coverme-scanner 1.2.0 → 1.3.0

package/src/prompts/orchestration.md

@@ -2,11 +2,11 @@
 
 **Ultrathink** - Analyze deeply, consider edge cases, trace data flows completely.
 
-Execute this 21-agent security scan with cross-validation.
+Execute this 22-agent security scan with cross-validation.
 
 ---
 
-## PHASE 0: PROJECT DISCOVERY
+## PHASE 0: PROJECT DISCOVERY & RUNTIME CHECK
 
 Before scanning, understand what you're scanning:
 
@@ -34,6 +34,21 @@ Create a **Project Overview** to include in the report:
 
 This context helps readers understand the security findings in context.
 
+### Step 3: Check for Runtime Verification (SSH)
+
+```bash
+cat .coverme/runtime.json 2>/dev/null || echo "NO_RUNTIME_CONFIG"
+```
+
+**IF runtime.json exists with environments:**
+- Runtime verification is ENABLED
+- Store the SSH details for use in AGENT 22 (Runtime Verification)
+- The agent will SSH to compare actual runtime vs code expectations
+
+**IF NO runtime.json:**
+- Runtime verification is DISABLED (skip AGENT 22)
+- This is normal - many projects don't need runtime verification
+
 ---
 
 ## CRITICAL OUTPUT FORMAT
@@ -1215,6 +1230,149 @@ After all other agents complete, generate an executive summary.
 
 ---
 
+### AGENT 22: Runtime Verification Scanner (ID prefix: RUNTIME)
+
+**CONDITIONAL AGENT** - Only runs if SSH is configured in Phase 0.
+
+Check if runtime.json was found in Phase 0:
+- If NO runtime.json → Skip this agent entirely
+- If runtime.json exists → Proceed with runtime verification
+
+**PURPOSE**: Find dangerous mismatches between code configuration and actual runtime environment.
+
+**Example of what this catches:**
+> The code says `USER appuser` in Dockerfile, but the container actually runs as `root`.
+> This is why a DuckDB file read vulnerability could access /etc/passwd!
+
+---
+
+**STEP 1: Gather Code Expectations**
+
+Analyze configuration files to understand EXPECTED runtime state:
+
+```bash
+# Dockerfile
+grep -E "^USER|^EXPOSE|^ENV" Dockerfile 2>/dev/null
+
+# Docker Compose
+grep -E "user:|ports:|environment:" docker-compose*.yml 2>/dev/null
+
+# Kubernetes
+grep -E "runAsUser|runAsNonRoot|readOnlyRootFilesystem|securityContext" k8s/*.yaml helm/**/values.yaml 2>/dev/null
+
+# PM2
+grep -E "user|uid|cwd" ecosystem.config.js pm2.config.js 2>/dev/null
+
+# Systemd
+grep -E "^User=|^Group=" *.service 2>/dev/null
+```
+
+Build expected state:
+```json
+{
+  "expected": {
+    "user": "appuser",
+    "uid": 1000,
+    "runAsRoot": false,
+    "readOnlyFs": true,
+    "ports": [3000],
+    "source": "Dockerfile:15 - USER appuser"
+  }
+}
+```
+
+---
+
+**STEP 2: SSH and Check Actual Runtime**
+
+Use the SSH configuration from runtime.json:
+
+```bash
+# Build SSH command (from runtime.json)
+# host: user@server.com, port: 22, keyPath: ~/.ssh/id_rsa
+
+# Check who is running the process
+ssh user@server.com "ps -eo user,pid,cmd | grep -E 'node|python|java|pm2' | head -5"
+
+# Check Docker container user
+ssh user@server.com "docker ps -q | head -1 | xargs -I {} docker exec {} id"
+
+# Check Kubernetes pod user
+ssh user@server.com "kubectl get pods -o name | head -1 | xargs -I {} kubectl exec {} -- id"
+
+# Check file permissions
+ssh user@server.com "ls -la /app/ 2>/dev/null | head -10"
+
+# Check listening ports
+ssh user@server.com "ss -tlnp | grep -E ':3000|:8080|:6379'"
+```
+
+Build actual state:
+```json
+{
+  "actual": {
+    "user": "root",
+    "uid": 0,
+    "runAsRoot": true,
+    "readOnlyFs": false,
+    "ports": [3000, 6379],
+    "evidence": "uid=0(root) gid=0(root)"
+  }
+}
+```
+
+---
+
+**STEP 3: Compare and Generate Findings**
+
+| Mismatch | Severity | ID |
+|----------|----------|-----|
+| Code says non-root, runs as root | CRITICAL | RUNTIME-001 |
+| Dockerfile USER ignored | CRITICAL | RUNTIME-002 |
+| K8s runAsNonRoot:true but runs as root | HIGH | RUNTIME-003 |
+| ReadOnlyRootFilesystem not enforced | HIGH | RUNTIME-004 |
+| Unexpected ports exposed | MEDIUM | RUNTIME-005 |
+| File permissions too open (777) | MEDIUM | RUNTIME-006 |
+| Environment variables mismatch | LOW | RUNTIME-007 |
+
+**Output Format:**
+```json
+{
+  "id": "RUNTIME-001",
+  "title": "Container running as root despite USER directive",
+  "severity": "critical",
+  "category": "runtime-mismatch",
+  "fixOwner": "devops",
+  "fixType": "infrastructure",
+
+  "expected": {
+    "value": "appuser (uid 1000)",
+    "source": "Dockerfile:15",
+    "code": "USER appuser"
+  },
+
+  "actual": {
+    "value": "root (uid 0)",
+    "command": "docker exec container id",
+    "evidence": "uid=0(root) gid=0(root)"
+  },
+
+  "description": "The Dockerfile specifies USER appuser, but the container runs as root. This likely means docker-compose or K8s overrides the user.",
+
+  "impact": "Running as root means any code vulnerability can access ALL system files. The DuckDB read_text() issue could read /etc/shadow, SSH keys, or any file on the system.",
+
+  "recommendation": "1. Remove user: root from docker-compose.yml\n2. Add securityContext.runAsNonRoot: true to K8s deployment\n3. Verify no --user root in docker run commands",
+
+  "verification": {
+    "codeFile": "Dockerfile:15",
+    "sshCommand": "docker exec container_name id",
+    "sshOutput": "uid=0(root) gid=0(root)"
+  }
+}
+```
+
+---
+
 ## PHASE 2: DUPLICATE & EXISTING SOLUTIONS CHECK
 
