@shomra/agent 0.2.11 → 0.2.12

package/code-sast.mjs

@@ -424,6 +424,14 @@ const JS_RULES = [
     category: 'obfuscation',
     confidence: 0.6,
     re: /(?<![.\w])require\s*\(\s*[^'"\s)]|(?<![.\w])import\s*\(\s*[^'"\s)]/,
+    // …but a path BUILT from literals and __dirname is a literal spelled across
+    // path.join — it conceals nothing. `require(path.join(__dirname,'..','generated','prisma'))`
+    // (a Prisma client import) was the shape that made this rule noisy. The CLI has
+    // no AST tier, so without this veto that FP lands at HIGH — a blocking severity.
+    suppress: (m, unitText, ctx) => {
+      const arg = callArgText(unitText, m.index);
+      return isNotAModuleLoad(m, unitText, arg) || isStaticPathExpr(arg, ctx.pathNs, ctx.constPaths);
+    },
     sink: (m) => m[0].trim(),
     message: 'Loads a module chosen at runtime rather than a string literal, often to conceal which dangerous module is imported.',
     remediation: 'Import modules by string literal so the dependency is statically reviewable; remove runtime-computed requires.',
@@ -632,6 +640,141 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * The argument text of the call whose `(` follows `from`, read with balanced
+ * brackets and string-aware so a `)` inside a literal doesn't end it early.
+ * Empty string when the call is unterminated inside the logical line.
+ */
+function callArgText(text, from) {
+  const open = text.indexOf('(', from);
+  if (open < 0) return '';
+  let depth = 0;
+  let quote = '';
+  for (let i = open; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === '\\') i++;
+      else if (ch === quote) quote = '';
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if (ch === '(') depth++;
+    else if (ch === ')') {
+      depth--;
+      if (depth === 0) return text.slice(open + 1, i);
+    }
+  }
+  return '';
+}
+
+/**
+ * True when the `require(`/`import(` the regex matched is not Node's module
+ * loader at all. Two shapes, both found in first-party code at HIGH severity:
+ *
+ *  • A DECLARATION of something named `require` — `private async require(orgId, id)`
+ *    is a repository helper, not a module load. The Python rules already carry the
+ *    equivalent `(?<!def )` guard; the JS rule never got one.
+ *  • A call with more than one top-level argument. `require()` takes exactly one.
+ *    (NOT applied to `import()`, which legitimately takes import attributes as a
+ *    second argument.)
+ */
+const DECL_PREFIX_RE = /\b(?:function|async|get|set|static|private|public|protected|readonly)\s*\*?\s*$/;
+function isNotAModuleLoad(m, unitText, argText) {
+  if (DECL_PREFIX_RE.test(unitText.slice(Math.max(0, m.index - 24), m.index))) return true;
+  if (/^\s*import\b/.test(m[0])) return false; // import attributes are a real 2nd arg
+  let depth = 0;
+  let quote = '';
+  for (let i = 0; i < argText.length; i++) {
+    const ch = argText[i];
+    if (quote) {
+      if (ch === '\\') i++;
+      else if (ch === quote) quote = '';
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if ('([{'.includes(ch)) depth++;
+    else if (')]}'.includes(ch)) depth--;
+    else if (ch === ',' && depth === 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Local names bound to the `path` module in this file. The builder call is
+ * `path.join` only by convention — `const p = require('node:path')` is just as
+ * common, and keying the constant-folder off the literal name "path" missed it.
+ */
+const PATH_BIND_RE =
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]\s*\)|import\s+(?:\*\s+as\s+)?([A-Za-z_$][\w$]*)\s+from\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]/g;
+
+function pathBindings(text) {
+  const ns = new Set(['path']);
+  PATH_BIND_RE.lastIndex = 0;
+  for (let m = PATH_BIND_RE.exec(text); m; m = PATH_BIND_RE.exec(text)) ns.add(m[1] || m[2]);
+  return ns;
+}
+
+/**
+ * Identifiers whose declaration folds to a constant path. Requires the RHS to
+ * mention a path-shaped token — a bare `const m = 'child_process'` must stay
+ * unfolded so `require(m)` still reads as a hidden dangerous import. Two rounds,
+ * so `const ROOT = …; const SRC = `${ROOT}/src`` both land.
+ */
+const CONST_DECL_RE = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^\n;]+)/g;
+const PATHISH_RE = /__dirname|__filename|import\.meta\.url|process\.cwd|os\.(?:homedir|tmpdir)|fileURLToPath|new\s+URL|\.(?:join|resolve|normalize)\s*\(/;
+
+function constPathBindings(text, pathNs) {
+  const found = new Set();
+  for (let round = 0; round < 2; round++) {
+    CONST_DECL_RE.lastIndex = 0;
+    for (let m = CONST_DECL_RE.exec(text); m; m = CONST_DECL_RE.exec(text)) {
+      const [, name, rhsRaw] = m;
+      if (found.has(name)) continue;
+      const rhs = rhsRaw.replace(/[,;]\s*$/, '').trim();
+      // Must be path-shaped, OR built on a constant this pass already proved —
+      // `const SRC = `${ROOT}src/`` inherits ROOT's provenance. Anything else
+      // (a plain string constant) stays unfolded on purpose.
