@shomra/agent 0.3.29 → 0.3.30

package/src/detect/signals/model-config.mjs

@@ -0,0 +1,61 @@
+import { lineOf } from './lines.mjs';
+import { gradeModelConfig, modelConfigFormat } from './model-config-rules.mjs';
+import { extractChatTemplates, isChatTemplateFile, scanChatTemplate } from './chat-template.mjs';
+
+const MODELFILE_RE = /^(?:.*\.)?modelfile$/i;
+const base = (p) => String(p ?? '').replace(/\\/g, '/').split('/').pop() ?? '';
+
+export function isModelConfigPath(path, content) {
+  const b = base(path);
+  if (MODELFILE_RE.test(b) || isChatTemplateFile(b)) return true;
+  return modelConfigFormat(path, content ?? 'x') !== null;
+}
+
+const SENSITIVE_LOCAL = /(?:^|[\\/])(?:\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.config[\\/]gcloud|\.netrc|\.git-credentials|\.env)(?:[\\/]|$)|^\/(?:etc|root|proc|sys)(?:\/|$)|id_(?:rsa|ed25519|ecdsa|dsa)\b|shadow$|passwd$|\.pem$|\.key$/i;
+const localRef = (r) => /^(?:\/|~|\.{1,2}[\\/]|[A-Za-z]:[\\/])/.test(r);
+
+function modelfileFindings(content, name) {
+  const out = [];
+  const push = (severity, title, remediationText, needle) => out.push({ severity, title, remediationText, needle });
+  const from = content.match(/^\s*FROM\s+(\S+)/im)?.[1] ?? null;
+  const adapters = [...content.matchAll(/^\s*ADAPTER\s+(\S+)/gim)].map((m) => m[1]).slice(0, 10);
+  const tmpl = content.match(/^\s*TEMPLATE\s+(?:"""([\s\S]*?)"""|(.*))$/im);
+  const template = tmpl ? (tmpl[1] ?? tmpl[2] ?? '').trim() : '';
+
+  for (const h of template ? scanChatTemplate(template, name, { sink: 'TEMPLATE', renderer: 'Ollama' }) : []) push(h.severity, h.title, h.remediation, 'TEMPLATE');
+
+  for (const ref of [from, ...adapters].filter((x) => x && localRef(x))) {
+    const dev = /^\/dev\//.test(ref);
+    if (!dev && !SENSITIVE_LOCAL.test(ref) && !/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(ref)) continue;
+    push(dev ? 'MEDIUM' : SENSITIVE_LOCAL.test(ref) ? 'HIGH' : 'MEDIUM',
+      dev ? `Model "${name}" reads a device file as weights (${ref})` : `Model "${name}" bundles a local file from outside the model directory (${ref})`,
+      'Reference weights/adapters inside the model directory only, and run Ollama 0.1.34+.', ref);
+  }
+  if (from && !localRef(from)) {
+    const remote = /^https?:\/\//i.test(from);
+    const host = /^([a-z0-9-]+(?:\.[a-z0-9-]+)+(?::\d+)?)\//i.exec(from)?.[1] ?? null;
+    if (host && !remote && !/^(?:registry\.ollama\.ai|ollama\.com|hf\.co|huggingface\.co)$/i.test(host)) push('MEDIUM', `Model "${name}" is pulled from a third-party registry (${host})`, 'Pull from a registry you control or trust, pinned by digest.', from);
+    if (remote) push('HIGH', `Model "${name}" is built from weights fetched over the network`, 'Reference a registry model by name and digest, or vendor the weights and pin them by hash.', from);
+    else if (!/@sha256[:-][0-9a-f]{12,}/i.test(from) && !(/:[\w.-]+$/.test(from) && !/:latest$/i.test(from))) push('LOW', `Model "${name}" is built from an unpinned base`, 'Pin the base to an explicit version or digest and update it deliberately.', from);
+  }
+  if (adapters.length) push('MEDIUM', `Model "${name}" applies a fine-tuning adapter`, 'Pin the adapter by digest, record who trained it and on what data, and re-evaluate the composed model.', adapters[0]);
+  return out;
+}
+
+export function localModelConfig(content, { path } = {}) {
+  const text = String(content ?? '');
+  if (!text.trim()) return [];
+  const name = base(path) || 'model-config';
+  const rows = [];
+  if (MODELFILE_RE.test(name) && /^\s*FROM\s+\S+/im.test(text)) rows.push(...modelfileFindings(text, name));
+  else {
+    for (const f of gradeModelConfig(path ?? name, text)) rows.push({ severity: f.severity, title: f.title, remediationText: f.remediation, needle: f.anchor });
+    for (const t of extractChatTemplates(text, path ?? name)) {
+      for (const h of scanChatTemplate(t.text, name, { sink: t.name })) rows.push({ severity: h.severity, title: h.title, remediationText: h.remediation, needle: t.name });
+    }
+  }
+  return rows.map(({ needle, ...r }) => {
+    const line = needle ? lineOf(text, needle) : undefined;
+    return { ...r, ...(line ? { line } : {}) };
+  });
+}

package/src/detect/signals/prose-context.mjs

@@ -83,10 +83,12 @@ export function isDocumentationLine(line, offset) {
 }
 
 const PROHIBITION_MARKER_RE =
-  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of|do NOT)\b[^.:;\n]{0,60}$/i;
+  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of|do NOT|(?:ask|check with)(?: the user| a human| me| for (?:confirmation|approval|permission))? before|confirm(?: with the user)? before|(?:get|obtain|wait for) (?:explicit )?(?:approval|confirmation|sign-?off) before|require (?:explicit )?(?:approval|confirmation) (?:before|for))\b[^.:;\n]{0,60}$/i;
 
 const DOUBLE_NEGATIVE_RE = /\b(?:hesitate|worry|be afraid|forget|fail|neglect|shy away)\b/i;
 
+const NEGATED_GUARD_RE = /\b(?:never|do not|don'?t|no need to|without|skip)\s[\w ]{0,20}\b(?:ask|asking|confirm|confirming|check|checking|wait|waiting|prompt|prompting|approval)\b/i;
+
 const COORDINATE_TAIL_RE = /(?:\b(?:and|or|but|then|also)\b|[,;])\s*$/i;
 
 export function prohibitsAt(line, offset) {
@@ -95,15 +97,10 @@ export function prohibitsAt(line, offset) {
   const before = line.slice(Math.max(0, at - 90), at);
   if (!PROHIBITION_MARKER_RE.test(before)) return false;
   if (COORDINATE_TAIL_RE.test(before)) return false;
+  if (NEGATED_GUARD_RE.test(before)) return false;
   return !DOUBLE_NEGATIVE_RE.test(before);
 }
 
