@skaleagents/swarm 0.6.5 → 0.6.7

package/README.md

@@ -109,7 +109,8 @@ See [client setup](https://skaleagents.com/settings) for Cursor, Claude Code,
 Claude Desktop, ChatGPT, and Codex instructions.
 
 The web app hosts this endpoint using `handleMcpRequest` from
-`@skaleagents/swarm/http`. It validates each bearer credential with the API's
+`@skaleagents/swarm/http`. Audit workers import `scanIac` from
+`@skaleagents/swarm/scan`. It validates each bearer credential with the API's
 `/api/oauth/mcp-token` endpoint before running a tool. Tokens are bound to the
 MCP resource and cannot access unrelated API routes. Credentials are not
 forwarded to the public bot directory.

package/dist/iac/parse.js

@@ -278,12 +278,31 @@ export function parseIac(content, requested = "auto") {
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
-function parsePulumiProgram(content) {
-    const searchable = content
+function programLocation(content, offset, path) {
+    const before = content.slice(0, offset);
+    return {
+        line: before.split("\n").length,
+        column: offset - before.lastIndexOf("\n"),
+        path,
+    };
+}
+function stripProgramComments(content) {
+    return content
         .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
         .replace(/(^|[^:])\/\/[^\n]*/g, (match) => match.replace(/[^\n]/g, " "))
         .replace(/(^|\n)\s*#[^\n]*/g, (match) => match.replace(/[^\n]/g, " "));
+}
+function parsePulumiProgram(content) {
+    const searchable = stripProgramComments(content);
     const resources = [];
+    const addProgram = (id, type, value, offset, path) => {
+        resources.push({
+            id,
+            type,
+            value,
+            locate: () => programLocation(content, offset, path),
+        });
+    };
     for (const match of searchable.matchAll(/(?:0\.0\.0\.0\/0|::\/0)/g)) {
         const offset = match.index ?? 0;
         const window = searchable.slice(Math.max(0, offset - 1500), offset);
@@ -291,26 +310,45 @@ function parsePulumiProgram(content) {
         const egressAt = window.toLowerCase().lastIndexOf("egress");
         if (ingressAt < 0 || egressAt > ingressAt)
             continue;
-        const before = content.slice(0, offset);
-        resources.push({
-            id: `pulumi.program.${resources.length + 1}`,
-            type: "pulumi:program/securityGroup:SecurityGroup",
-            value: { properties: { ingress: [{ cidrBlocks: [match[0]] }] } },
-            locate: () => ({
-                line: before.split("\n").length,
-                column: offset - before.lastIndexOf("\n"),
-                path: "ingress.cidrBlocks",
-            }),
-        });
+        addProgram(`pulumi.program.ingress.${resources.length + 1}`, "pulumi:program/securityGroup:SecurityGroup", { properties: { ingress: [{ cidrBlocks: [match[0]] }] } }, offset, "ingress.cidrBlocks");
+    }
+    const database = {};
+    const publicDb = /publicly_?accessible\s*[:=]\s*true\b/i.exec(searchable);
+    const unencrypted = /storage_?encrypted\s*[:=]\s*false\b/i.exec(searchable);
+    const noBackup = /backup_?retention_?period\s*[:=]\s*0\b/i.exec(searchable);
+    if (publicDb)
+        database.publicly_accessible = true;
+    if (unencrypted)
+        database.storage_encrypted = false;
+    if (noBackup)
+        database.backup_retention_period = 0;
+    const databaseMatch = publicDb ?? unencrypted ?? noBackup;
+    if (databaseMatch) {
+        addProgram("pulumi.program.database", "aws_db_instance", { properties: database }, databaseMatch.index, "database");
+    }
+    const publicAcl = /(?:acl|accessControl)\s*[:=]\s*["']public-read(?:-write)?["']/i.exec(searchable);
+    if (publicAcl) {
+        addProgram("pulumi.program.bucket", "aws_s3_bucket", { properties: { acl: "public-read" } }, publicAcl.index, "acl");
+    }
+    for (const match of searchable.matchAll(/actions?\s*[:=]\s*(?:\[\s*)?["']\*["']/gi)) {
+        const offset = match.index ?? 0;
+        const before = searchable.slice(Math.max(0, offset - 300), offset);
+        const effects = [
+            ...before.matchAll(/(?:effect|Effect)\s*[:=]\s*["']?(Allow|Deny)["']?/gi),
+        ];
+        const nearest = effects.at(-1)?.[1] ?? "";
+        if (!/^allow$/i.test(nearest))
+            continue;
+        addProgram("pulumi.program.policy", "pulumi:program/iam:Policy", { properties: { effect: "Allow", actions: ["*"] } }, offset, "actions");
+        break;
     }
+    addProgram("pulumi.program.source", "pulumi:program/source:Source", { program: searchable }, 0, "program");
     return {
         format: "pulumi",
         resources,
         warnings: [
             "Pulumi programs are scanned as text. Computed values, stacks, and external modules are not evaluated.",
-            ...(resources.length
-                ? []
-                : ["No literal ingress CIDRs were found in the Pulumi program."]),
+            "Database, storage, IAM, credential, and network checks use literal settings in the submitted program.",
         ],
     };
 }

