@zivis/mcp 0.1.8 → 0.1.10

package/dist/matcher/walker.js

@@ -0,0 +1,71 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+const HARD_SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    ".yarn",
+    ".pnpm",
+    "dist",
+    "build",
+    "out",
+    ".next",
+    ".nuxt",
+    ".turbo",
+    ".cache",
+    "coverage",
+    "vendor",
+    "__pycache__",
+    ".venv",
+    "target",
+]);
+const MAX_FILES = 50_000;
+const LANG_EXTENSIONS = {
+    typescript: [".ts", ".tsx"],
+    javascript: [".js", ".jsx", ".mjs", ".cjs"],
+    python: [".py"],
+    go: [".go"],
+};
+export async function walkLanguageFiles(rootDir, languages) {
+    const extToLang = new Map();
+    for (const lang of languages) {
+        for (const ext of LANG_EXTENSIONS[lang])
+            extToLang.set(ext, lang);
+    }
+    const filesByLanguage = new Map();
+    for (const lang of languages)
+        filesByLanguage.set(lang, []);
+    let filesScanned = 0;
+    let filesSkipped = 0;
+    const total = () => Array.from(filesByLanguage.values()).reduce((n, l) => n + l.length, 0);
+    async function visit(dirAbs) {
+        if (total() >= MAX_FILES)
+            return;
+        let entries;
+        try {
+            entries = await fs.readdir(dirAbs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (HARD_SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) {
+                    filesSkipped++;
+                    continue;
+                }
+                await visit(path.join(dirAbs, entry.name));
+                continue;
+            }
+            if (!entry.isFile() && !entry.isSymbolicLink())
+                continue;
+            filesScanned++;
+            const ext = path.extname(entry.name).toLowerCase();
+            const lang = extToLang.get(ext);
+            if (lang) {
+                filesByLanguage.get(lang).push(path.join(dirAbs, entry.name));
+            }
+        }
+    }
+    await visit(rootDir);
+    return { filesByLanguage, filesScanned, filesSkipped };
+}

package/dist/pattern-pack/index.d.ts

@@ -0,0 +1,125 @@
+export interface PackManifest {
+    schema_version: "1.0.0";
+    pack_id: string;
+    pack_name: string;
+    version: string;
+    built_at: string;
+    tier: "public_teaser" | "public" | "customer_safe";
+    description?: string;
+    capsules: ManifestCapsuleEntry[];
+    prompts: ManifestPromptEntry[];
+    controls?: ManifestControlEntry[];
+}
+export interface ManifestCapsuleEntry {
+    id: string;
+    version: string;
+    path: string;
+    sha256: string;
+    category?: string;
+    lifecycle?: string;
+    applicable_languages?: string[];
+}
+export interface ManifestPromptEntry {
+    path: string;
+    sha256: string;
+    capsule_id?: string;
+}
+export interface ManifestControlEntry {
+    id: string;
+    path: string;
+    sha256: string;
+    applicable_languages?: string[];
+}
+export interface ControlDetectionRule {
+    language: "typescript" | "javascript" | "python" | "go";
+    rule: unknown;
+}
+export interface Control {
+    id: string;
+    description?: string;
+    applicable_languages: string[];
+    detection: ControlDetectionRule[];
+    lifecycle?: string;
+    owner?: string;
+}
+export interface RelevanceTerm {
+    dependency?: string;
+    direct_only?: boolean;
+    language?: string;
+    framework?: string;
+    evidence?: string;
+}
+export interface RelevanceFilter {
+    any_of?: RelevanceTerm[];
+    all_of?: RelevanceTerm[];
+    none_of?: RelevanceTerm[];
+}
+export interface Capsule {
+    id: string;
+    slug: string;
+    version: string;
+    category: string;
+    title?: string;
+    headline?: string;
+    description?: string;
+    detection_tier: "public" | "proprietary";
+    scoring_tier: "public" | "proprietary";
+    applicable_languages: string[];
+    relevance_filter?: RelevanceFilter;
+    strategies: unknown[];
+    required_evidence_count: number;
+    threats?: unknown[];
+    lifecycle: "draft" | "active" | "deprecated";
+    sensitivity_level?: "public_teaser" | "customer_safe" | "zivis_confidential";
+    safe_summary?: string;
+    detect_when?: string;
+    risk_hints?: string[];
+    architectural_signals?: string[];
+    model_task_prompt_ref?: string;
+    expected_output_schema?: unknown;
+    minimum_context_required?: {
+        lines?: number;
+        symbols?: string[];
+    };
+    related_patterns?: string[];
+    repair_contract?: {
+        allowed?: string[];
+        forbidden?: string[];
+    };
+    validation_contract?: {
+        requires_tests_pass?: boolean;
+        requires_static_rules?: string[];
+    };
+}
+export interface PackHandle {
+    manifest: PackManifest;
+    rootDir: string;
+}
+export interface GraphArtifactView {
+    scope: {
+        languages?: string[];
+    };
+    nodes: Array<{
+        type: string;
+        evidence: Array<{
+            kind: string;
+        }>;
+        attributes?: {
+            package?: string;
+        };
+    }>;
+}
+export declare function loadActivePack(packId?: string): Promise<PackHandle>;
+export declare function getCapsule(handle: PackHandle, capsuleId: string): Promise<Capsule>;
+export declare function getInferencePrompt(handle: PackHandle, ref: string): Promise<string>;
+export declare function listCapsuleIds(handle: PackHandle): Promise<string[]>;
+export declare function listControlIds(handle: PackHandle): Promise<string[]>;
+export declare function getControl(handle: PackHandle, controlId: string): Promise<Control>;
+export declare function findRelevantCapsules(handle: PackHandle, artifact: GraphArtifactView): Promise<Capsule[]>;
+interface EvalContext {
+    packageNames: Set<string>;
+    languages: Set<string>;
+    evidenceKinds: Set<string>;
+}
+export declare function matchesRelevance(cap: Capsule, ctx: EvalContext): boolean;
+export {};

