@skaleagents/swarm 0.6.4 → 0.6.6

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -22,5 +22,7 @@ export declare class ScanInputError extends Error {
 export declare function object(value: unknown): Record<string, unknown>;
 export declare function array(value: unknown): unknown[];
 export declare function looksLikeIac(content: string): boolean;
+export declare function looksLikePulumiProgram(content: string): boolean;
+export declare function looksLikeCompose(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;

package/dist/iac/parse.js

@@ -38,7 +38,15 @@ export function looksLikeIac(content) {
     return (/^\s*(?:resource|module|terraform|variable|provider)\s+["{]/m.test(content) ||
         /^\s*(?:["']?Resources["']?\s*:|apiVersion\s*:)/m.test(content) ||
         /^\s*\{\s*"(?:resource|Resources|apiVersion|AWSTemplateFormatVersion)"\s*:/.test(content) ||
-        looksLikePulumiYaml(content));
+        looksLikePulumiYaml(content) ||
+        looksLikePulumiProgram(content) ||
+        looksLikeCompose(content));
+}
+export function looksLikePulumiProgram(content) {
+    return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
+}
+export function looksLikeCompose(content) {
+    return /^\s*services\s*:/m.test(content) && /^\s+image\s*:/m.test(content);
 }
 export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
@@ -48,8 +56,10 @@ export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
     if (requested !== "terraform" &&
-        /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content)) {
-        throw new ScanInputError("Pulumi TypeScript, Python, and Go programs are not parsed yet. Submit Pulumi YAML.");
+        requested !== "compose" &&
+        looksLikePulumiProgram(content) &&
+        !looksLikePulumiYaml(content)) {
+        return parsePulumiProgram(content);
     }
     const warnings = [];
     const resources = [];
@@ -152,12 +162,18 @@ export function parseIac(content, requested = "auto") {
         checkShape(data);
         const root = object(data);
         const pulumiResources = pulumiResourceMap(root);
+        const services = composeServiceMap(root);
         let detected;
         if (requested === "pulumi" || (requested === "auto" && pulumiResources)) {
             if (!pulumiResources)
-                throw new ScanInputError("Pulumi YAML requires a resources mapping. Each resource needs a type token. Pulumi TypeScript, Python, and Go programs are not parsed yet.");
+                throw new ScanInputError("Pulumi YAML requires a resources mapping. Each resource needs a type token.");
             detected = "pulumi";
         }
+        else if (requested === "compose" || (requested === "auto" && services)) {
+            if (!services)
+                throw new ScanInputError("Docker Compose requires a services mapping with an image, build, or ports field.");
+            detected = "compose";
+        }
         else {
             detected = root.Resources
                 ? "cloudformation"
@@ -188,7 +204,11 @@ export function parseIac(content, requested = "auto") {
                 },
             });
         };
-        if (format === "pulumi") {
+        if (format === "compose") {
+            for (const [name, raw] of Object.entries(services ?? {}))
+                add(name, "compose:service", raw, ["services", name]);
+        }
+        else if (format === "pulumi") {
             for (const [name, raw] of Object.entries(pulumiResources ?? {})) {
                 const value = object(raw);
                 add(name, String(value.type), value, ["resources", name]);
@@ -251,13 +271,103 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, or Pulumi YAML.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, or Docker Compose.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
+function programLocation(content, offset, path) {
+    const before = content.slice(0, offset);
+    return {
+        line: before.split("\n").length,
+        column: offset - before.lastIndexOf("\n"),
+        path,
+    };
+}
+function stripProgramComments(content) {
+    return content
+        .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/(^|[^:])\/\/[^\n]*/g, (match) => match.replace(/[^\n]/g, " "))
+        .replace(/(^|\n)\s*#[^\n]*/g, (match) => match.replace(/[^\n]/g, " "));
+}
+function parsePulumiProgram(content) {
+    const searchable = stripProgramComments(content);
+    const resources = [];
+    const addProgram = (id, type, value, offset, path) => {
+        resources.push({
+            id,
+            type,
+            value,
+            locate: () => programLocation(content, offset, path),
+        });
+    };
+    for (const match of searchable.matchAll(/(?:0\.0\.0\.0\/0|::\/0)/g)) {
+        const offset = match.index ?? 0;
+        const window = searchable.slice(Math.max(0, offset - 1500), offset);
+        const ingressAt = window.toLowerCase().lastIndexOf("ingress");
+        const egressAt = window.toLowerCase().lastIndexOf("egress");
+        if (ingressAt < 0 || egressAt > ingressAt)
+            continue;
+        addProgram(`pulumi.program.ingress.${resources.length + 1}`, "pulumi:program/securityGroup:SecurityGroup", { properties: { ingress: [{ cidrBlocks: [match[0]] }] } }, offset, "ingress.cidrBlocks");
+    }
+    const database = {};
+    const publicDb = /publicly_?accessible\s*[:=]\s*true\b/i.exec(searchable);
+    const unencrypted = /storage_?encrypted\s*[:=]\s*false\b/i.exec(searchable);
+    const noBackup = /backup_?retention_?period\s*[:=]\s*0\b/i.exec(searchable);
+    if (publicDb)
+        database.publicly_accessible = true;
+    if (unencrypted)
+        database.storage_encrypted = false;
+    if (noBackup)
+        database.backup_retention_period = 0;
+    const databaseMatch = publicDb ?? unencrypted ?? noBackup;
+    if (databaseMatch) {
+        addProgram("pulumi.program.database", "aws_db_instance", { properties: database }, databaseMatch.index, "database");
+    }
+    const publicAcl = /(?:acl|accessControl)\s*[:=]\s*["']public-read(?:-write)?["']/i.exec(searchable);
+    if (publicAcl) {
+        addProgram("pulumi.program.bucket", "aws_s3_bucket", { properties: { acl: "public-read" } }, publicAcl.index, "acl");
+    }
+    for (const match of searchable.matchAll(/actions?\s*[:=]\s*(?:\[\s*)?["']\*["']/gi)) {
+        const offset = match.index ?? 0;
+        const before = searchable.slice(Math.max(0, offset - 300), offset);
+        const effects = [
+            ...before.matchAll(/(?:effect|Effect)\s*[:=]\s*["']?(Allow|Deny)["']?/gi),
+        ];
+        const nearest = effects.at(-1)?.[1] ?? "";
+        if (!/^allow$/i.test(nearest))
+            continue;
+        addProgram("pulumi.program.policy", "pulumi:program/iam:Policy", { properties: { effect: "Allow", actions: ["*"] } }, offset, "actions");
+        break;
+    }
+    addProgram("pulumi.program.source", "pulumi:program/source:Source", { program: searchable }, 0, "program");
+    return {
+        format: "pulumi",
+        resources,
+        warnings: [
+            "Pulumi programs are scanned as text. Computed values, stacks, and external modules are not evaluated.",
+            "Database, storage, IAM, credential, and network checks use literal settings in the submitted program.",
+        ],
+    };
+}
+function composeServiceMap(root) {
+    if (root.apiVersion || root.kind || root.Resources || root.resources)
+        return undefined;
+    const services = object(root.services);
+    const entries = Object.entries(services);
+    if (entries.length > 0 &&
+        entries.every(([, raw]) => {
+            const service = object(raw);
+            return ("image" in service ||
+                "build" in service ||
+                "ports" in service ||
+                "privileged" in service);
+        }))
+        return services;
+    return undefined;
+}
 function pulumiResourceMap(root) {
     const resources = object(root.resources);
     const entries = Object.entries(resources);

package/dist/iac/rules.js

@@ -225,6 +225,8 @@ export function resourceFindings(resources, format) {
         });
         if (format === "kubernetes")
             checkKubernetes(resource, resources, check);
+        else if (format === "compose")
+            checkCompose(resource, check);
         else
             checkCloud(resource, resources, format, check);
     }
@@ -240,6 +242,44 @@ function walk(value, visit, path = []) {
                 walk(child, visit, [...path, key]);
         }
 }
+function composePortIsPublic(port) {
+    if (typeof port === "string") {
+        const value = port.trim();
+        if (/^(?:127\.0\.0\.1|localhost):/.test(value))
+            return false;
+        if (value.includes("0.0.0.0"))
+            return true;
+        return /^\d+:\d+(?:\/[A-Za-z0-9]+)?$/.test(value);
+    }
+    const mapping = object(port);
+    const host = mapping.host_ip ?? mapping.hostIp;
+    if (host === "127.0.0.1" || host === "localhost")
+        return false;
+    return host === "0.0.0.0" || mapping.published != null || mapping.target != null;
+}
+function checkCompose(resource, check) {
+    const service = resource.value;
+    const image = typeof service.image === "string" ? service.image : "";
+    const limits = object(object(object(service.deploy).resources).limits);
+    const user = service.user;
+    check("K8S001", service.privileged === true, ["privileged"]);
+    check("K8S002", service.network_mode === "host", ["network_mode"]);
+    check("K8S003", array(service.volumes).some((volume) => {
+        const text = typeof volume === "string"
+            ? volume
+            : String(object(volume).source ?? object(volume).target ?? "");
+        return (text.includes("docker.sock") ||
+            /(?:^|:)\/:/.test(text) ||
+            text.startsWith("/var/run/"));
+    }), ["volumes"]);
+    check("K8S004", user === "root" || user === "0" || user === 0, ["user"]);
+    check("K8S006", array(service.cap_add).some((cap) => ["ALL", "SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE"].includes(String(cap).toUpperCase())), ["cap_add"]);
+    check("K8S007", image !== "" && (image.endsWith(":latest") || !/[:@]/.test(image)), ["image"]);
+    check("K8S008", service.mem_limit == null &&
+        limits.memory == null &&
+        service.mem_reservation == null, ["mem_limit"]);
+    check("NET001", array(service.ports).some(composePortIsPublic), ["ports"]);
+}
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";
     const pulumi = format === "pulumi";

package/dist/review.js

@@ -131,6 +131,30 @@ export function architectureFindings(content, focus) {
             detail: "Retries are set to unlimited. Cap retries and add backoff so a failing dependency cannot amplify load.",
         });
     }
+    if (shouldInclude(focusValue, "reliability") &&
+        /(?:max_?open_?conns|maxOpenConns|SetMaxOpenConns)\s*(?:[:=]|\()\s*0\b/.test(content)) {
+        findings.push({
+            severity: "high",
+            title: "Database connection limit is unlimited",
+            detail: "The database client allows unlimited open connections. Set a finite pool size so a traffic spike cannot exhaust the database.",
+        });
+    }
+    if (shouldInclude(focusValue, "reliability") &&
+        /(?:mem_limit|memory_limit)\s*[:=]\s*["']?0\b/i.test(content)) {
+        findings.push({
+            severity: "medium",
+            title: "Memory limit is disabled",
+            detail: "The memory limit is zero. Set a memory limit so one workload cannot consume the host.",
+        });
+    }
+    if (shouldInclude(focusValue, "security") &&
+        /^\s*USER\s+root\s*$/im.test(content)) {
+        findings.push({
+            severity: "medium",
+            title: "Container runs as root",
+            detail: "The container user is root. Run the process as an unprivileged user.",
+        });
+    }
     return findings.map((finding, index) => {
         if (index === 0)
             return finding;
@@ -149,6 +173,9 @@ export function architectureFindings(content, focus) {
             "Outbound call has no timeout": /(?:^|[^.\w])(?:timeout|read_timeout|connect_timeout|request_timeout|readTimeout|connectTimeout)\s*[:=]\s*(?:0|false|none)\b/i,
             "Connection pool is capped at one": /(?:pool_size|max_connections|connectionLimit|maxPoolSize|maximumPoolSize|max_pool_size)\s*[:=]\s*1\b/,
             "Retry limit is unbounded": /(?:max_?retries|retry_?count|retries)\s*[:=]\s*(?:-1|Infinity)\b/i,
+            "Database connection limit is unlimited": /(?:max_?open_?conns|maxOpenConns|SetMaxOpenConns)\s*(?:[:=]|\()\s*0\b/,
+            "Memory limit is disabled": /(?:mem_limit|memory_limit)\s*[:=]\s*["']?0\b/i,
+            "Container runs as root": /^\s*USER\s+root\s*$/im,
         };
         const pattern = matchers[finding.title];
         const matches = pattern
@@ -175,6 +202,8 @@ export function architectureFindings(content, focus) {
                     "Outbound call has no timeout",
                     "Connection pool is capped at one",
                     "Retry limit is unbounded",
+                    "Database connection limit is unlimited",
+                    "Memory limit is disabled",
                 ].includes(finding.title)
                     ? "reliability"
                     : "security"),

package/dist/server.js

@@ -72,12 +72,13 @@ export function createServer(remote = false) {
                 "cloudformation",
                 "kubernetes",
                 "pulumi",
+                "compose",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, application, auto"),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, application, auto"),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -125,7 +126,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, or Pulumi YAML. Check security, reliability and cost rules with resource locations and remediation. Pulumi TypeScript, Python, and Go programs are not parsed yet.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -133,9 +134,16 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, or Pulumi YAML"),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose"),
                 format: z
-                    .enum(["terraform", "cloudformation", "kubernetes", "pulumi", "auto"])
+                    .enum([
+                    "terraform",
+                    "cloudformation",
+                    "kubernetes",
+                    "pulumi",
+                    "compose",
+                    "auto",
+                ])
                     .default("auto"),
                 ...filters,
             },

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.4";
+export declare const VERSION = "0.6.6";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.4";
+export const VERSION = "0.6.6";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "private": false,
   "publishConfig": {
     "access": "public"