@shomra/agent 0.3.17 → 0.3.18

package/{design.mjs → src/detect/design.mjs}

@@ -1,33 +1,4 @@
-/**
- * shomra design — threat-model a system that does not exist yet.
- *
- * Every other Shomra surface needs an artifact: a file to gate, a call to
- * screen, a repo to scan. This one reads a DESCRIPTION — a design doc, an RFC, a
- * Jira/Linear ticket, a PR body — and answers the only question worth asking
- * before the first line is written: does the thing being described hand an
- * attacker a path from untrusted input to a consequence?
- *
- * The engine is the platform's, not a new one. `attack-graph.ts` models an
- * entity as six capability flags split into SOURCES (untrusted input, sensitive
- * reads, filesystem) and SINKS (network egress, execution, destructive action),
- * and calls a closed source→sink pair an attack path. That model does not care
- * whether the capabilities came from a scan or from a sentence. Here they come
- * from a sentence.
- *
- * ⚠ THE INVARIANT THAT MATTERS: absence of a described capability is NOT absence
- * of the capability. Prose is written by people who leave things out. Every
- * verdict this module can return names what it FOUND; none of them says the
- * design is safe, and `NOT_DESCRIBED` is not a pass. Getting this wrong would
- * turn a thinking aid into false assurance at the exact moment — before the
- * build — when false assurance is cheapest to act on and most expensive to
- * discover.
- *
- * Zero dependencies (Node built-ins only), like every other module here.
- */
-
-// The capability vocabulary, mirroring `Caps` in the backend's attack-graph.ts.
-// Keep the split identical: a divergence here would produce a CLI threat model
-// that disagrees with the platform's for the same system.
+
 export const SOURCE_CAPS = ['injection', 'readsSensitive', 'filesystem'];
 export const SINK_CAPS = ['network', 'exec', 'destructive'];
 
@@ -40,35 +11,16 @@ export const CAP_LABEL = {
   destructive: 'destructive action',
 };
 
-/**
- * Prose → capability. Each rule carries the phrasing a designer actually uses,
- * not the phrasing a scanner would emit. `what` is the human noun that goes into
- * the attack story, so a path reads as a sentence about the system rather than a
- * list of flags.
- *
- * Rules are matched per line so the evidence can cite one.
- *
- * ⚠ A line that DISCLAIMS a capability must not grant it. This originally said
- * the opposite — that a "we will not do X" sentence was a design decision worth
- * surfacing — and that was wrong: granting the flag from a disclaimer invents a
- * phantom attack path out of the one sentence that rules it out, which is the
- * most misleading output this tool can produce. "The tool has no access to
- * customer data" is the designer telling you the source does not exist.
- */
 const DISCLAIMER_RE = /\b(no|never|not|without|excludes?|excluding|neither|nor)\b[^.\n]{0,30}\b(access|read|write|permission|abilit|able|connection|integration)\w*|\b(does |do |will |can |must )(not|n't)\b|\bout of scope\b|\bnon-goals?\b|\bis not (able|permitted|allowed)\b/i;
 const CAP_RULES = [
-  // ── SOURCES ────────────────────────────────────────────────────────────────
+
   { cap: 'injection', what: 'end-user or customer text', re: /\b(user|customer|client|end[- ]user)[- ]?(input|message|text|query|prompt|request|content|submission)\b/i },
   { cap: 'injection', what: 'inbound email', re: /\b(inbound |incoming |receiv\w+ )?e-?mails?\b|\bmailbox\b|\bimap\b|\bsupport inbox\b/i },
   { cap: 'injection', what: 'support tickets', re: /\b(support |help[- ]?desk |zendesk |intercom |freshdesk )?tickets?\b|\bcase notes?\b/i },
   { cap: 'injection', what: 'issues and PR descriptions', re: /\b(github |gitlab |jira |linear )?(issues?|pull[- ]requests?|PR) (body|description|comments?)\b|\bissue tracker\b/i },
-  // Document nouns are plural far more often than not in a design doc ("ingests
-  // uploaded PDFs"), and an `\bpdf\b` that cannot match "PDFs" is a rule that
-  // misses the common phrasing while looking correct in a unit test.
+
   { cap: 'injection', what: 'uploaded documents', re: /\b(upload(ed|s)?|attach(ed|ment)s?)\b.{0,30}\b(files?|documents?|pdfs?|images?|csvs?|spreadsheets?)\b|\b(pdf|docx|csv)s? (upload|ingest|pars\w+)/i },
-  // Provenance, not format: content ACCEPTED FROM a party outside the trust
-  // boundary is untrusted whatever shape it arrives in. Anchored on a receiving
-  // verb + "from" + the party, so ordinary prose about customers does not fire.
+
   { cap: 'injection', what: 'content received from outside', re: /\b(ingest|receiv|accept|import|process|pull|collect|read|fetch)\w*\b[^.\n]{0,40}\bfrom\b[^.\n]{0,25}\b(customers?|users?|clients?|end[- ]users?|the public|third[- ]part\w+|external|partners?|vendors?|suppliers?)\b/i },
   { cap: 'injection', what: 'scraped or fetched web content', re: /\b(scrap\w+|crawl\w+|fetch\w+|browse\w*)\b.{0,30}\b(web|site|page|url|internet)\b|\bweb (page|content|search results?)\b/i },
   { cap: 'injection', what: 'retrieved documents (RAG)', re: /\bRAG\b|\bretrieval[- ]augmented\b|\b(retriev\w+|search\w*) (documents?|chunks?|context|corpus)\b|\bvector (store|db|database|search)\b|\bknowledge base\b/i },
@@ -84,13 +36,9 @@ const CAP_RULES = [
   { cap: 'readsSensitive', what: 'private source code', re: /\bprivate (repo|repositor\w+|source|code)\b|\bproprietary (code|source)\b|\binternal (repo|codebase|wiki|docs?)\b/i },
   { cap: 'readsSensitive', what: 'object storage', re: /\bS3 bucket\b|\b(blob|object) storage\b|\bGCS bucket\b|\bdata lake\b/i },
 