package/dist/iac/rules.js

@@ -242,15 +242,43 @@ function walk(value, visit, path = []) {
                 walk(child, visit, [...path, key]);
         }
 }
+function composePortIsPublic(port) {
+    if (typeof port === "string") {
+        const value = port.trim();
+        if (/^(?:127\.0\.0\.1|localhost):/.test(value))
+            return false;
+        if (value.includes("0.0.0.0"))
+            return true;
+        return /^\d+:\d+(?:\/[A-Za-z0-9]+)?$/.test(value);
+    }
+    const mapping = object(port);
+    const host = mapping.host_ip ?? mapping.hostIp;
+    if (host === "127.0.0.1" || host === "localhost")
+        return false;
+    return host === "0.0.0.0" || mapping.published != null || mapping.target != null;
+}
 function checkCompose(resource, check) {
     const service = resource.value;
+    const image = typeof service.image === "string" ? service.image : "";
+    const limits = object(object(object(service.deploy).resources).limits);
+    const user = service.user;
     check("K8S001", service.privileged === true, ["privileged"]);
-    check("NET001", array(service.ports).some((port) => {
-        if (typeof port === "string")
-            return port.includes("0.0.0.0");
-        const mapping = object(port);
-        return mapping.host_ip === "0.0.0.0" || mapping.hostIp === "0.0.0.0";
-    }), ["ports"]);
+    check("K8S002", service.network_mode === "host", ["network_mode"]);
+    check("K8S003", array(service.volumes).some((volume) => {
+        const text = typeof volume === "string"
+            ? volume
+            : String(object(volume).source ?? object(volume).target ?? "");
+        return (text.includes("docker.sock") ||
+            /(?:^|:)\/:/.test(text) ||
+            text.startsWith("/var/run/"));
+    }), ["volumes"]);
+    check("K8S004", user === "root" || user === "0" || user === 0, ["user"]);
+    check("K8S006", array(service.cap_add).some((cap) => ["ALL", "SYS_ADMIN", "NET_ADMIN", "SYS_PTRACE"].includes(String(cap).toUpperCase())), ["cap_add"]);
+    check("K8S007", image !== "" && (image.endsWith(":latest") || !/[:@]/.test(image)), ["image"]);
+    check("K8S008", service.mem_limit == null &&
+        limits.memory == null &&
+        service.mem_reservation == null, ["mem_limit"]);
+    check("NET001", array(service.ports).some(composePortIsPublic), ["ports"]);
 }
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.5";
+export declare const VERSION = "0.6.7";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.5";
+export const VERSION = "0.6.7";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -11,6 +11,10 @@
     "./http": {
       "types": "./dist/http.d.ts",
       "import": "./dist/http.js"
+    },
+    "./scan": {
+      "types": "./dist/iac/scan.d.ts",
+      "import": "./dist/iac/scan.js"
     }
   },
   "bin": {