@shomra/agent 0.2.10 → 0.2.12

package/code-sast.mjs

@@ -424,6 +424,14 @@ const JS_RULES = [
     category: 'obfuscation',
     confidence: 0.6,
     re: /(?<![.\w])require\s*\(\s*[^'"\s)]|(?<![.\w])import\s*\(\s*[^'"\s)]/,
+    // …but a path BUILT from literals and __dirname is a literal spelled across
+    // path.join — it conceals nothing. `require(path.join(__dirname,'..','generated','prisma'))`
+    // (a Prisma client import) was the shape that made this rule noisy. The CLI has
+    // no AST tier, so without this veto that FP lands at HIGH — a blocking severity.
+    suppress: (m, unitText, ctx) => {
+      const arg = callArgText(unitText, m.index);
+      return isNotAModuleLoad(m, unitText, arg) || isStaticPathExpr(arg, ctx.pathNs, ctx.constPaths);
+    },
     sink: (m) => m[0].trim(),
     message: 'Loads a module chosen at runtime rather than a string literal, often to conceal which dangerous module is imported.',
     remediation: 'Import modules by string literal so the dependency is statically reviewable; remove runtime-computed requires.',
@@ -632,6 +640,141 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * The argument text of the call whose `(` follows `from`, read with balanced
+ * brackets and string-aware so a `)` inside a literal doesn't end it early.
+ * Empty string when the call is unterminated inside the logical line.
+ */
+function callArgText(text, from) {
+  const open = text.indexOf('(', from);
+  if (open < 0) return '';
+  let depth = 0;
+  let quote = '';
+  for (let i = open; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === '\\') i++;
+      else if (ch === quote) quote = '';
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if (ch === '(') depth++;
+    else if (ch === ')') {
+      depth--;
+      if (depth === 0) return text.slice(open + 1, i);
+    }
+  }
+  return '';
+}
+
+/**
+ * True when the `require(`/`import(` the regex matched is not Node's module
+ * loader at all. Two shapes, both found in first-party code at HIGH severity:
+ *
+ *  • A DECLARATION of something named `require` — `private async require(orgId, id)`
+ *    is a repository helper, not a module load. The Python rules already carry the
+ *    equivalent `(?<!def )` guard; the JS rule never got one.
+ *  • A call with more than one top-level argument. `require()` takes exactly one.
+ *    (NOT applied to `import()`, which legitimately takes import attributes as a
+ *    second argument.)
+ */
+const DECL_PREFIX_RE = /\b(?:function|async|get|set|static|private|public|protected|readonly)\s*\*?\s*$/;
+function isNotAModuleLoad(m, unitText, argText) {
+  if (DECL_PREFIX_RE.test(unitText.slice(Math.max(0, m.index - 24), m.index))) return true;
+  if (/^\s*import\b/.test(m[0])) return false; // import attributes are a real 2nd arg
+  let depth = 0;
+  let quote = '';
+  for (let i = 0; i < argText.length; i++) {
+    const ch = argText[i];
+    if (quote) {
+      if (ch === '\\') i++;
+      else if (ch === quote) quote = '';
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if ('([{'.includes(ch)) depth++;
+    else if (')]}'.includes(ch)) depth--;
+    else if (ch === ',' && depth === 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Local names bound to the `path` module in this file. The builder call is
+ * `path.join` only by convention — `const p = require('node:path')` is just as
+ * common, and keying the constant-folder off the literal name "path" missed it.
+ */
+const PATH_BIND_RE =
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]\s*\)|import\s+(?:\*\s+as\s+)?([A-Za-z_$][\w$]*)\s+from\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]/g;
+
+function pathBindings(text) {
+  const ns = new Set(['path']);
+  PATH_BIND_RE.lastIndex = 0;
+  for (let m = PATH_BIND_RE.exec(text); m; m = PATH_BIND_RE.exec(text)) ns.add(m[1] || m[2]);
+  return ns;
+}
+
+/**
+ * Identifiers whose declaration folds to a constant path. Requires the RHS to
+ * mention a path-shaped token — a bare `const m = 'child_process'` must stay
+ * unfolded so `require(m)` still reads as a hidden dangerous import. Two rounds,
+ * so `const ROOT = …; const SRC = `${ROOT}/src`` both land.
+ */
+const CONST_DECL_RE = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^\n;]+)/g;
+const PATHISH_RE = /__dirname|__filename|import\.meta\.url|process\.cwd|os\.(?:homedir|tmpdir)|fileURLToPath|new\s+URL|\.(?:join|resolve|normalize)\s*\(/;
+
+function constPathBindings(text, pathNs) {
+  const found = new Set();
+  for (let round = 0; round < 2; round++) {
+    CONST_DECL_RE.lastIndex = 0;
+    for (let m = CONST_DECL_RE.exec(text); m; m = CONST_DECL_RE.exec(text)) {
+      const [, name, rhsRaw] = m;
+      if (found.has(name)) continue;
+      const rhs = rhsRaw.replace(/[,;]\s*$/, '').trim();
+      // Must be path-shaped, OR built on a constant this pass already proved —
+      // `const SRC = `${ROOT}src/`` inherits ROOT's provenance. Anything else
+      // (a plain string constant) stays unfolded on purpose.
+      const buildsOnKnown = [...found].some((n) => new RegExp(`\\b${escapeRe(n)}\\b`).test(rhs));
+      if (!PATHISH_RE.test(rhs) && !buildsOnKnown) continue;
+      if (isStaticPathExpr(rhs, pathNs, found)) found.add(name);
+    }
+  }
+  return found;
+}
+
+/** Pure path builders: constant arguments in ⇒ one constant path out. */
+const PATH_FNS = 'join|resolve|normalize|relative|dirname|basename|extname';
+
+/**
+ * True when `argText` provably evaluates to one fixed path: nothing survives
+ * after removing string literals and the build-time tokens (pure `path.*`
+ * builders, `__dirname`, `import.meta.url`, …). Conservative — any identifier it
+ * does not recognise (a parameter, a config value, a model result) leaves a
+ * residue and the hit stands. Mirrors `isStaticPathExpr` in the backend's
+ * code-sast.ts, and the structural `isStaticModulePath` in code-ast.ts.
+ */
+export function isStaticPathExpr(argText, pathNs = new Set(['path']), constPaths = new Set()) {
+  if (!argText.trim()) return false;
+  const ns = [...pathNs].map(escapeRe).join('|');
+  const consts = constPaths.size ? `|${[...constPaths].map(escapeRe).join('|')}` : '';
+  const staticTokens = new RegExp(
+    `\\b(?:(?:${ns})(?:\\.(?:posix|win32))?\\.(?:${PATH_FNS})|__dirname|__filename|import\\.meta\\.url|process\\.cwd|os\\.(?:homedir|tmpdir)|fileURLToPath|require\\.resolve|new\\s+URL|String\\.raw${consts})\\b`,
+    'g',
+  );
+  // A member read off whatever remains — `new URL(…).href`, `.toString()`. Applied
+  // as a token strip, so `cfg.modulePath` still leaves `cfg` behind and reports.
+  const pureMembers = /\.(?:href|pathname|toString|toLowerCase|toUpperCase|trim|normalize|valueOf)\b/g;
+  // A template literal reduces to its ${…} expressions — those must be constant
+  // too; its fixed text is just a literal. Plain literals collapse away entirely.
+  let t = argText
+    .replace(/`(?:[^`\\]|\\.)*`/g, (lit) => ` ${[...lit.matchAll(/\$\{([^{}]*)\}/g)].map((x) => x[1]).join(' , ')} `)
+    .replace(/'(?:[^'\\]|\\.)*'/g, ' ')
+    .replace(/"(?:[^"\\]|\\.)*"/g, ' ');
+  t = t.replace(pureMembers, ' ').replace(staticTokens, ' ');
+  // Structure-only residue (separators, concatenation, empty call parens) is fine.
