@skaleagents/swarm 0.6.4 → 0.6.5

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -22,5 +22,7 @@ export declare class ScanInputError extends Error {
 export declare function object(value: unknown): Record<string, unknown>;
 export declare function array(value: unknown): unknown[];
 export declare function looksLikeIac(content: string): boolean;
+export declare function looksLikePulumiProgram(content: string): boolean;
+export declare function looksLikeCompose(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;

package/dist/iac/parse.js

@@ -38,7 +38,15 @@ export function looksLikeIac(content) {
     return (/^\s*(?:resource|module|terraform|variable|provider)\s+["{]/m.test(content) ||
         /^\s*(?:["']?Resources["']?\s*:|apiVersion\s*:)/m.test(content) ||
         /^\s*\{\s*"(?:resource|Resources|apiVersion|AWSTemplateFormatVersion)"\s*:/.test(content) ||
-        looksLikePulumiYaml(content));
+        looksLikePulumiYaml(content) ||
+        looksLikePulumiProgram(content) ||
+        looksLikeCompose(content));
+}
+export function looksLikePulumiProgram(content) {
+    return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
+}
+export function looksLikeCompose(content) {
+    return /^\s*services\s*:/m.test(content) && /^\s+image\s*:/m.test(content);
 }
 export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
@@ -48,8 +56,10 @@ export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
     if (requested !== "terraform" &&
-        /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content)) {
-        throw new ScanInputError("Pulumi TypeScript, Python, and Go programs are not parsed yet. Submit Pulumi YAML.");
+        requested !== "compose" &&
+        looksLikePulumiProgram(content) &&
+        !looksLikePulumiYaml(content)) {
+        return parsePulumiProgram(content);
     }
     const warnings = [];
     const resources = [];
@@ -152,12 +162,18 @@ export function parseIac(content, requested = "auto") {
         checkShape(data);
         const root = object(data);
         const pulumiResources = pulumiResourceMap(root);
+        const services = composeServiceMap(root);
         let detected;
         if (requested === "pulumi" || (requested === "auto" && pulumiResources)) {
             if (!pulumiResources)
-                throw new ScanInputError("Pulumi YAML requires a resources mapping. Each resource needs a type token. Pulumi TypeScript, Python, and Go programs are not parsed yet.");
+                throw new ScanInputError("Pulumi YAML requires a resources mapping. Each resource needs a type token.");
             detected = "pulumi";
         }
+        else if (requested === "compose" || (requested === "auto" && services)) {
+            if (!services)
+                throw new ScanInputError("Docker Compose requires a services mapping with an image, build, or ports field.");
+            detected = "compose";
+        }
         else {
             detected = root.Resources
                 ? "cloudformation"
@@ -188,7 +204,11 @@ export function parseIac(content, requested = "auto") {
                 },
             });
         };
-        if (format === "pulumi") {
+        if (format === "compose") {
+            for (const [name, raw] of Object.entries(services ?? {}))
+                add(name, "compose:service", raw, ["services", name]);
+        }
+        else if (format === "pulumi") {
             for (const [name, raw] of Object.entries(pulumiResources ?? {})) {
                 const value = object(raw);
                 add(name, String(value.type), value, ["resources", name]);
@@ -251,13 +271,65 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, or Pulumi YAML.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, or Docker Compose.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
+function parsePulumiProgram(content) {
+    const searchable = content
+        .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/(^|[^:])\/\/[^\n]*/g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/(^|\n)\s*#[^\n]*/g, (match) => match.replace(/[^\n]/g, " "));
+    const resources = [];
+    for (const match of searchable.matchAll(/(?:0\.0\.0\.0\/0|::\/0)/g)) {
+        const offset = match.index ?? 0;
+        const window = searchable.slice(Math.max(0, offset - 1500), offset);
+        const ingressAt = window.toLowerCase().lastIndexOf("ingress");
+        const egressAt = window.toLowerCase().lastIndexOf("egress");
+        if (ingressAt < 0 || egressAt > ingressAt)
+            continue;
+        const before = content.slice(0, offset);
+        resources.push({
+            id: `pulumi.program.${resources.length + 1}`,
+            type: "pulumi:program/securityGroup:SecurityGroup",
+            value: { properties: { ingress: [{ cidrBlocks: [match[0]] }] } },
+            locate: () => ({
+                line: before.split("\n").length,
+                column: offset - before.lastIndexOf("\n"),
+                path: "ingress.cidrBlocks",
+            }),
+        });
+    }
+    return {
+        format: "pulumi",
+        resources,
+        warnings: [
+            "Pulumi programs are scanned as text. Computed values, stacks, and external modules are not evaluated.",
+            ...(resources.length
+                ? []
+                : ["No literal ingress CIDRs were found in the Pulumi program."]),
+        ],
+    };
+}
+function composeServiceMap(root) {
+    if (root.apiVersion || root.kind || root.Resources || root.resources)
+        return undefined;
+    const services = object(root.services);
+    const entries = Object.entries(services);
+    if (entries.length > 0 &&
+        entries.every(([, raw]) => {
+            const service = object(raw);
+            return ("image" in service ||
+                "build" in service ||
+                "ports" in service ||
+                "privileged" in service);
+        }))
+        return services;
+    return undefined;
+}
 function pulumiResourceMap(root) {
     const resources = object(root.resources);
     const entries = Object.entries(resources);

package/dist/iac/rules.js

@@ -225,6 +225,8 @@ export function resourceFindings(resources, format) {
         });
         if (format === "kubernetes")
             checkKubernetes(resource, resources, check);
+        else if (format === "compose")
+            checkCompose(resource, check);
         else
             checkCloud(resource, resources, format, check);
     }
@@ -240,6 +242,16 @@ function walk(value, visit, path = []) {
                 walk(child, visit, [...path, key]);
         }
 }
+function checkCompose(resource, check) {
+    const service = resource.value;
+    check("K8S001", service.privileged === true, ["privileged"]);
+    check("NET001", array(service.ports).some((port) => {
+        if (typeof port === "string")
+            return port.includes("0.0.0.0");
+        const mapping = object(port);
+        return mapping.host_ip === "0.0.0.0" || mapping.hostIp === "0.0.0.0";
+    }), ["ports"]);
+}
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";
     const pulumi = format === "pulumi";

package/dist/review.js

@@ -131,6 +131,30 @@ export function architectureFindings(content, focus) {
             detail: "Retries are set to unlimited. Cap retries and add backoff so a failing dependency cannot amplify load.",
         });
     }
+    if (shouldInclude(focusValue, "reliability") &&
+        /(?:max_?open_?conns|maxOpenConns|SetMaxOpenConns)\s*(?:[:=]|\()\s*0\b/.test(content)) {
+        findings.push({
+            severity: "high",
+            title: "Database connection limit is unlimited",
+            detail: "The database client allows unlimited open connections. Set a finite pool size so a traffic spike cannot exhaust the database.",
+        });
+    }
+    if (shouldInclude(focusValue, "reliability") &&
+        /(?:mem_limit|memory_limit)\s*[:=]\s*["']?0\b/i.test(content)) {
+        findings.push({
+            severity: "medium",
+            title: "Memory limit is disabled",
+            detail: "The memory limit is zero. Set a memory limit so one workload cannot consume the host.",
+        });
+    }
+    if (shouldInclude(focusValue, "security") &&
+        /^\s*USER\s+root\s*$/im.test(content)) {
+        findings.push({
+            severity: "medium",
+            title: "Container runs as root",
+            detail: "The container user is root. Run the process as an unprivileged user.",
+        });
+    }
     return findings.map((finding, index) => {
         if (index === 0)
             return finding;
@@ -149,6 +173,9 @@ export function architectureFindings(content, focus) {
             "Outbound call has no timeout": /(?:^|[^.\w])(?:timeout|read_timeout|connect_timeout|request_timeout|readTimeout|connectTimeout)\s*[:=]\s*(?:0|false|none)\b/i,
             "Connection pool is capped at one": /(?:pool_size|max_connections|connectionLimit|maxPoolSize|maximumPoolSize|max_pool_size)\s*[:=]\s*1\b/,
             "Retry limit is unbounded": /(?:max_?retries|retry_?count|retries)\s*[:=]\s*(?:-1|Infinity)\b/i,
+            "Database connection limit is unlimited": /(?:max_?open_?conns|maxOpenConns|SetMaxOpenConns)\s*(?:[:=]|\()\s*0\b/,
+            "Memory limit is disabled": /(?:mem_limit|memory_limit)\s*[:=]\s*["']?0\b/i,
+            "Container runs as root": /^\s*USER\s+root\s*$/im,
         };
         const pattern = matchers[finding.title];
         const matches = pattern
@@ -175,6 +202,8 @@ export function architectureFindings(content, focus) {
                     "Outbound call has no timeout",
                     "Connection pool is capped at one",
                     "Retry limit is unbounded",
+                    "Database connection limit is unlimited",
+                    "Memory limit is disabled",
                 ].includes(finding.title)
                     ? "reliability"
                     : "security"),

package/dist/server.js

@@ -72,12 +72,13 @@ export function createServer(remote = false) {
                 "cloudformation",
                 "kubernetes",
                 "pulumi",
+                "compose",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, application, auto"),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, application, auto"),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -125,7 +126,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, or Pulumi YAML. Check security, reliability and cost rules with resource locations and remediation. Pulumi TypeScript, Python, and Go programs are not parsed yet.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -133,9 +134,16 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, or Pulumi YAML"),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose"),
                 format: z
-                    .enum(["terraform", "cloudformation", "kubernetes", "pulumi", "auto"])
+                    .enum([
+                    "terraform",
+                    "cloudformation",
+                    "kubernetes",
+                    "pulumi",
+                    "compose",
+                    "auto",
+                ])
                     .default("auto"),
                 ...filters,
             },

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.4";
+export declare const VERSION = "0.6.5";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.4";
+export const VERSION = "0.6.5";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "private": false,
   "publishConfig": {
     "access": "public"