsurfrules|\.clinerules|copilot-instructions\.md)$/.test(rel)
+  || /(^|\/)\.cursor\/rules\//.test(rel) || /(^|\/)\.clinerules\//.test(rel);
+
+const CRED_PATH = /(?:~|\$HOME|%USERPROFILE%)[\\/]\.(?:ssh|aws|npmrc|netrc|docker|kube)\b|\.ssh[\\/]id_[a-z0-9]+|\.aws[\\/]credentials|\.config[\\/]gcloud|\bid_rsa\b|\bprintenv\b(?!\s+[A-Za-z_])|\benv\s*(?:>>?\s*\S|\|\s*(?:grep|curl|wget|nc|base64|tee|sort|head|xargs)\b)|\bexport\s+-p\b|\bGet-ChildItem\s+env:|json\.dumps\(\s*(?:dict\()?os\.environ|JSON\.stringify\(\s*process\.env/i;
+const SEND_SECRET = /\b(?:send|upload|post(?![-\w])|transmit|exfiltrate|email|forward)\b[^\n]{0,80}?\b(?:tokens?|secrets?|credentials?|passwords?|(?:api|private|ssh|secret|access|signing|encryption|service[ _-]?role)[ _-]?keys?|\.env)\b/i;
+const NEGATION = /\b(?:never|do not|don't|dont|must not|mustn't|should not|shouldn't|cannot|can't|avoid|not)\b[^.;:!?]*$/i;
+const HIDING = /(?:font-size\s*:\s*[01]\s*(?:px|pt|em|rem|%)?\s*(?:[;"']|$)|(?:^|[;"'\s])color\s*:\s*(?:#f{3}(?:f{3})?\b|white\b|rgb\(\s*255\s*,\s*255\s*,\s*255\s*\))|display\s*:\s*none|visibility\s*:\s*hidden|opacity\s*:\s*0(?:\.0+)?\s*(?:[;"']|$)|(?:width|height)\s*:\s*0(?:px)?\s*[;"'])/i;
+const HIDDEN_ELEMENT = /<(\w+)\b([^>]*)>([^<]{10,})/g;
+const COMMENT = new RegExp('<!--([\\s\\S]*?)-->', 'g');
+const DIRECTIVE = [
+  /\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:instructions?|rules?|prompts?|above|previous|prior|guidelines)\b/i,
+  /\byou\s+(?:must|should|will|shall|need\s+to|have\s+to|are\s+(?:now|to))\b/i,
+  /\b(?:ai|llm|agents?|assistants?|claude|copilot|gemini|cursor|codex)\b[^.\n]{0,30}\b(?:must|should|always|never|run|execute|ignore|do\s+not)\b/i,
+  /\bdo\s+not\s+(?:tell|mention|reveal|show|inform)\b/i,
+  /\bsystem\s+prompt\b/i,
+  /\b(?:run|execute)\s+(?:the\s+)?(?:following|this|these)\b/i,
+];
+
+const lineAt = (text, idx) => { let n = 1; for (let i = text.indexOf('\n'); i >= 0 && i < idx; i = text.indexOf('\n', i + 1)) n++; return n; };
+
+// "send BOTH the apikey header and Authorization: Bearer <key>" explains how to call the project's own API; nothing leaves the machine.
+// A send-a-key sentence counts as that when it talks about a header or Authorization and names no destination (a URL or a domain).
+const AUTH_HEADER_USE = /\b(?:headers?|authorization|bearer)\b/i;
+const DESTINATION = /https?:\/\/|\b[a-z0-9-]+\.[a-z]{2,}\b/i;
+const isApiAuthUse = (line, m) => { const window = line.slice(m.index, m.index + m[0].length + 120); return AUTH_HEADER_USE.test(window) && !DESTINATION.test(window); };
+
+function credentialHit(line) {
+  for (const re of [CRED_PATH, SEND_SECRET]) {
+    const m = re.exec(line);
+    if (m && !NEGATION.test(line.slice(0, m.index)) && !(re === SEND_SECRET && isApiAuthUse(line, m))) return m[0];
+  }
+  return null;
+}
+
+export function instructionIssues(rel, text) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  const push = (i) => ({ line: i + 1, file: rel });
+  const seen = new Set();
+  const add = (issue) => { const k = `${issue.rule}:${issue.line}`; if (!seen.has(k)) { seen.add(k); out.push(issue); } };
+  lines.forEach((line, i) => {
+    const run = fetchAndRun(line);
+    if (run) {
+      add({
+        rule: 'instruction-fetch-exec', key: `instr-run:${i + 1}`, severity: 'high', ...push(i),
+        title: 'Instruction file directs agents to fetch and run code',
+        description: `${rel} line ${i + 1} contains a command that ${run.via === 'download' ? 'downloads' : 'decodes'} content and executes it ("${run.fetch}" ... "${run.exec}"). An agent that follows its instruction files will run whatever the remote server returns.`,
+        evidence: clip(line), fix: 'Remove the instruction, or replace it with a committed, reviewed script and a pinned checksum.',
+      });
+    }
+    const cred = credentialHit(line);
+    if (cred) {
+      add({
+        rule: 'instruction-credentials', key: `instr-cred:${i + 1}`, severity: 'high', ...push(i),
+        title: 'Instruction file directs agents to read or send credentials',
+        description: `${rel} line ${i + 1} tells an agent to read credential files or environment dumps, or to send tokens, secrets or keys somewhere ("${clip(cred, 60)}").`,
+        evidence: clip(line), fix: 'Remove the instruction. Agents should never be told to read or transmit credentials.',
+      });
+    }
+    for (const m of line.matchAll(HIDDEN_ELEMENT)) {
+      if (HIDING.test(m[2])) {
+        add({
+          rule: 'instruction-hidden-markup', key: `instr-hidden-markup:${i + 1}`, severity: 'high', ...push(i),
+          title: 'Instruction file hides text with zero-size or white-text markup',
+          description: `${rel} line ${i + 1} wraps text in markup that renders it invisible to a human reviewer while an agent still reads it.`,
+          evidence: clip(`<${m[1]} ${m[2].trim()}> ${m[3]}`), fix: 'Remove the hidden element. Instruction files should contain only visible text.',
+        });
+      }
+    }
+  });
+  for (const m of text.matchAll(COMMENT)) {
+    const body = m[1];
+    const hit = DIRECTIVE.map((re) => re.exec(body)).find(Boolean) ?? (fetchAndRun(body) ? ['fetch-and-run'] : null) ?? (credentialHit(body) ? ['credentials'] : null);
+    if (!hit) continue;
+    const line = lineAt(text, m.index);
+    add({
+      rule: 'instruction-hidden-comment', key: `instr-comment:${line}`, severity: 'high', line, file: rel,
+      title: 'Instruction file hides instructions in an HTML comment',
+      description: `${rel} line ${line} has an HTML comment that reads as an instruction to an agent ("${clip(hit[0], 60)}"). Markdown viewers do not show comments, so a human reviewer misses it while an agent reads it.`,
+      evidence: clip(body), fix: 'Remove the comment, or move the instruction into visible text a reviewer can read.',
+    });
+  }
+  return out;
+}

package/dist/security-runtime/src/checks/agent-surface/patterns.mjs

@@ -0,0 +1,68 @@
+// Shared detection helpers for the agent-surface check: the fetch-or-decode-then-execute predicate, JSONC parsing, line lookup.
+
+const FETCH = [
+  /\b(?:curl|wget|Invoke-WebRequest|iwr|irm|Invoke-RestMethod)\b/i,
+  /\bfetch\s*\(/i,
+  /\bcertutil\b[^\n]*-urlcache/i,
+  /\bbitsadmin\b/i,
+];
+const DECODE = [
+  /\bbase64\s+(?:-[a-zA-Z]*d[a-zA-Z]*|--decode)\b/i,
+  /\bFromBase64String\b/i,
+  /\batob\s*\(/i,
+  /\bcertutil\b[^\n]*-decode/i,
+];
+const EXEC = [
+  /\|\s*(?:sudo\s+(?:-\S+\s+)*)?(?:\/\S*\/)?(?:ba|z|da|k|a)?sh\b/i, // | sh, | bash, | sudo bash
+  /\|\s*(?:\/\S*\/)?(?:node|nodejs|bun|deno|python3?|perl|ruby|php|pwsh|powershell|iex)\b/i,
+  /\b(?:iex|Invoke-Expression)\b/i,
+  /\b(?:ba|z|da)?sh\s+(?:-\w+\s+)*-c\s+["']?\$\(/i, // sh -c "$(curl ...)"
+  /\b(?:ba|z)?sh\s+<\(/i, // bash <(curl ...)
+  /\beval\b/i,
+];
+
+/** Returns { via, fetch, exec } when the text fetches or decodes content and executes it, otherwise null. */
+export function fetchAndRun(text) {
+  const s = String(text);
+  const fetch = FETCH.map((re) => re.exec(s)).find(Boolean);
+  const decode = fetch ? null : DECODE.map((re) => re.exec(s)).find(Boolean);
+  const first = fetch ?? decode;
+  if (!first) return null;
+  const exec = EXEC.map((re) => re.exec(s)).find(Boolean);
+  if (!exec) return null;
+  return { via: fetch ? 'download' : 'decode', fetch: first[0], exec: exec[0].trim() };
+}
+
+/** JSON with comments and trailing commas (VS Code and devcontainer files). Returns undefined when unparseable. */
+export function parseJsonc(text) {
+  const src = String(text).replace(/^\uFEFF/, '');
+  try { return JSON.parse(src); } catch { /* fall through to the tolerant pass */ }
+  let out = '';
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === '"') {
+      let j = i + 1;
+      while (j < src.length && src[j] !== '"') j += src[j] === '\\' ? 2 : 1;
+      out += src.slice(i, j + 1);
+      i = j;
+    } else if (c === '/' && src[i + 1] === '/') {
+      while (i < src.length && src[i] !== '\n') i++;
+      out += '\n';
+    } else if (c === '/' && src[i + 1] === '*') {
+      const end = src.indexOf('*/', i + 2);
+      i = end < 0 ? src.length : end + 1;
+    } else out += c;
+  }
+  try { return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1')); } catch { return undefined; }
+}
+
+/** Line number (1-based) of the first occurrence of needle at or after `from`, or 1. */
+export function lineOf(text, needle, from = 0) {
+  const at = needle ? text.indexOf(needle, from) : -1;
+  if (at < 0) return 1;
+  let line = 1;
+  for (let i = text.indexOf('\n'); i >= 0 && i < at; i = text.indexOf('\n', i + 1)) line++;
+  return line;
+}
+
+export const clip = (s, n = 200) => { const t = String(s).replace(/\s+/g, ' ').trim(); return t.length > n ? `${t.slice(0, n)}...` : t; };

package/dist/security-runtime/src/checks/agent-surface/unicode.mjs

@@ -0,0 +1,88 @@
+// Hidden-Unicode rows of the agent-surface table: tag characters, bidi controls, zero-width characters, variation selectors.
+// Emoji sequences (ZWJ, skin tones, FE0F, subdivision flags) are recognised and never flagged.
+
+const CANDIDATE = /[\u200B-\u200D\u2060\uFEFF\u202A-\u202E\u2066-\u2069\uFE00-\uFE0F\u{E0000}-\u{E01EF}]/gu;
+// Subdivision flag: black flag + 2 to 7 lowercase letters or digits as tag characters + cancel tag (e.g. England: gbeng).
+const FLAG = /\u{1F3F4}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{2,7}\u{E007F}/gu;
+
+const PICTO = /^\p{Extended_Pictographic}$/u;
+const MODIFIER = /^\p{Emoji_Modifier}$/u;
+const EMOJI = /^\p{Emoji}$/u;
+const hex = (cp) => `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`;
+
+function prevCp(text, i) {
+  const lo = text.charCodeAt(i - 1);
+  if (lo >= 0xdc00 && lo <= 0xdfff && i >= 2) {
+    const hi = text.charCodeAt(i - 2);
+    if (hi >= 0xd800 && hi <= 0xdbff) return { cp: ((hi - 0xd800) << 10) + (lo - 0xdc00) + 0x10000, at: i - 2 };
+  }
+  return i >= 1 ? { cp: lo, at: i - 1 } : null;
+}
+const nextCp = (text, i) => (i < text.length ? text.codePointAt(i) : null);
+
+/** The emoji (or pictographic symbol) a joiner or selector at index i is attached to, skipping skin tones and FE0F. */
+function baseBefore(text, i) {
+  let p = prevCp(text, i);
+  while (p && (p.cp === 0xfe0f || p.cp === 0xfe0e || MODIFIER.test(String.fromCodePoint(p.cp)))) p = prevCp(text, p.at);
+  return p;
+}
+
+function lineIndex(text) {
+  const starts = [0];
+  for (let i = text.indexOf('\n'); i >= 0; i = text.indexOf('\n', i + 1)) starts.push(i + 1);
+  return (idx) => {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if (starts[mid] <= idx) lo = mid; else hi = mid - 1; }
+    return { line: lo + 1, col: idx - starts[lo] + 1 };
+  };
+}
+
+/**
+ * Scans text. `tier` is "sensitive" (instruction, config, docs, lockfiles) or "code".
+ * Returns one issue per rule: { rule, severity, line, count, evidence, hidden? }.
+ */
+export function scanUnicode(text, tier) {
+  if (text.search(CANDIDATE) < 0) return [];
+  const flags = [...text.matchAll(FLAG)].map((m) => [m.index, m.index + m[0].length]);
+  const inFlag = (i) => flags.some(([a, b]) => i >= a && i < b);
+  const where = lineIndex(text);
+  const found = { tag: [], bidi: [], zero: [], variation: [] };
+  for (const m of text.matchAll(CANDIDATE)) {
+    const i = m.index;
+    const cp = m[0].codePointAt(0);
+    const at = where(i);
+    const item = { cp, ...at, i };
+    if (cp >= 0xe0000 && cp <= 0xe007f) { if (!inFlag(i)) found.tag.push(item); continue; }
+    if ((cp >= 0x202a && cp <= 0x202e) || (cp >= 0x2066 && cp <= 0x2069)) { found.bidi.push(item); continue; }
+    if (cp >= 0xe0100 && cp <= 0xe01ef) { found.variation.push(item); continue; }
+    if (cp >= 0xfe00 && cp <= 0xfe0f) {
+      const base = baseBefore(text, i);
+      const ch = base ? String.fromCodePoint(base.cp) : '';
+      const keycap = base && /^[0-9#*]$/.test(ch) && nextCp(text, i + 1) === 0x20e3;
+      const legit = base && (PICTO.test(ch) || (EMOJI.test(ch) && !/^[0-9#*]$/.test(ch)) || keycap);
+      if (!legit) found.variation.push(item);
+      continue;
+    }
+    if (cp === 0xfeff && i === 0) continue; // byte order mark
+    if (cp === 0x200d) {
+      const base = baseBefore(text, i);
+      const next = nextCp(text, i + 1);
+      const between = base && PICTO.test(String.fromCodePoint(base.cp)) && next !== null && PICTO.test(String.fromCodePoint(next));
+      if (between) continue;
+    }
+    found.zero.push(item);
+  }
+  const sensitive = tier !== 'code';
+  const list = (items) => items.slice(0, 8).map((x) => `${hex(x.cp)} at ${x.line}:${x.col}`).join(', ') + (items.length > 8 ? `, and ${items.length - 8} more` : '');
+  const issue = (rule, severity, items, extra = {}) => ({ rule, severity, line: items[0].line, count: items.length, evidence: list(items), ...extra });
+  const out = [];
+  if (found.tag.length) {
+    const decoded = found.tag.map((x) => (x.cp >= 0xe0020 && x.cp <= 0xe007e ? String.fromCharCode(x.cp - 0xe0000) : '')).join('');
+    out.push(issue('tag-characters', 'critical', found.tag, { evidence: `${list(found.tag)}${decoded ? `; decoded hidden text: "${decoded.slice(0, 200)}"` : ''}` }));
+  }
+  if (found.bidi.length) out.push(issue('bidi-controls', sensitive ? 'critical' : 'high', found.bidi));
+  if (found.zero.length) out.push(issue('zero-width', sensitive ? 'high' : 'medium', found.zero));
+  if (found.variation.length) out.push(issue('variation-selectors', 'high', found.variation));
+  return out;
+}