@shomra/agent 0.3.6 → 0.3.7

package/code-sast.mjs

@@ -278,15 +278,25 @@ const PY_RULES = [
   },
   {
     id: 'python.network_egress',
-    title: 'Network egress from model code',
-    severity: 'HIGH',
+    title: 'Network egress',
+    // ⚠ MEDIUM, and titled 'Network egress' NOT 'from model code' — in lockstep
+    // with checks/code-sast.ts (python.network_egress). This rule fires on ANY
+    // `requests.get`/`httpx`/`socket`, and this SAST tier runs over EVERY source
+    // file in a repo, not just model loaders — so an ordinary RAG/app file that
+    // makes an outbound call (`benign/src/rag.py`) got a HIGH "from model code"
+    // finding for doing the most normal thing an application does. A bare
+    // outbound call is an informational capability standalone; it is DANGEROUS
+    // only chained with a remote-code load, which `chain.remote_code_egress`
+    // already escalates to CRITICAL. Drifting this back to HIGH re-breaks the
+    // parity the local-mirror bench exists to protect.
+    severity: 'MEDIUM',
     category: 'egress',
-    confidence: 0.6,
+    confidence: 0.5,
     re: /\b(requests|httpx)\.(get|post|put|request)\s*\(|\burllib\.request\.(urlopen|urlretrieve)\s*\(|\bsocket\.(socket|create_connection)\s*\(|\baiohttp\.ClientSession\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'network',
-    message: 'Model code opens a network connection. Legitimate modeling/tokenizer code has no reason to phone out — this is the exfiltration / second-stage-download shape.',
-    remediation: 'Review the destination and payload. Model inference code should never make outbound requests; treat this model as hostile until proven otherwise.',
+    message: 'Opens an outbound network connection. Normal in application code; in model/tokenizer code that should never phone out, or chained with a remote-code load, this is the exfiltration / second-stage-download shape.',
+    remediation: 'Confirm the destination and payload. Model inference code should never make outbound requests; treat a phoning-out model as hostile until proven otherwise.',
     cwe: 'CWE-913',
   },
   {
@@ -439,14 +449,17 @@ const JS_RULES = [
   },
   {
     id: 'js.network_egress',
-    title: 'Network egress from tool code',
-    severity: 'HIGH',
+    title: 'Network egress',
+    // MEDIUM + neutral title, in lockstep with checks/code-sast.ts js.network_egress.
+    // Same reasoning as the python twin above: a bare outbound call is ordinary
+    // application behaviour, HIGH only when chained with a remote-code load.
+    severity: 'MEDIUM',
     category: 'egress',
-    confidence: 0.6,
+    confidence: 0.5,
     re: /\baxios\s*\.\s*(get|post|put|request)\s*\(|\bhttps?\.request\s*\(|\bnet\.(connect|createConnection)\s*\(|\bnew\s+WebSocket\s*\(|require\(\s*['"](node-fetch|got|undici|axios)['"]/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'network',
-    message: 'Opens an outbound connection from tool code. Paired with reads of secrets or files this is the exfiltration / second-stage-download shape.',
+    message: 'Opens an outbound network connection. Normal in application code; chained with a reads-secrets or remote-code-load finding this is the exfiltration / second-stage-download shape.',
     remediation: 'Confirm the destination is expected and necessary; agent tools should not phone out to arbitrary hosts.',
     cwe: 'CWE-913',
   },

package/guard-signals.mjs

@@ -127,7 +127,33 @@ export const SECRET_PATTERNS = [
   { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
   { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
   { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
+  // ── AI-provider keys ──────────────────────────────────────────────────────
+  // ⚠ These seven were in `checks/patterns.ts` and NOT here, so the mirror was
+  // silently the weaker half: `shomra secrets` found 3 of 6 planted credentials
+  // in a .env that `shomra gate` (server-side) scored 6 CRITICAL on. The command
+  // named after the job was the one that missed them.
+  //
+  // `sk-[A-Za-z0-9]{20,}` above cannot match `sk-ant-api03-…` OR `sk-proj-…`:
+  // the HYPHEN after the vendor segment is outside the character class, so the
+  // quantifier dies on the fourth character. That covers both the provider this
+  // product is built on and the CURRENT OpenAI project-key format.
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
+  { name: 'GitLab PAT', re: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/ },
   { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
+  // Keyed forms: the VALUE alone is unremarkable (40 base64-ish chars), so the
+  // assignment is the evidence. Without these an AWS secret key and a database
+  // password sit in a .env looking like configuration.
+  { name: 'AWS secret access key (keyed)', re: /\bAWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/ },
+  // The negative lookahead mirrors checks/patterns.ts — `postgres://user:pass@host/db`
+  // is the documentation placeholder, not a credential.
+  {
+    name: 'Database URL with password',
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)[^\s:@/]+:[^\s:@/]{4,}@/i,
+  },
   { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
   { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
 ];
@@ -139,10 +165,13 @@ export const RISKY_CONFIG_MARKERS = [
 ];
 
 // ── PII (patterns + Luhn gate) ──
+// ⚠ Bounded quantifiers, mirroring checks/patterns.ts — the unbounded `+`/`[ -]*?`
+// forms are O(n²) ReDoS on a long single-class run (100KB of "AAAA…" → ~7s of
+// pegged CPU). RFC-correct maxima, so no real email/card is missed.
 export const PII_PATTERNS = [
-  { name: 'Email address', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
+  { name: 'Email address', re: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/ },
   { name: 'US SSN', re: /\b\d{3}-\d{2}-\d{4}\b/ },
-  { name: 'Credit card number', re: /\b(?:\d[ -]*?){13,16}\b/ },
+  { name: 'Credit card number', re: /\b(?:\d[ -]?){13,16}\b/ },
   { name: 'Phone number', re: /\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/ },
   { name: 'IPv4 address', re: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/ },
 ];
@@ -328,11 +357,24 @@ function lineOf(text, needle) {
 // sits in such a code/data context (→ safe to down-rank) rather than as a bare,
 // runnable command line (→ still dangerous).
 
-// Single-pass mask of the "code/data" regions of a text: string literals (', ",
-// backtick — multi-line aware), line comments (//, #), block comments (/* */,
-// <!-- -->), regex literals (/…/), and fenced code blocks. mask[i] === 1 means
-// offset i is inside such a region, i.e. any pattern there is DATA (a rule
-// definition, a quoted sample, a documented example), not a live command line.
+// Two marks, because "not a live command line" splits into two OPPOSITE cases.
+//
+//   1 = QUOTED. String literals, `//` and `#` line comments, /* */ blocks,
+//       regex literals, fenced code blocks. The reader SEES this text. A rule
+//       definition, a docs example, a quoted sample — safe to down-rank.
+//
+//   2 = CONCEALED. An HTML comment. The reader does NOT see this text and the
+//       model does. That is not a quotation, it is a hiding place, and it is the
+//       single most common way a poisoned document carries a payload past human
+//       review.
+//
+// ⚠ These were both 1, so wrapping a payload in `<!-- -->` was a ONE-LINE
+// bypass: an identical instruction-override scored HIGH/QUARANTINE as bare
+// prose and LOW/REVIEW inside a comment, labelled "[in a code block]" so the
+// reviewer would dismiss it. Concealment must never buy a discount. Anything
+// reading this mask must test `=== 1`, never truthiness.
+const MARK_CONCEALED = 2;
+// Single-pass mask of the non-plain regions of a text.
 // A best-effort tokenizer — it biases toward marking (fewer false positives),
 // which is the correct trade for a security tool scanning content it will merely
 // read; execution is gated separately by the pre-call firewall.
@@ -367,19 +409,19 @@ function codeMask(text) {
       if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
       if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
       if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
-      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
+      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = MARK_CONCEALED; continue; }
       if (c === '/' && REGEX_START.has(prevSig)) { state = 7; inClass = false; mask[i++] = 1; continue; }
       if (!/\s/.test(c)) prevSig = c;
       i++;
       continue;
     }
-    mask[i] = 1;
+    mask[i] = state === 6 ? MARK_CONCEALED : 1;
     if (state === 1) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === "'") { state = 0; prevSig = "'"; } i++; continue; }
     if (state === 2) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '"') { state = 0; prevSig = '"'; } i++; continue; }
     if (state === 3) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '`') { state = 0; prevSig = '`'; } i++; continue; }
     if (state === 4) { if (c === '\n') state = 0; i++; continue; }
     if (state === 5) { if (c === '*' && c2 === '/') { mask[i + 1] = 1; i += 2; state = 0; } else i++; continue; }
-    if (state === 6) { if (text.startsWith('-->', i)) { mask[i + 1] = 1; mask[i + 2] = 1; i += 3; state = 0; } else i++; continue; }
+    if (state === 6) { if (text.startsWith('-->', i)) { mask[i + 1] = MARK_CONCEALED; mask[i + 2] = MARK_CONCEALED; i += 3; state = 0; } else i++; continue; }
     if (state === 7) { // regex literal
       if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; }
       if (c === '\n') { state = 0; } // unterminated → bail
@@ -404,8 +446,10 @@ function locate(text, needle, mask) {
     const m = text.match(needle);
     idx = m && m.index != null ? m.index : -1;
   }
-  if (idx < 0) return { line: undefined, codeContext: false };
-  return { line: lineAt(text, idx), codeContext: mask[idx] === 1 };
+  if (idx < 0) return { line: undefined, codeContext: false, concealed: false };
+  // `codeContext` stays strictly the QUOTED case — it is what down-ranking keys
+  // on, and a concealed payload must not qualify for that discount.
+  return { line: lineAt(text, idx), codeContext: mask[idx] === 1, concealed: mask[idx] === MARK_CONCEALED };
 }
 
 // Obvious non-secrets: documented sample keys, placeholders, masked values.

package/model-refs.mjs

@@ -14,7 +14,7 @@
  */
 
 // A line must carry one of these to be considered a model load.
-const LOADER_HINT = /\b(from_pretrained|SentenceTransformer|CrossEncoder|hf_hub_download|snapshot_download|InferenceClient|AutoModel\w*|AutoTokenizer|AutoConfig|AutoProcessor|AutoFeatureExtractor|from_hf_hub|hf_hub|load_dataset|torch\.hub\.load|ollama)\b|\bpipeline\s*\(|\bmodel\s*=\s*['"]|huggingface\.co|\bhf\.co\b/i;
+const LOADER_HINT = /\b(from_pretrained|SentenceTransformer|CrossEncoder|hf_hub_download|snapshot_download|InferenceClient|AutoModel\w*|AutoTokenizer|AutoConfig|AutoProcessor|AutoFeatureExtractor|from_hf_hub|hf_hub|load_dataset|torch\.hub\.load|ollama)\b|\bpipeline\s*\(|\bmodel\s*[=:]\s*['"]|huggingface\.co|\bhf\.co\b/i;
 
 // A quoted HF-style id: "org/model" (one slash, HF-legal chars, no path/URL/ext).
 const QUOTED_ID = /['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
@@ -22,7 +22,25 @@ const QUOTED_ID = /['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
 // accept BARE ids (no org, e.g. "gpt2", "distilbert-base-uncased") from them.
 const FROM_PRETRAINED_ARG = /\bfrom_pretrained\s*\(\s*(?:[A-Za-z_][\w.]*\s*,\s*)?['"]([\w./-]+)['"]/g;
 const ST_ARG = /\b(?:SentenceTransformer|CrossEncoder)\s*\(\s*['"]([\w./-]+)['"]/g;
-const KW_ID = /\b(?:model|repo_id|model_name|model_id|model_name_or_path|pretrained_model_name_or_path|checkpoint|base_model)\s*=\s*['"]([\w./-]+)['"]/gi;
+// ⚠ `[=:]`, not `=`. This required an equals sign, so it saw Python and nothing
+// else: JS/TS object literals and JSON all write `model: "gpt-4o"`, which is how
+// every Node OpenAI/Anthropic SDK call declares its model. A JS repo full of
+// model calls reported "✓ No AI model references found in the code." — a green
+// pass over a blind spot, and no vuln lookups ran for the whole estate.
+//
+// The VALUE STAYS QUOTED. An unquoted value matches any identifier, so
+// `const model = keyword` and `model: capabilities` came back as models named
+// "keyword" and "capabilities" — an inventory of things that do not exist is
+// worse than a short one. YAML's unquoted form is handled by YAML_KW below,
+// where line anchoring makes it safe.
+const KW_ID = /\b(?:model|repo_id|model_name|model_id|model_name_or_path|pretrained_model_name_or_path|checkpoint|base_model)\s*[=:]\s*['"]([\w./-]+)['"]/gi;
+
+// YAML: `model: gpt-4o` with no quotes. Anchored to the start of a line and to
+// end-of-value, so it cannot fire inside expressions the way a free-floating
+// pattern does. The value must carry a digit, a slash or a dot — model ids do
+// (`gpt-4o`, `openai-community/gpt2`, `claude-opus-4-8`); bare English words
+// like `capabilities` do not.
+const YAML_KW = /^[ \t-]*(?:model|model_name|model_id|base_model|checkpoint)\s*:\s*([A-Za-z0-9][\w./-]*[\w/.-])\s*(?:#.*)?$/gim;
 // A pinned revision/commit in the same call.
 const REVISION = /\b(?:revision|commit|sha)\s*=\s*['"]([\w.-]{4,})['"]/i;
 // Bare-id positions can accidentally grab a pipeline TASK / device / dtype — drop those.
@@ -147,6 +165,11 @@ export function scanModelRefs(text, file = '') {
     for (const m of raw.matchAll(FROM_PRETRAINED_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'from_pretrained', bare: true });
     for (const m of raw.matchAll(ST_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'sentence-transformers', bare: true });
     for (const m of raw.matchAll(KW_ID)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model= keyword', bare: true });
+    // Unquoted YAML values, only where a model id is plausible (see YAML_KW).
+    for (const m of raw.matchAll(YAML_KW)) {
+      if (!/[0-9./]/.test(m[1])) continue; // no digit, slash or dot → an English word, not a model id
+      add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model: yaml key', bare: true });
+    }
 
     // 4b. Any other loader line with a quoted org/model id (hf_hub_download,
     //     snapshot_download, InferenceClient(model=…), etc.).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {