@swestash/agent-lens 0.5.0 → 0.5.2

package/dist/agent-lens.js

@@ -2319,7 +2319,7 @@ function classify(db, dirty) {
 
 // ../ingest/dist/detect.js
 import { createHash } from "crypto";
-var DETECTOR_VERSION = 3;
+var DETECTOR_VERSION = 6;
 function evidence(s, max = 200) {
   const one = s.replace(/\s+/g, " ").trim();
   return one.length > max ? one.slice(0, max - 1) + "\u2026" : one;
@@ -2330,7 +2330,7 @@ function findingId(toolCallId, ruleId) {
 var SYSTEM_PATH = /(^|\s)(\/etc\/|\/usr\/|\/bin\/|\/sbin\/|\/boot\/|\/var\/|\/root\/|~\/\.ssh\/|~\/\.aws\/)/;
 var HOME_OR_ROOT_TARGET = /(\s|^)(~\/?|\/|\/\*|\$HOME\/?|\*)(\s|$)/;
 var SECRET_FILE = /(^|\/|\s)(\.env(\.[\w.-]+)?|id_rsa|id_ed25519|id_ecdsa|\.ssh\/[\w.-]+|\.aws\/credentials|\.gcp\/|gcloud\/|\.npmrc|\.pypirc|\.netrc|\.pem|\.p12|\.pfx|secrets?\.(ya?ml|json|txt)|credentials(\.json)?)\b/i;
-var EXAMPLE_FILE = /\.(example|sample|template|dist)($|\.)/i;
+var EXAMPLE_FILE = /\.(example|sample|template|dist)(?![\w-])/i;
 var CONTENT_READ_CMD = /\b(cat|less|more|head|tail|bat|xxd|strings|base64|grep|egrep|rg|awk|sed|nl|tac|od|hexdump|cp|scp|sort)\b/i;
 var SECRET_VALUE_PATTERNS = [
   { re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/, label: "private-key", critical: true },
@@ -2341,23 +2341,73 @@ var SECRET_VALUE_PATTERNS = [
   { re: /\bsk-[A-Za-z0-9]{20,}\b/, label: "api-secret-key" }
 ];
 var isBash = (t) => t === "Bash";
-var AGENT_CONFIG_PATH = /(^|\/)\.claude\//;
+var stripComments = (c) => c.replace(/(^|\s)#[^\n]*/g, "$1");
+var neutralizeEcho = (c) => c.replace(/((?:^|[;&|\n(])\s*)(?:echo|printf)\b(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^;&|\n])*/gi, "$1echo");
+var blankHeredoc = (c) => c.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\s*\2\b/g, "<<HEREDOC");
+var codeOf = (c) => neutralizeEcho(stripComments(blankHeredoc(c)));
+var blankQuoted = (c) => c.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'[^']*'/g, "''");
+var bareOf = (c) => blankQuoted(codeOf(c));
+function execGeneratedScript(cmd) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const m of cmd.matchAll(/(?:>>?|\btee\b\s+(?:-a\s+)?)\s*["']?([A-Za-z0-9._/~-]+)/g)) {
+    if (m[1] && !m[1].startsWith("/dev/"))
+      targets.add(m[1]);
+  }
+  for (const t of targets) {
+    const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const interp = new RegExp(`\\b(?:sh|bash|zsh|ksh|dash|source)\\s+["']?${e}\\b|(?:^|[\\n;|&(])\\s*\\.\\s+["']?${e}\\b`);
+    const hasPath = /^(\.\/|\/|~\/)/.test(t);
+    const path = hasPath ? new RegExp(`(?:^|[\\n;|&(])\\s*${e}(?:\\s|$|[;&|<>])`) : new RegExp(`(?:^|[\\n;|&(])\\s*\\.\\/${e}\\b`);
+    if (interp.test(cmd) || path.test(cmd))
+      return t;
+  }
+  return null;
+}
 var TEMP_PATH = /^(\/tmp\/|\/var\/folders\/|\/private\/var\/folders\/)/;
-function isAgentOwnedPath(p) {
-  if (AGENT_CONFIG_PATH.test(p) || TEMP_PATH.test(p))
+function isAgentOwnedPath(p, configDirs) {
+  if (TEMP_PATH.test(p))
+    return true;
+  if (configDirs.some((d) => p === d || p.startsWith(d + "/")))
     return true;
   const tmp = process.env.TMPDIR;
   return !!tmp && p.startsWith(tmp.replace(/\/$/, "") + "/");
 }
-function outsideProject(filePath, projectPath) {
+function outsideProject(filePath, projectPath, configDirs) {
   if (!filePath || !filePath.startsWith("/"))
     return false;
-  if (isAgentOwnedPath(filePath))
+  if (isAgentOwnedPath(filePath, configDirs))
     return false;
   if (!projectPath)
     return false;
   return filePath !== projectPath && !filePath.startsWith(projectPath.replace(/\/$/, "") + "/");
 }
+var SCOPE_RANK = { unknown: 0, loopback: 1, internal: 2, external: 3 };
+function netTargetScope(rawCommand) {
+  const s = rawCommand.replace(/(?:-H|--header)\s+(['"]).*?\1/gi, " ").replace(/(?:-H|--header)\s+[^\s'"]+/gi, " ");
+  const authorities = [];
+  for (const m of s.matchAll(/\bhttps?:\/\/(\[[0-9a-fA-F:]+\]|[^/\s"'<>|]+)/gi))
+    authorities.push(m[1]);
+  for (const m of s.matchAll(/(?:^|[\s"'=(])(\[[0-9a-fA-F:]+\]|[A-Za-z0-9.-]+):\d{2,5}(?=[/\s"']|$)/g))
+    authorities.push(m[1]);
+  let scope = "unknown";
+  for (let host of authorities) {
+    host = host.replace(/^\[|\]$/g, "").replace(/^[^@/]*@/, "").toLowerCase();
+    if (!host.includes("::"))
+      host = host.replace(/:\d+$/, "");
+    let hs;
+    if (host === "localhost" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) || host === "0.0.0.0" || host === "::1")
+      hs = "loopback";
+    else if (/^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) || // RFC1918
+    /^192\.168\.\d{1,3}\.\d{1,3}$/.test(host) || /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/.test(host) || /^169\.254\.\d{1,3}\.\d{1,3}$/.test(host) || // link-local
+    host.endsWith(".local") || host.endsWith(".internal") || !host.includes("."))
+      hs = "internal";
+    else
+      hs = "external";
+    if (SCOPE_RANK[hs] > SCOPE_RANK[scope])
+      scope = hs;
+  }
+  return scope;
+}
 var RULES = [
   // --- Destructive / data-loss (OWASP ASI02 Tool Misuse) -------------------
   {
@@ -2368,14 +2418,14 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       const rf = /\brm\s+[^|;&\n]*(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r|--recursive[^|;&\n]*--force|--force[^|;&\n]*--recursive)/i;
       if (!rf.test(c))
         return null;
       const dangerousTarget = HOME_OR_ROOT_TARGET.test(c) || /\s\/(?:\s|$)/.test(c) || /\brm\b[^|;&\n]*\*/.test(c);
-      return { evidence: evidence(c), severity: dangerousTarget ? "critical" : "high", mods: { dangerous_target: dangerousTarget } };
+      return { evidence: evidence(ctx.command), severity: dangerousTarget ? "critical" : "high", mods: { dangerous_target: dangerousTarget } };
     }
   },
   {
@@ -2384,12 +2434,13 @@ var RULES = [
     framework_ref: "OWASP ASI02",
     title: "Discards local changes (git reset --hard)",
     tools: ["Bash"],
-    baseSeverity: "medium",
+    baseSeverity: "low",
+    // routine dev op — only uncommitted working-tree changes are lost; commits survive in reflog
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bgit\s+reset\s+--hard\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2398,13 +2449,14 @@ var RULES = [
     framework_ref: "OWASP ASI02",
     title: "Force-push rewrites remote history",
     tools: ["Bash"],
-    baseSeverity: "medium",
+    baseSeverity: "low",
+    // feature-branch force-push is routine; only a protected branch (below) is high
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bgit\s+push\b[^|;&\n]*(--force\b|--force-with-lease\b|\s-f\b)/i.test(c))
         return null;
       const mainBranch = /\b(main|master|release)\b/.test(c);
-      return { evidence: evidence(c), severity: mainBranch ? "high" : "medium", mods: { protected_branch: mainBranch } };
+      return { evidence: evidence(ctx.command), severity: mainBranch ? "high" : "low", mods: { protected_branch: mainBranch } };