package/dist/pattern-pack/index.js

@@ -0,0 +1,189 @@
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import * as crypto from "node:crypto";
+import * as yaml from "js-yaml";
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+function userPackRoot() {
+    return path.join(userCacheRoot(), "pattern-packs");
+}
+function bundledPackRoot() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "../pattern-packs");
+}
+const DEFAULT_PACK_ID = "zivis-public";
+export async function loadActivePack(packId = DEFAULT_PACK_ID) {
+    if (process.env.ZIVIS_PACK_DIR) {
+        return readManifest(process.env.ZIVIS_PACK_DIR);
+    }
+    const cached = await findCachedPack(packId);
+    if (cached) {
+        return readManifest(cached);
+    }
+    const bundledDir = await findBundledPack(packId);
+    if (!bundledDir) {
+        throw new Error(`No pattern pack found. Looked in user cache (${userPackRoot()}) and bundled location (${bundledPackRoot()}). ` +
+            `Set ZIVIS_PACK_DIR to override.`);
+    }
+    const handle = await readManifest(bundledDir);
+    const cacheDir = path.join(userPackRoot(), `${handle.manifest.pack_id}-${handle.manifest.version}`);
+    await copyDir(bundledDir, cacheDir);
+    return { manifest: handle.manifest, rootDir: cacheDir };
+}
+async function findCachedPack(packId) {
+    const root = userPackRoot();
+    if (!fssync.existsSync(root))
+        return undefined;
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    const candidates = entries
+        .filter((e) => e.isDirectory() && e.name.startsWith(`${packId}-`))
+        .map((e) => e.name)
+        .sort()
+        .reverse();
+    for (const name of candidates) {
+        const dir = path.join(root, name);
+        if (fssync.existsSync(path.join(dir, "manifest.json"))) {
+            return dir;
+        }
+    }
+    return undefined;
+}
+async function findBundledPack(packId) {
+    const root = bundledPackRoot();
+    if (!fssync.existsSync(root))
+        return undefined;
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    const matches = entries
+        .filter((e) => e.isDirectory() && e.name.startsWith(`${packId}-`))
+        .map((e) => path.join(root, e.name))
+        .sort()
+        .reverse();
+    return matches[0];
+}
+async function readManifest(rootDir) {
+    const manifestPath = path.join(rootDir, "manifest.json");
+    const raw = await fs.readFile(manifestPath, "utf8");
+    const manifest = JSON.parse(raw);
+    return { manifest, rootDir };
+}
+async function copyDir(src, dst) {
+    await fs.mkdir(dst, { recursive: true });
+    const entries = await fs.readdir(src, { withFileTypes: true });
+    await Promise.all(entries.map(async (entry) => {
+        const s = path.join(src, entry.name);
+        const d = path.join(dst, entry.name);
+        if (entry.isDirectory())
+            await copyDir(s, d);
+        else if (entry.isFile())
+            await fs.copyFile(s, d);
+    }));
+}
+export async function getCapsule(handle, capsuleId) {
+    const entry = handle.manifest.capsules.find((c) => c.id === capsuleId);
+    if (!entry)
+        throw new Error(`Capsule not found in pack: ${capsuleId}`);
+    const fullPath = path.join(handle.rootDir, entry.path);
+    const raw = await fs.readFile(fullPath, "utf8");
+    await verifySha256(raw, entry.sha256, entry.path);
+    return yaml.load(raw);
+}
+export async function getInferencePrompt(handle, ref) {
+    const entry = handle.manifest.prompts.find((p) => p.path === ref);
+    if (!entry)
+        throw new Error(`Prompt not found in pack: ${ref}`);
+    const fullPath = path.join(handle.rootDir, ref);
+    const raw = await fs.readFile(fullPath, "utf8");
+    await verifySha256(raw, entry.sha256, ref);
+    return raw;
+}
+async function verifySha256(content, expected, label) {
+    const actual = crypto.createHash("sha256").update(content).digest("hex");
+    if (actual !== expected) {
+        throw new Error(`Pack integrity check failed for ${label}: expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…`);
+    }
+}
+export async function listCapsuleIds(handle) {
+    return handle.manifest.capsules.map((c) => c.id);
+}
+export async function listControlIds(handle) {
+    return (handle.manifest.controls ?? []).map((c) => c.id);
+}
+export async function getControl(handle, controlId) {
+    const entry = (handle.manifest.controls ?? []).find((c) => c.id === controlId);
+    if (!entry)
+        throw new Error(`Control not found in pack: ${controlId}`);
+    const fullPath = path.join(handle.rootDir, entry.path);
+    const raw = await fs.readFile(fullPath, "utf8");
+    await verifySha256(raw, entry.sha256, entry.path);
+    return yaml.load(raw);
+}
+export async function findRelevantCapsules(handle, artifact) {
+    const out = [];
+    const ctx = buildEvalContext(artifact);
+    for (const entry of handle.manifest.capsules) {
+        const cap = await getCapsule(handle, entry.id);
+        if (matchesRelevance(cap, ctx))
+            out.push(cap);
+    }
+    return out;
+}
+function buildEvalContext(artifact) {
+    const packageNames = new Set();
+    for (const node of artifact.nodes) {
+        if (node.type === "external_dependency" && node.attributes?.package) {
+            packageNames.add(node.attributes.package);
+        }
+    }
+    const languages = new Set(artifact.scope.languages ?? []);
+    const evidenceKinds = new Set();
+    for (const node of artifact.nodes) {
+        for (const ev of node.evidence)
+            evidenceKinds.add(ev.kind);
+    }
+    return { packageNames, languages, evidenceKinds };
+}
+export function matchesRelevance(cap, ctx) {
+    if (cap.applicable_languages.length > 0) {
+        const hit = cap.applicable_languages.some((l) => l === "cross" || ctx.languages.has(l));
+        if (!hit)
+            return false;
+    }
+    const f = cap.relevance_filter;
+    if (!f)
+        return true;
+    if (f.any_of && f.any_of.length > 0) {
+        if (!f.any_of.some((t) => evalTerm(t, ctx)))
+            return false;
+    }
+    if (f.all_of && f.all_of.length > 0) {
+        if (!f.all_of.every((t) => evalTerm(t, ctx)))
+            return false;
+    }
+    if (f.none_of && f.none_of.length > 0) {
+        if (f.none_of.some((t) => evalTerm(t, ctx)))
+            return false;
+    }
+    return true;
+}
+function evalTerm(term, ctx) {
+    if (term.dependency !== undefined)
+        return ctx.packageNames.has(term.dependency);
+    if (term.language !== undefined)
+        return ctx.languages.has(term.language);
+    if (term.evidence !== undefined)
+        return ctx.evidenceKinds.has(term.evidence);
+    return false;
+}

