@securecode-ai/mcp 0.5.5 → 0.5.7

package/dist/utils/testSafety.js

@@ -1,38 +1,217 @@
 "use strict";
+/**
+ * Static test safety analyzer — defense-in-depth, NOT a security boundary.
+ *
+ * The real boundary is the verification sandbox (`verificationSandbox.ts`):
+ * Docker with `--network=none --read-only`, or Deno with `--allow-none`.
+ * This module exists to reject obviously dangerous scripts *before* we
+ * pay for a sandbox spawn, and as a second layer in case a sandbox backend
+ * is somehow misconfigured.
+ *
+ * Policy: deny-by-default. Only specific known-safe imports and globals
+ * are permitted. Anything else is blocked. The previous implementation
+ * was allow-by-default with a 4-module blocklist — it let `http`, `https`,
+ * `fs`, `dns`, `os`, `tls`, `vm`, `dgram`, `fetch`, `eval`, `new Function`,
+ * dynamic `import()`, and `process.env` access all pass. That gap is the
+ * reason this module was rewritten.
+ *
+ * What this analyzer checks (in priority order):
+ *   1. Static import / require specifiers — against an allowlist.
+ *   2. Dynamic require/import — blocked outright (cannot be statically
+ *      analyzed).
+ *   3. Global function calls that execute strings as code — `eval`,
+ *      `new Function`, `setTimeout(string)`, `setInterval(string)`,
+ *      `setImmediate(string)`.
+ *   4. Network-related globals and Node built-ins (covered by #1 for
+ *      imports; here for member-style access like `globalThis.fetch`).
+ *   5. Process/env access — `process.env`, `process.argv`, `process.cwd`,
+ *      `process.execPath`, `process.cwd()`.
+ *   6. Reflection tricks that resolve to dangerous globals —
+ *      `globalThis['eval']`, `globalThis['Function']`, `this['eval']`,
+ *      bracket access with string literals that match dangerous names.
+ *
+ * Obfuscation handling: we catch literal bracket access like
+ * `globalThis["eval"]` and `process["env"]`. We do NOT attempt to defeat
+ * arbitrary runtime-computed string construction (e.g., `String.fromCharCode`
+ * to build a name) — that is the sandbox's job. This analyzer only catches
+ * what a defender can see statically.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkTestSafety = checkTestSafety;
-const BLOCKED_MODULES = new Set(['child_process', 'net', 'cluster', 'worker_threads']);
-const BLOCKED_PATTERNS = [
-    { pattern: /process\.exit\s*\(/g, reason: () => 'process.exit() masks test results — use console.error + throw instead' },
-    { pattern: /require\s*\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\)/g, reason: () => 'dynamic require with variable is not statically checkable' },
+// ── Import allowlist ────────────────────────────────────────────────────────
+//
+// Allowed import specifiers (after the leading `node:` / `bun:` prefix is
+// stripped for built-ins). Built-ins are kept on a tiny allowlist because
+// even `node:` built-ins like `fs` are dangerous. The sandbox is the real
+// boundary, but we still block here so we don't waste a container start
+// on something obviously bad.
+const ALLOWED_NODE_BUILTINS = new Set([
+    'assert', 'console', 'crypto', 'path', 'util', 'module',
+    'string_decoder', 'url',
+]);
+const ALLOWED_PREFIXES = [
+    './', '../', // relative imports — needed to load the vulnerable module
+    'effect', // the user's framework
+    'bun:', // bun:* built-ins (test framework, etc.)
+    '@synara/', // user's workspace packages
 ];
-const ALLOWED_IMPORT_PREFIXES = ['node:', 'effect', 'bun', 'bun:', '@synara/', './', '../'];
-const BLOCKED_MODULE_REASONS = {
-    child_process: 'child_process is blocked — use only for testing command injection with mock spawns',
-    net: 'net is blocked — use HTTP libraries instead',
-    cluster: 'cluster is blocked',
-    worker_threads: 'worker_threads is blocked',
-};
+// Modules blocked even if a prefix matches (defense-in-depth).
