atris 3.80.0 → 3.80.1

package/lib/security-audit-classes.js

@@ -8,7 +8,7 @@
 // control that should stop them, and the concrete result across the boundary.
 
 const CODE_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.py', '.rb', '.go', '.java', '.php', '.rs', '.sh', '.bash', '.zsh']);
-const WEB_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.html', '.vue', '.svelte']);
+const WEB_EXTS = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.html', '.vue', '.svelte', '.erb', '.rb']);
 const WORKFLOW_RE = /(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/;
 
 const CLASSES = [
@@ -23,6 +23,9 @@ const CLASSES = [
       /\bsubprocess\.(?:run|call|Popen|check_output|check_call)\s*\(/,
       /\bos\.(?:system|popen)\s*\(/,
       /\bshell\s*:\s*true\b/,
+      // Ruby, Go, Java
+      /\b(?:system|spawn|exec)\s*\(?\s*["'][^"'\n]*#\{|%x[{(\[]|\bIO\.popen\b|\bOpen3\.\w+|`[^`\n]*#\{/,
+      /\bexec\.Command(?:Context)?\s*\(|\bRuntime\.getRuntime\(\)\.exec\b|\bnew\s+ProcessBuilder\b/,
     ],
     guide: [
       'Invariant: a lower-trust value never becomes shell syntax, a program name, or an option the caller did not intend.',
@@ -44,6 +47,7 @@ const CLASSES = [
       /\brequire\s*\(\s*(?!['"`])[^)]/,
       /\bimport\s*\(\s*(?!['"`])[^)]/,
       /\b(?:exec|compile)\s*\(\s*(?!['"])/,
+      /\b(?:instance_eval|class_eval|module_eval|instance_exec)\b|\.(?:constantize|safe_constantize)\b|\bconst_get\s*\(|\.(?:public_)?send\s*\(\s*(?![:'\"])/,
     ],
     guide: [
       'Invariant: text from a lower-trust source is never run as code, and a module path is never chosen by it.',
@@ -61,6 +65,7 @@ const CLASSES = [
       /\b(?:readFileSync|writeFileSync|readFile|writeFile|appendFileSync|createReadStream|createWriteStream|unlinkSync|rmSync|rmdirSync|renameSync|copyFileSync|symlinkSync|cpSync)\s*\(\s*(?!['"`])/,
       /\bpath\.(?:join|resolve)\s*\([^)]*\b(?:req|params|query|body|name|slug|id|input|args?|file|target)\b/,
       /\bextract(?:All)?\s*\(|\btar\b.*\bx\b|\bunzip\b/,
+      /\bFile\.(?:read|write|open|binread|binwrite|delete|unlink|rename|symlink)\s*\(\s*(?!['\"])|\bFileUtils\.\w+|\bsend_file\b|\bos\.(?:Open|OpenFile|Create|ReadFile|WriteFile|Remove(?:All)?)\s*\(|\bfilepath\.Join\s*\(/,
     ],
     guide: [
       'Invariant: a path built from a lower-trust value stays inside the directory the code means, after normalization and symlink resolution.',
@@ -81,6 +86,7 @@ const CLASSES = [
       /\baxios(?:\.\w+)?\s*\(/,
       /\brequests\.(?:get|post|put|patch|delete|request)\s*\(/,
       /\burllib\.request\.urlopen\s*\(/,
+      /\bNet::HTTP\b|\bHTTParty\b|\bFaraday\b|\bURI\.open\b|\bRestClient\b|\bhttp\.(?:Get|Post|Head|NewRequest(?:WithContext)?)\s*\(/,
     ],
     guide: [
       'Invariant: a lower-trust value cannot pick the host, scheme, or port of a request made with this process\'s network position or credentials.',
@@ -100,6 +106,10 @@ const CLASSES = [
       /\bcreateServer\s*\(/,
       /\.listen\s*\(\s*(?:\d|port|PORT)/,
       /\b(?:req|request)\.(?:headers|query|params|body)\b/,
+      /\b(?:before_action|skip_before_action|authorize!?|current_user|policy_scope|load_and_authorize_resource)\b|\bparams\[/,
+      /\bdef\s+(?:self\.)?(?:authorized\?|visible\?|scope_items\b|resolve\b)|\bfield\s+:\w+|\bargument\s+:\w+/,
+      /^\s*(?:get|post|put|patch|delete|match|resources?)\s+['\":]/,
+      /\bhttp\.HandleFunc\s*\(|\b\w+\.(?:GET|POST|PUT|PATCH|DELETE|Handle|HandleFunc)\s*\(\s*\"\//,
     ],
     guide: [
       'Invariant: every action that reads or changes another principal\'s data, or spends shared resources, checks who is asking and whether they may.',
@@ -119,6 +129,7 @@ const CLASSES = [
       /os\.environ(?:\.get)?\s*[[(]\s*['"][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)/,
       /\b(?:authorization|x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token)\b/i,
       /\bcredentials?\.json\b|\bkeychain\b|\.netrc\b/i,
+      /\bENV(?:\.fetch)?\s*[\[(]\s*['\"][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)|\bos\.Getenv\s*\(\s*\"[A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)/,
     ],
     guide: [
       'Invariant: a credential reaches only the party it was issued for, and never lands in logs, errors, receipts, prompts, child process environments, or files others can read.',
@@ -155,6 +166,7 @@ const CLASSES = [
       /\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^;\n]*(?:\$\{|['"`]\s*\+|%s|\.format\(|\bf["'])/i,
       /\.(?:query|execute|raw|exec)\s*\(\s*(?:`[^`]*\$\{|f["']|['"][^'"]*['"]\s*\+)/,