-/**
- * ⚠ AN OFFSET ON THE OPENING BACKTICK IS INSIDE THE SPAN. Several rules anchor
- * on the backtick itself (a markdown code span and a shell command substitution
- * are the same character), so counting only what precedes the offset put every
- * code-span guard one character outside the span it was meant to be inside.
- */
 function insideCodeSpan(line, offset) {
   let ticks = 0;
   for (let i = 0; i < offset && i < line.length; i++) if (line[i] === '`') ticks++;
@@ -112,7 +109,7 @@ function insideCodeSpan(line, offset) {
 }
 
 /**
- * ⚠ A LINE THAT NAMES A COMMAND AS ITS SUBJECT IS DESCRIBING IT — the second
+ * ⚠ A LINE THAT NAMES A COMMAND AS ITS SUBJECT IS DESCRIBING IT - the second
  * carve-out `carriesHardEvidence` needs, for the same reason `prohibitsAt` was
  * the first. Security documentation is written in exactly this mood -
  * *"`curl … | sh` is a pipe-to-shell installer"*, *"`chmod 777` means the file
@@ -128,7 +125,7 @@ function insideCodeSpan(line, offset) {
  *
  * ⚠ THE MATCH MUST BE INSIDE A CODE SPAN, and ⚠ AN IMPERATIVE BEFORE IT WINS.
  *
- * Mirrors `describesAt` in the backend's prose-context.ts — `local-mirror-bench`
+ * Mirrors `describesAt` in the backend's prose-context.ts - `local-mirror-bench`
  * compares the two on every mood, in both directions.
  */
 const DESCRIPTIVE_PREDICATE_RE =

package/src/detect/signals/scan.mjs

@@ -2,7 +2,7 @@ import { RISKY_CONFIG_MARKERS, riskyConfigHit } from './config-markers.mjs';
 import { detectCredentialHarvest } from './credential-harvest.mjs';
 import { egressHost } from './egress.mjs';
 import { detectExecutionHijack } from './execution-hijack.mjs';
-import { BUILD_ARTIFACT, INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE, PRECEDING_NEGATION, describesRatherThanInstructs } from './injection.mjs';
+import { BUILD_ARTIFACT, INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE, precededByNegation, describesRatherThanInstructs } from './injection.mjs';
 import { lineAt, locate } from './lines.mjs';
 import { codeMask, deobfuscate } from './masking.mjs';
 import { PII_PATTERNS, RESERVED_IPV4, SECRET_PATTERNS, VERSION_CONTEXT, isPlaceholderSecret, luhnValid } from './secrets.mjs';
@@ -32,7 +32,7 @@ export function localScan(text, opts = {}) {
     for (const p of INJECTION_PHRASES) {
       const at = low.indexOf(p);
       if (at < 0) continue;
-      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      if (precededByNegation(t.slice(Math.max(0, at - 60), at))) continue;
       findings.push({ label: `Injected instruction: "${p}"`, severity: 'HIGH', category: 'injection', ...locate(t, p, mask) });
       break;
     }
@@ -40,7 +40,7 @@ export function localScan(text, opts = {}) {
       const m = t.match(re);
       if (!m) continue;
       const at = m.index ?? 0;
-      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      if (precededByNegation(t.slice(Math.max(0, at - 60), at))) continue;
       if (label === 'Bulk destructive command' && BUILD_ARTIFACT.test(m[0])) continue;
       if (moodGuarded && describesRatherThanInstructs(t, at)) continue;
       findings.push({ label, severity: 'HIGH', category: 'injection', ...locate(t, re, mask) });
@@ -48,7 +48,7 @@ export function localScan(text, opts = {}) {
     if (INVISIBLE_CHARS_RE.test(t)) findings.push({ label: 'Invisible / zero-width characters', severity: 'MEDIUM', category: 'injection', ...locate(t, INVISIBLE_CHARS_RE, mask) });
   }
   if (cats.includes('secret')) {
-    for (const { name, re } of SECRET_PATTERNS) { const m = t.match(re); if (m && !isPlaceholderSecret(m[0])) findings.push({ label: `Live credential: ${name}`, severity: 'CRITICAL', category: 'secret', ...locate(t, re, mask) }); }
+    for (const { name, re } of SECRET_PATTERNS) { const m = t.match(re); if (m && (/private key/i.test(name) || !isPlaceholderSecret(m[0]))) findings.push({ label: `Live credential: ${name}`, severity: 'CRITICAL', category: 'secret', ...locate(t, re, mask) }); }
   }
   if (cats.includes('pii')) {
     for (const { name, re } of PII_PATTERNS) {

package/src/detect/signals/secret-scanner.mjs

@@ -0,0 +1,241 @@
+export const SECRET_PATTERNS                                 = [
+  { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },
+  { name: 'OpenAI admin / service-account key', re: /\bsk-(?:svcacct|admin)-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
+  { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
+  { name: 'AWS temporary key id (STS)', re: /\bASIA[0-9A-Z]{16}/ },
+  { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
+  { name: 'GitLab PAT', re: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/ },
+  { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
+  { name: 'AWS secret access key (keyed)', re: /\bAWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/ },
+  {
+    name: 'Database URL with password',
+    re: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|rediss?|amqps?|mssql|sqlserver|oracle|clickhouse|cockroachdb|snowflake|neo4j(?:\+s)?|couchbases?):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)(?!([^\s:@/]+):\1@)(?!(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*:(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*@)[^\s:@/]+:(?![$<[{])[^\s:@/]{4,}@/i,
+  },
+  { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
+  { name: 'Encrypted private key block', re: /-----BEGIN ENCRYPTED PRIVATE KEY-----|-----BEGIN [A-Z ]{2,20}PRIVATE KEY-----\r?\nProc-Type: ?4, ?ENCRYPTED|PuTTY-User-Key-File-\d{1,2}:[^\r\n]{1,80}\r?\nEncryption: ?(?!none\b)[\w-]{2,40}/ },
+  { name: 'PuTTY private key', re: /PuTTY-User-Key-File-\d{1,2}:[^\r\n]{1,80}\r?\nEncryption: ?none\b/ },
+  { name: 'Private key block', re: /-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----\r?\n(?:[\w-]{1,40}: [^\r\n]{1,200}\r?\n){0,4}(?:\r?\n)?[ \t]{0,8}[A-Za-z0-9+/]{12,}/ },
+  { name: 'Groq API key', re: /\bgsk_[A-Za-z0-9]{40,}/ },
+  { name: 'Replicate API token', re: /\br8_[A-Za-z0-9]{30,}/ },
+  { name: 'Perplexity API key', re: /\bpplx-[A-Za-z0-9]{32,}/ },
+  { name: 'Fireworks API key', re: /\bfw_[A-Za-z0-9]{20,}/ },
+  { name: 'xAI API key', re: /\bxai-[A-Za-z0-9]{40,}/ },
+  { name: 'LangSmith API key', re: /\blsv2_(?:pt|sk)_[A-Za-z0-9]{24,}_[A-Za-z0-9]{8,}/ },
+  { name: 'Pinecone API key', re: /\bpcsk_[A-Za-z0-9_]{30,}/ },
+  { name: 'OpenRouter API key', re: /\bsk-or-v1-[A-Za-z0-9]{32,}/ },
+  { name: 'Discord webhook', re: /\bdiscord(?:app)?\.com\/api\/webhooks\/\d{17,}\/[A-Za-z0-9_-]{40,}/ },
+  { name: 'Telegram bot token', re: /\b\d{8,12}:AA[A-Za-z0-9_-]{30,}/ },
+  { name: 'Sentry DSN with secret', re: /\bhttps:\/\/[a-f0-9]{32}(?::[a-f0-9]{32})?@[\w.-]*(?:sentry\.io|ingest\.[\w.-]+)\/\d+/ },
+  { name: 'Registry auth blob (docker config)', re: /"auth"\s*:\s*"[A-Za-z0-9+/]{24,}={0,2}"/ },
+  {
+    name: 'Provider API key (named env var)',
+    re: /\b(?:AZURE_OPENAI_API_KEY|MISTRAL_API_KEY|COHERE_API_KEY|CO_API_KEY|TOGETHER_API_KEY|DEEPSEEK_API_KEY|DD_API_KEY|DATADOG_API_KEY|TWILIO_AUTH_TOKEN|VERCEL_TOKEN|CLOUDFLARE_API_TOKEN|WEAVIATE_API_KEY|VOYAGE_API_KEY|NVIDIA_API_KEY|CEREBRAS_API_KEY|SAMBANOVA_API_KEY)\s*[=:]\s*["']?[A-Za-z0-9_-]{24,}\b/,
+  },
+];
+
+export const ENTERPRISE_SECRET_PATTERNS                                 = [
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{24,}/ },
+  { name: 'OpenAI key', re: /\bsk-(?:proj-)?[A-Za-z0-9]{20,}/ },
+  { name: 'OpenAI project/org', re: /\b(?:org|proj)-[A-Za-z0-9]{20,}/ },
+  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
+  { name: 'Cohere key', re: /\bco-[A-Za-z0-9]{40,}/ },
+  { name: 'Google AI / API key', re: /\bAIza[0-9A-Za-z_-]{35}/ },
+  { name: 'AWS access key id', re: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}/ },
+  { name: 'AWS secret access key (keyed)', re: /aws_secret_access_key\s*[=:]\s*["']?[A-Za-z0-9/+]{40}/i },
+  { name: 'GCP service-account private key id', re: /"private_key_id"\s*:\s*"[0-9a-f]{40}"/ },
+  { name: 'GCP API key', re: /\bAIza[0-9A-Za-z_-]{35}/ },
+  { name: 'Azure storage key', re: /AccountKey\s*=\s*[A-Za-z0-9+/]{80,}==/ },
+  { name: 'GitHub personal token (classic)', re: /\bghp_[0-9A-Za-z]{36}/ },
+  { name: 'GitHub fine-grained token', re: /\bgithub_pat_[0-9A-Za-z_]{60,}/ },
+  { name: 'GitHub OAuth/app token', re: /\bgh[osur]_[0-9A-Za-z]{36}/ },
+  { name: 'GitLab personal token', re: /\bglpat-[0-9A-Za-z_-]{20,}/ },
+  { name: 'npm token', re: /\bnpm_[0-9A-Za-z]{36}/ },
+  { name: 'PyPI upload token', re: /\bpypi-AgEIcHlwaS[A-Za-z0-9_-]{50,}/ },
+  { name: 'Stripe live secret key', re: /\b[rs]k_(?:live|prod)_[0-9a-zA-Z]{10,99}/ },
+  { name: 'Stripe webhook secret', re: /\bwhsec_[A-Za-z0-9+/=]{32,}/ },
+  { name: 'Slack token', re: /\bxox[baprs]-[0-9A-Za-z-]{10,}/ },
+  { name: 'Slack webhook', re: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Za-z_]+\/B[0-9A-Za-z_]+\/[0-9A-Za-z]+/ },
+  { name: 'SendGrid key', re: /\bSG\.[0-9A-Za-z_-]{22}\.[0-9A-Za-z_-]{43}/ },
+  { name: 'Twilio account SID', re: /\bAC[0-9a-f]{32}/ },
+  { name: 'Twilio API key', re: /\bSK[0-9a-f]{32}/ },
+  { name: 'Mailgun key', re: /\bkey-[0-9a-f]{32}/ },
+  { name: 'Datadog API key', re: /\bdd[ap]i_[0-9a-f]{32,}/i },
+  { name: 'Shopify access token', re: /\bshp(?:at|ca|pa|ss)_[0-9a-fA-F]{32}/ },