+      const buildsOnKnown = [...found].some((n) => new RegExp(`\\b${escapeRe(n)}\\b`).test(rhs));
+      if (!PATHISH_RE.test(rhs) && !buildsOnKnown) continue;
+      if (isStaticPathExpr(rhs, pathNs, found)) found.add(name);
+    }
+  }
+  return found;
+}
+
+/** Pure path builders: constant arguments in ⇒ one constant path out. */
+const PATH_FNS = 'join|resolve|normalize|relative|dirname|basename|extname';
+
+/**
+ * True when `argText` provably evaluates to one fixed path: nothing survives
+ * after removing string literals and the build-time tokens (pure `path.*`
+ * builders, `__dirname`, `import.meta.url`, …). Conservative — any identifier it
+ * does not recognise (a parameter, a config value, a model result) leaves a
+ * residue and the hit stands. Mirrors `isStaticPathExpr` in the backend's
+ * code-sast.ts, and the structural `isStaticModulePath` in code-ast.ts.
+ */
+export function isStaticPathExpr(argText, pathNs = new Set(['path']), constPaths = new Set()) {
+  if (!argText.trim()) return false;
+  const ns = [...pathNs].map(escapeRe).join('|');
+  const consts = constPaths.size ? `|${[...constPaths].map(escapeRe).join('|')}` : '';
+  const staticTokens = new RegExp(
+    `\\b(?:(?:${ns})(?:\\.(?:posix|win32))?\\.(?:${PATH_FNS})|__dirname|__filename|import\\.meta\\.url|process\\.cwd|os\\.(?:homedir|tmpdir)|fileURLToPath|require\\.resolve|new\\s+URL|String\\.raw${consts})\\b`,
+    'g',
+  );
+  // A member read off whatever remains — `new URL(…).href`, `.toString()`. Applied
+  // as a token strip, so `cfg.modulePath` still leaves `cfg` behind and reports.
+  const pureMembers = /\.(?:href|pathname|toString|toLowerCase|toUpperCase|trim|normalize|valueOf)\b/g;
+  // A template literal reduces to its ${…} expressions — those must be constant
+  // too; its fixed text is just a literal. Plain literals collapse away entirely.
+  let t = argText
+    .replace(/`(?:[^`\\]|\\.)*`/g, (lit) => ` ${[...lit.matchAll(/\$\{([^{}]*)\}/g)].map((x) => x[1]).join(' , ')} `)
+    .replace(/'(?:[^'\\]|\\.)*'/g, ' ')
+    .replace(/"(?:[^"\\]|\\.)*"/g, ' ');
+  t = t.replace(pureMembers, ' ').replace(staticTokens, ' ');
+  // Structure-only residue (separators, concatenation, empty call parens) is fine.
+  return !/[A-Za-z0-9_$]/.test(t.replace(/[\s(),.+[\]/\\:-]/g, ''));
+}
+
 /**
  * Whether byte `offset` in `text` falls inside a string literal — tracks single/
  * double/backtick + triple quotes, honouring escapes. Drops `codeOnly` rule
@@ -802,6 +945,9 @@ function scanLines(text, file, rules, taintCfg) {
   const units = logicalLines(lines);
   const out = [];
   const seen = new Set(); // dedupe by ruleId@line
+  // Whole-file facts a `suppress` predicate may consult; computed once per scan.
+  const pathNs = pathBindings(text);
+  const ctx = { pathNs, constPaths: constPathBindings(text, pathNs) };
   for (const unit of units) {
     for (const rule of rules) {
       rule.re.lastIndex = 0;
@@ -810,6 +956,10 @@ function scanLines(text, file, rules, taintCfg) {
       // Drop code-construct rules whose match lands inside a string literal
       // (docstring / log message / usage example) — the Falcon-class FP.
       if (rule.codeOnly && isInsideString(unit.text, m.index)) continue;
+      // Last-word veto on a match the regex accepted: the signal is real code but
+      // the ARGUMENT proves it benign — needs balanced-bracket reading a regex
+      // cannot express. Returning true drops the hit.
+      if (rule.suppress && rule.suppress(m, unit.text, ctx)) continue;
       const idx = physicalIdx(unit, m.index);
       const trimmed = (lines[idx] ?? '').trim();
       if (!trimmed || isCommentLine(trimmed)) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {