@shomra/agent 0.3.29 → 0.3.30

package/src/detect/signals/agent-frameworks.mjs

@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import { parseYaml } from '../../core/yaml-lite.mjs';
+
+const PROMPT_FIELD_RE = /^(?:template|system_?message|system_?prompt|systemMessagePrompt|humanMessagePrompt|prompt|instructions?|agent_description)$/i;
+const MAX_PROMPTS = 40;
+
+function takePrompts(into                , node        , fields                     , read                     )       {
+  for (const [k, v] of Object.entries(fields).slice(0, 200)) {
+    if (into.prompts.length >= MAX_PROMPTS || !PROMPT_FIELD_RE.test(k)) continue;
+    const text = read(v);
+    if (typeof text === 'string' && text.trim().length > 8) into.prompts.push({ node, text: text.slice(0, 8000) });
+  }
+}
+
+const MAX = 200;
+const obj = (v         )                             => (v && typeof v === 'object' && !Array.isArray(v) ? (v                       ) : null);
+const arr = (v         )        => (Array.isArray(v) ? v.slice(0, MAX) : []);
+const isTrue = (v         ) => v === true || (typeof v === 'string' && /^true$/i.test(v.trim()));
+const names = (v         )           => arr(v).map((t) => (typeof t === 'string' ? t : String(obj(t)?.name ?? obj(t)?.id ?? obj(t)?.provider ?? ''))).filter(Boolean).slice(0, 40);
+
+function parse(path        , text        )                             {
+  const t = text.replace(/^/, '');
+  if (/\.json$/i.test(path)) { try { return obj(JSON.parse(t)); } catch { return null; } }
+  if (/\.ya?ml$/i.test(path)) return obj(parseYaml(t));
+  return null;
+}
+
+const CREW_FIELDS = ['role', 'goal', 'backstory'];
+
+function isCrewAgentMap(doc                     )          {
+  const vals = Object.values(doc).slice(0, 50);
+  return vals.length > 0 && vals.every((v) => obj(v)) && vals.some((v) => CREW_FIELDS.filter((k) => k in v).length >= 2);
+}
+
+export function agentFrameworkOf(path        , text                           , doc                             )                        {
+  if (!text || !/\.(json|ya?ml)$/i.test(path)) return null;
+  if (!/agent_class|autogen_|"nodes"|nodes\s*:|kind\s*:\s*app|backstory|langgraph|graphs|code_execution/i.test(text)) return null;
+  const d = doc === undefined ? parse(path, text) : doc;
+  if (!d) return null;
+  if (typeof d.agent_class === 'string' || (typeof d.instruction === 'string' && typeof d.model === 'string' && (Array.isArray(d.sub_agents) || Array.isArray(d.tools)))) return 'adk';
+  if (typeof d.provider === 'string' && /^autogen_(?:agentchat|ext|core)\./.test(d.provider)) return 'autogen';
+  if (d.kind === 'app' && obj(d.app) && (obj(d.workflow) || obj(d.model_config))) return 'dify';
+  const data = obj(d.data);
+  if (data && Array.isArray(data.nodes) && arr(data.nodes).some((n) => typeof obj(obj(n)?.data)?.type === 'string')) return 'langflow';
+  if (Array.isArray(d.nodes) && Array.isArray(d.edges) && arr(d.nodes).some((n) => typeof obj(obj(n)?.data)?.category === 'string' && typeof obj(obj(n)?.data)?.name === 'string')) return 'flowise';
+  if (obj(d.graphs) && /langgraph/i.test(path + text)) return 'langgraph';
+  if (isCrewAgentMap(d) || Array.isArray(d.agents) || obj(d.agents)) return /crew|backstory/i.test(path + text) ? 'crewai' : 'agent-framework';
+  return null;
+}
+
+function crewAgents(doc                     )                   {
+  const entries                  = Array.isArray(doc.agents)
+    ? arr(doc.agents).map((a, i) => [String(obj(a)?.name ?? obj(a)?.role ?? `agent ${i + 1}`), a])
+    : obj(doc.agents)
+      ? Object.entries(doc.agents)
+      : Object.entries(doc).filter(([, v]) => obj(v) && CREW_FIELDS.some((k) => k in v));
+  return entries.slice(0, 40).map(([name, raw]) => {
+    const a = obj(raw) ?? {};
+    const exec = isTrue(a.allow_code_execution);
+    const unsafe = String(a.code_execution_mode ?? '').toLowerCase() === 'unsafe';
+    return {
+      name,
+      role: typeof a.role === 'string' ? a.role.trim().slice(0, 120) : null,
+      tools: names(a.tools),
+      delegates: isTrue(a.allow_delegation ?? a.allowDelegation),
+      codeExec: exec ? (unsafe ? 'host' : 'container') : null,
+      codeExecWhy: exec ? `allow_code_execution: true, code_execution_mode: ${unsafe ? 'unsafe' : a.code_execution_mode ?? 'safe (default)'}` : null,
+    };
+  });
+}
+
+function adkAgents(doc                     )                   {
+  const own                 = {
+    name: String(doc.name ?? 'root_agent'),
+    role: typeof doc.description === 'string' ? doc.description.slice(0, 120) : null,
+    tools: names(doc.tools),
+    delegates: arr(doc.sub_agents).length > 0 && !isTrue(doc.disallow_transfer_to_peers),
+    codeExec: null,
+    codeExecWhy: null,
+  };
+  return [own];
+}
+
+function autogenAgents(doc                     )                   {
+  const agents                   = [];
+  const visit = (n     , depth        ) => {
+    if (depth > 16 || agents.length >= 40 || !n || typeof n !== 'object') return;
+    if (Array.isArray(n)) { for (const x of n.slice(0, MAX)) visit(x, depth + 1); return; }
+    const provider = typeof n.provider === 'string' ? n.provider : '';
+    const cfg = obj(n.config) ?? {};
+    if (/\.agents\./.test(provider)) {
+      const exec = executorOf(cfg);
+      agents.push({ name: String(cfg.name ?? provider.split('.').pop()), role: typeof cfg.description === 'string' ? cfg.description.slice(0, 120) : null, tools: names(cfg.tools), delegates: false, codeExec: exec.where, codeExecWhy: exec.why });
+    }
+    for (const v of Object.values(n)) visit(v, depth + 1);
+  };
+  visit(doc, 0);
+  return agents;
+}
+
+function executorOf(cfg                     )                                               {
+  const found           = [];
+  const visit = (n     , depth        ) => {
+    if (depth > 10 || !n || typeof n !== 'object') return;
+    if (typeof n.provider === 'string' && /code_executors?\.|CodeExecution|Executor/i.test(n.provider)) found.push(n.provider);
+    for (const v of Object.values(n)) visit(v, depth + 1);
+  };
+  visit(cfg, 0);
+  const local = found.find((p) => /LocalCommandLineCodeExecutor|JupyterCodeExecutor|\.local\./.test(p));
+  if (local) return { where: 'host', why: `${local.split('.').pop()} runs generated code as the host process` };
+  const docker = found.find((p) => /Docker/i.test(p));
+  if (docker) return { where: 'container', why: `${docker.split('.').pop()}` };
+  if (found.length) return { where: 'sandbox', why: found[0].split('.').pop() ?? null };
+  return { where: null, why: null };
+}
+
+const LANGFLOW_INTERPRETER_RE = /^(?:PythonREPL(?:Component|Tool)?|PythonInterpreter|PythonCodeStructuredTool|CodeInterpreter)$/i;
+const USER_INPUT_TYPES_RE = /^(?:ChatInput|TextInput|Webhook(?:Component)?|APIRequest|start|trigger-webhook|chatflow|chatInput)$/i;
+
+function reachableFrom(starts          , edges                                      )              {
+  const next = new Map                  ();
+  for (const e of edges.slice(0, 5000)) next.set(e.source, [...(next.get(e.source) ?? []), e.target]);
+  const seen = new Set        ();
+  const queue = [...starts];
+  while (queue.length && seen.size < 5000) {
+    const id = queue.shift() ;
+    for (const t of next.get(id) ?? []) if (!seen.has(t)) { seen.add(t); queue.push(t); }
+  }
+  return seen;
+}
+
+function langflow(doc                     , m                )       {
+  const data = obj(doc.data) ?? {};
+  const nodes = arr(data.nodes).map(obj).filter(Boolean)                         ;
+  const edges = arr(data.edges).map((e) => ({ source: String(obj(e)?.source ?? ''), target: String(obj(e)?.target ?? '') }));
+  m.nodeCount = nodes.length;
+  const inputs = nodes.filter((n) => USER_INPUT_TYPES_RE.test(String(obj(n.data)?.type ?? ''))).map((n) => String(n.id));
+  const reach = reachableFrom(inputs, edges);
+  for (const n of nodes) {
+    const d = obj(n.data) ?? {};
+    const type = String(d.type ?? '');
+    const template = obj(obj(d.node)?.template) ?? {};
+    takePrompts(m, String(obj(d.node)?.display_name ?? type), template, (v) => obj(v)?.value);
+    const interpreter = LANGFLOW_INTERPRETER_RE.test(type);
+    const source = typeof obj(template.code)?.value === 'string' ? String(obj(template.code) .value) : '';
+    const extra = [obj(template.python_code)?.value, obj(template.tool_code)?.value].filter((x) => typeof x === 'string').join('\n');
+    if (!interpreter && !source && !extra) continue;
+    m.codeNodes.push({
+      name: String(obj(d.node)?.display_name ?? type), type, language: 'python', code: [source, extra].filter(Boolean).join('\n'),
+      interpreter, fromUserInput: reach.has(String(n.id)), sandboxed: false, ...langflowProvenance(d, type, source),
+    });
+  }
+}
+
+function langflowProvenance(d                     , type        , source        )                                                               {
+  const node = obj(d.node) ?? {};
+  const declared = typeof obj(node.metadata)?.code_hash === 'string' ? String(obj(node.metadata) .code_hash) : null;
+  const actual = source ? createHash('sha256').update(source, 'utf8').digest('hex').slice(0, 12) : null;
+  const module = typeof obj(node.metadata)?.module === 'string' ? String(obj(node.metadata) .module) : null;
+  if (actual && declared && actual !== declared) return { provenance: 'altered', declaredHash: declared, actualHash: actual };
+
+  const custom = /^Custom/i.test(type) || isTrue(node.edited) || (module !== null && !/^(?:lfx|langflow)\.components\./.test(module));
+  return { provenance: custom ? 'custom' : 'claimed-stock', declaredHash: declared, actualHash: actual };
+}
+
+const FLOWISE_CODE_INPUTS = ['javascriptFunction', 'customToolFunc', 'ifFunction', 'elseFunction', 'customFunctionJavascriptFunction', 'code'];
+
+function flowise(doc                     , m                )       {
+  const nodes = arr(doc.nodes).map(obj).filter(Boolean)                         ;
+  const edges = arr(doc.edges).map((e) => ({ source: String(obj(e)?.source ?? ''), target: String(obj(e)?.target ?? '') }));
+  m.nodeCount = nodes.length;
+  const inputs = nodes.filter((n) => /chat|start|webhook/i.test(String(obj(n.data)?.name ?? ''))).map((n) => String(n.id));
+  const reach = reachableFrom(inputs, edges);
+  for (const n of nodes) {
+    const d = obj(n.data) ?? {};
+    const name = String(d.name ?? '');
+    const inp = obj(d.inputs) ?? {};
+    const code = FLOWISE_CODE_INPUTS.map((k) => inp[k]).filter((x) => typeof x === 'string' && x.trim()).join('\n');
+    takePrompts(m, String(d.label ?? name), inp, (v) => v);
+    const interpreter = /codeInterpreter|pythonInterpreter/i.test(name);
+    if (!code && !interpreter) {
+      if (/^(?:requestsGet|requestsPost|httpRequest)/i.test(name) && typeof inp.url === 'string') m.httpUrls.push(inp.url);
+      continue;
+    }
+    m.codeNodes.push({ name: String(d.label ?? name), type: name, language: 'javascript', code, interpreter, fromUserInput: reach.has(String(n.id)), sandboxed: /E2B/i.test(name) });
+  }
+}
+
+function dify(doc                     , m                )       {
+  const wf = obj(doc.workflow) ?? {};
+  const graph = obj(wf.graph) ?? {};
+  const nodes = arr(graph.nodes).map(obj).filter(Boolean)                         ;
+  const edges = arr(graph.edges).map((e) => ({ source: String(obj(e)?.source ?? ''), target: String(obj(e)?.target ?? '') }));
+  m.nodeCount = nodes.length;
+  const starts = nodes.filter((n) => USER_INPUT_TYPES_RE.test(String(obj(n.data)?.type ?? ''))).map((n) => String(n.id));
+  const reach = reachableFrom(starts, edges);
+  for (const n of nodes) {
+    const d = obj(n.data) ?? {};
+    const type = String(d.type ?? '');
+    if (type === 'code' && typeof d.code === 'string') {
+      m.codeNodes.push({ name: String(d.title ?? 'code'), type, language: /javascript/i.test(String(d.code_language)) ? 'javascript' : 'python', code: d.code, interpreter: false, fromUserInput: reach.has(String(n.id)), sandboxed: true });
+    }
+    if (type === 'http-request' && typeof d.url === 'string') m.httpUrls.push(d.url);
+    if (type === 'llm' || type === 'agent' || type === 'agent-v2') {
+      const tpl = Array.isArray(d.prompt_template) ? arr(d.prompt_template).map((p) => obj(p)?.text).filter((x) => typeof x === 'string').join('\n') : d.prompt_template;
+      takePrompts(m, String(d.title ?? type), { prompt: tpl, instruction: d.instruction ?? obj(obj(d.agent_parameters)?.instruction)?.value }, (v) => v);
+    }
+    if (type === 'agent' || type === 'agent-v2') m.agents.push({ name: String(d.title ?? 'agent'), role: null, tools: names(obj(d.agent_parameters)?.tools?.value ?? d.tools), delegates: false, codeExec: null, codeExecWhy: null });
+  }
+  for (const v of arr(wf.environment_variables).map(obj)) {
+    if (v && String(v.value_type) === 'secret' && typeof v.value === 'string' && v.value.trim()) m.exportedSecrets.push(String(v.name ?? 'secret'));
+  }
+}
+
+export function agentFrameworkModel(path        , text        , fw                        )                        {
+  const doc = parse(path, text);
+  const framework = fw ?? agentFrameworkOf(path, text, doc);
+  if (!doc || !framework) return null;
+  const m                 = { framework, agents: [], graphs: [], codeNodes: [], httpUrls: [], exportedSecrets: [], nodeCount: 0, prompts: [] };
+  switch (framework) {
+    case 'adk': m.agents = adkAgents(doc); break;
+    case 'autogen': m.agents = autogenAgents(doc); break;
+    case 'langflow': langflow(doc, m); break;
+    case 'flowise': flowise(doc, m); break;
+    case 'dify': dify(doc, m); break;
+    default: m.agents = crewAgents(doc); break;
+  }
+  if (obj(doc.graphs)) m.graphs = Object.keys(doc.graphs).slice(0, 20);
+  return m;
+}
+

package/src/detect/signals/agent-graph-surface.mjs

@@ -0,0 +1,113 @@
+import { agentFrameworkModel,                                                         } from './agent-frameworks.mjs';
+import { locate } from './agentic-shim.mjs';
+import { codeFindings, describesAt, egressFindings, prohibitsAt, shellFindings, ssrfFindings, textFindings } from './agentic-shim.mjs';
+
+const FRAMEWORK_LABEL                                 = {
+  crewai: 'CrewAI', langgraph: 'LangGraph', autogen: 'AutoGen', adk: 'Google ADK', langflow: 'Langflow',
+  flowise: 'Flowise', dify: 'Dify', 'agent-framework': 'agent framework',
+};
+
+const STRUCTURAL_SIGNAL_RE = /directive tag|forced output|verdict coercion/i;
+
+const CONDITIONAL_DEFENCE_RE =
+  /\b(?:if|when|whenever|should)\b[^.\n]{0,160}\b(?:attempts?|tries|try|asks?|tells?|instructs?|contains?|says?|claims?)\b|\b(?:prompt[\s-]injection|jailbreak(?:s|ing)?|confidentiality)\s*[:—-]|\b(?:never|do not|don't|must not|refuse to)\s+(?:[\w-]+,?\s+(?:or\s+)?){0,5}(?:reveal|share|disclose|repeat|recite|follow|comply|obey|execute|print|expose)\b/i;
+function instructionLines(text        )         {
+  return text.split('\n').filter((l) => !prohibitsAt(l) && !describesAt(l) && !CONDITIONAL_DEFENCE_RE.test(l)).join('\n');
+}
+
+function hostExecFindings(a                  , m                , label        )                    {
+  const out                    = [];
+  const delegation = m.agents.some((g) => g.delegates);
+  for (const g of m.agents.filter((x) => x.codeExec === 'host' || x.codeExec === 'container').slice(0, 10)) {
+    const host = g.codeExec === 'host';
+    out.push({
+      class: host ? 'OVER_PERMISSIONED' : 'INSECURE_CONFIG',
+      severity: host ? 'CRITICAL' : 'LOW',
+      title: host ? `${label} agent "${g.name}" runs generated code on the host` : `${label} agent "${g.name}" executes generated code in a container`,
+      detail: host
+        ? `${g.codeExecWhy}. Whatever the model writes - including code an injected document or page asked for - runs as the process that started the agents: same filesystem, same credentials, same network.${delegation ? ' Delegation is on in this configuration, so any agent can hand work to this one and reach its executor.' : ''}`
+        : `${g.codeExecWhy}. Container execution is the right boundary; confirm what the container mounts and what network it reaches, because generated code runs with exactly that.`,
+      remediationText: host
+        ? 'Run generated code in an isolated sandbox (a container without host mounts or credentials, or a remote sandbox such as E2B / Modal), or remove code execution from the agent.'
+        : 'Keep the executor image minimal, mount only a scratch directory, and deny network egress it does not need.',
+      remediationTier: host ? 1 : 3,
+      evidence: { agent: g.name, codeExec: g.codeExec, why: g.codeExecWhy, framework: m.framework, path: a.path, ...locate(host ? /unsafe|LocalCommandLine|Jupyter/ : /allow_code_execution|Docker/, a.content) },
+    });
+  }
+  return out;
+}
+
+const MAX_CODE_NODES = 200;
+
+function codeNodeFindings(a                  , m                , label        , n          )                    {
+  const out                    = [];
+  if (n.interpreter) {
+    out.push({
+      class: 'OVER_PERMISSIONED',
+      severity: n.fromUserInput && !n.sandboxed ? 'CRITICAL' : n.sandboxed ? 'MEDIUM' : 'HIGH',
+      title: n.fromUserInput
+        ? `${label} flow "${a.name}" wires user input into a code interpreter ("${n.name}")`
+        : `${label} flow "${a.name}" contains a code interpreter ("${n.name}")`,
+      detail:
+        `The ${n.type} node executes ${n.language === 'python' ? 'Python' : 'code'} it is handed at run time${n.sandboxed ? ' in a remote sandbox' : ' inside the flow server\'s own process'}.` +
+        (n.fromUserInput ? ' It is reachable from the flow\'s chat / API input, so anyone who can send the flow a message can make it run code - with the server\'s environment variables, stored credentials and network.' : ' Anything that can steer the model driving it can choose the code.'),
+      remediationText: 'Remove the interpreter from flows that serve untrusted users, or point it at an isolated sandbox with no credentials; never expose such a flow on an unauthenticated endpoint.',
+      remediationTier: 1,
+      evidence: { node: n.name, type: n.type, fromUserInput: n.fromUserInput, sandboxed: n.sandboxed, framework: m.framework, path: a.path, ...locate(n.type, a.content) },
+    });
+  }
+  if (n.provenance === 'altered') {
+    out.push({
+      class: 'INSECURE_CONFIG',
+      severity: 'LOW',
+      title: `${label} node "${n.name}" runs code that no longer matches its declared hash`,
+      detail: `The export declares code_hash ${n.declaredHash} but the code it carries hashes to ${n.actualHash}. Langflow gates custom code on that hash server-side, so this node is the flow's own code - edited in place, or altered after export - and is graded as such rather than as a shipped component.`,
+      remediationText: 'Review the node\'s code; if it was not deliberately customised, replace it with the stock component.',
+      remediationTier: 3,
+      evidence: { node: n.name, declaredHash: n.declaredHash, actualHash: n.actualHash, path: a.path, ...locate(n.declaredHash ?? n.name, a.content) },
+    });
+  }
+  if (!n.code.trim()) return out;
+  const where = `${n.type} node "${n.name}" of ${label} flow "${a.name}"`;
+  const virtualPath = `${a.path}#${n.name.replace(/[^\w.-]+/g, '_')}.${n.language === 'javascript' ? 'js' : 'py'}`;
+  const all = [...shellFindings(a, n.code, where), ...codeFindings(a, virtualPath, n.code, { context: 'agent' }), ...egressFindings(a, n.code, where)];
+
+  const graded = n.provenance === 'claimed-stock' ? all.filter((f) => f.severity === 'HIGH' || f.severity === 'CRITICAL') : all;
+  for (const f of graded.slice(0, 6)) {
+    const ev = (f.evidence ?? {})                       ;
+
+    if (typeof ev.snippet === 'string' && !(a.content ?? '').includes(ev.snippet)) { delete ev.snippet; delete ev.snippetStartLine; delete ev.line; }
+    out.push({ ...f, severity: n.sandboxed && f.severity === 'CRITICAL' ? 'HIGH' : f.severity, evidence: { ...ev, node: n.name, sandboxed: n.sandboxed, provenance: n.provenance ?? 'custom', ...(ev.line == null ? locate(n.name, a.content) : {}) } });
+  }
+  return out;
+}
+
+export function frameworkFindings(a                  )                    {
+  const m = agentFrameworkModel(a.path, a.content ?? '', (a.meta?.framework                              ) ?? null);
+  if (!m) return [];
+  const label = FRAMEWORK_LABEL[m.framework];
+  const out                    = hostExecFindings(a, m, label);
+  for (const n of m.codeNodes.slice(0, MAX_CODE_NODES)) out.push(...codeNodeFindings(a, m, label, n));
+
+  for (const p of m.prompts) {
+    for (const f of textFindings(a, instructionLines(p.text), 'PROMPT_INJECTION').filter((x) => x.class === 'PROMPT_INJECTION')) {
+      const signals = ((f.evidence?.signals                        ) ?? []).filter((s) => !STRUCTURAL_SIGNAL_RE.test(s));
+      if (!signals.length) continue;
+      out.push({ ...f, title: `Injected instruction in the "${p.node}" prompt of ${label} flow "${a.name}"`, evidence: { ...(f.evidence ?? {}), signals, node: p.node, path: a.path } });
+    }
+  }
+  for (const url of [...new Set(m.httpUrls)].slice(0, 10)) out.push(...ssrfFindings(a, url, `HTTP node of ${label} flow "${a.name}"`));
+  if (m.exportedSecrets.length) {
+    out.push({
+      class: 'SECRET_EXPOSURE',
+      severity: 'HIGH',
+      title: `${label} export "${a.name}" contains secret variable values`,
+      detail: `${m.exportedSecrets.slice(0, 6).join(', ')} ${m.exportedSecrets.length === 1 ? 'is a' : 'are'} secret-typed environment variable${m.exportedSecrets.length === 1 ? '' : 's'} exported with ${m.exportedSecrets.length === 1 ? 'its' : 'their'} value. Anyone the DSL file is shared with, or any repository it is committed to, holds the credential.`,
+      remediationText: 'Rotate the credentials and re-export without secrets (Dify leaves secret values empty unless include_secret is set).',
+      remediationTier: 1,
+      evidence: { variables: m.exportedSecrets, path: a.path, ...locate(m.exportedSecrets[0], a.content) },
+    });
+  }
+  return out;
+}
+