+  { name: 'Square access token', re: /\bsq0(?:atp|csp|idp)-[0-9A-Za-z_-]{22,}/ },
+  { name: 'DigitalOcean token', re: /\bdop_v1_[0-9a-f]{64}/ },
+  { name: 'Cloudflare API token', re: /\b[A-Za-z0-9_-]{40}\b(?=[^\n]{0,40}cloudflare)/i },
+  { name: 'Azure AD client secret', re: /(?<![\w~.-])[a-zA-Z0-9_~.]{3}\dQ~[a-zA-Z0-9_~.-]{31,34}(?![\w~.-])/ },
+  { name: 'Azure SAS token', re: /[?&]sig=[A-Za-z0-9%+/]{40,120}(?:%3D|=){0,2}/ },
+  { name: 'Azure Service Bus / Event Hub key', re: /\bSharedAccessKey=[A-Za-z0-9+/]{42,44}=/ },
+  { name: 'AWS Bedrock API key', re: /\bABSK[A-Za-z0-9+/]{109,269}={0,2}|\bbedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t[A-Za-z0-9+/=%]{20,}/ },
+  { name: 'Databricks token', re: /\bdapi[a-f0-9]{32}(?:-\d)?\b/ },
+  { name: 'Google OAuth client secret', re: /\bGOCSPX-[A-Za-z0-9_-]{28}\b/ },
+  { name: 'Google OAuth access token', re: /\bya29\.[0-9A-Za-z_-]{50,}/ },
+  { name: 'GitLab CI / deploy / runner token', re: /\b(?:gldt|glrt|glsoat|glft|glimt|glagent|gloas)-[0-9A-Za-z_-]{20,}|\bglptt-[0-9a-f]{40}\b|\bglcbt-[0-9A-Za-z]{1,5}_[0-9A-Za-z_-]{20,}|\bGR1348941[\w-]{20,}/ },
+  { name: 'Slack app token', re: /\bxapp-\d-[A-Z0-9]{8,}-\d{6,}-[a-z0-9]{32,}/i },
+  { name: 'Mailchimp API key', re: /\b[a-f0-9]{32}-us\d{1,2}\b/ },
+  { name: 'HashiCorp Vault token', re: /\bhvs\.[\w-]{90,120}|\bhvb\.[\w-]{138,300}/ },
+  { name: 'Terraform Cloud token', re: /\b[a-z0-9]{14}\.atlasv1\.[a-z0-9_=-]{60,70}/i },
+  { name: 'Doppler token', re: /\bdp\.(?:pt|st|sa|scim|audit|ct)\.[A-Za-z0-9]{40,44}\b/ },
+  { name: '1Password service-account token', re: /\bops_eyJ[A-Za-z0-9+/]{250,}={0,3}/ },
+  { name: '1Password secret key', re: /\bA3-[A-Z0-9]{6}-(?:[A-Z0-9]{11}|[A-Z0-9]{6}-[A-Z0-9]{5})-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\b/ },
+  { name: 'age secret key', re: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}\b/ },
+  { name: 'Grafana token', re: /\bglc_[A-Za-z0-9+/]{32,400}={0,3}|\bglsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}\b/ },
+  { name: 'Sentry auth token', re: /\bsntryu_[a-f0-9]{64}\b|\bsntrys_eyJ[A-Za-z0-9+/=_-]{60,}/ },
+  { name: 'Linear API key', re: /\blin_api_[A-Za-z0-9]{40}\b/ },
+  { name: 'Notion token', re: /\bntn_\d{11}[A-Za-z0-9]{35}\b|\bsecret_[A-Za-z0-9]{43}\b/ },
+  { name: 'Postman API key', re: /\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/i },
+  { name: 'Pulumi token', re: /\bpul-[a-f0-9]{40}\b/ },
+  { name: 'Heroku API key', re: /\bHRKU-AA[0-9A-Za-z_-]{58}\b/ },
+  { name: 'Hugging Face org token', re: /\bapi_org_[A-Za-z]{34}\b/ },
+  { name: 'Atlassian API token', re: /\bATATT3[A-Za-z0-9_=-]{180,200}/ },
+  { name: 'Fly.io token', re: /\bfo1_[\w-]{43}\b|\bfm[12][ar]?_[A-Za-z0-9+/]{100,}={0,3}/ },
+  { name: 'PlanetScale token', re: /\bpscale_(?:tkn|pw|oauth)_[\w=.-]{32,64}\b/ },
+  { name: 'RubyGems API key', re: /\brubygems_[a-f0-9]{48}\b/ },
+  { name: 'Clojars token', re: /\bCLOJARS_[a-z0-9]{60}\b/i },
+  { name: 'NuGet API key', re: /\boy2[a-z0-9]{43}\b/ },
+  { name: 'Docker Hub token', re: /\bdckr_pat_[A-Za-z0-9_-]{27,}/ },
+  { name: 'JFrog Artifactory token', re: /\bAKCp[A-Za-z0-9]{69}\b|\bcmVmd[A-Za-z0-9]{59}\b/ },
+  { name: 'Dynatrace token', re: /\bdt0c01\.[A-Za-z0-9]{24}\.[A-Za-z0-9]{64}\b/ },
+  { name: 'Prefect API key', re: /\bpnu_[A-Za-z0-9]{36}\b/ },
+  { name: 'Brevo API key', re: /\bxkeysib-[a-f0-9]{64}-[A-Za-z0-9]{16}\b/ },
+  { name: 'Supabase access token', re: /\bsbp_[a-f0-9]{40}\b/ },
+  { name: 'Alibaba Cloud access key', re: /\bLTAI[A-Za-z0-9]{20}\b/ },
+  { name: 'Tencent Cloud secret id', re: /\bAKID[A-Za-z0-9]{32}\b/ },
+  { name: 'Harness token', re: /\b(?:pat|sat)\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9]{24}\.[A-Za-z0-9]{20}\b/ },
+  { name: 'Sourcegraph token', re: /\bsgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}\b/ },
+  { name: 'Microsoft Teams webhook', re: /\bhttps:\/\/[a-z0-9-]{1,63}\.webhook\.office\.com\/webhookb2\/[a-f0-9-]{36}@[a-f0-9-]{36}\/IncomingWebhook\/[a-f0-9]{32}\/[a-f0-9-]{36}/i },
+  { name: 'dotenvx private key', re: /\bDOTENV_PRIVATE_KEY(?:_[A-Z0-9_]{1,40})?[ \t]{0,4}=[ \t]{0,4}["']?[a-f0-9]{64}\b/ },
+  { name: 'Credential in URL', re: /\b(?:https?|git|ssh|ftps?|smb|ldaps?):\/\/(?![^\s:@/]{1,64}:(?:\$|\{\{|<|\[|x{3}|\*{3}|password\b|passwd\b|pass\b|secret\b|token\b|changeme\b)[^\s@/]{0,64}@)[^\s:@/{}<>]{1,64}:[^\s:@/{}<>]{8,128}@(?!(?:example\.(?:com|org|net)|localhost|127\.0\.0\.1)(?:[:/\s]|$))[A-Za-z0-9.-]{3,}/i },
+  { name: 'JWT', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._~+/-]{20,}=*/i },
+];
+
+export const GENERIC_SECRET_LABELS = new Set(['Generic bearer', 'JWT', 'JSON web token', 'Credential in URL']);
+
+export const ALL_SECRET_PATTERNS                                 = [
+  ...[...SECRET_PATTERNS, ...ENTERPRISE_SECRET_PATTERNS].filter((p) => !GENERIC_SECRET_LABELS.has(p.name)),
+  ...[...SECRET_PATTERNS, ...ENTERPRISE_SECRET_PATTERNS].filter((p) => GENERIC_SECRET_LABELS.has(p.name)),
+];
+
+export function textCarriesSecret(text                           )          {
+  if (!text) return false;
+  return ALL_SECRET_PATTERNS.some((p) => p.re.test(text));
+}
+
+export function shannonEntropy(s        )         {
+  if (!s) return 0;
+  const freq = new Map                ();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let bits = 0;
+  for (const c of freq.values()) {
+    const p = c / s.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
+
+export const SECRET_KEY_RE =
+  /\b(\w*(?:secret|token|passw(?:or)?d|api[_-]?key|apikey|access[_-]?key|client[_-]?secret|auth[_-]?token|private[_-]?key|credential|session[_-]?key|encryption[_-]?key|signing[_-]?key)\w*)\b/i;
+
+const ASSIGNMENT_RE =
+  /([A-Za-z_$][\w.$-]{0,127})[ \t]{0,32}[:=][ \t]{0,32}(?:(["'`])([^"'`\r\n]{12,512})\2|([A-Za-z0-9_./+=~!@#$%^&*?:,-]{12,512}))/g;
+
+const ENV_VAR_KEY_RE = /^[A-Z][A-Z0-9_]{2,}$/;
+
+const NON_SECRET_SHAPE = [
+  /^[0-9a-f]{7,40}$/i,
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
+  /^\d[\d.]+\d$/,
+  /^(?:[A-Za-z]+[-_/.])+[A-Za-z]+$/,
+  /^(?:~|\.{1,2}|\$\{?\w+\}?:?)?\/(?:[\w.-]+\/)*[\w.-]+$/,
+  /^[a-z][a-z0-9+.-]{1,30}:\/\/[^\s@]*$/i,
+  /^[\w.-]+(?:[\\/][\w.-]+)+\.[a-z0-9]{1,6}$/i,
+  /^\$(?:2[abxy]|1|5|6|apr1|argon2(?:i|d|id)|scrypt|pbkdf2(?:-sha\d+)?)\$/,
+  /^(?:pk\.eyJ|pk_(?:live|test)_)/,
+  /^6LeIxAcTAAAAA(?:JcZVRqyHh71UMIEGNQ_MXjiZKhI|GG-vFI1TnRWxMZNFuojJ4WifJWe)$/,
+];
+
+export const isNonSecretShape = (v        )          => NON_SECRET_SHAPE.some((r) => r.test(v.trim()));
+export const NAMES_ITS_ROLE_RE = /passw(?:or)?d|passwd|secret|token|api[_-]?key|credential/i;
+
+const ENTROPY_MIN_MIXED = 3.5;
+const ENTROPY_MIN_HEX = 3.0;
+
+export function isPlaceholderValue(v        )          {
+  const low = v.toLowerCase();
+  if (/(your|my|the|some|placeholder|example|sample|dummy|test|fake|changeme|redacted|x{3,64}|\.\.\.|todo|replace|insert|here|value|token|secret|key)$/i.test(low)) return true;
+  if (/^[x*.\-_0]+$/i.test(v)) return true;
+  if (/(.)\1{7,}/.test(v)) return true;
+  if (/^(?:abc|123|test|foo|bar|qwerty)/i.test(low)) return true;
+  return false;
+}
+
+export const SECRET_REFERENCE_RE =
+  /^(?:\$\{[^}]{1,120}\}|\$\([^)]{1,200}\)|\$[A-Za-z_][A-Za-z0-9_]{1,80}$|\{\{[^}]{1,160}\}\}|%\{[\w.]{1,80}\}|op:\/\/|vault:|sm:\/\/|awssm:\/\/|gcpsm:\/\/|azkv:\/\/|doppler:\/\/|infisical:\/\/|arn:aws[\w-]{0,20}:(?:secretsmanager|ssm):|projects\/[^/\s]{1,80}\/secrets\/|@Microsoft\.KeyVault\(|!vault\b)/i;
+export const ENCRYPTED_VALUE_RE = /^(?:ENC\[[A-Z0-9_]{3,20},|encrypted:|\$ANSIBLE_VAULT;|-----BEGIN (?:AGE ENCRYPTED FILE|PGP MESSAGE)-----|AgA[A-Za-z0-9+/]{100,})/;
+export const isSecretReference = (v        )          => SECRET_REFERENCE_RE.test(v.trim());
+export const isEncryptedValue = (v        )          => ENCRYPTED_VALUE_RE.test(v.trim());
+export const IDENTIFIER_SECRET_LABELS = new Set(['Twilio account SID', 'OpenAI project/org']);
+export const MAX_SECRET_HITS = 500;
+
+const URL_PLACEHOLDER_PASSWORD_RE =
+  /^(?:[$<[{%]|.*(?:passw|secret|change|replace|your|example|placeholder|insecure|dummy|sample|xxx|\*\*\*|todo|fill))/i;
+export function urlCredentialIsPlaceholder(match        )          {
+  const m = /:\/\/([^\s:@/]*):([^\s@/]*)@/.exec(match);
+  return !!m && (URL_PLACEHOLDER_PASSWORD_RE.test(m[2]) || m[2] === m[1]);
+}
+
+export function scanSecrets(text                           )              {
+  const s = text ?? '';
+  if (!s) return [];
+  const out              = [];
+  const claimed                          = [];
+
+  const overlaps = (a        , b        ) => claimed.some(([x, y]) => a < y && x < b);
+
+  for (const { name, re } of ALL_SECRET_PATTERNS) {
+    if (out.length >= MAX_SECRET_HITS) break;
+    const g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    for (const m of s.matchAll(g)) {
+      if (out.length >= MAX_SECRET_HITS) break;
+      const at = m.index ?? 0;
+      if (overlaps(at, at + m[0].length)) continue;
+
+      if (m[0].length < 200 && !/private key/i.test(name) && isPlaceholderValue(m[0])) continue;
+      if ((name === 'Database URL with password' || name === 'Credential in URL') && urlCredentialIsPlaceholder(m[0])) continue;
+      claimed.push([at, at + m[0].length]);
+      out.push({ name, match: m[0], index: at, kind: 'named', tier: 'structure' });
+    }
+  }
+
+  for (const m of s.matchAll(ASSIGNMENT_RE)) {
+    if (out.length >= MAX_SECRET_HITS) break;
+    const key = m[1];
+    const quoted = m[2] !== undefined;
+    const raw = (quoted ? m[3] : m[4]) ?? '';
+    const value = raw.replace(/[=]{1,64}$/, '');
+    const at = (m.index ?? 0) + m[0].lastIndexOf(raw);
+    if (overlaps(at, at + value.length)) continue;
+    if (!SECRET_KEY_RE.test(key)) continue;
+
+    if (!quoted && !ENV_VAR_KEY_RE.test(key)) continue;
+    if (value.length < 16 || /\s/.test(value)) continue;
+    if (isPlaceholderValue(value) || isSecretReference(value) || isEncryptedValue(value) || NAMES_ITS_ROLE_RE.test(value)) continue;
+    if (NON_SECRET_SHAPE.some((r) => r.test(value))) continue;
+    const isHex = /^[0-9a-f]+$/i.test(value);
+    const ent = shannonEntropy(value);
+    if (ent < (isHex ? ENTROPY_MIN_HEX : ENTROPY_MIN_MIXED)) continue;
+    claimed.push([at, at + value.length]);
+    out.push({ name: `High-entropy secret in "${key}"`, match: value, index: at, kind: 'entropy', tier: 'heuristic' });
+  }
+
+  return out.sort((a, b) => a.index - b.index);
+}
+

package/src/detect/signals/secrets.mjs

@@ -1,52 +1,5 @@
-export const SECRET_PATTERNS = [
 
-  { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },
-  { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
-  { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
-  { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
-
-  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
-  { name: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}/ },
-  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
-  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
-  { name: 'GitLab PAT', re: /\bglpat-[A-Za-z0-9_-]{20,}/ },
-  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/ },
-  { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
-
-  { name: 'AWS secret access key (keyed)', re: /\bAWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/ },
-
-  {
-    name: 'Database URL with password',
-    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)(?!([^\s:@/]+):\1@)(?!(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*:(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*@)[^\s:@/]+:[^\s:@/]{4,}@/i,
-  },
-  { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
-  { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]{0,80}?[\r\n]+\s*[A-Za-z0-9+/=]{32,}/ },
-
-  { name: 'Groq API key', re: /\bgsk_[A-Za-z0-9]{40,}/ },
-  { name: 'Replicate API token', re: /\br8_[A-Za-z0-9]{30,}/ },
-  { name: 'Perplexity API key', re: /\bpplx-[A-Za-z0-9]{32,}/ },
-  { name: 'Fireworks API key', re: /\bfw_[A-Za-z0-9]{20,}/ },
-  { name: 'xAI API key', re: /\bxai-[A-Za-z0-9]{40,}/ },
-  { name: 'LangSmith API key', re: /\blsv2_(?:pt|sk)_[A-Za-z0-9]{24,}_[A-Za-z0-9]{8,}/ },
-  { name: 'Pinecone API key', re: /\bpcsk_[A-Za-z0-9_]{30,}/ },
-  { name: 'OpenRouter API key', re: /\bsk-or-v1-[A-Za-z0-9]{32,}/ },
-  { name: 'DigitalOcean token', re: /\bdop_v1_[a-f0-9]{60,}/ },
-  { name: 'Shopify access token', re: /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{30,}/ },
-  { name: 'GitHub fine-grained PAT', re: /\bgithub_pat_[A-Za-z0-9_]{60,}/ },
-  { name: 'GitHub OAuth / refresh / server token', re: /\bgh[osur]_[A-Za-z0-9]{20,}/ },
-  { name: 'SendGrid API key', re: /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{40,}/ },
-  { name: 'Slack incoming webhook', re: /\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{20,}/ },
-  { name: 'Discord webhook', re: /\bdiscord(?:app)?\.com\/api\/webhooks\/\d{17,}\/[A-Za-z0-9_-]{40,}/ },
-  { name: 'Telegram bot token', re: /\b\d{8,12}:AA[A-Za-z0-9_-]{30,}/ },
-  { name: 'Sentry DSN with secret', re: /\bhttps:\/\/[a-f0-9]{32}(?::[a-f0-9]{32})?@[\w.-]*(?:sentry\.io|ingest\.[\w.-]+)\/\d+/ },
-  { name: 'Azure storage account key', re: /\bAccountKey\s*=\s*[A-Za-z0-9+/]{60,}={0,2}/ },
-  { name: 'JSON web token', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{20,}/ },
-  { name: 'Registry auth blob (docker config)', re: /"auth"\s*:\s*"[A-Za-z0-9+/]{24,}={0,2}"/ },
-  {
-    name: 'Provider API key (named env var)',
-    re: /\b(?:AZURE_OPENAI_API_KEY|MISTRAL_API_KEY|COHERE_API_KEY|CO_API_KEY|TOGETHER_API_KEY|DEEPSEEK_API_KEY|DD_API_KEY|DATADOG_API_KEY|TWILIO_AUTH_TOKEN|VERCEL_TOKEN|CLOUDFLARE_API_TOKEN|WEAVIATE_API_KEY|VOYAGE_API_KEY|NVIDIA_API_KEY|CEREBRAS_API_KEY|SAMBANOVA_API_KEY)\s*[=:]\s*["']?[A-Za-z0-9_-]{24,}\b/,
-  },
-];
+export { ALL_SECRET_PATTERNS as SECRET_PATTERNS } from './secret-scanner.mjs';
 
 export const PII_PATTERNS = [
   { name: 'Email address', re: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/ },

package/src/detect/signals/shell.mjs

@@ -28,7 +28,7 @@ export function targetsExternalNetwork(line) {
   });
 }
 
-const RM_RF_RE = /\brm\b(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*f|--force))/i;
+const RM_RF_RE = /(?<!\b(?:docker|podman|nerdctl|kubectl|helm|conda|brew)\s{1,4})\brm\b(?=[^\n;|&]{0,200}?\s(?:-[a-zA-Z]*r[a-zA-Z]*|--recursive)(?![\w-]))(?=[^\n;|&]{0,200}?\s(?:-[a-zA-Z]*f[a-zA-Z]*|--force)(?![\w-]))/i;
 