package/dist/pattern-packs/zivis-public-0.2.0/capsules/agents/privilege-separation.yaml

@@ -0,0 +1,224 @@
+# Detection Card: Privilege Separation (absent)
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: agents.privilege-separation
+slug: privilege-separation
+version: 0.1.0
+category: agents
+title: Privilege Separation
+headline: Per-Subtask Capability Scoping
+description: >
+  Detects agentic codebases where multiple agents share a single tool/capability
+  set without per-agent scoping. Absence of privilege separation means one
+  compromised agent inherits the full capability surface of the system.
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+# Don't run this pattern unless an agent framework is actually present.
+# Mirrors nuclei-style relevance gating to keep the noise floor low.
+relevance_filter:
+  any_of:
+    - dependency: "langgraph"
+      direct_only: true
+    - dependency: "langchain"
+      direct_only: true
+    - dependency: "@langchain/langgraph"
+      direct_only: true
+    - dependency: "crewai"
+      direct_only: true
+    - dependency: "llama-index"
+      direct_only: true
+    - dependency: "openai-agents"
+      direct_only: true
+    - dependency: "autogen-agentchat"
+      direct_only: true
+
+strategies:
+  # 1. AST: Find tool list assignments (Python — LangChain/LangGraph idiom).
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        kind: assignment
+        pattern: $TOOLS = [$$$]
+        has:
+          stopBy: end
+          any:
+            - pattern: create_react_agent
+            - pattern: bind_tools
+            - pattern: AgentExecutor
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.25
+
+  # 2. AST: TypeScript/JavaScript equivalent.
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          - pattern: const $TOOLS = [$$$]
+          - pattern: bindTools($$$)
+          - pattern: createReactAgent($$$)
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.25
+
+  # 3. GRAPH: Two or more agent declarations share the same tool set.
+  # Predicate evaluated against extractor output (components/edges).
+  - code: GRAPH
+    expression: |
+      count(distinct agent_declaration) >= 2
+      AND any_pair(agents, lambda a, b: a.tool_set == b.tool_set)
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.35
+
+  # 4. META: Absence of per-agent capability scope OR explicit authz layer.
+  - code: META
+    expression:
+      none_of_controls:
+        - langgraph_state_machine_with_per_node_tools
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.30
+
+  # 5. INFER: Last-resort semantic check; never alone proves a finding.
+  - code: INFER
+    expression: "prompt_id:agents.privilege-separation.identify"
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 3
+
+# Presence of any of these controls downgrades or eliminates the finding.
+control_negations:
+  - "presence_of(per_agent_tool_filter)"
+  - "presence_of(capability_token_check)"
+  - "presence_of(langgraph_state_machine_with_per_node_tools)"
+
+threats:
+  - title: Compromised planner inherits executor capabilities
+    stride: [tampering, elevation_of_privilege]
+    description: >
+      A prompt-injection compromise of any agent escalates to the full set of
+      tools available to all agents in the system, including high-impact tools
+      like code execution, email, or file write.
+    remediation: >
+      Bind only the minimum tools required to each agent. In LangGraph, define
+      tools per node rather than globally. Add a capability token or
+      authorization layer that validates tool dispatch against agent identity.
+  - title: Lateral compromise via shared tool registry
+    stride: [elevation_of_privilege, information_disclosure]
+    description: >
+      Any tool callable from one agent is callable from every agent. There is
+      no blast-radius reduction even if one agent is otherwise constrained.
+
+fixtures:
+  positive:
+    - "fixtures/positive/privilege-separation/langgraph_shared_tools_python"
+    - "fixtures/positive/privilege-separation/langchain_shared_tools_typescript"
+  negative:
+    - "fixtures/negative/privilege-separation/langgraph_per_node_tools"
+    - "fixtures/negative/privilege-separation/non_agentic_repo"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - agentic-ai
+  - least-privilege
+  - blast-radius
+
+# Capsule fields — added in Phase 2A so the pack builder can ship this card
+# as a runnable customer-safe capsule (deterministic strategies + inference prompt).
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Multi-agent systems often share a single tool registry across agents. When that
+  happens, a prompt-injection compromise of any one agent inherits the full
+  capability surface of the system — including high-impact tools like code
+  execution, email, or filesystem write. Privilege separation means each agent
+  is bound only to the minimum tools required for its role.
+
+detect_when: >
+  Two or more agent declarations are wired to the same tool list, or a single
+  shared tool array is referenced by every agent factory call, with no per-agent
+  capability scoping or authorization layer between agent and tool dispatch.
+
+risk_hints:
+  - Any tool callable from one agent becomes callable from every agent
+  - Compromise of the weakest-prompted agent escalates to the most-privileged tool
+  - LangGraph's per-node tool binding is the idiomatic fix; AgentExecutor with a flat tool list is the anti-pattern
+
+architectural_signals:
+  - Shared TOOLS array reused across multiple agent constructors
+  - No capability_token / authorization_layer between planner and tool dispatch
+  - LangGraph used without per-node tool binding
+
+model_task_prompt_ref: prompts/agents/privilege-separation/identify.md
+
+expected_output_schema:
+  type: object
+  required: [verdict, rationale, evidence_spans]
+  properties:
+    verdict:
+      type: string
+      enum: [present, absent, unclear]
+      description: present = privilege separation IS implemented; absent = the anti-pattern fires; unclear = needs human review
+    confidence:
+      type: number
+      minimum: 0
+      maximum: 1
+    rationale:
+      type: string
+      description: One paragraph, cites specific code constructs.
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 120
+  symbols:
+    - bind_tools
+    - bindTools
+    - create_react_agent
+    - createReactAgent
+    - AgentExecutor
+
+related_patterns:
+  - agents.goal-decomposition-attack-surface
+  - agents.tool-call-without-authorization
+
+repair_contract:
+  allowed:
+    - Bind a per-agent tool subset at construction time
+    - Introduce a capability-token or authorization layer between agent and tool dispatch
+    - Migrate to LangGraph state machines with per-node tools
+  forbidden:
+    - Removing tools entirely without functional replacement
+    - Centralizing tools further (the opposite direction)
+    - Disabling agent execution to "fix" the finding
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - no_shared_tool_registry_after_patch
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates