@shomra/agent 0.2.5 → 0.2.7

package/guard-signals.mjs

@@ -117,9 +117,12 @@ export const INVISIBLE_CHARS_RE = /[؜ᅟᅠ᠎​‌‎‏‪-‮⁠-⁤⁦-⁩
 
 // ── secrets ──
 export const SECRET_PATTERNS = [
-  { name: 'Stripe live key', re: /sk_live_[0-9a-zA-Z]{16,}/ },
-  { name: 'OpenAI key', re: /sk-[A-Za-z0-9]{20,}/ },
-  { name: 'AWS access key id', re: /AKIA[0-9A-Z]{16}/ },
+  // Prefix-style keys are \b-anchored (backend parity, checks/patterns.ts): a
+  // slug that merely CONTAINS the prefix ("task-0123456789abcdefghij",
+  // "disk-…") must not read as a live credential — these are CRITICAL and BLOCK.
+  { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },
+  { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
+  { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
   { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
   { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
   { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
@@ -175,6 +178,65 @@ export function containsAny(haystack, needles) {
   return null;
 }
 
+// Like containsAny, but the needle must START at a word boundary — 'aws' must
+// not fire inside "flaws", 'cat ' inside "concat ", 'token' is fine ("tokens"
+// still hits: only the START is guarded, because these lists match prose where
+// words inflect at the end). Mirrors the backend's containsWord.
+const WORD_RE_CACHE = new Map();
+function leadingBoundaryRe(needle) {
+  let re = WORD_RE_CACHE.get(needle);
+  if (!re) {
+    const esc = needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    re = new RegExp(/^\w/.test(needle) ? `(?<!\\w)${esc}` : esc, 'i');
+    WORD_RE_CACHE.set(needle, re);
+  }
+  return re;
+}
+export function containsWord(haystack, needles) {
+  const h = String(haystack ?? '');
+  for (const n of needles) if (leadingBoundaryRe(n).test(h)) return n;
+  return null;
+}
+
+// ── risky-config: mention vs configuration ──
+// `\w`-only boundaries, NOT `[\w-]`: markers legitimately butt against dashes
+// (--dangerously-skip-permissions), so excluding '-' would suppress the flag
+// form; excluding `\w` is what stops 'dangerously' firing on
+// dangerouslySetInnerHTML. Mirrors the backend (checks/text-inspector.ts).
+const MARKER_RE_CACHE = new Map();
+function markerRe(marker) {
+  let re = MARKER_RE_CACHE.get(marker);
+  if (!re) {
+    re = new RegExp(`(?<!\\w)${marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?!\\w)`, 'gi');
+    MARKER_RE_CACHE.set(marker, re);
+  }
+  re.lastIndex = 0; // shared instance: an early return leaves lastIndex dirty
+  return re;
+}
+const FLAG_BEFORE = /(?:^|\s)--?[\w-]*$/; // --yolo, --dangerously-skip-permissions
+const ENABLE_AFTER = /^["'`\]]?\s*[:=]/; // "yolo": true, AUTO_APPROVE=1
+const ENABLE_BEFORE = /[:=]\s*["'`\[]?\s*$/; // "mode": "unrestricted" — one delimiter; two (`= ['`) is a definition LIST
+function isEnablement(text, at, len) {
+  const before = text.slice(Math.max(0, at - 24), at);
+  const after = text.slice(at + len, at + len + 12);
+  return FLAG_BEFORE.test(before) || ENABLE_AFTER.test(after) || ENABLE_BEFORE.test(before);
+}
+/**
+ * First occurrence of a risky-config marker that reads as a setting being
+ * ENABLED (word-bounded + enablement-shaped), or null. Unlike the backend twin
+ * this does NOT suppress on the mask: the CLI mask is binary (string ≡ comment),
+ * and JSON config keys ARE string literals — the hooks' codeContext downrank
+ * handles the literal/comment case instead.
+ */
+function riskyConfigHit(text, marker) {
+  const re = markerRe(marker);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (isEnablement(text, m.index, m[0].length)) return { start: m.index, end: m.index + m[0].length };
+  }
+  return null;
+}
+
 // Attacker-controlled data sinks — a tool call/result referencing one is an
 // exfiltration endpoint.
 export const SUSPICIOUS_EGRESS_HOSTS = [
@@ -206,11 +268,26 @@ function deobfuscate(text) {
   return { text: decoded.length ? `${text}\n${decoded.join('\n')}` : text, decodedPayload: decoded.length > 0 };
 }
 
-/** Reference to a known exfiltration sink host, or null. */
+/**
+ * Reference to a known exfiltration sink host, or null. Host-boundary matched,
+ * NOT a raw substring — `includes('ix.io')` fired inside "matrix.io" and
+ * `includes('file.io')` inside "profile.io", and this feeds a HIGH/FLAG on live
+ * tool calls. The char before must not be a host label char (a leading '.' IS
+ * allowed so "paste.c-net.org" still hits); the char after must end the host.
+ */
+const EGRESS_RE_CACHE = new Map();
+function egressHostRe(host) {
+  let re = EGRESS_RE_CACHE.get(host);
+  if (!re) {
+    re = new RegExp(`(^|[^a-z0-9-])${host.replace(/[.]/g, '\\.')}($|[^a-z0-9.-])`, 'i');
+    EGRESS_RE_CACHE.set(host, re);
+  }
+  return re;
+}
 export function egressHost(text) {
   if (!text) return null;
   const low = text.toLowerCase();
-  return SUSPICIOUS_EGRESS_HOSTS.find((h) => low.includes(h)) ?? null;
+  return SUSPICIOUS_EGRESS_HOSTS.find((h) => egressHostRe(h).test(low)) ?? null;
 }
 
 /** 1-based line number of a character offset inside `text`. */
@@ -267,13 +344,8 @@ function codeMask(text) {
   while (i < n) {
     const c = text[i], c2 = text[i + 1];
     if (state === 0) {
-      if (c === "'") { state = 1; mask[i++] = 1; continue; }
-      if (c === '"') { state = 2; mask[i++] = 1; continue; }
-      if (c === '`') { state = 3; mask[i++] = 1; continue; }
-      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
-      if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
-      if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
-      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
+      // The fence test MUST precede the backtick-string test, or ``` is consumed
+      // as a template-literal opener and the fence handler below never runs.
       if (text.startsWith('```', i) || text.startsWith('~~~', i)) { // fenced block → mask the whole span, delimiters included
         const fence = text.slice(i, i + 3);
         const nl = text.indexOf('\n', i);
@@ -286,6 +358,13 @@ function codeMask(text) {
         for (let k = i; k < end; k++) mask[k] = 1;
         prevSig = ''; i = end; continue;
       }
+      if (c === "'") { state = 1; mask[i++] = 1; continue; }
+      if (c === '"') { state = 2; mask[i++] = 1; continue; }
+      if (c === '`') { state = 3; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
+      if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
+      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
       if (c === '/' && REGEX_START.has(prevSig)) { state = 7; inClass = false; mask[i++] = 1; continue; }
       if (!/\s/.test(c)) prevSig = c;
       i++;
@@ -400,8 +479,18 @@ export function localScan(text, opts = {}) {
     }
   }
   if (cats.includes('config')) {
-    const low = t.toLowerCase();
-    for (const m of RISKY_CONFIG_MARKERS) if (low.includes(m)) { findings.push({ label: `Risky setting: "${m}"`, severity: 'MEDIUM', category: 'config', ...locate(t, m, mask) }); break; }
+    // A marker counts only where a setting is being TURNED ON — `"yolo": true`,
+    // AUTO_APPROVE=1, --dangerously-skip-permissions — not merely named:
+    // 'dangerously' inside dangerouslySetInnerHTML, a marker-definition array
+    // (this very file), "yolo mode" in prose. Word-bounded + enablement-gated,
+    // skipping comment/fence mentions; mirrors the backend's riskyConfigHit.
+    for (const m of RISKY_CONFIG_MARKERS) {
+      const hit = riskyConfigHit(t, m);
+      if (hit) {
+        findings.push({ label: `Risky setting: "${m}"`, severity: 'MEDIUM', category: 'config', line: lineAt(t, hit.start), codeContext: mask[hit.start] === 1 });
+        break;
+      }
+    }
   }
   if (cats.includes('egress')) {
     const h = egressHost(t);
@@ -700,7 +789,7 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
   const host = egressHost(text);
   if (host) push('HIGH', `${isInstruction ? 'Rules file' : 'Memory'} references a data-exfiltration host (${host})`, 'Remove the reference and roll back to the approved baseline.', host);
-  if (hasImperative && containsAny(text, SENSITIVE_READ) && containsAny(text, NETWORK_VERBS)) {
+  if (hasImperative && containsWord(text, SENSITIVE_READ) && containsWord(text, NETWORK_VERBS)) {
     push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.');
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/shomra.mjs

@@ -15,12 +15,25 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { discoverAll } from './discovery.mjs';
 import { localScan, localGate, grade, downrankCodeContext, SECRET_PATTERNS } from './guard-signals.mjs';
 import { scanSourceFile, isScannableSource, isModelConfig } from './code-sast.mjs';
 import { scanModelRefs, isModelRefScannable } from './model-refs.mjs';
 
-const VERSION = '0.2.0';
+// Read from package.json rather than hardcoding: the two spellings drifted (this
+// const said 0.2.0 while the package was already 0.2.4), so `shomra --version`
+// and the `x-shomra-agent` header both under-reported the running build — which
+// is exactly the value you need to trust when triaging a bad scan in the field.
+// Falls back to the package version being unreadable rather than crashing the CLI.
+const VERSION = (() => {
+  try {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return JSON.parse(fs.readFileSync(path.join(here, 'package.json'), 'utf8')).version ?? '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+})();
 const CONFIG_DIR = path.join(os.homedir(), '.shomra');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 
@@ -2830,9 +2843,17 @@ async function screenModelLoad(agent, tool, input, url) {
   if (!refs.length) return; // modelLookup is cache-first + breaker-aware, so don't bail here
 
   const flagged = [];
+  // ONE budget for the whole screen, not one per ref. This runs inside the
+  // PreToolUse hook, so its cost is added to a tool call the dev is watching: a
+  // file citing five uncached models must not be able to spend 5× the guard
+  // timeout. Cache hits and a tripped breaker short-circuit before any network,
+  // so the common path never touches this.
+  const deadline = Date.now() + guardTimeoutMs();
   for (const r of refs) {
+    const left = deadline - Date.now();
+    if (left <= 0) break; // budget spent — flag what we screened, never stall the call
     let lk;
-    try { lk = await modelLookup(url, r.id, r.revision); } catch { return; } // uncached + backend down → can't judge, stay silent
+    try { lk = await modelLookup(url, r.id, r.revision, left); } catch { return; } // uncached + backend down → can't judge, stay silent
     const findings = (lk && lk.findings) || [];
     const worst = findings.reduce((m, f) => Math.max(m, MODEL_SEV_RANK[f.severity] || 0), 0);
     const bad = lk && lk.found && (lk.verdict === 'FAIL' || lk.verdict === 'REVIEW' || worst >= MODEL_SEV_RANK.HIGH);
@@ -3003,6 +3024,26 @@ async function cmdToolGuard(flags) {
       signal: ctrl.signal,
     });
     clearTimeout(timer);
+    // fetch() does NOT reject on 4xx/5xx. Without this check a rejected key
+    // returned its error body, r.json() parsed it happily, breakerReset() marked
+    // the backend healthy, res.decision came back undefined — and every
+    // escalated call silently ALLOWed. Org policy off, no error, no breaker, no
+    // signal, indefinitely. Non-2xx must reach the failure path below.
+    if (!r.ok) {
+      // An auth failure is a misconfiguration, not an outage: it will not heal
+      // on its own, so it gets a visible line rather than a 30s breaker cooldown
+      // that would hide it (and skip even this warning on the calls after it).
+      if (r.status === 401 || r.status === 403) {
+        process.stderr.write(
+          `[shomra] guard NOT enforced: the backend rejected this API key (HTTP ${r.status}). ` +
+            `Local Tier-0 screening still ran; org policy, agent identity and flow control did not. ` +
+            `Re-enroll with \`shomra init --key <key>\`.\n`,
+        );
+        if (strict) emitGuardDeny(agent, `Shomra guard could not authenticate (HTTP ${r.status}); blocked by fail-closed policy.`);
+        process.exit(0);
+      }
+      throw new Error(`HTTP ${r.status}`); // 5xx / 429 → a real outage, trip the breaker
+    }
     res = await r.json();
     breakerReset(); // healthy response — clear any tripped breaker
   } catch (e) {
@@ -3095,6 +3136,20 @@ async function cmdResultGuard(flags) {
       signal: ctrl.signal,
     });
     clearTimeout(timer);
+    // See cmdToolGuard: fetch() does not reject on 4xx, so an error body would
+    // parse cleanly and `res.decision` would be undefined → silent fail-open.
+    if (!r.ok) {
+      if (r.status === 401 || r.status === 403) {
+        process.stderr.write(
+          `[shomra] result-guard NOT enforced: the backend rejected this API key (HTTP ${r.status}). ` +
+            `Local Tier-0 screening still ran; server-side flow taint did not. ` +
+            `Re-enroll with \`shomra init --key <key>\`.\n`,
+        );
+        if (strict) emitResultBlock(agent, `Shomra result-guard could not authenticate (HTTP ${r.status}); blocked by fail-closed policy.`);
+        process.exit(0);
+      }
+      throw new Error(`HTTP ${r.status}`); // 5xx / 429 → a real outage, trip the breaker
+    }
     res = await r.json();
     breakerReset();
   } catch (e) {
@@ -3678,7 +3733,11 @@ function modelCacheOff() { return process.env.SHOMRA_MODEL_CACHE === '0' || Stri
 function loadModelCache() { try { return JSON.parse(fs.readFileSync(MODEL_CACHE_FILE, 'utf8')) || {}; } catch { return {}; } }
 function saveModelCache(c) { try { fs.mkdirSync(CONFIG_DIR, { recursive: true }); fs.writeFileSync(MODEL_CACHE_FILE, JSON.stringify(c)); } catch { /* cache is best-effort */ } }
 
-async function modelLookup(url, id, sha) {
+// `timeoutMs` overrides the interactive API budget. The PreToolUse hook MUST
+// pass the guard budget: this function's default is sized for a human waiting on
+// `shomra models`, and inheriting it on the hot path froze a dev's terminal for
+// 15s per uncached ref against a cold backend.
+async function modelLookup(url, id, sha, timeoutMs) {
   const key = `${id}@${sha || 'latest'}`;
   const ttl = clampInt(process.env.SHOMRA_MODEL_CACHE_TTL_MS, 7 * 24 * 3600 * 1000, 0, 365 * 24 * 3600 * 1000);
   const cache = modelCacheOff() ? {} : loadModelCache();
@@ -3699,7 +3758,7 @@ async function modelLookup(url, id, sha) {
 
   const q = `id=${encodeURIComponent(id)}${sha ? `&sha=${encodeURIComponent(sha)}` : ''}`;
   const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), clampInt(process.env.SHOMRA_API_TIMEOUT_MS, 15000, 1000, 60000));
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs ?? clampInt(process.env.SHOMRA_API_TIMEOUT_MS, 15000, 1000, 60000));
   try {
     const res = await fetch(`${url}/models/lookup?${q}`, { signal: ctrl.signal, headers: { Accept: 'application/json', 'User-Agent': 'shomra-agent' } });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);