 export function rmTargetClass(line) {
   if (/\brm\s+-{1,2}[a-zA-Z][\w-]*\s*["'`,)\]}?!](?![\w./~$*-])/.test(line)) return 'local';
@@ -106,7 +106,7 @@ export const DANGEROUS_SHELL = [
   { name: 'Force-deletes a cloud storage bucket (aws s3 rb --force)', re: /\b(aws\s+s3\s+rb|gsutil\s+(rm\s+-r|rb)|az\s+storage\s+(account|container)\s+delete)\b[^\n]{0,80}(--force|--yes|-f\b|\bs3:\/\/|\bgs:\/\/)/i, severity: 'HIGH' },
   { name: 'Force-pushes over a protected branch (rewrites shared history)', re: /\bgit\s+push\b[^\n]{0,80}(--force\b(?!-with-lease)|(?:^|\s)-f\b)[^\n]{0,60}\b(main|master|release|prod(uction)?)\b/i, severity: 'MEDIUM' },
 
-  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /\brm\b(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*f|--force))(?=[^\n;|&]{0,200}(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
+  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /(?<!\b(?:docker|podman|nerdctl|kubectl|helm|conda|brew)\s{1,4})\brm\b(?=[^\n;|&]{0,200}?\s(?:-[a-zA-Z]*r[a-zA-Z]*|--recursive)(?![\w-]))(?=[^\n;|&]{0,200}?\s(?:-[a-zA-Z]*f[a-zA-Z]*|--force)(?![\w-]))(?=[^\n;|&]{0,200}(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
   { name: 'Fork bomb (process-exhaustion DoS)', re: /(:|\b[a-z_][a-z0-9_]*)\s*\(\s*\)\s*\{\s*\1\s*[^\n}]*\|\s*\1[^\n}]*&\s*\}\s*;\s*\1/i, severity: 'HIGH' },
   { name: 'Writes over a raw disk device (data destruction)', re: /\b(dd\b[^\n]{0,80}\bof=\/dev\/[sh]d|mkfs(\.\w+)?\s+[^\n]{0,40}\/dev\/|>\s*\/dev\/[sh]d[a-z])/i, severity: 'CRITICAL' },
   { name: 'Reads the system password-hash / sudo policy file', re: /\b(cat|less|more|head|tail|strings|xxd|od|grep|awk|sed|cp|scp|tar)\b[^\n]{0,80}\/etc\/(shadow|gshadow|sudoers(\.d)?)\b/i, severity: 'HIGH' },
@@ -132,6 +132,6 @@ export const DANGEROUS_SHELL = [
   { name: 'Kills the audit / EDR agent (anti-forensics)', re: /\b(?:pkill|killall|kill)\b[^\n]{0,40}\b(?:auditd|osqueryd?|falcon-sensor|falconctl|wazuh|ossec|filebeat|splunkd|sysmon|crowdstrike|carbonblack|cbagent)\b|\bSet-MpPreference\b[^\n]{0,60}-Disable\w*\s+\$?true/i, severity: 'HIGH' },
   { name: 'Downloads and executes through a signed system binary (LOLBin)', re: /\bcertutil\b[^\n]{0,80}-urlcache\b|\bbitsadmin\b[^\n]{0,80}\/transfer\b|\bmshta\b\s+https?:\/\/|\bregsvr32\b[^\n]{0,60}\/i:\s*https?:\/\/|\brundll32\b[^\n]{0,60}\b(?:url\.dll|javascript:)|\bwmic\b[^\n]{0,60}\bprocess\s+call\s+create\b|\bmsiexec\b[^\n]{0,40}\/i\s+https?:\/\//i, severity: 'CRITICAL' },
   { name: 'PowerShell runs a base64-encoded command', re: /\bpowershell(?:\.exe)?\b[^\n]{0,80}\s-(?:e|ec|enc|encoded|encodedcommand)\b/i, severity: 'CRITICAL' },
-  { name: 'Interpreter opens a raw socket (reverse shell)', re: /\b(?:perl|ruby|php|python[0-9.]*|node)\b[^\n]{0,40}-(?:e|r|c)\b[^\n]{0,200}\b(?:fsockopen|socket\s*\(|Socket::|SOCK_STREAM|net\.connect|createConnection)\b/i, severity: 'CRITICAL' },
+  { name: 'Interpreter opens a raw socket (reverse shell)', re: /\b(?:perl|ruby|php|python[0-9.]*|node)\b[^\n]{0,40}-(?:e|r|c)\b[^\n]{0,200}(?:\bfsockopen|\bsocket\s*\(|\bSocket::|\bSOCK_STREAM\b|\bnet\.connect|\bcreateConnection\b)/i, severity: 'CRITICAL' },
   { name: 'Netcat listener or command-execution flag', re: /\bn?c(?:at)?\b[^\n]{0,40}\s-\w*[ec]\s+\S{0,30}(?:sh|bash|cmd|powershell)\b|\bn?c(?:at)?\b[^\n]{0,20}\s-\w*l\w*\s*(?:-\w+\s*)*\d{2,5}\b/i, severity: 'HIGH' },
 ];

package/src/gate/advisories.mjs

@@ -0,0 +1,16 @@
+import { grade } from '../detect/guard-signals.mjs';
+import { lineOf } from '../detect/signals/lines.mjs';
+import { advisoriesDisabled, mcpAdvisoryFindings } from '../detect/signals/mcp-advisories.mjs';
+
+
+export async function withMcpAdvisories(local, { content, path, kind, flags = {}, fetchImpl } = {}) {
+  if (!['mcp', 'auto', undefined].includes(kind) || advisoriesDisabled(flags)) return { local, advisories: 'skipped' };
+  const { status, findings } = await mcpAdvisoryFindings(content, path ?? '', fetchImpl ? { fetchImpl } : {});
+  if (!findings.length) return { local, advisories: status };
+  const seen = new Set(local.findings.map((f) => f.title));
+  const added = findings
+    .filter((f) => !seen.has(f.title))
+    .map((f) => ({ severity: f.severity, title: f.title, remediationText: f.remediationText, ...(lineOf(content, f.anchor) ? { line: lineOf(content, f.anchor) } : {}) }));
+  const all = [...local.findings, ...added];
+  return { local: { ...local, ...grade(all), findings: all }, advisories: status };
+}

package/src/gate/batch.mjs

@@ -7,6 +7,7 @@ import { localGate } from '../detect/guard-signals.mjs';
 import { applyRepoPolicy, loadRepoPolicy } from './repo-policy.mjs';
 import { localAsGateResult } from './result.mjs';
 import { collectLocalSast, mergeSastIntoResult } from './sast.mjs';
+import { withMcpAdvisories } from './advisories.mjs';
 import { loadBaseline, loadIgnoreRules, suppressResult } from './suppressions.mjs';
 
 const DEFAULT_CONCURRENCY = 8;
@@ -122,6 +123,15 @@ export async function gateArtifactList(artifacts, { apiKey, url, env, flags, roo
   const prepared = analyseLocally(artifacts, quiet);
   const { verdicts, rejected, backendDown } = await requestServerVerdicts(prepared, { apiKey, url, env, flags, quiet });
 
+  let advisoryOutage = false;
+  await Promise.all(prepared.map(async (p, i) => {
+    if (verdicts[i] || p.artifact.kind !== 'mcp') return;
+    const { local, advisories } = await withMcpAdvisories(p.local, { content: p.content, path: p.artifact.rel, kind: 'mcp', flags });
+    p.local = local;
+    if (advisories === 'unavailable') advisoryOutage = true;
+  }));
+  if (advisoryOutage && !quiet) console.log(`  ${yellow('⚠')} ${dim('Advisory lookup (OSV) unreachable - pinned MCP packages were not checked for published CVEs.')}`);
+
   const results = [];
   let blocked = 0;
   let flagged = 0;

package/src/gate/environment.mjs

@@ -1,32 +1,10 @@
-import { execSync } from 'node:child_process';
+import { git } from '../core/git-exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 
-export const GATE_KINDS = ['mcp', 'skill', 'command', 'subagent', 'hook', 'rules', 'agent-card', 'memory', 'auto'];
-
-/**
- * ⚠ A CLOUD AGENT SESSION IS NOT A DEVELOPER MACHINE, and until this existed it
- * reported as one. Claude Code on the web runs in an EPHEMERAL container: fresh
- * $HOME, no `shomra` config, a hostname nobody will ever see again. It carries
- * no CI variables, so it fell through to LOCAL - and an operator counting
- * "screened laptops" was counting containers that no longer exist.
- *
- * ⚠ CI IS CHECKED FIRST and stays first. A cloud session driven by a GitHub
- * Action is CI: that branch carries repo, ref and commit, which is the stronger
- * attribution. REMOTE is what is left when nothing else names where this ran.
- */
-/**
- * ⚠ ONE ENTRY PER RUNTIME, and only where the variable has been SEEN. A marker
- * invented from a vendor's docs either never fires - useless - or fires on a
- * name something else uses, which labels a real laptop as an ephemeral
- * container and puts a `floor` on a machine the org actually owns. Add a row
- * here once somebody has read the variable out of a live session of that
- * runtime; until then that runtime uses SHOMRA_ENVIRONMENT below, which is the
- * whole reason the override exists.
- *
- * `verified` records who has actually seen it, so the next person can tell a
- * confirmed marker from an optimistic one.
- */
+export const GATE_KINDS = ['mcp', 'skill', 'command', 'subagent', 'hook', 'rules', 'agent-card', 'memory', 'plugin', 'tool-manifest', 'model-config', 'extension', 'workflow', 'guardrail', 'framework', 'auto'];
+
+
 export const REMOTE_RUNTIMES = [
   {
     runner: 'claude-code-cloud',
@@ -37,13 +15,6 @@ export const REMOTE_RUNTIMES = [
   },
 ];
 
-/**
- * ⚠ CODESPACES AND DEVCONTAINERS ARE DELIBERATELY ABSENT. They are containers,
- * but they PERSIST between sessions, can be enrolled, and their guard survives
- * to report a window it spent blind - which is the whole distinction REMOTE
- * draws. Filing them here would put "we cannot vouch for its silence" on
- * machines that can in fact vouch for it.
- */
 export function remoteRunner(e = process.env) {
   for (const rt of REMOTE_RUNTIMES) {
     for (const key of rt.vars) if (String(e?.[key] ?? '').trim()) return rt.runner;
@@ -61,15 +32,7 @@ export function declaredEnvironment(e = process.env) {
   return v in ENV_RANK ? v : null;
 }
 
-/**
- * ⚠⚠ THE OVERRIDE MAY ONLY EVER RAISE. `SHOMRA_ENVIRONMENT` exists so an
- * operator can declare a runtime we do not yet detect - a cloud agent from a
- * vendor whose markers nobody has read. Letting it go the other way would make
- * it a switch that relabels a detected ephemeral container as a trusted laptop,
- * clearing the `floor` its unreportable silence earns. That is the same
- * privilege-reduction shape `mayRaiseOnly` and `foldTimeout` refuse on the
- * server, and it would be reachable by anything that can set an env var.
- */
+
 export function mergeEnvironment(detected, declared) {
   if (!declared) return detected;
   return ENV_RANK[declared] > ENV_RANK[detected] ? declared : detected;
@@ -147,16 +110,8 @@ export function detectEnv(env) {
 }
 
 function gitContext() {
-  const run = (args) => {
-    try {
-      return execSync(`git ${args}`, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 2000 })
-        .toString()
-        .trim();
-    } catch {
-      return undefined;
-    }
-  };
-  const origin = run('config --get remote.origin.url');
+  const run = (args) => git(args, { timeout: 2000 })?.trim();
+  const origin = run(['config', '--get', 'remote.origin.url']);
   let repo;
   if (origin) {
     const m = origin.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
@@ -165,7 +120,7 @@ function gitContext() {
 
   let repoUrl = origin || undefined;
   if (repoUrl) repoUrl = repoUrl.replace(/^([a-z][\w+.-]*:\/\/)[^/@]*@/i, '$1');
-  return { repo, repoUrl, ref: run('rev-parse --abbrev-ref HEAD'), commit: run('rev-parse HEAD') };
+  return { repo, repoUrl, ref: run(['rev-parse', '--abbrev-ref', 'HEAD']), commit: run(['rev-parse', 'HEAD']) };
 }
 
 export function collectSiblings(fullTarget, relPath) {