@swestash/agent-lens 0.5.0 → 0.5.1

package/dist/agent-lens.js

@@ -2319,7 +2319,7 @@ function classify(db, dirty) {
 
 // ../ingest/dist/detect.js
 import { createHash } from "crypto";
-var DETECTOR_VERSION = 3;
+var DETECTOR_VERSION = 5;
 function evidence(s, max = 200) {
   const one = s.replace(/\s+/g, " ").trim();
   return one.length > max ? one.slice(0, max - 1) + "\u2026" : one;
@@ -2330,7 +2330,7 @@ function findingId(toolCallId, ruleId) {
 var SYSTEM_PATH = /(^|\s)(\/etc\/|\/usr\/|\/bin\/|\/sbin\/|\/boot\/|\/var\/|\/root\/|~\/\.ssh\/|~\/\.aws\/)/;
 var HOME_OR_ROOT_TARGET = /(\s|^)(~\/?|\/|\/\*|\$HOME\/?|\*)(\s|$)/;
 var SECRET_FILE = /(^|\/|\s)(\.env(\.[\w.-]+)?|id_rsa|id_ed25519|id_ecdsa|\.ssh\/[\w.-]+|\.aws\/credentials|\.gcp\/|gcloud\/|\.npmrc|\.pypirc|\.netrc|\.pem|\.p12|\.pfx|secrets?\.(ya?ml|json|txt)|credentials(\.json)?)\b/i;
-var EXAMPLE_FILE = /\.(example|sample|template|dist)($|\.)/i;
+var EXAMPLE_FILE = /\.(example|sample|template|dist)(?![\w-])/i;
 var CONTENT_READ_CMD = /\b(cat|less|more|head|tail|bat|xxd|strings|base64|grep|egrep|rg|awk|sed|nl|tac|od|hexdump|cp|scp|sort)\b/i;
 var SECRET_VALUE_PATTERNS = [
   { re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/, label: "private-key", critical: true },
@@ -2341,18 +2341,41 @@ var SECRET_VALUE_PATTERNS = [
   { re: /\bsk-[A-Za-z0-9]{20,}\b/, label: "api-secret-key" }
 ];
 var isBash = (t) => t === "Bash";
-var AGENT_CONFIG_PATH = /(^|\/)\.claude\//;
+var stripComments = (c) => c.replace(/(^|\s)#[^\n]*/g, "$1");
+var neutralizeEcho = (c) => c.replace(/((?:^|[;&|\n(])\s*)(?:echo|printf)\b(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^;&|\n])*/gi, "$1echo");
+var blankHeredoc = (c) => c.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\s*\2\b/g, "<<HEREDOC");
+var codeOf = (c) => neutralizeEcho(stripComments(blankHeredoc(c)));
+var blankQuoted = (c) => c.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'[^']*'/g, "''");
+var bareOf = (c) => blankQuoted(codeOf(c));
+function execGeneratedScript(cmd) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const m of cmd.matchAll(/(?:>>?|\btee\b\s+(?:-a\s+)?)\s*["']?([A-Za-z0-9._/~-]+)/g)) {
+    if (m[1] && !m[1].startsWith("/dev/"))
+      targets.add(m[1]);
+  }
+  for (const t of targets) {
+    const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const interp = new RegExp(`\\b(?:sh|bash|zsh|ksh|dash|source)\\s+["']?${e}\\b|(?:^|[\\n;|&(])\\s*\\.\\s+["']?${e}\\b`);
+    const hasPath = /^(\.\/|\/|~\/)/.test(t);
+    const path = hasPath ? new RegExp(`(?:^|[\\n;|&(])\\s*${e}(?:\\s|$|[;&|<>])`) : new RegExp(`(?:^|[\\n;|&(])\\s*\\.\\/${e}\\b`);
+    if (interp.test(cmd) || path.test(cmd))
+      return t;
+  }
+  return null;
+}
 var TEMP_PATH = /^(\/tmp\/|\/var\/folders\/|\/private\/var\/folders\/)/;
-function isAgentOwnedPath(p) {
-  if (AGENT_CONFIG_PATH.test(p) || TEMP_PATH.test(p))
+function isAgentOwnedPath(p, configDirs) {
+  if (TEMP_PATH.test(p))
+    return true;
+  if (configDirs.some((d) => p === d || p.startsWith(d + "/")))
     return true;
   const tmp = process.env.TMPDIR;
   return !!tmp && p.startsWith(tmp.replace(/\/$/, "") + "/");
 }
-function outsideProject(filePath, projectPath) {
+function outsideProject(filePath, projectPath, configDirs) {
   if (!filePath || !filePath.startsWith("/"))
     return false;
-  if (isAgentOwnedPath(filePath))
+  if (isAgentOwnedPath(filePath, configDirs))
     return false;
   if (!projectPath)
     return false;
@@ -2368,14 +2391,14 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       const rf = /\brm\s+[^|;&\n]*(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r|--recursive[^|;&\n]*--force|--force[^|;&\n]*--recursive)/i;
       if (!rf.test(c))
         return null;
       const dangerousTarget = HOME_OR_ROOT_TARGET.test(c) || /\s\/(?:\s|$)/.test(c) || /\brm\b[^|;&\n]*\*/.test(c);
-      return { evidence: evidence(c), severity: dangerousTarget ? "critical" : "high", mods: { dangerous_target: dangerousTarget } };
+      return { evidence: evidence(ctx.command), severity: dangerousTarget ? "critical" : "high", mods: { dangerous_target: dangerousTarget } };
     }
   },
   {
@@ -2386,10 +2409,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "medium",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bgit\s+reset\s+--hard\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2400,11 +2423,11 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "medium",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bgit\s+push\b[^|;&\n]*(--force\b|--force-with-lease\b|\s-f\b)/i.test(c))
         return null;
       const mainBranch = /\b(main|master|release)\b/.test(c);
-      return { evidence: evidence(c), severity: mainBranch ? "high" : "medium", mods: { protected_branch: mainBranch } };
+      return { evidence: evidence(ctx.command), severity: mainBranch ? "high" : "medium", mods: { protected_branch: mainBranch } };
     }
   },
   {
@@ -2415,10 +2438,11 @@ var RULES = [
     tools: "*",
     baseSeverity: "high",
     test(ctx) {
-      const hay = ctx.command ?? (typeof ctx.input?.query === "string" ? ctx.input.query : null);
+      const query = typeof ctx.input?.query === "string" ? ctx.input.query : null;
+      const hay = ctx.commandCode ?? query;
       if (!hay || !/\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE(\s+TABLE)?)\b/i.test(hay))
         return null;
-      return { evidence: evidence(hay) };
+      return { evidence: evidence(ctx.command ?? query) };
     }
   },
   {
@@ -2429,10 +2453,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/(\bdd\s+if=|\bmkfs(\.\w+)?\b|\bshred\b)/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2460,12 +2484,18 @@ var RULES = [
     tools: ["Read", "Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const hay = ctx.toolName === "Read" ? ctx.filePath : ctx.command;
-      if (!hay || !SECRET_FILE.test(hay) || EXAMPLE_FILE.test(hay))
-        return null;
-      if (isBash(ctx.toolName) && !CONTENT_READ_CMD.test(hay))
+      if (isBash(ctx.toolName)) {
+        const cmd = ctx.commandBare;
+        if (!cmd)
+          return null;
+        const segments = cmd.split(/\|\||&&|[|;\n]/);
+        const reads = segments.some((seg) => SECRET_FILE.test(seg) && !EXAMPLE_FILE.test(seg) && CONTENT_READ_CMD.test(seg));
+        return reads ? { evidence: evidence(ctx.command) } : null;
+      }
+      const f = ctx.filePath;
+      if (!f || !SECRET_FILE.test(f) || EXAMPLE_FILE.test(f))
         return null;
-      return { evidence: evidence(hay) };
+      return { evidence: evidence(f) };
     }
   },
   {
@@ -2496,14 +2526,14 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "critical",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/(\||<)\s*(sudo\s+)?(curl|wget|nc|ncat|netcat|ssh|scp)\b/i.test(c))
         return null;
       if (!/\b(cat|tar|zip|gzip|base64|env|printenv|cat\s|<)\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2514,7 +2544,7 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       const upload = /\b(curl|wget)\b[^|;&\n]*(-X\s*POST|--data\b|--data-\w+\b|\s-d\b|-T\b|--upload-file\b|-F\b|--form\b)/i.test(c);
@@ -2523,7 +2553,7 @@ var RULES = [
       const external = /https?:\/\/(?!(localhost|127\.0\.0\.1|0\.0\.0\.0))/i.test(c);
       const withFile = /(@[^\s'"]+|--upload-file|\s-T\b)/.test(c);
       return {
-        evidence: evidence(c),
+        evidence: evidence(ctx.command),
         severity: withFile && external ? "critical" : "high",
         mods: { external, with_file: withFile }
       };
@@ -2537,12 +2567,12 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "critical",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/\b(nc|ncat|netcat)\b[^|;&\n]*(-e\b|-c\b|\d{2,5})|\/dev\/tcp\/|bash\s+-i\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   // --- Privilege escalation / guardrail bypass (OWASP LLM06 Excessive Agency)
@@ -2554,10 +2584,10 @@ var RULES = [
     tools: "*",
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/--dangerously-skip-permissions\b|--yolo\b|--dangerously-skip\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2568,10 +2598,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|python\d?|node)\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2583,10 +2613,28 @@ var RULES = [
     baseSeverity: "high",
     // root escalation removes a real safety barrier — higher than an in-project op
     test(ctx) {
-      const c = ctx.command;
-      if (!c || !/(^|\s|\|)sudo\s+/i.test(c))
+      const c = ctx.commandBare;
+      if (!c || !/(?:^|[\n;|&(])\s*sudo\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.exec_generated_script",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Writes a shell script from inline output and executes it",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const raw = ctx.command;
+      if (!raw)
+        return null;
+      const file = execGeneratedScript(stripComments(raw));
+      if (!file)
         return null;
-      return { evidence: evidence(c) };
+      const critical = /(?:^|["'\s;|&(])sudo\b|\brm\s+[^|;&\n]*-[a-z]*r[a-z]*f|\bchmod\s+0?777\b|\bmkfs|\bdd\s+if=/i.test(raw);
+      return { evidence: evidence(raw), severity: critical ? "critical" : "high", mods: { script_file: file } };
     }
   },
   {
@@ -2597,10 +2645,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "medium",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bchmod\s+(-[a-zA-Z]+\s+)*0?777\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2611,12 +2659,12 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/\bcrontab\s+-|\bsystemctl\s+enable\b|\blaunchctl\s+load\b|>>\s*~\/\.(bashrc|zshrc|profile|bash_profile)\b|\/etc\/(cron|systemd|rc\.local)/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2628,7 +2676,7 @@ var RULES = [
     baseSeverity: "medium",
     test(ctx) {
       const f = ctx.filePath;
-      if (!outsideProject(f, ctx.projectPath))
+      if (!outsideProject(f, ctx.projectPath, ctx.ownedConfigDirs))
         return null;
       const system = !!f && SYSTEM_PATH.test(f);
       return { evidence: evidence(f), severity: system ? "high" : "medium", mods: { project: ctx.projectPath, system_path: system } };
@@ -2638,7 +2686,7 @@ var RULES = [
 function appliesTo(rule, toolName) {
   return rule.tools === "*" || rule.tools.includes(toolName);
 }
-function buildContext(row, projectPath) {
+function buildContext(row, projectPath, ownedConfigDirs) {
   let input = null;
   try {
     input = row.input_json ? JSON.parse(row.input_json) : null;
@@ -2646,8 +2694,10 @@ function buildContext(row, projectPath) {
     input = null;
   }
   const command = typeof input?.command === "string" ? input.command : null;
+  const commandCode = command != null ? codeOf(command) : null;
+  const commandBare = command != null ? bareOf(command) : null;
   const filePath = typeof input?.file_path === "string" ? input.file_path : null;
-  return { toolName: row.tool_name, command, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath };
+  return { toolName: row.tool_name, command, commandCode, commandBare, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath, ownedConfigDirs };
 }
 function detect(db, dirty) {
   const incremental = dirty != null;
@@ -2661,6 +2711,7 @@ function detect(db, dirty) {
     })(dirty);
   }
   const scope = incremental ? " WHERE tc.session_id IN (SELECT id FROM _dirty_sec)" : "";
+  const ownedConfigDirs = db.prepare("SELECT config_dir FROM sources WHERE config_dir IS NOT NULL").all().map((r) => r.config_dir.replace(/\/$/, "")).filter(Boolean);
   const projPath = /* @__PURE__ */ new Map();
   for (const r of db.prepare(`SELECT s.id id, p.path path FROM sessions s JOIN projects p ON p.id = s.project_id${incremental ? " WHERE s.id IN (SELECT id FROM _dirty_sec)" : ""}`).all()) {
     projPath.set(r.id, r.path);
@@ -2674,7 +2725,7 @@ function detect(db, dirty) {
   const tx = db.transaction(() => {
     db.exec(delScope);
     for (const row of rows) {
-      const ctx = buildContext(row, projPath.get(row.session_id) ?? null);
+      const ctx = buildContext(row, projPath.get(row.session_id) ?? null, ownedConfigDirs);
       for (const rule of RULES) {
         if (!appliesTo(rule, ctx.toolName))
           continue;