+  return !/[A-Za-z0-9_$]/.test(t.replace(/[\s(),.+[\]/\\:-]/g, ''));
+}
+
 /**
  * Whether byte `offset` in `text` falls inside a string literal — tracks single/
  * double/backtick + triple quotes, honouring escapes. Drops `codeOnly` rule
@@ -802,6 +945,9 @@ function scanLines(text, file, rules, taintCfg) {
   const units = logicalLines(lines);
   const out = [];
   const seen = new Set(); // dedupe by ruleId@line
+  // Whole-file facts a `suppress` predicate may consult; computed once per scan.
+  const pathNs = pathBindings(text);
+  const ctx = { pathNs, constPaths: constPathBindings(text, pathNs) };
   for (const unit of units) {
     for (const rule of rules) {
       rule.re.lastIndex = 0;
@@ -810,6 +956,10 @@ function scanLines(text, file, rules, taintCfg) {
       // Drop code-construct rules whose match lands inside a string literal
       // (docstring / log message / usage example) — the Falcon-class FP.
       if (rule.codeOnly && isInsideString(unit.text, m.index)) continue;
+      // Last-word veto on a match the regex accepted: the signal is real code but
+      // the ARGUMENT proves it benign — needs balanced-bracket reading a regex
+      // cannot express. Returning true drops the hit.
+      if (rule.suppress && rule.suppress(m, unit.text, ctx)) continue;
       const idx = physicalIdx(unit, m.index);
       const trimmed = (lines[idx] ?? '').trim();
       if (!trimmed || isCommentLine(trimmed)) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/shomra.mjs

@@ -1656,6 +1656,108 @@ function printWhy(res) {
   console.log('');
 }
 
+// ── shomra provenance: which of these changed files did an AI agent write? ──
+//
+//   shomra provenance [--staged | --base main] [--trailer] [--fail-on-blocked] [--json]
+//
+// Every mutating tool call the runtime firewall screened was recorded with its
+// target path and ALLOW/FLAG/BLOCK decision. This joins a real git diff against
+// that record, so a commit can carry an EVIDENCE-BACKED statement of authorship
+// instead of a "Co-Authored-By" line anyone can type.
+//
+// ⚠ "Unattributed" means the firewall has no record — NOT that a human wrote it.
+// With the hook uninstalled every file is unattributed, so the output always
+// states its coverage and never claims human authorship. Don't rewrite that copy.
+
+/** All changed paths (not just AI artifacts) for provenance. */
+function gitChangedPaths(root, { staged, base }) {
+  const run = (args) => {
+    try {
+      return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString();
+    } catch {
+      return null;
+    }
+  };
+  let out = null;
+  if (staged) {
+    out = run('diff --cached --name-only --relative --diff-filter=ACM');
+  } else if (base) {
+    for (const b of [`origin/${base}`, base]) {
+      out = run(`diff --name-only --relative --diff-filter=ACM ${b}...HEAD`);
+      if (out !== null) break;
+    }
+  }
+  if (out === null) out = run('diff HEAD~1 --name-only --relative --diff-filter=ACM');
+  if (out === null) return null;
+  return out.split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+async function cmdProvenance(flags, positional) {
+  const root = path.resolve(flags.path || positional[0] || '.');
+  const staged = !!flags.staged;
+  const base = flags.base || (staged ? null : process.env.GITHUB_BASE_REF || 'main');
+
+  const paths = gitChangedPaths(root, { staged, base });
+  if (paths === null) {
+    console.error(red('✗') + ' Not a git repository (or no diff available). Run inside a repo, or pass --base <ref>.');
+    process.exit(1);
+  }
+  if (!paths.length) {
+    if (flags.json) console.log(JSON.stringify({ files: [], agentAuthored: 0, coverage: 'NO_TELEMETRY', summary: 'no changed files' }, null, 2));
+    else console.log(green('\n  ✓ No changed files to attribute.\n'));
+    return;
+  }
+
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
+  let res;
+  try {
+    res = await api(url, apiKey, '/gate/provenance', {
+      paths,
+      repo: flags.repo || process.env.GITHUB_REPOSITORY || undefined,
+      sessionId: flags.session || undefined,
+      sinceHours: flags.since ? Number(flags.since) : undefined,
+    });
+  } catch (e) {
+    // Provenance is an evidence lookup, not a guard — a backend outage must not
+    // block a commit. Say so plainly instead of silently reporting "no agents".
+    console.error(yellow('!') + ` Provenance unavailable (${e.message}). Authorship not established.`);
+    process.exit(flags['fail-on-blocked'] ? 1 : 0);
+  }
+
+  if (flags.json) {
+    console.log(JSON.stringify(res, null, 2));
+  } else if (flags.trailer) {
+    for (const t of res.trailers || []) console.log(t);
+  } else {
+    const noTel = res.coverage === 'NO_TELEMETRY';
+    console.log('');
+    console.log(`  ${bold('Commit provenance')} ${dim(`· ${res.files.length} changed file(s)`)}`);
+    console.log(`  ${noTel ? yellow('⚠ ' + res.summary) : res.summary}`);
+    if (noTel) {
+      console.log(dim('    No firewall telemetry for this range — this is NOT a claim that a human wrote them.'));
+      console.log(dim('    Install the runtime hook with ') + bold('shomra protect') + dim(' to attribute future work.'));
+    }
+    console.log('');
+    for (const f of res.files.slice(0, 40)) {
+      const tag =
+        f.authorship === 'AGENT' ? cyan('agent') : f.authorship === 'BLOCKED_ATTEMPT' ? red('blocked') : dim('unattributed');
+      const who = f.agents?.length ? dim(` ${f.agents.join(', ')}`) : '';
+      const amb = f.ambiguous ? yellow(' ~ambiguous') : '';
+      console.log(`    ${tag.padEnd(22)} ${f.path}${who}${amb}`);
+    }
+    if (res.files.length > 40) console.log(dim(`    …and ${res.files.length - 40} more`));
+    console.log('');
+  }
+
+  // A path the firewall BLOCKED that changed anyway is the signal worth failing
+  // on: either the guard was bypassed, or something wrote it outside the agent.
+  if (flags['fail-on-blocked'] && res.blockedAttempts > 0) {
+    console.error(red('✗') + ` ${res.blockedAttempts} file(s) the firewall blocked were modified anyway.`);
+    process.exit(1);
+  }
+}
+
 // ── shomra install-precommit: gate staged AI artifacts at commit time ──
 //
 //   shomra install-precommit [dir] [--force]
@@ -3951,6 +4053,7 @@ ${bold('COMMANDS')}
   ${cyan('init')}          Configure + enroll this machine       ${dim('--key shm_live_… [--url <backend>]')}
   ${cyan('protect')}       Wire the runtime firewall for every coding agent ${dim('[--local] [--force]')}
   ${cyan('install-hook')}  Wire the runtime firewall into ONE agent ${dim('[--agent claude|cursor|windsurf|gemini|codex|copilot|cline|aider|all] [--global]')}
+  ${cyan('provenance')}    Which changed files an AI agent wrote   ${dim('[--staged | --base main] [--trailer] [--fail-on-blocked] [--json]')}
   ${cyan('install-precommit')} Gate staged AI artifacts on git commit ${dim('[dir] [--force]')}
   ${cyan('doctor')}        ${bold('Am I safe?')} Posture of this machine's AI setup ${dim('[--json]')}
 
@@ -4163,6 +4266,7 @@ const COMMANDS = {
   baseline: (f, p) => cmdBaseline(f, p),
   fix: (f, p) => cmdFix(f, p),
   why: (f, p) => cmdWhy(f, p),
+  provenance: (f, p) => cmdProvenance(f, p),
   'install-precommit': (f, p) => cmdInstallPrecommit(f, p),
   'scan-zip': (f, p) => cmdScanZip(f, p),
   'model-scan': (f, p) => cmdModelScan(f, p),