       /\$where\b|\.find\s*\(\s*(?:req|request)\./,
+      /\.(?:where|order|group|having|joins|select|pluck|find_by_sql|exec_query|execute)\s*\(\s*\"[^\"\n]*#\{|\.order\s*\(\s*params\b|\.(?:Query|QueryRow|Exec)(?:Context)?\s*\([^)\n]*fmt\.Sprintf/,
     ],
     guide: [
       'Invariant: lower-trust values reach a query only as bound parameters, never as query text, identifiers, or operators.',
@@ -175,6 +187,7 @@ const CLASSES = [
       /\bv-html\b|\{@html\b/,
       /\bpostMessage\s*\(|addEventListener\s*\(\s*['"]message['"]/,
       /\bhref\s*=\s*\{?\s*(?!['"](?:https?:|\/|#))/,
+      /\.html_safe\b|\braw\s*\(|<%==/,
     ],
     guide: [
       'Invariant: text from another user or an outside source renders as text, never as markup or script, and cross-window messages are accepted only from expected origins.',
@@ -194,6 +207,7 @@ const CLASSES = [
       /\bunserialize\s*\(|\bMarshal\.load\b/,
       /\b__proto__\b|\bconstructor\s*\[\s*['"]prototype/,
       /\bObject\.assign\s*\(\s*\{\}\s*,\s*(?:req|body|input|data|JSON\.parse)/,
+      /\bYAML\.(?:load|unsafe_load)\s*\(|\bPsych\.(?:load|unsafe_load)\b|\bOj\.load\b|\bnew\s+ObjectInputStream\b|\bgob\.NewDecoder\b/,
     ],
     guide: [
       'Invariant: parsing lower-trust input never runs code, never changes shared object prototypes, and never produces an object the next step trusts more than the input.',
@@ -212,6 +226,8 @@ const CLASSES = [
       /createHash\s*\(\s*['"](?:md5|sha1)['"]/,
       /\b\w*(?:token|secret|signature|hmac|digest)\w*\s*(?:===|!==|==|!=)\s*\w*(?:token|secret|signature|hmac|digest|expected)/i,
       /\bjwt\.(?:decode|verify)\s*\(|algorithms?\s*:\s*\[?\s*['"]none['"]/,
+      /\bOpenSSL::(?:Cipher|PKey|HMAC|Digest|KDF)\b|\bDigest::(?:MD5|SHA1)\b|\bSecureRandom\b|\bsecure_compare\b|\bJWT\.decode\b/,
+      /\bcrypto\.(?:createCipheriv|createDecipheriv|createSign|createVerify|timingSafeEqual)\b|\b(?:decrypt|encrypt|verify_signature|verify_raw|sign_raw)\s*[(]|\bcrypto\/(?:aes|cipher|rsa|ecdsa|ed25519|hmac|subtle)\b/,
     ],
     guide: [
       'Invariant: secrets, session ids, and one-time codes are unguessable, and checks of them do not leak timing or accept forged values.',
@@ -225,7 +241,7 @@ const CLASSES = [
     boundary: 'install, build, and release',
     weight: 8,
     exts: null,
-    files: (rel) => WORKFLOW_RE.test(rel) || /(?:^|\/)package\.json$/.test(rel) || /(?:^|\/)(?:Dockerfile|Makefile|install\.sh|setup\.py|pyproject\.toml)$/.test(rel),
+    files: (rel) => WORKFLOW_RE.test(rel) || /(?:^|\/)package\.json$/.test(rel) || /(?:^|\/)(?:Dockerfile|Makefile|install\.sh|setup\.py|pyproject\.toml|Gemfile|Rakefile|go\.mod)$/.test(rel) || /\.gemspec$/.test(rel),
     detect: [
       /"(?:preinstall|install|postinstall|prepare|prepublish)"\s*:/,
       /\bpull_request_target\b|\bworkflow_run\b/,
@@ -233,6 +249,7 @@ const CLASSES = [
       /\bcurl\b[^|\n]*\|\s*(?:ba|z)?sh\b|\bwget\b[^|\n]*\|\s*(?:ba|z)?sh\b/,
       /\$\{\{\s*github\.event\.(?:issue|pull_request|comment|head_commit|review)\b/,
       /\bsecrets\.[A-Z0-9_]+/,
+      /^\s*(?:gem|source)\s+['\"][^'\"]+['\"]\s*,\s*(?:git|github|path):|\.add_(?:runtime_)?dependency\b|\bspec\.(?:files|executables)\b/,
     ],
     guide: [
       'Invariant: code from a lower-trust contributor or dependency cannot run with release credentials, change what ships, or execute on a user\'s machine at install time.',
@@ -277,6 +294,7 @@ const CANDIDATE_GATE = [
   'Propose "confirmed" only when the trace is complete, the impact crosses a stated boundary, every condition is listed, and no layer in source prevents it.',
   'Do not strengthen a crash into code execution, ordinary work into an outage, or a same-person action into privilege gain.',
   'If a decisive fact is outside source (deployment, proxy, provider setting, who can write a file), propose "needs_validation" with the exact missing fact. It gets no severity.',
+  'Before calling a library version or behavior unknown, read what is installed in the target: lockfiles, venv or .venv site-packages, node_modules, vendor folders. A fact on disk is not outside source.',
   'A missing best practice with no affected principal or resource goes in "hardening", not in candidates. A candidate disproved by source is dropped.',
   'The fingerprint names the root cause, like "lib/foo.js:runHook/shell-from-task-title". No line numbers, no severity, no verdict in it.',
   'Return an empty candidates array when nothing survives these rules. Most units should end "covered".',

package/lib/security-audit.js

@@ -761,6 +761,7 @@ function verifierPrompt({ candidate, cls }) {
       'Ask who controls the input. If it is the same person who runs the tool, it is self-impact, so reject it.',
       '"confirmed": the full trace holds, the impact crosses the stated boundary, and nothing in source prevents it. Fix the severity if it is overstated; overall can never exceed impact.',
       '"needs_validation": the trace holds in source, but a decisive fact is outside it. Name that fact exactly and give a safe check the owner can run.',
+      'A library version or behavior is not outside source when the target has it installed. Read the lockfile, the venv or .venv site-packages, or node_modules before sending it to the owner.',
       '"rejected": the source disproves it. Name the line that does.',
       'Use "corrected" only for fields you would change. Read-only: do not run the target or touch the network.',
     ]),
@@ -1163,6 +1164,17 @@ function resolveOutDir(root, { out, repo }) {
   return { dir: path.join(outRoot, `run-${next}`), outRoot };
 }
 
+// Same function in the fingerprint and sinks within a few lines of each other:
+// one defect, even when two hunters filed it under different classes.
+function sameRootCause(a, b) {
+  const scope = (fp) => String(fp || '').split('/').slice(0, -1).join('/');
+  const sink = (c) => (Array.isArray(c.trace) && c.trace.length ? c.trace[c.trace.length - 1] : null);
+  const sa = sink(a);
+  const sb = sink(b);
+  if (!sa || !sb || !scope(a.fingerprint) || scope(a.fingerprint) !== scope(b.fingerprint)) return false;
+  return sa.file === sb.file && Math.abs(Number(sa.line) - Number(sb.line)) <= 3;
+}
+
 function budgetPlan(profile, total) {
   const critics = profile === 'quick' ? 1 : 2;
   const verifyReserve = Math.max(1, Math.ceil(0.3 * (total - critics)));
@@ -1256,7 +1268,11 @@ async function runAudit(opts = {}) {
 
   const plan = budgetPlan(profile, total);
   const plannedCount = ledger.filter((u) => u.status === 'planned').length;
-  meta.plan = { ...plan, planned_units: plannedCount, units_per_hunter: UNITS_PER_HUNTER[profile], hunters_needed: Math.ceil(plannedCount / UNITS_PER_HUNTER[profile]) };
+  // Hunters take one class in one subsystem at a time, so count batches per group.
+  const groupSizes = new Map();
+  for (const u of ledger) if (u.status === 'planned') { const k = `${u.attack_class}\0${u.subsystem}`; groupSizes.set(k, (groupSizes.get(k) || 0) + 1); }
+  const huntersNeeded = [...groupSizes.values()].reduce((n, size) => n + Math.ceil(size / UNITS_PER_HUNTER[profile]), 0);
+  meta.plan = { ...plan, planned_units: plannedCount, units_per_hunter: UNITS_PER_HUNTER[profile], hunters_needed: huntersNeeded };
 
   const pendingRecords = [];
   const finish = (status, reason, records = [], carriedPending = []) => {
@@ -1378,9 +1394,23 @@ async function runAudit(opts = {}) {
   const pending = [];
   const toVerify = [];
   const seenFp = new Set();
+  const kept = [];
   for (const cand of queue) {
     if (seenFp.has(cand.fingerprint)) continue;
     seenFp.add(cand.fingerprint);
+    const twin = !cand._carried && kept.find((k) => !k._carried && sameRootCause(k, cand));
+    if (twin) {
+      // Two hunters named one root cause from different classes. Check it once
+      // and point the twin's areas at the surviving fingerprint.
+      twin.coverage_ids = [...new Set([...(twin.coverage_ids || []), ...(cand.coverage_ids || [])])];
+      for (const u of ledger) {
+        if (Array.isArray(u.result_fingerprints) && u.result_fingerprints.includes(cand.fingerprint)) {
+          u.result_fingerprints = [...new Set(u.result_fingerprints.map((fp) => (fp === cand.fingerprint ? twin.fingerprint : fp)))];
+        }
+      }
+      continue;
+    }
+    kept.push(cand);
     if (!cand.attack_class || !CLASS_BY_ID.has(cand.attack_class)) cand.attack_class = cand._unit_class || 'command-injection';
     const errs = citationErrors(root, cand);
     if (errs.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.80.0",
+  "version": "3.80.1",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",
@@ -91,7 +91,14 @@
     "developer-tools",
     "cli",
     "codebase-navigation",
-    "ai-agents"
+    "ai-agents",
+    "agent-memory",
+    "ai-memory",
+    "llm-memory",
+    "project-memory",
+    "context-graph",
+    "knowledge-graph",
+    "memory"
   ],
   "author": "Keshav Rao (atrislabs)",
   "license": "MIT",

package/utils/auth.js

@@ -40,9 +40,11 @@ let inputIndex = 0;
 /**
  * Prompt the user for input, handling both TTY and piped input.
  * @param {string} question - Prompt text to display
+ * @param {{secret?: boolean}} [opts] - secret: never print the answer back
  * @returns {Promise<string>} User's input
  */
-function promptUser(question) {
+function promptUser(question, opts = {}) {
+  const shown = (answer) => (opts.secret ? '' : answer);
   // If stdin is not a TTY (piped input), read all lines upfront
   if (!process.stdin.isTTY && inputLines.length === 0 && !sharedRl) {
     return new Promise((resolve) => {
@@ -57,7 +59,7 @@ function promptUser(question) {
         inputLines = data.trim().split('\n');
         process.stdout.write(question);
         const answer = inputLines[inputIndex++] || '';
-        console.log(answer);
+        console.log(shown(answer));
         resolve(answer.trim());
       });
       process.stdin.resume();
@@ -69,22 +71,34 @@ function promptUser(question) {
     return new Promise((resolve) => {
       process.stdout.write(question);
       const answer = inputLines[inputIndex++] || '';
-      console.log(answer);
+      console.log(shown(answer));
       resolve(answer.trim());
     });
   }
 
   // Interactive TTY mode - create readline per prompt
+  // A secret typed at a terminal must stay hidden even when stdout is a file:
+  // terminal mode turns off the terminal's own echo, and the prompt goes to
+  // whichever stream is still the screen.
+  const secretOut = opts.secret && !process.stdout.isTTY && process.stderr.isTTY ? process.stderr : process.stdout;
   const rl = readline.createInterface({
     input: process.stdin,
-    output: process.stdout
+    output: secretOut,
+    ...(opts.secret ? { terminal: Boolean(process.stdin.isTTY) } : {}),
   });
 
+  // Secret answers: let the prompt through, then swallow the typed echo.
+  let muted = false;
+  if (opts.secret) {
+    rl._writeToOutput = (text) => { if (!muted) rl.output.write(text); };
+  }
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
+      if (muted) rl.output.write('\n');
       rl.close();
       resolve(answer.trim());
     });
+    muted = Boolean(opts.secret);
   });
 }