     }
   },
   {
@@ -2415,10 +2467,11 @@ var RULES = [
     tools: "*",
     baseSeverity: "high",
     test(ctx) {
-      const hay = ctx.command ?? (typeof ctx.input?.query === "string" ? ctx.input.query : null);
+      const query = typeof ctx.input?.query === "string" ? ctx.input.query : null;
+      const hay = ctx.commandCode ?? query;
       if (!hay || !/\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE(\s+TABLE)?)\b/i.test(hay))
         return null;
-      return { evidence: evidence(hay) };
+      return { evidence: evidence(ctx.command ?? query) };
     }
   },
   {
@@ -2429,10 +2482,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/(\bdd\s+if=|\bmkfs(\.\w+)?\b|\bshred\b)/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2441,14 +2494,16 @@ var RULES = [
     framework_ref: "OWASP ASI02",
     title: "Overwrites a critical project file",
     tools: ["Write", "Edit", "MultiEdit"],
-    baseSeverity: "medium",
+    baseSeverity: "low",
     test(ctx) {
       const f = ctx.filePath;
       if (!f)
         return null;
-      if (!/(^|\/)(package-lock\.json|pnpm-lock\.ya?ml|yarn\.lock|Cargo\.lock|go\.sum|\.github\/workflows\/|\.gitlab-ci\.ya?ml)\b/.test(f))
+      const lock = /(^|\/)(package-lock\.json|pnpm-lock\.ya?ml|yarn\.lock|Cargo\.lock|go\.sum)\b/.test(f);
+      const ci = /(^|\/)(\.github\/workflows\/|\.gitlab-ci\.ya?ml)\b/.test(f);
+      if (!lock && !ci)
         return null;
-      return { evidence: evidence(f) };
+      return { evidence: evidence(f), severity: ci ? "medium" : "low", mods: { kind: ci ? "ci-config" : "lockfile" } };
     }
   },
   // --- Credential & secret access ------------------------------------------
@@ -2460,12 +2515,18 @@ var RULES = [
     tools: ["Read", "Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const hay = ctx.toolName === "Read" ? ctx.filePath : ctx.command;
-      if (!hay || !SECRET_FILE.test(hay) || EXAMPLE_FILE.test(hay))
-        return null;
-      if (isBash(ctx.toolName) && !CONTENT_READ_CMD.test(hay))
+      if (isBash(ctx.toolName)) {
+        const cmd = ctx.commandBare;
+        if (!cmd)
+          return null;
+        const segments = cmd.split(/\|\||&&|[|;\n]/);
+        const reads = segments.some((seg) => SECRET_FILE.test(seg) && !EXAMPLE_FILE.test(seg) && CONTENT_READ_CMD.test(seg));
+        return reads ? { evidence: evidence(ctx.command) } : null;
+      }
+      const f = ctx.filePath;
+      if (!f || !SECRET_FILE.test(f) || EXAMPLE_FILE.test(f))
         return null;
-      return { evidence: evidence(hay) };
+      return { evidence: evidence(f) };
     }
   },
   {
@@ -2496,36 +2557,43 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "critical",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/(\||<)\s*(sudo\s+)?(curl|wget|nc|ncat|netcat|ssh|scp)\b/i.test(c))
         return null;
       if (!/\b(cat|tar|zip|gzip|base64|env|printenv|cat\s|<)\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
     id: "exfil.network_upload",
     category: "exfiltration",
     framework_ref: "MITRE ATLAS AML.T0086",
-    title: "Uploads data to an external host",
+    title: "Uploads data to a network host",
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
-      const upload = /\b(curl|wget)\b[^|;&\n]*(-X\s*POST|--data\b|--data-\w+\b|\s-d\b|-T\b|--upload-file\b|-F\b|--form\b)/i.test(c);
+      const upload = /\b(curl|wget)\b[^|;&\n]*(-X\s*POST|--data\b|--data-\w+\b|\s-d\b|-T\b|--upload-file\b|-F\b|--form\b)/.test(c);
       if (!upload)
         return null;
-      const external = /https?:\/\/(?!(localhost|127\.0\.0\.1|0\.0\.0\.0))/i.test(c);
       const withFile = /(@[^\s'"]+|--upload-file|\s-T\b)/.test(c);
+      const scope = netTargetScope(ctx.command);
+      let severity;
+      if (scope === "external")
+        severity = withFile ? "critical" : "high";
+      else if (scope === "unknown")
+        severity = "high";
+      else
+        severity = withFile ? bumpSeverity(scope === "loopback" ? "info" : "low", 1) : scope === "loopback" ? "info" : "low";
       return {
-        evidence: evidence(c),
-        severity: withFile && external ? "critical" : "high",
-        mods: { external, with_file: withFile }
+        evidence: evidence(ctx.command),
+        severity,
+        mods: { target_scope: scope, with_file: withFile }
       };
     }
   },
@@ -2537,12 +2605,12 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "critical",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/\b(nc|ncat|netcat)\b[^|;&\n]*(-e\b|-c\b|\d{2,5})|\/dev\/tcp\/|bash\s+-i\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   // --- Privilege escalation / guardrail bypass (OWASP LLM06 Excessive Agency)
@@ -2554,10 +2622,10 @@ var RULES = [
     tools: "*",
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/--dangerously-skip-permissions\b|--yolo\b|--dangerously-skip\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2568,10 +2636,17 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
-      if (!c || !/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|python\d?|node)\b/i.test(c))
+      const c = ctx.commandBare;
+      if (!c)
         return null;
-      return { evidence: evidence(c) };
+      const m = /\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(sh|bash|zsh|python\d?|node)\b([^|;&]*)/i.exec(c);
+      if (!m)
+        return null;
+      const interp = m[1].toLowerCase();
+      const args = m[2] || "";
+      if (/^(?:node|python)/.test(interp) && /(?:^|\s)-(?:e|c|m|p)\b|(?:^|\s)--(?:eval|command|module|print)\b/.test(args))
+        return null;
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2583,10 +2658,28 @@ var RULES = [
     baseSeverity: "high",
     // root escalation removes a real safety barrier — higher than an in-project op
     test(ctx) {
-      const c = ctx.command;
-      if (!c || !/(^|\s|\|)sudo\s+/i.test(c))
+      const c = ctx.commandBare;
+      if (!c || !/(?:^|[\n;|&(])\s*sudo\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.exec_generated_script",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Writes a shell script from inline output and executes it",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const raw = ctx.command;
+      if (!raw)
+        return null;
+      const file = execGeneratedScript(stripComments(raw));
+      if (!file)
         return null;
-      return { evidence: evidence(c) };
+      const critical = /(?:^|["'\s;|&(])sudo\b|\brm\s+[^|;&\n]*-[a-z]*r[a-z]*f|\bchmod\s+0?777\b|\bmkfs|\bdd\s+if=/i.test(raw);
+      return { evidence: evidence(raw), severity: critical ? "critical" : "high", mods: { script_file: file } };
     }
   },
   {
@@ -2597,10 +2690,10 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "medium",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c || !/\bchmod\s+(-[a-zA-Z]+\s+)*0?777\b/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2611,12 +2704,12 @@ var RULES = [
     tools: ["Bash"],
     baseSeverity: "high",
     test(ctx) {
-      const c = ctx.command;
+      const c = ctx.commandBare;
       if (!c)
         return null;
       if (!/\bcrontab\s+-|\bsystemctl\s+enable\b|\blaunchctl\s+load\b|>>\s*~\/\.(bashrc|zshrc|profile|bash_profile)\b|\/etc\/(cron|systemd|rc\.local)/i.test(c))
         return null;
-      return { evidence: evidence(c) };
+      return { evidence: evidence(ctx.command) };
     }
   },
   {
@@ -2625,20 +2718,21 @@ var RULES = [
     framework_ref: "OWASP LLM06",
     title: "Writes a file outside the working project",
     tools: ["Write", "Edit", "MultiEdit"],
-    baseSeverity: "medium",
+    baseSeverity: "low",
+    // writing to /tmp, scratch dirs, adjacent repos is routine; only a system path (below) is high
     test(ctx) {
       const f = ctx.filePath;
-      if (!outsideProject(f, ctx.projectPath))
+      if (!outsideProject(f, ctx.projectPath, ctx.ownedConfigDirs))
         return null;
       const system = !!f && SYSTEM_PATH.test(f);
-      return { evidence: evidence(f), severity: system ? "high" : "medium", mods: { project: ctx.projectPath, system_path: system } };
+      return { evidence: evidence(f), severity: system ? "high" : "low", mods: { project: ctx.projectPath, system_path: system } };
     }
   }
 ];
 function appliesTo(rule, toolName) {
   return rule.tools === "*" || rule.tools.includes(toolName);
 }
-function buildContext(row, projectPath) {
+function buildContext(row, projectPath, ownedConfigDirs) {
   let input = null;
   try {
     input = row.input_json ? JSON.parse(row.input_json) : null;
@@ -2646,8 +2740,10 @@ function buildContext(row, projectPath) {
     input = null;
   }
   const command = typeof input?.command === "string" ? input.command : null;
+  const commandCode = command != null ? codeOf(command) : null;
+  const commandBare = command != null ? bareOf(command) : null;
   const filePath = typeof input?.file_path === "string" ? input.file_path : null;
-  return { toolName: row.tool_name, command, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath };
+  return { toolName: row.tool_name, command, commandCode, commandBare, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath, ownedConfigDirs };
 }
 function detect(db, dirty) {
   const incremental = dirty != null;
@@ -2661,6 +2757,7 @@ function detect(db, dirty) {
     })(dirty);
   }
   const scope = incremental ? " WHERE tc.session_id IN (SELECT id FROM _dirty_sec)" : "";
+  const ownedConfigDirs = db.prepare("SELECT config_dir FROM sources WHERE config_dir IS NOT NULL").all().map((r) => r.config_dir.replace(/\/$/, "")).filter(Boolean);
   const projPath = /* @__PURE__ */ new Map();
   for (const r of db.prepare(`SELECT s.id id, p.path path FROM sessions s JOIN projects p ON p.id = s.project_id${incremental ? " WHERE s.id IN (SELECT id FROM _dirty_sec)" : ""}`).all()) {
     projPath.set(r.id, r.path);
@@ -2674,7 +2771,7 @@ function detect(db, dirty) {
   const tx = db.transaction(() => {
     db.exec(delScope);
     for (const row of rows) {
-      const ctx = buildContext(row, projPath.get(row.session_id) ?? null);
+      const ctx = buildContext(row, projPath.get(row.session_id) ?? null, ownedConfigDirs);
       for (const rule of RULES) {
         if (!appliesTo(rule, ctx.toolName))
           continue;