atris 3.82.4 → 3.82.7

package/lib/sentinel-agents.js

@@ -27,6 +27,60 @@ const AREA_LABEL = {
   mcp: 'mcp servers',
   hidden: 'hidden instructions',
 };
+// The hand-written regular expressions below stay in code, out of the
+// proposer's reach. The rules file (the agents part) holds only literal
+// supplements the proposer may extend: extra override substrings (matched
+// lowercase with plain includes) and extra secret environment names. They
+// are data, never code. They are matched with string operations.
+const RULES_FILE = path.join(__dirname, 'sentinel-rules.json');
+
+const SECRET_KEY_NAME = /(?:^|_|-)(?:api[_-]?key|key|token|secret|password|passwd|pat|credential|credentials|auth)(?:$|_|-)/i;
+const DOWNLOAD = '(?:curl|wget|fetch|iwr|Invoke-WebRequest|irm|Invoke-RestMethod)\\b';
+const DOWNLOAD_RUN = [
+  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:ba|z|da|k|fi)?sh\\b`, 'i'),
+  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:python[0-9.]*|node|perl|ruby|php|iex|Invoke-Expression)\\b`, 'i'),
+  new RegExp(`(?:ba|z|k)?sh\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`(?:ba|z|k)?sh\\s+-c\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`source\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
+];
+const EVAL_FETCHED = [
+  new RegExp(`\\beval\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`\\beval\\s+["']?\`\\s*${DOWNLOAD}`, 'i'),
+  /\beval\s*\(\s*(?:await\s+)?\(?\s*(?:await\s+)?fetch\s*\(/i,
+  /\bexec\s*\(\s*(?:urllib\.request\.)?urlopen\s*\(/i,
+  /\bexec\s*\(\s*requests\.get\s*\(/i,
+];
+const SKIP_FLAGS = /(?:^|\s)(?:--dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yolo|--permission-mode[ =]bypassPermissions|--approval-mode[ =]yolo|--allow-dangerously-skip-permissions)(?=\s|$|["'])/;
+const OVERRIDE = [
+  /\b(?:ignore|disregard|forget|override|bypass)\s+(?:all\s+|any\s+|every\s+)?(?:of\s+)?(?:the\s+|your\s+|my\s+)?(?:previous|prior|above|earlier|preceding|original|system|other)\s+(?:instructions?|prompts?|rules|directions|guidelines|messages)\b/i,
+  /\byou\s+are\s+now\s+(?:in\s+)?(?:developer|dan|jailbreak|god)\s+mode\b/i,
+  /\b(?:do\s+not|don't|never)\s+(?:tell|inform|show)\s+the\s+user\s+(?:about|that|what|anything|this|you\b|we\b)/i,
+  /\b(?:do\s+not|don't|never)\s+mention\s+(?:this|it)\s+to\s+the\s+user\b/i,
+  /\bwithout\s+(?:telling|informing|alerting)\s+the\s+user\b/i,
+  /\bhide\s+this\s+from\s+the\s+user\b/i,
+  /\bnew\s+system\s+prompt\s*:/i,
+];
+const COMMENT_DIRECTIVE = /\b(?:ignore\s+(?:the|all|any|previous|prior|above)|disregard|secretly|silently|do\s+not\s+tell|don't\s+tell|without\s+telling|curl|wget|exfiltrate|send\s+(?:the|all|any|your)\s+\w+\s+to|system\s+prompt|you\s+are\s+(?:now|an?|the)|you\s+must|always\s+run|run\s+the\s+following|execute\s+(?:the|this))\b/i;
+
+// The literal supplements from the rules file. A proposer may add plain
+// phrases and names here; the checks below match them with string ops.
+function compileRules(raw) {
+  const a = (raw && raw.agents) || {};
+  const list = (v, name) => { if (v === undefined) return []; if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) throw new Error(`rules: agents.${name} must be a list of strings`); return v; };
+  return {
+    overrideSubstrings: list(a.override_substrings, 'override_substrings').map((x) => x.toLowerCase()),
+    secretEnvNames: new Set(list(a.secret_env_names, 'secret_env_names')),
+  };
+}
+
+let DEFAULT_RULES = null;
+let ACTIVE_RULES = null;
+function R() {
+  if (ACTIVE_RULES) return ACTIVE_RULES;
+  if (!DEFAULT_RULES) DEFAULT_RULES = compileRules(JSON.parse(fs.readFileSync(RULES_FILE, 'utf8')));
+  return DEFAULT_RULES;
+}
+
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_FILES = 4000;
 const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.venv', 'venv', 'dist', 'build', '.trash', '.Trash']);
@@ -158,7 +212,6 @@ function secretHits(text) {
 // "API_KEY": "abc..." in JSON, and API_KEY = "abc..." in TOML. Only keys
 // whose name says secret, and only values that look real (not $VAR, not a
 // placeholder, not short).
-const SECRET_KEY_NAME = /(?:^|_|-)(?:api[_-]?key|key|token|secret|password|passwd|pat|credential|credentials|auth)(?:$|_|-)/i;
 function envBlockHits(text) {
   let scan;
   try { scan = require('./security-scan'); } catch { return []; }
@@ -167,7 +220,7 @@ function envBlockHits(text) {
   let m;
   while ((m = re.exec(text))) {
     const [, key, value] = m;
-    if (!SECRET_KEY_NAME.test(key)) continue;
+    if (!SECRET_KEY_NAME.test(key) && !R().secretEnvNames.has(key)) continue;
     if (/^\$|\$\{|^<|^\{\{|^env:|^op:\/\/|^\/|^~|^https?:\/\//i.test(value)) continue;
     if (/\s/.test(value)) continue;
     const q = scan.secretQuality(value, {}, m[0]);
@@ -179,21 +232,6 @@ function envBlockHits(text) {
 
 // Download piped into a shell or interpreter, process substitution of a
 // download, and eval of fetched content.
-const DOWNLOAD = '(?:curl|wget|fetch|iwr|Invoke-WebRequest|irm|Invoke-RestMethod)\\b';
-const DOWNLOAD_RUN = [
-  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:ba|z|da|k|fi)?sh\\b`, 'i'),
-  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:python[0-9.]*|node|perl|ruby|php|iex|Invoke-Expression)\\b`, 'i'),
-  new RegExp(`(?:ba|z|k)?sh\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`(?:ba|z|k)?sh\\s+-c\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`source\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
-];
-const EVAL_FETCHED = [
-  new RegExp(`\\beval\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`\\beval\\s+["']?\`\\s*${DOWNLOAD}`, 'i'),
-  /\beval\s*\(\s*(?:await\s+)?\(?\s*(?:await\s+)?fetch\s*\(/i,
-  /\bexec\s*\(\s*(?:urllib\.request\.)?urlopen\s*\(/i,
-  /\bexec\s*\(\s*requests\.get\s*\(/i,
-];
 
 function downloadRunHits(text) {
   const out = [];
@@ -205,7 +243,6 @@ function downloadRunHits(text) {
   return out;
 }
 
-const SKIP_FLAGS = /(?:^|\s)(?:--dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yolo|--permission-mode[ =]bypassPermissions|--approval-mode[ =]yolo|--allow-dangerously-skip-permissions)(?=\s|$|["'])/;
 
 function flagHits(text) {
   const out = [];
@@ -239,36 +276,23 @@ function invisibleHits(text) {
   return out;
 }
 
-const OVERRIDE = [
-  /\b(?:ignore|disregard|forget|override|bypass)\s+(?:all\s+|any\s+|every\s+)?(?:of\s+)?(?:the\s+|your\s+|my\s+)?(?:previous|prior|above|earlier|preceding|original|system|other)\s+(?:instructions?|prompts?|rules|directions|guidelines|messages)\b/i,
-  /\byou\s+are\s+now\s+(?:in\s+)?(?:developer|dan|jailbreak|god)\s+mode\b/i,
-  // Secrecy, not ordinary guidance: "do not tell the user about this", but
-  // not "do not tell the user to restart".
-  /\b(?:do\s+not|don't|never)\s+(?:tell|inform|show)\s+the\s+user\s+(?:about|that|what|anything|this|you\b|we\b)/i,
-  /\b(?:do\s+not|don't|never)\s+mention\s+(?:this|it)\s+to\s+the\s+user\b/i,
-  /\bwithout\s+(?:telling|informing|alerting)\s+the\s+user\b/i,
-  /\bhide\s+this\s+from\s+the\s+user\b/i,
-  /\bnew\s+system\s+prompt\s*:/i,
-];
 
 function overrideHits(text) {
   const out = [];
+  const extra = R().overrideSubstrings;
   text.split('\n').forEach((line, i) => {
-    for (const re of OVERRIDE) {
-      const m = line.match(re);
-      if (!m) continue;
-      // Quoted or in code: a doc about prompt attacks, most likely.
-      const at = m.index;
-      const before = line.slice(0, at);
-      const quoted = /["'`“‘]\s*$/.test(before) || (before.split('`').length % 2 === 0) || /^\s*>/.test(line);
-      out.push({ line: i + 1, rule: quoted ? 'override-phrase-quoted' : 'override-phrase' });
-      break;
-    }
+    let at = -1;
+    for (const re of OVERRIDE) { const m = line.match(re); if (m) { at = m.index; break; } }
+    if (at === -1 && extra.length) { const low = line.toLowerCase(); for (const sub of extra) { const k = low.indexOf(sub); if (k !== -1) { at = k; break; } } }
+    if (at === -1) return;
+    // Quoted or in code: a doc about prompt attacks, most likely.
+    const before = line.slice(0, at);
+    const quoted = /["'`“‘]\s*$/.test(before) || (before.split('`').length % 2 === 0) || /^\s*>/.test(line);
+    out.push({ line: i + 1, rule: quoted ? 'override-phrase-quoted' : 'override-phrase' });
   });
   return out;
 }
 
-const COMMENT_DIRECTIVE = /\b(?:ignore\s+(?:the|all|any|previous|prior|above)|disregard|secretly|silently|do\s+not\s+tell|don't\s+tell|without\s+telling|curl|wget|exfiltrate|send\s+(?:the|all|any|your)\s+\w+\s+to|system\s+prompt|you\s+are\s+(?:now|an?|the)|you\s+must|always\s+run|run\s+the\s+following|execute\s+(?:the|this))\b/i;
 function hiddenCommentHits(text) {
   const out = [];
   // Comments inside fenced code blocks are examples, not hidden text.
@@ -500,7 +524,15 @@ function grade(findings) {
   return 'pass';
 }
 
-function runAgentCheck(root, { home = false, homeDir = os.homedir() } = {}) {
+// rules: a rules object to judge instead of the file beside this one.
+function runAgentCheck(root, { home = false, homeDir = os.homedir(), rules = null } = {}) {
+  if (!rules) return runAgentCheckWith(root, { home, homeDir });
+  const prev = ACTIVE_RULES;
+  ACTIVE_RULES = compileRules(rules);
+  try { return runAgentCheckWith(root, { home, homeDir }); } finally { ACTIVE_RULES = prev; }
+}
+
+function runAgentCheckWith(root, { home, homeDir }) {
   const targets = collectTargets(root, { home, homeDir });
   const findings = [];
   for (const t of targets) {
@@ -576,6 +608,8 @@ function renderReport(result, { color = false } = {}) {
 }
 
 module.exports = {
+  compileRules,
+  RULES_FILE,
   RULES,
   checkFile,
   runAgentCheck,