-  // Plurals throughout: "writes the generated files to the repo" is the normal
-  // phrasing, and `\bfile\b` cannot match it. Same blind spot as `\bpdf\b` vs
-  // "PDFs" — assume every noun here arrives plural at least half the time.
   { cap: 'filesystem', what: 'file writes', re: /\bwrit\w+\b[^.\n]{0,25}\b(files?|disks?|filesystems?|director(y|ies)|folders?|repos?|repositor(y|ies))\b|\b(file ?system|local files?) (access|write)\b|\bcommits? (code|files?|changes?)\b/i },
   { cap: 'filesystem', what: 'workspace or repo checkout', re: /\b(clones?|checks? out|checkout)\b.{0,25}\b(repo|repositor\w+)\b|\bworkspace (access|mount|volume)\b/i },
 
-  // ── SINKS ──────────────────────────────────────────────────────────────────
   { cap: 'network', what: 'outbound API calls', re: /\bcalls?\b.{0,30}\b(external|third[- ]party|public|remote|partner)\b.{0,20}\bapi\b|\boutbound (request|call|http|traffic)\b|\begress\b/i },
   { cap: 'network', what: 'webhooks', re: /\bwebhooks?\b|\bpost(s|ing|ed)?\b[^.\n]{0,30}\bto\b[^.\n]{0,25}\b(endpoints?|urls?|callbacks?|apis?|services?|partners?|systems?)\b/i },
   { cap: 'network', what: 'sending email or messages', re: /\bsends?\b.{0,25}\b(e-?mail|message|notification|sms|slack|dm)\b|\bnotif(y|ies|ication)\b.{0,25}\b(user|customer|channel|slack|teams|email)\b|\bsmtp\b/i },
@@ -103,25 +51,17 @@ const CAP_RULES = [
   { cap: 'exec', what: 'agent tool calls', re: /\b(tool[- ]call|function[- ]call|tool use|agentic loop|autonomous(ly)?)\b|\bagent (executes?|acts?|takes? actions?)\b/i },
 
   { cap: 'destructive', what: 'deleting data', re: /\bdelet\w+|\bremov\w+\b.{0,20}\b(record|row|file|user|account|data)\b|\bpurge\b|\bdrop (table|database)\b|\btruncat\w+/i },
-  // A money NOUN alone is not a capability — "the dashboard displays the refund
-  // history" is a read. The line has to name an act that MOVES the money, so the
-  // verb is required and read-only verbs are not on the list.
+
   { cap: 'destructive', what: 'moving money', re: /\b(issues?|issuing|processes|processing|triggers?|initiates?|creates?|approves?|grants?|sends?|makes?|charges?|refunds?|voids?|cancels?)\b[^.\n]{0,30}\b(refunds?|payments?|charges?|invoices?|payouts?|transfers?|subscriptions?|purchases?|orders?)\b|\bmoves? money\b|\bthrough stripe\b|\bvia stripe\b/i },
   { cap: 'destructive', what: 'changing access or state', re: /\b(revok\w+|disabl\w+|suspend\w+|deactivat\w+|cancel\w*|ban\w*)\b.{0,25}\b(user|account|access|key|token|subscription|service)\b|\bgrants? (access|permission|role)\b/i },
   { cap: 'destructive', what: 'writing to production', re: /\bwrit\w+\b.{0,25}\bprod(uction)?\b|\bprod(uction)?\b.{0,20}\bwrite (access|path)\b|\bmutat\w+\b.{0,25}\b(prod|live|customer) (data|state)\b/i },
 ];
 
-/** Lines that are headings, code fences or list scaffolding carry no design intent. */
 function isSkippableLine(line) {
   const t = line.trim();
   return !t || t === '---' || /^```/.test(t) || /^\|[\s-:|]+\|$/.test(t);
 }
 
-/**
- * Extract the capability set a document DESCRIBES, with the line and phrase that
- * evidenced each — the evidence is the point: a reader has to be able to check
- * the machine's reading against their own words and disagree with it.
- */
 export function capsFromProse(text) {
   const caps = { injection: false, readsSensitive: false, filesystem: false, network: false, exec: false, destructive: false };
   const evidence = {};
@@ -131,11 +71,9 @@ export function capsFromProse(text) {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     if (/^\s*```/.test(line)) { inFence = !inFence; continue; }
-    // Code blocks in a design doc are illustrative snippets, not statements of
-    // intent — and they are exactly where a scanner's vocabulary produces noise.
+
     if (inFence || isSkippableLine(line)) continue;
-    // A disclaimer names the capability in order to rule it out. Granting the
-    // flag here would invent an attack path from the sentence that removes it.
+
     if (DISCLAIMER_RE.test(line)) continue;
 
     for (const r of CAP_RULES) {
@@ -143,22 +81,15 @@ export function capsFromProse(text) {
       if (!m) continue;
       caps[r.cap] = true;
       const list = (evidence[r.cap] = evidence[r.cap] || []);
-      if (list.some((e) => e.what === r.what)) continue; // one citation per distinct capability phrasing
+      if (list.some((e) => e.what === r.what)) continue;
       list.push({ what: r.what, line: i + 1, quote: line.trim().slice(0, 160), match: m[0].slice(0, 60), score: evidenceScore(line) });
     }
   }
-  // Rank each capability's citations so the one the attack story quotes is the
-  // line that DESCRIBES the behaviour, not the first line the word appeared on.
-  // "Reduce first-response time on support tickets" (a goal) and "polls the
-  // support inbox and reads inbound emails" (the design) both mention tickets;
-  // quoting the goal makes the finding look like a keyword hit and is the
-  // fastest way for a reader to stop trusting the output.
+
   for (const k of Object.keys(evidence)) evidence[k].sort((a, b) => b.score - a.score || a.line - b.line);
   return { caps, evidence };
 }
 
-// A line that says what the system DOES, rather than what it is for. Used only
-// to order evidence — never to grant or withhold a capability.
 const ACTION_LINE_RE = /\b(reads?|writes?|polls?|fetch\w*|calls?|sends?|runs?|executes?|issues?|looks? up|quer\w+|retriev\w+|ingest\w*|receiv\w+|access\w*|store[sd]?|upload\w*|post\w*|delet\w+|creat\w+|updat\w+|has|have|will|can|must)\b/i;
 const GOAL_LINE_RE = /^\s{0,3}#{1,6}\s|^\s*(goal|motivation|background|summary|context|out of scope|non-goals?)\b/i;
 
@@ -166,12 +97,10 @@ function evidenceScore(line) {
   let s = 0;
   if (ACTION_LINE_RE.test(line)) s += 3;
   if (GOAL_LINE_RE.test(line)) s -= 3;
-  if (line.trim().length > 60) s += 1; // a full sentence beats a heading fragment
+  if (line.trim().length > 60) s += 1;
   return s;
 }
 
-/** Severity of a closed path. Mirrors chainSeverity() in attack-graph.ts:
- *  untrusted input reaching a hard sink is the worst case in the model. */
 function pathSeverity(source, sink) {
   const hardSink = sink === 'exec' || sink === 'destructive';
   if (hardSink && source === 'injection') return 'CRITICAL';
@@ -180,9 +109,6 @@ function pathSeverity(source, sink) {
   return 'MEDIUM';
 }
 
-// What has to be true for a given source→sink pair to be safe to build. These
-// are stated as testable conditions rather than advice, because their job is to
-// become the acceptance criteria on the ticket that describes the system.
 const CONTROLS = {
   'injection→exec': [
     'The set of commands the agent can run is a fixed allowlist in code. Model output selects WHICH allowlisted action runs, never the command string itself.',
@@ -226,20 +152,9 @@ const CONTROLS = {
 const GENERIC_CONTROLS = [
   'Give the agent its own identity with its own credentials, so its actions are attributable and revocable independently of a human user.',
   'Record every tool call the agent makes, with the input that caused it, so an incident can be reconstructed.',
-  'Decide now what the agent must NOT be able to do, and enforce it in code rather than in the prompt — a prompt is a request, not a control.',
+  'Decide now what the agent must NOT be able to do, and enforce it in code rather than in the prompt - a prompt is a request, not a control.',
 ];
 
-/**
- * Threat-model a described system.
- *
- * `verdict` deliberately has no clean value:
- *   OPEN_PATH     — a source and a sink are both described; the path is closed.
- *   PARTIAL       — only one side is described. Not safety: the other side may
- *                   simply be unwritten, or may arrive in the next sprint.
- *   NOT_DESCRIBED — neither side was recognised. The likeliest reading is that
- *                   the document does not describe capabilities in a way this
- *                   matched, NOT that the system has none.
- */
 export function analyzeDesign(text, { name = 'design' } = {}) {
   const { caps, evidence } = capsFromProse(text);
   const sources = SOURCE_CAPS.filter((c) => caps[c]);
@@ -258,8 +173,8 @@ export function analyzeDesign(text, { name = 'design' } = {}) {
         key: `${s}→${k}`,
         story:
           `${cap(srcEv ? srcEv.what : CAP_LABEL[s])} reaches ${sinkEv ? sinkEv.what : CAP_LABEL[k]}` +
-          `${s === 'injection' ? ' — whoever writes that input is choosing what the agent does' : ''}` +
-          `${s === 'readsSensitive' && k === 'network' ? ' — the data and the way out are held by the same component' : ''}.`,
+          `${s === 'injection' ? ' - whoever writes that input is choosing what the agent does' : ''}` +
+          `${s === 'readsSensitive' && k === 'network' ? ' - the data and the way out are held by the same component' : ''}.`,
         sourceEvidence: srcEv || null,
         sinkEvidence: sinkEv || null,
         controls: CONTROLS[`${s}→${k}`] || [],
@@ -271,8 +186,6 @@ export function analyzeDesign(text, { name = 'design' } = {}) {
   const verdict = paths.length ? 'OPEN_PATH' : sources.length || sinks.length ? 'PARTIAL' : 'NOT_DESCRIBED';
   const worst = paths.length ? paths[0].severity : null;
 
-  // Deduplicate controls across paths, worst-severity first, then append the
-  // ones that apply to any agent with a consequence.
   const seen = new Set();
   const controls = [];
   for (const p of paths) for (const c of p.controls) if (!seen.has(c)) { seen.add(c); controls.push({ text: c, from: p.key, severity: p.severity }); }
@@ -287,27 +200,25 @@ function cap(s) {
   return String(s || '').charAt(0).toUpperCase() + String(s || '').slice(1);
 }
 
-/** The result as a markdown task list — the form that becomes the ticket's
- *  acceptance criteria, which is the only form anyone acts on. */
 export function designChecklist(result) {
   const out = [];
-  out.push(`## Security acceptance criteria — ${result.name}`);
+  out.push(`## Security acceptance criteria - ${result.name}`);
   out.push('');
   if (result.verdict !== 'OPEN_PATH') {
     out.push(
       result.verdict === 'PARTIAL'
         ? `Only one side of an attack path is described here (${[...result.sources, ...result.sinks].map((c) => CAP_LABEL[c]).join(', ')}). Re-run this when the design names what the agent can *do* with it.`
-        : 'No capabilities were recognised in this document. That is a statement about the document, not about the system — if the agent will read anything untrusted or take any action, write that down and re-run.',
+        : 'No capabilities were recognised in this document. That is a statement about the document, not about the system - if the agent will read anything untrusted or take any action, write that down and re-run.',
     );
     out.push('');
     return out.join('\n') + '\n';
   }
   out.push(`This design closes ${result.paths.length} attack path${result.paths.length === 1 ? '' : 's'}. Each item below is a condition to satisfy before it ships.`);
   out.push('');
-  for (const p of result.paths.slice(0, 6)) out.push(`- **${p.severity} · ${CAP_LABEL[p.source]} → ${CAP_LABEL[p.sink]}** — ${p.story}`);
+  for (const p of result.paths.slice(0, 6)) out.push(`- **${p.severity} · ${CAP_LABEL[p.source]} → ${CAP_LABEL[p.sink]}** - ${p.story}`);
   out.push('');
   for (const c of result.controls) out.push(`- [ ] ${c.text}`);
   out.push('');
-  out.push('_Derived by `shomra design` from the description above. It reads prose, so it sees only what was written down — a capability nobody documented is not a capability you do not have._');
+  out.push('_Derived by `shomra design` from the description above. It reads prose, so it sees only what was written down - a capability nobody documented is not a capability you do not have._');
   return out.join('\n') + '\n';
 }

package/src/detect/guard-signals.mjs

@@ -0,0 +1,18 @@
+export { autonomySeverity, localAutonomy } from './signals/autonomy.mjs';
+export { RISKY_CONFIG_MARKERS } from './signals/config-markers.mjs';
+export { detectCredentialHarvest } from './signals/credential-harvest.mjs';
+export { claimSeverity, detectDurableClaims } from './signals/durable-claims.mjs';
+export { SUSPICIOUS_EGRESS_HOSTS, egressHost } from './signals/egress.mjs';
+export { detectExecutionHijack } from './signals/execution-hijack.mjs';
+export { localGate } from './signals/gate.mjs';
+export { INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE } from './signals/injection.mjs';
+export { localMemory } from './signals/memory.mjs';
+export { AGENT_ROOT_RE, isAgentAdjacentPath, localPropagation } from './signals/propagation.mjs';
+export { citationGoverns, isDocumentationLine, prohibitsAt } from './signals/prose-context.mjs';
+export { downrankCodeContext, localScan } from './signals/scan.mjs';
+export { PII_PATTERNS, SECRET_PATTERNS } from './signals/secrets.mjs';
+export { NETWORK_VERBS, SENSITIVE_READ } from './signals/sensitive.mjs';
+export { grade } from './signals/severity.mjs';
+export { DANGEROUS_SHELL, matchesShellSignal } from './signals/shell.mjs';
+export { scanStagedFetchExec } from './signals/staged-fetch.mjs';
+export { containsAny, containsWord } from './signals/text-match.mjs';

package/{model-refs.mjs → src/detect/model-refs.mjs}

@@ -1,49 +1,17 @@
-/**
- * Model-reference extractor — finds the AI MODELS a dev's code loads, so the CLI
- * can look each one up in the platform's Model Security Index (GET /models/lookup)
- * and surface known vulnerabilities. This is the "you reference a model → we tell
- * you if it's dangerous" path: you can't read a model's weights from source, but
- * you CAN see which model id the code pulls, and the platform has already scanned
- * the popular ones.
- *
- * Dependency-free, line-oriented, low-false-positive: model ids are only extracted
- * from lines that carry a real loader hint (from_pretrained / SentenceTransformer /
- * hf_hub_download / snapshot_download / pipeline(model=…) / a huggingface.co URL /
- * torch.hub.load / ollama pull|run), never from arbitrary "a/b" strings (which are
- * usually file paths or npm packages).
- */
-
-// A line must carry one of these to be considered a model load.
+
 const LOADER_HINT = /\b(from_pretrained|SentenceTransformer|CrossEncoder|hf_hub_download|snapshot_download|InferenceClient|AutoModel\w*|AutoTokenizer|AutoConfig|AutoProcessor|AutoFeatureExtractor|from_hf_hub|hf_hub|load_dataset|torch\.hub\.load|ollama)\b|\bpipeline\s*\(|\bmodel\s*[=:]\s*['"]|huggingface\.co|\bhf\.co\b/i;
 
-// A quoted HF-style id: "org/model" (one slash, HF-legal chars, no path/URL/ext).
 const QUOTED_ID = /['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
-// High-confidence positions whose quoted value IS a model id — so we can also
-// accept BARE ids (no org, e.g. "gpt2", "distilbert-base-uncased") from them.
+
 const FROM_PRETRAINED_ARG = /\bfrom_pretrained\s*\(\s*(?:[A-Za-z_][\w.]*\s*,\s*)?['"]([\w./-]+)['"]/g;
 const ST_ARG = /\b(?:SentenceTransformer|CrossEncoder)\s*\(\s*['"]([\w./-]+)['"]/g;
-// ⚠ `[=:]`, not `=`. This required an equals sign, so it saw Python and nothing
-// else: JS/TS object literals and JSON all write `model: "gpt-4o"`, which is how
-// every Node OpenAI/Anthropic SDK call declares its model. A JS repo full of
-// model calls reported "✓ No AI model references found in the code." — a green
-// pass over a blind spot, and no vuln lookups ran for the whole estate.
-//
-// The VALUE STAYS QUOTED. An unquoted value matches any identifier, so
-// `const model = keyword` and `model: capabilities` came back as models named
-// "keyword" and "capabilities" — an inventory of things that do not exist is
-// worse than a short one. YAML's unquoted form is handled by YAML_KW below,
-// where line anchoring makes it safe.
+
 const KW_ID = /\b(?:model|repo_id|model_name|model_id|model_name_or_path|pretrained_model_name_or_path|checkpoint|base_model)\s*[=:]\s*['"]([\w./-]+)['"]/gi;
 
-// YAML: `model: gpt-4o` with no quotes. Anchored to the start of a line and to
-// end-of-value, so it cannot fire inside expressions the way a free-floating
-// pattern does. The value must carry a digit, a slash or a dot — model ids do
-// (`gpt-4o`, `openai-community/gpt2`, `claude-opus-4-8`); bare English words
-// like `capabilities` do not.
 const YAML_KW = /^[ \t-]*(?:model|model_name|model_id|base_model|checkpoint)\s*:\s*([A-Za-z0-9][\w./-]*[\w/.-])\s*(?:#.*)?$/gim;
-// A pinned revision/commit in the same call.
+
 const REVISION = /\b(?:revision|commit|sha)\s*=\s*['"]([\w.-]{4,})['"]/i;
-// Bare-id positions can accidentally grab a pipeline TASK / device / dtype — drop those.
+
 const ID_STOPWORDS = new Set([
   'auto', 'cpu', 'cuda', 'mps', 'none', 'true', 'false', 'main', 'default',
   'text-classification', 'token-classification', 'question-answering', 'fill-mask',
@@ -52,18 +20,13 @@ const ID_STOPWORDS = new Set([
   'image-classification', 'object-detection', 'automatic-speech-recognition',
   'conversational', 'ner', 'sentiment-analysis', 'embeddings', 'chat', 'completion',
 ]);
-// Full huggingface.co / hf.co model URLs.
+
 const HF_URL = /https?:\/\/(?:www\.)?(?:huggingface\.co|hf\.co)\/([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)(?:\/tree\/([\w.-]+))?/gi;
-// `ollama pull llama3:8b` / `ollama run mistral` — local runtime models (no slash).
+
 const OLLAMA = /\bollama\s+(?:pull|run|cp|create)\s+([a-z0-9][\w.:\/-]*)/gi;
-// torch.hub.load("pytorch/vision", …) — a GitHub owner/repo that runs hubconf.py.
+
 const TORCH_HUB = /torch\.hub\.load\s*\(\s*['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
 
-// Hosted-API model families. A bare `model="gpt-4o"` / `model="claude-…"` is an
-// OpenAI/Anthropic/Google/etc API call, NOT a Hugging Face repo — but `model=` is
-// their SDK param too, so KW_ID/from_pretrained would otherwise tag these 'hf' and
-// trigger a doomed HF-Index lookup ("gpt-4o (hf) lookup failed"). Recognize them
-// and tag 'api' with the provider. Prefix-anchored to avoid matching HF repos.
 const API_MODEL = /^(?:gpt-|gpt4|o[1-4](?:-|$)|text-embedding-|text-(?:davinci|curie|babbage|ada)|davinci|dall-e|whisper-|tts-|chatgpt|claude[-\d]|gemini[-.]|gemini$|models\/gemini|mistral-|mixtral-|codestral-|command(?:-|$)|command-r|grok-|deepseek-(?:chat|coder|reasoner)|sonar-)/i;
 function apiProvider(id) {
   const s = String(id || '').toLowerCase();
@@ -78,10 +41,8 @@ function apiProvider(id) {
   return 'api';
 }
 
-// Reject ids that are really file paths, packages, or non-model strings.
 const ASSET_EXT = /\.(py|pyc|ipynb|[mc]?[jt]sx?|json|ya?ml|toml|txt|md|lock|cfg|ini|sh|env|png|jpg|svg|css|html?|csv|tsv|parquet)$/i;
-// First path segment on huggingface.co that is a SITE section, not an org — so
-// huggingface.co/docs/datasets isn't mistaken for the model "docs/datasets".
+
 const NONMODEL_ORGS = new Set([
   'docs', 'blog', 'spaces', 'datasets', 'models', 'join', 'login', 'settings',
   'pricing', 'tasks', 'learn', 'papers', 'collections', 'organizations', 'new',
@@ -90,14 +51,13 @@ const NONMODEL_ORGS = new Set([
 function looksLikeModelId(id) {
   if (!id || id.startsWith('@') || id.startsWith('.') || id.startsWith('/')) return false;
   if (id.includes('..') || id.split('/').length !== 2) return false;
-  if (ASSET_EXT.test(id)) return false; // a model id never ends in a code/asset ext
+  if (ASSET_EXT.test(id)) return false;
   const [a, b] = id.split('/');
-  if (!/[A-Za-z]/.test(a) || !/[A-Za-z]/.test(b)) return false; // kills "123/456"
-  if (NONMODEL_ORGS.has(a.toLowerCase())) return false; // site path, not an org
+  if (!/[A-Za-z]/.test(a) || !/[A-Za-z]/.test(b)) return false;
+  if (NONMODEL_ORGS.has(a.toLowerCase())) return false;
   return true;
 }
-// A bare id (no org) from a high-confidence position — accept unless it's clearly
-// a task/device token or an asset path.
+
 function validBareId(id) {
   if (!id || id.startsWith('@') || id.startsWith('.') || id.startsWith('/') || id.includes('..')) return false;
   if (ID_STOPWORDS.has(id.toLowerCase())) return false;
@@ -106,23 +66,14 @@ function validBareId(id) {
   return true;
 }
 
-/**
- * Extract model references from one source file's text. Returns
- * `[{ id, revision?, source, line, via }]` — `source` is the origin registry
- * ('hf' | 'github' | 'ollama'), `via` names the matched loader for evidence.
- * De-duplicated per (id, revision) within the file, keeping the first line.
- */
 export function scanModelRefs(text, file = '') {
   if (!text) return [];
   const out = [];
   const seen = new Set();
-  // `bare` allows an org-less id ("gpt2") when it came from a high-confidence
-  // position (from_pretrained/SentenceTransformer/model=); ollama ids are freeform.
+
   const add = (id, { revision, source, line, via, bare }) => {
     if (!id) return;
-    // A bare hosted-API model name reached us via an HF-shaped matcher (`model=`,
-    // from_pretrained). It is not an HF repo — reclassify to 'api' + provider so it
-    // is labeled correctly and skips the HF-Index lookup. See API_MODEL.
+
     if (source === 'hf' && !id.includes('/') && API_MODEL.test(id)) {
       source = 'api';
       via = `${via} · ${apiProvider(id)} API`;
@@ -141,38 +92,29 @@ export function scanModelRefs(text, file = '') {
     if (!trimmed) continue;
     const ln = i + 1;
 
-    // 1. Full HF URLs — scanned on EVERY line (incl. comments / README / markdown
-    //    headers), since a huggingface.co URL is an unambiguous model reference.
     for (const m of raw.matchAll(HF_URL)) add(m[1], { revision: m[2], source: 'hf', line: ln, via: 'huggingface.co URL' });
 
-    // Code-oriented extractors below skip pure comment lines (a commented-out load).
     if (trimmed.startsWith('#') || trimmed.startsWith('//') || trimmed.startsWith('*')) continue;
 
-    // 2. torch.hub.load("owner/repo", …) → GitHub-hosted, runs hubconf.py.
     const isTorchHub = /torch\.hub\.load/.test(raw);
     for (const m of raw.matchAll(TORCH_HUB)) add(m[1], { source: 'github', line: ln, via: 'torch.hub.load' });
 
-    // 3. ollama pull/run <model>.
     const isOllama = /\bollama\b/.test(raw);
     for (const m of raw.matchAll(OLLAMA)) add(m[1], { source: 'ollama', line: ln, via: 'ollama' });
 
-    // Lines already fully handled by a specific matcher shouldn't also be mined
-    // by the generic HF extractors (avoids torch.hub's owner/repo re-added as hf).
     if (isTorchHub || isOllama || /huggingface\.co|hf\.co/.test(raw)) continue;
 
     const rev = (raw.match(REVISION) || [])[1];
-    // 4a. High-confidence positions — accept BARE ids (org-less) too.
+
     for (const m of raw.matchAll(FROM_PRETRAINED_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'from_pretrained', bare: true });
     for (const m of raw.matchAll(ST_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'sentence-transformers', bare: true });
     for (const m of raw.matchAll(KW_ID)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model= keyword', bare: true });
-    // Unquoted YAML values, only where a model id is plausible (see YAML_KW).
+
     for (const m of raw.matchAll(YAML_KW)) {
-      if (!/[0-9./]/.test(m[1])) continue; // no digit, slash or dot → an English word, not a model id
+      if (!/[0-9./]/.test(m[1])) continue;
       add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model: yaml key', bare: true });
     }
 
-    // 4b. Any other loader line with a quoted org/model id (hf_hub_download,
-    //     snapshot_download, InferenceClient(model=…), etc.).
     if (LOADER_HINT.test(raw)) {
       for (const m of raw.matchAll(QUOTED_ID)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model loader' });
     }
@@ -180,7 +122,6 @@ export function scanModelRefs(text, file = '') {
   return out;
 }
 
-/** Extensions worth scanning for model references. */
 const SCAN_EXT = /\.(py|ipynb|[mc]?[jt]sx?|ya?ml|yml|toml|txt|md|env|cfg|ini|json)$/i;
 export function isModelRefScannable(file) {
   return SCAN_EXT.test(String(file || ''));

package/src/detect/sast/chains.mjs

@@ -0,0 +1,30 @@
+import { CHAINS } from './rules-chains.mjs';
+import { contextChunk } from './source-lines.mjs';
+
+export function chainFindings(lines, findings, file) {
+  const ids = new Set(findings.map((f) => f.ruleId));
+  const out = [];
+  for (const chain of CHAINS) {
+    if (!chain.needs(ids)) continue;
+
+    const anchor = findings.find((f) => chain.anchor.includes(f.ruleId));
+    const line = anchor ? anchor.line : 1;
+    const idx = Math.max(0, line - 1);
+    out.push({
+      ruleId: chain.id,
+      title: chain.title,
+      severity: chain.severity,
+      category: chain.category,
+      confidence: chain.confidence,
+      file,
+      line,
+      sink: 'multi-signal',
+      chain: [...new Set(findings.filter((f) => chain.parts.includes(f.ruleId)).map((f) => f.ruleId))],
+      ...contextChunk(lines, idx),
+      message: chain.message,
+      remediation: chain.remediation,
+      cwe: chain.cwe,
+    });
+  }
+  return out;
+}

package/src/detect/sast/path-expressions.mjs

@@ -0,0 +1,76 @@
+import { escapeRe } from './source-lines.mjs';
+
+const DECL_PREFIX_RE = /\b(?:function|async|get|set|static|private|public|protected|readonly)\s*\*?\s*$/;
+
+export function isNotAModuleLoad(m, unitText, argText) {
+  if (DECL_PREFIX_RE.test(unitText.slice(Math.max(0, m.index - 24), m.index))) return true;
+  if (/^\s*import\b/.test(m[0])) return false;
+  let depth = 0;
+  let quote = '';
+  for (let i = 0; i < argText.length; i++) {
+    const ch = argText[i];
+    if (quote) {
+      if (ch === '\\') i++;
+      else if (ch === quote) quote = '';
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if ('([{'.includes(ch)) depth++;
+    else if (')]}'.includes(ch)) depth--;
+    else if (ch === ',' && depth === 0) return true;
+  }
+  return false;
+}
+
+const PATH_BIND_RE =
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]\s*\)|import\s+(?:\*\s+as\s+)?([A-Za-z_$][\w$]*)\s+from\s*['"](?:node:)?path(?:\/(?:posix|win32))?['"]/g;
+
+export function pathBindings(text) {
+  const ns = new Set(['path']);
+  PATH_BIND_RE.lastIndex = 0;
+  for (let m = PATH_BIND_RE.exec(text); m; m = PATH_BIND_RE.exec(text)) ns.add(m[1] || m[2]);
+  return ns;
+}
+
+const CONST_DECL_RE = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^\n;]+)/g;
+
+const PATHISH_RE = /__dirname|__filename|import\.meta\.url|process\.cwd|os\.(?:homedir|tmpdir)|fileURLToPath|new\s+URL|\.(?:join|resolve|normalize)\s*\(/;
+
+export function constPathBindings(text, pathNs) {
+  const found = new Set();
+  for (let round = 0; round < 2; round++) {
+    CONST_DECL_RE.lastIndex = 0;
+    for (let m = CONST_DECL_RE.exec(text); m; m = CONST_DECL_RE.exec(text)) {
+      const [, name, rhsRaw] = m;
+      if (found.has(name)) continue;
+      const rhs = rhsRaw.replace(/[,;]\s*$/, '').trim();
+
+      const buildsOnKnown = [...found].some((n) => new RegExp(`\\b${escapeRe(n)}\\b`).test(rhs));
+      if (!PATHISH_RE.test(rhs) && !buildsOnKnown) continue;
+      if (isStaticPathExpr(rhs, pathNs, found)) found.add(name);
+    }
+  }
+  return found;
+}
+
+const PATH_FNS = 'join|resolve|normalize|relative|dirname|basename|extname';
+
+export function isStaticPathExpr(argText, pathNs = new Set(['path']), constPaths = new Set()) {
+  if (!argText.trim()) return false;
+  const ns = [...pathNs].map(escapeRe).join('|');
+  const consts = constPaths.size ? `|${[...constPaths].map(escapeRe).join('|')}` : '';
+  const staticTokens = new RegExp(
+    `\\b(?:(?:${ns})(?:\\.(?:posix|win32))?\\.(?:${PATH_FNS})|__dirname|__filename|import\\.meta\\.url|process\\.cwd|os\\.(?:homedir|tmpdir)|fileURLToPath|require\\.resolve|new\\s+URL|String\\.raw${consts})\\b`,
+    'g',
+  );
+
+  const pureMembers = /\.(?:href|pathname|toString|toLowerCase|toUpperCase|trim|normalize|valueOf)\b/g;
+
+  let t = argText
+    .replace(/`(?:[^`\\]|\\.)*`/g, (lit) => ` ${[...lit.matchAll(/\$\{([^{}]*)\}/g)].map((x) => x[1]).join(' , ')} `)
+    .replace(/'(?:[^'\\]|\\.)*'/g, ' ')
+    .replace(/"(?:[^"\\]|\\.)*"/g, ' ');
+  t = t.replace(pureMembers, ' ').replace(staticTokens, ' ');
+
+  return !/[A-Za-z0-9_$]/.test(t.replace(/[\s(),.+[\]/\\:-]/g, ''));
+}

package/src/detect/sast/rules-chains.mjs

@@ -0,0 +1,33 @@
+export const CHAINS = [
+  {
+    id: 'chain.decode_exec',
+    title: 'Decode-and-execute packer (multi-signal)',
+    severity: 'CRITICAL',
+    category: 'chain',
+    confidence: 0.6,
+
+    parts: ['python.encoded_payload', 'js.decode_and_run', 'python.dangerous_sinks', 'js.code_exec', 'python.dynamic_import'],
+    needs: (ids) => (ids.has('python.encoded_payload') || ids.has('js.decode_and_run')) &&
+      (ids.has('python.dangerous_sinks') || ids.has('js.code_exec') || ids.has('python.dynamic_import')),
+    anchor: ['python.dangerous_sinks', 'js.code_exec', 'python.encoded_payload', 'js.decode_and_run'],
+    message: 'This file BOTH decodes an encoded blob AND contains a code-execution sink - the two halves of a decode-then-run packer. Detected by co-occurrence in one file, not a proven decode→exec path, so confirm the decoded blob is what reaches the sink; when it is, this is how a hidden payload is smuggled and run.',
+    remediation: 'Decode every embedded blob offline and inspect it, and remove the decode → eval/exec path entirely. Do not ship artifacts that assemble code at runtime.',
+    cwe: 'CWE-506',
+  },
+  {
+    id: 'chain.remote_code_egress',
+    title: 'Remote-code model that also phones out',
+    severity: 'CRITICAL',
+    category: 'chain',
+    confidence: 0.6,
+
+    parts: ['python.trust_remote_code', 'python.torch_remote_code', 'json.automodel_usage', 'json.autotokenizer_usage', 'python.network_egress', 'js.network_egress'],
+    needs: (ids) => (ids.has('python.trust_remote_code') || ids.has('python.torch_remote_code') ||
+      ids.has('json.automodel_usage') || ids.has('json.autotokenizer_usage')) &&
+      (ids.has('python.network_egress') || ids.has('js.network_egress')),
+    anchor: ['python.network_egress', 'js.network_egress', 'python.trust_remote_code', 'python.torch_remote_code'],
+    message: 'This file loads code shipped in a model repo (trust_remote_code / auto_map / torch.hub) AND opens a network connection. Detected by co-occurrence in one file, not a proven load→egress path. Remote-code modeling that also phones out is the classic staged-download / exfiltration shape - confirm whether the network call is reachable from the model-code load.',
+    remediation: 'Do not load remote model code; use a native-transformers model or a reviewed, pinned revision. Model code should never make outbound requests - treat this artifact as hostile.',
+    cwe: 'CWE-494',
+  },
+];