+const BLOCKED_MODULE_NAMES = new Set([
+    'child_process', 'node:child_process',
+    'net', 'node:net',
+    'http', 'node:http',
+    'https', 'node:https',
+    'http2', 'node:http2',
+    'dgram', 'node:dgram',
+    'dns', 'node:dns',
+    'dns/promises', 'node:dns/promises',
+    'tls', 'node:tls',
+    'fs', 'node:fs',
+    'fs/promises', 'node:fs/promises',
+    'os', 'node:os',
+    'vm', 'node:vm',
+    'worker_threads', 'node:worker_threads',
+    'cluster', 'node:cluster',
+    'repl', 'node:repl',
+    'process', 'node:process',
+    'inspector', 'node:inspector',
+    'perf_hooks', 'node:perf_hooks', // timing side-channels
+]);
+// ── Dangerous globals & member access ───────────────────────────────────────
+const DANGEROUS_GLOBAL_CALLS = [
+    { pattern: /\beval\s*\(/, reason: 'eval() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+Function\s*\(/, reason: 'new Function() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+AsyncFunction\s*\(/, reason: 'new AsyncFunction() executes arbitrary strings as code' },
+    { pattern: /\bnew\s+GeneratorFunction\s*\(/, reason: 'new GeneratorFunction() executes arbitrary strings as code' },
+];
+// setTimeout/setInterval/setImmediate with a STRING argument is eval-by-proxy.
+const TIMER_STRING_ARG = /\b(setTimeout|setInterval|setImmediate)\s*\(\s*['"`]/;
+const DANGEROUS_PROCESS_ACCESS = [
+    { pattern: /\bprocess\.env\b/, reason: 'process.env access can leak host secrets — pass values explicitly' },
+    { pattern: /\bprocess\.argv\b/, reason: 'process.argv access can leak host arguments' },
+    { pattern: /\bprocess\.execPath\b/, reason: 'process.execPath exposes the host runtime path' },
+    { pattern: /\bprocess\.cwd\s*\(/, reason: 'process.cwd() exposes the host filesystem layout' },
+    { pattern: /\bprocess\.getuid\s*\(/, reason: 'process.getuid() exposes host user identity' },
+    { pattern: /\bprocess\.getgid\s*\(/, reason: 'process.getgid() exposes host group identity' },
+];
+// Network & fs globals reachable without import (Node 18+ has global fetch).
+const DANGEROUS_GLOBAL_REFERENCES = [
+    { pattern: /\bfetch\s*\(/, reason: 'fetch() can exfiltrate data over the network' },
+    { pattern: /\bnavigator\b/, reason: 'navigator access is not needed in a unit test' },
+];
+// Dynamic import (ESM) and dynamic require (CJS) — both are unsafe because
+// the specifier can be computed at runtime.
+const DYNAMIC_IMPORT = /\bimport\s*\(\s*[^"'\s`]/;
+const DYNAMIC_REQUIRE = /\brequire\s*\(\s*(?![`'"])[^)]*\)/;
+const STATIC_REQUIRE = /\brequire\s*\(\s*['"`]([^`'"]+)['"`]\s*\)/g;
+const STATIC_IMPORT_FROM = /\bimport\s+[^;]*?\s+from\s*['"`]([^`'"]+)['"`]/g;
+const STATIC_IMPORT_BARE = /\bimport\s+['"`]([^`'"]+)['"`]/g;
+const STATIC_EXPORT_FROM = /\bexport\s+[^;]*?\s+from\s*['"`]([^`'"]+)['"`]/g;
+// Bracket-access reflection: globalThis["eval"], process["env"], etc.
+// Matches `<identifier|keyword>["<dangerous-name>"]` and `['...']`.
+function buildBracketAccessRegex(name) {
+    // Capture a bracket access where the property is a string literal matching
+    // the dangerous name. The receiver is any identifier-like token (we
+    // accept anything that's not a quote, to keep this simple).
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\b[^'"\\\`\\s]+\\s*\\[\\s*['"\`\\s]*${escaped}['"\`\\s]*\\]`, 'i');
+}
+const DANGEROUS_BRACKET_NAMES = [
+    'eval', 'Function', 'AsyncFunction', 'GeneratorFunction',
+    'fetch', 'process', 'require', 'import',
+    'child_process', 'net', 'http', 'https', 'fs', 'os', 'vm',
+    'exec', 'execSync', 'spawn', 'spawnSync', 'fork',
+    // Dangerous properties of `process` accessed via bracket (process["env"]).
+    // Blocking the property name on any receiver is intentional — bracket
+    // access to "env" is a known reflection trick and tests shouldn't need it.
+    'env', 'argv', 'execPath', 'mainModule',
+];
+// ── Main entry ──────────────────────────────────────────────────────────────
 function checkTestSafety(script, _workspaceRoot) {
-    for (const { pattern, reason } of BLOCKED_PATTERNS) {
-        pattern.lastIndex = 0;
+    // 1. Dangerous call patterns (eval, Function, etc.)
+    for (const { pattern, reason } of DANGEROUS_GLOBAL_CALLS) {
         if (pattern.test(script)) {
-            return { allowed: false, reason: reason('') };
+            return { allowed: false, reason };
         }
     }
-    const importRegex = /(?:import\s+[^;]+?from\s*|require\s*\(\s*)["']([^"']+)["']/g;
-    let match;
-    while ((match = importRegex.exec(script)) !== null) {
-        const mod = match[1];
-        if (BLOCKED_MODULES.has(mod)) {
-            return { allowed: false, reason: BLOCKED_MODULE_REASONS[mod] || mod };
+    // 2. Timer-with-string (eval-by-proxy)
+    if (TIMER_STRING_ARG.test(script)) {
+        return { allowed: false, reason: 'setTimeout/setInterval/setImmediate with a string argument is eval-by-proxy' };
+    }
+    // 3. process.* access that leaks host state
+    for (const { pattern, reason } of DANGEROUS_PROCESS_ACCESS) {
+        if (pattern.test(script)) {
+            return { allowed: false, reason };
+        }
+    }
+    // 4. Global network refs
+    for (const { pattern, reason } of DANGEROUS_GLOBAL_REFERENCES) {
+        if (pattern.test(script)) {
+            return { allowed: false, reason };
         }
-        if (mod.startsWith('node:') || mod.startsWith('./') || mod.startsWith('../'))
-            continue;
-        if (mod.startsWith('effect') || mod.startsWith('bun') || mod.startsWith('@synara/'))
-            continue;
-        if (ALLOWED_IMPORT_PREFIXES.some(p => mod.startsWith(p)))
-            continue;
+    }
+    // 5. Dynamic import / dynamic require — non-static specifiers
+    if (DYNAMIC_IMPORT.test(script)) {
+        return { allowed: false, reason: 'dynamic import() with a computed specifier cannot be statically analyzed' };
+    }
+    if (DYNAMIC_REQUIRE.test(script)) {
+        return { allowed: false, reason: 'dynamic require with variable is not statically checkable' };
+    }
+    // 6. Bracket-access reflection (globalThis["eval"], process["env"], etc.)
+    for (const name of DANGEROUS_BRACKET_NAMES) {
+        const re = buildBracketAccessRegex(name);
+        if (re.test(script)) {
+            return { allowed: false, reason: `bracket access to "${name}" is blocked — use the safe form directly if needed` };
+        }
+    }
+    // 7. Static import / require specifiers — allowlist
+    const checkSpecifier = (mod) => {
+        if (BLOCKED_MODULE_NAMES.has(mod)) {
+            return { allowed: false, reason: `module "${mod}" is blocked — use the sandbox boundary for fs/net/process access` };
+        }
+        // node: prefix — strip and check the built-in allowlist.
+        if (mod.startsWith('node:')) {
+            const name = mod.slice('node:'.length);
+            if (!ALLOWED_NODE_BUILTINS.has(name)) {
+                return { allowed: false, reason: `node built-in "${mod}" is not on the allowlist (allowed: ${[...ALLOWED_NODE_BUILTINS].join(', ')})` };
+            }
+            return null;
+        }
+        // Bare built-in (no node: prefix) — block unless it's on the allowlist.
+        // We block bare 'fs', 'net', etc. even though Node resolves them to the
+        // same thing as node:fs.
+        if (ALLOWED_NODE_BUILTINS.has(mod))
+            return null;
+        if (mod === 'node')
+            return null; // not a real import
+        if (ALLOWED_PREFIXES.some(p => mod.startsWith(p)))
+            return null;
+        // Bare module names that aren't on an allowed prefix and aren't a
+        // built-in. These are third-party packages. We allow them — the
+        // sandbox will deny network access if they try to fetch anything.
+        // But we keep the known-dangerous ones in BLOCKED_MODULE_NAMES above.
+        return null;
+    };
+    const importPatterns = [
+        { re: STATIC_IMPORT_FROM, label: 'import' },
+        { re: STATIC_IMPORT_BARE, label: 'import' },
+        { re: STATIC_EXPORT_FROM, label: 'export' },
+        { re: STATIC_REQUIRE, label: 'require' },
+    ];
+    for (const { re } of importPatterns) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(script)) !== null) {
+            const mod = m[1];
+            const verdict = checkSpecifier(mod);
+            if (verdict)
+                return verdict;
+        }
+    }
+    // 8. process.exit() — masks test results and prevents the runner from
+    // capturing PASS/FAIL markers. (Was blocked before; keep the behavior.)
+    if (/\bprocess\.exit\s*\(/.test(script)) {
+        return { allowed: false, reason: 'process.exit() masks test results — use console.error + throw instead' };
     }
     return { allowed: true, reason: '' };
 }

package/dist/utils/testSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"testSafety.js","sourceRoot":"","sources":["../../src/utils/testSafety.ts"],"names":[],"mappings":";;AAgBA,0CAqBC;AArCD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF,MAAM,gBAAgB,GAAgE;IAClF,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,uEAAuE,EAAE;IACzH,EAAE,OAAO,EAAE,+CAA+C,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,2DAA2D,EAAE;CAC1I,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAE5F,MAAM,sBAAsB,GAA2B;IACnD,aAAa,EAAE,oFAAoF;IACnG,GAAG,EAAE,6CAA6C;IAClD,OAAO,EAAE,oBAAoB;IAC7B,cAAc,EAAE,2BAA2B;CAC9C,CAAC;AAEF,SAAgB,eAAe,CAAC,MAAc,EAAE,cAAsB;IAClE,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACjD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAClD,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,6DAA6D,CAAC;IAClF,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACvF,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC9F,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;IACvE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"testSafety.js","sourceRoot":"","sources":["../../src/utils/testSafety.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;AA6GH,0CA6FC;AAnMD,+EAA+E;AAC/E,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,8BAA8B;AAE9B,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IACvD,gBAAgB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG;IACrB,IAAI,EAAE,KAAK,EAAW,0DAA0D;IAChF,QAAQ,EAAc,uBAAuB;IAC7C,MAAM,EAAgB,yCAAyC;IAC/D,UAAU,EAAY,4BAA4B;CACrD,CAAC;AAEF,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,eAAe,EAAE,oBAAoB;IACrC,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,mBAAmB;IACnC,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,kBAAkB;IACjC,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE,qBAAqB;IACvC,SAAS,EAAE,cAAc;IACzB,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,cAAc;IACzB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,iBAAiB,EAAG,uBAAuB;CAC5D,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,sBAAsB,GAA+C;IACvE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,2CAA2C,EAAE;IAC/E,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,mDAAmD,EAAE;IACjG,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,wDAAwD,EAAE;IAC3G,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,4DAA4D,EAAE;CACtH,CAAC;AAEF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAW,sDAAsD,CAAC;AAExF,MAAM,wBAAwB,GAA+C;IACzE,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,mEAAmE,EAAE;IAC5G,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,6CAA6C,EAAE;IACvF,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,EAAE;IAC9F,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,kDAAkD,EAAE;IAC9F,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,6CAA6C,EAAE;IAC5F,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,8CAA8C,EAAE;CAChG,CAAC;AAEF,6EAA6E;AAC7E,MAAM,2BAA2B,GAA+C;IAC5E,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,8CAA8C,EAAE;IACnF,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,+CAA+C,EAAE;CACxF,CAAC;AAEF,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAM,cAAc,GAAW,0BAA0B,CAAC;AAC1D,MAAM,eAAe,GAAW,mCAAmC,CAAC;AACpE,MAAM,cAAc,GAAW,4CAA4C,CAAC;AAC5E,MAAM,kBAAkB,GAAW,iDAAiD,CAAC;AACrF,MAAM,kBAAkB,GAAW,iCAAiC,CAAC;AACrE,MAAM,kBAAkB,GAAW,iDAAiD,CAAC;AAErF,sEAAsE;AACtE,oEAAoE;AACpE,SAAS,uBAAuB,CAAC,IAAY;IACzC,2EAA2E;IAC3E,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,MAAM,CAAC,wCAAwC,OAAO,eAAe,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC5B,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB;IACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;IACvC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IACzD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM;IAChD,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY;CAC1C,CAAC;AAEF,+EAA+E;AAE/E,SAAgB,eAAe,CAAC,MAAc,EAAE,cAAsB;IAClE,oDAAoD;IACpD,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IACrH,CAAC;IAED,4CAA4C;IAC5C,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,wBAAwB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,2BAA2B,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;IACnG,CAAC;IAED,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,qDAAqD,EAAE,CAAC;QACvH,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,cAAc,GAAG,CAAC,GAAW,EAA2B,EAAE;QAC5D,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,mEAAmE,EAAE,CAAC;QACzH,CAAC;QACD,yDAAyD;QACzD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,GAAG,uCAAuC,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5I,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;QACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,sEAAsE;QACtE,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAyC;QACzD,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE;QAC3C,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;KAC3C,CAAC;IAEF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QAClC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAChC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IAC/G,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC"}

package/dist/utils/verificationSandbox.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Verification sandbox — the real security boundary for LLM-generated tests.
+ *
+ * Phase 2 of the agent scan pipeline takes an LLM-generated test script and
+ * executes it on the user's machine. The previous implementation ran the
+ * script via `execFileSync` with the full `process.env` spread and only a
+ * decorative blocklist (`checkTestSafety`) in front. Prompt-injected code
+ * in the scanned source could ride into the verify-generate prompt and
+ * produce a test script that exfiltrated secrets, hit the network, or
+ * spawned processes — `checkTestSafety` missed `fetch`, `http`, `https`,
+ * `fs`, `dns`, `eval`, `new Function`, dynamic imports, and `process.env`
+ * access.
+ *
+ * This module replaces that with a real isolation boundary. Pluggable
+ * backends provide kernel-enforced isolation:
+ *
+ *   - DockerSandbox: `docker run --network=none --cpus=1
+ *     --memory=256m --pids-limit=64 --user 1000:1000 -v <workspace>:/workspace:ro`
+ *     — network disabled at the kernel level, workspace read-only, temp
+ *     dir as tmpfs, no host env, non-root user. Works for any Node/Python
+ *     test script unchanged.
+ *   - DenoSandbox: `deno run --allow-read=<workspace> --allow-write=<tmp>
+ *     --allow-env=NODE_ENV --no-prompt --no-remote` — real permission
+ *     model, no network, no arbitrary fs, no arbitrary env. Only works
+ *     for test scripts that don't use `require()` (Deno is ESM-only by
+ *     default); the verify-generate prompt must be told to emit
+ *     Deno-compatible code when Deno is the backend.
+ *
+ * If neither backend is available, `detectSandbox()` returns null and the
+ * caller MUST return INCONCLUSIVE. Never fall back to unrestricted
+ * `execFileSync` — that is the bug this module exists to fix.
+ *
+ * `checkTestSafety()` remains as defense-in-depth (it can reject scripts
+ * before we pay for a container start), but it is NOT the security
+ * boundary. The sandbox is.
+ */
+export interface SandboxExecuteOptions {
+    /** Execution mode: 'script' (default) runs a script via runner; 'command' runs a validated executable+args. */
+    mode?: 'script' | 'command';
+    /** Test script source code (required for mode='script'). */
+    script?: string;
+    /** Runner: 'node' | 'tsx' | 'bun' | 'python' | 'python3' | 'deno' | ... (required for mode='script'). */
+    runner?: string;
+    /** Validated executable (required for mode='command'). Passed as argv[0] — never via shell. */
+    executable?: string;
+    /** Validated args array (required for mode='command'). Each arg passed as a separate argv element. */
+    args?: string[];
+    /** Workspace root — mounted read-only into the sandbox. */
+    workspaceRoot: string;
+    /** Optional setup script run before the test (same sandbox). */
+    setupScript?: string | null;
+    /** Hard wall-clock timeout in ms. The sandbox kills the process at this boundary. */
+    timeoutMs: number;
+    /** AbortSignal — if aborted, the sandbox must kill the process and return. */
+    signal?: AbortSignal;
+}
+export interface SandboxExecuteResult {
+    verdict: 'pass' | 'fail' | 'error' | 'timeout' | 'blocked' | 'sandbox-unavailable' | 'cancelled';
+    output: string;
+    exitCode: number;
+    /** Identifier of the backend that ran the test (for logging). */
+    backend: string;
+}
+export interface SandboxBackend {
+    readonly name: string;
+    readonly available: boolean;
+    execute(opts: SandboxExecuteOptions): Promise<SandboxExecuteResult>;
+}
+/**
+ * Command-mode verdict: no PASS:/FAIL: markers. Exit code 0 = pass, nonzero = fail.
+ * This is the standard semantics for `npm test`, `pytest`, etc.
+ */
+export declare function parseVerdictCommandMode(exitCode: number, timedOut: boolean): SandboxExecuteResult['verdict'];
+/**
+ * Pick the Docker image for a command-mode executable. Returns null if no
+ * suitable image is configured — the caller returns sandbox-unavailable.
+ */
+export declare function pickImageForCommand(executable: string): {
+    image: string | null;
+    reason?: string;
+};
+/**
+ * Pick the Docker image for a script-mode runner. Returns null if no suitable
+ * image is configured — the caller returns sandbox-unavailable so the user
+ * gets a clear "install X / set ENV to enable" message rather than a crash.
+ */
+export declare function pickImageForRunner(runner: string): {
+    image: string | null;
+    reason?: string;
+};
+/**
+ * Build the in-container command string for a runner + script path.
+ * The path is generated by us (unique suffix), so shell quoting is not
+ * required for safety; we still quote defensively in case the workspace
+ * path contains spaces.
+ */
+export declare function runnerInvocation(runner: string, scriptPath: string): string;
+/**
+ * Detect the best available sandbox backend. Docker is preferred (runs any
+ * Node/Python test unchanged); Deno is a fallback for TS/JS tests only.
+ * Returns null if neither is available — the caller MUST return INCONCLUSIVE.
+ */
+export declare function detectSandbox(): SandboxBackend | null;
+/** Reset the cached backend selection. Used by tests. */
+export declare function _resetSandboxCacheForTests(): void;
+/** Force a specific backend (for tests). Pass null to simulate "no sandbox". */
+export declare function _setSandboxForTests(backend: SandboxBackend | null): void;
+export declare class __UnsafeHostSandboxForTests implements SandboxBackend {
+    readonly name = "unsafe-host-tests-only";
+    constructor();
+    get available(): boolean;
+    execute(opts: SandboxExecuteOptions): Promise<SandboxExecuteResult>;
+}