 ### AGENT 21: Duplicate & Existing Solutions Scanner (ID prefix: DUP)

package/src/prompts/runtime-verify.md

@@ -0,0 +1,353 @@
+# CoverMe Runtime Verification Agent
+
+Compare your **actual runtime environment** against **code configuration** to find dangerous mismatches.
+
+## Arguments
+
+$ARGUMENTS - Environment name (from `coverme verify list`)
+
+---
+
+## CRITICAL: This agent requires SSH access
+
+Before running, ensure:
+1. SSH environment is configured: `coverme verify setup --host user@server --name production`
+2. You have SSH key or password ready
+3. The environment name is passed as argument
+
+---
+
+## PHASE 1: Load Environment Configuration
+
+```bash
+cat .coverme/runtime.json 2>/dev/null || echo "NO_RUNTIME_CONFIG"
+```
+
+If no config found, output:
+```
+ERROR: No runtime environments configured.
+
+To set up runtime verification:
+  coverme verify setup --host user@server.com --name production
+
+Then run:
+  /coverme-verify production
+```
+
+Extract the environment details:
+- `host`: SSH host (user@server)
+- `port`: SSH port
+- `keyPath`: Optional SSH key path
+
+---
+
+## PHASE 2: Gather Code Expectations
+
+Before SSH, analyze the codebase to understand EXPECTED runtime configuration:
+
+### Check Dockerfile/Docker Compose
+```bash
+cat Dockerfile 2>/dev/null
+cat docker-compose*.yml 2>/dev/null
+```
+
+Look for:
+- `USER` directive (what user should container run as?)
+- `EXPOSE` ports
+- Environment variables
+- Volume mounts
+
+### Check Kubernetes/Helm
+```bash
+cat k8s/*.yaml helm/**/values.yaml 2>/dev/null
+```
+
+Look for:
+- `securityContext.runAsUser`
+- `securityContext.runAsNonRoot`
+- `securityContext.readOnlyRootFilesystem`
+- Resource limits
+- Service accounts
+
+### Check PM2/Process Manager
+```bash
+cat ecosystem.config.js pm2.config.js 2>/dev/null
+```
+
+Look for:
+- `user` field
+- `cwd` working directory
+- Environment variables
+
+### Check Systemd
+```bash
+cat *.service 2>/dev/null
+```
+
+Look for:
+- `User=` directive
+- `Group=` directive
+- `WorkingDirectory=`
+
+### Build Expected State Object
+```json
+{
+  "expected": {
+    "user": "appuser",
+    "uid": 1000,
+    "workDir": "/app",
+    "ports": [3000, 8080],
+    "env": ["NODE_ENV=production"],
+    "readOnlyFs": true,
+    "source": "Dockerfile line 15: USER appuser"
+  }
+}
+```
+
+---
+
+## PHASE 3: SSH and Gather Runtime State
+
+**IMPORTANT**: Use the Bash tool with SSH commands. The user has pre-configured SSH access.
+
+Build SSH command prefix:
+```
+SSH_CMD="ssh -o StrictHostKeyChecking=no -p {port} {keyPath ? '-i ' + keyPath : ''} {host}"
+```
+
+### Check Running Processes
+
+```bash
+# Find Node.js/Python/Java processes
+$SSH_CMD "ps aux | grep -E 'node|python|java|pm2' | grep -v grep"
+
+# Get current user
+$SSH_CMD "whoami"
+
+# Get user running the app
+$SSH_CMD "ps -eo user,pid,cmd | grep -E 'node|python|java' | head -5"
+```
+
+### Check Docker Containers (if Docker)
+
+```bash
+# List running containers
+$SSH_CMD "docker ps --format '{{.Names}}\t{{.Image}}\t{{.Status}}'"
+
+# Get user inside container
+$SSH_CMD "docker exec {container_name} whoami"
+
+# Get container user ID
+$SSH_CMD "docker exec {container_name} id"
+
+# Check container security
+$SSH_CMD "docker inspect {container_name} --format '{{.Config.User}} {{.HostConfig.ReadonlyRootfs}} {{.HostConfig.Privileged}}'"
+```
+
+### Check Kubernetes Pods (if K8s)
+
+```bash
+# Get pods
+$SSH_CMD "kubectl get pods -o wide"
+
+# Get security context
+$SSH_CMD "kubectl get pod {pod_name} -o jsonpath='{.spec.securityContext}'"
+
+# Get container user
+$SSH_CMD "kubectl exec {pod_name} -- id"
+```
+
+### Check PM2 Processes
+
+```bash
+# PM2 status
+$SSH_CMD "pm2 list"
+
+# PM2 process details
+$SSH_CMD "pm2 show 0 | grep -E 'user|uid|gid|cwd'"
+```
+
+### Check System Permissions
+
+```bash
+# Check file permissions on app directory
+$SSH_CMD "ls -la /app/ 2>/dev/null || ls -la /home/*/app/ 2>/dev/null"
+
+# Check who owns the app files
+$SSH_CMD "stat -c '%U:%G %a %n' /app/* 2>/dev/null | head -10"
+
+# Check sensitive files
+$SSH_CMD "ls -la /app/.env* /app/config/*.json 2>/dev/null"
+```
+
+### Check Network
+
+```bash
+# Check listening ports
+$SSH_CMD "netstat -tlnp 2>/dev/null || ss -tlnp"
+
+# Check firewall rules
+$SSH_CMD "iptables -L -n 2>/dev/null || ufw status 2>/dev/null"
+```
+
+### Build Actual State Object
+```json
+{
+  "actual": {
+    "user": "root",
+    "uid": 0,
+    "workDir": "/app",
+    "ports": [3000, 8080, 6379],
+    "env": ["NODE_ENV=production"],
+    "readOnlyFs": false,
+    "privileged": false,
+    "containerUser": "root",
+    "processUser": "root"
+  }
+}
+```
+
+---
+
+## PHASE 4: Compare and Generate Findings
+
+Compare expected vs actual for EACH field:
+
+### Critical Mismatches (RUNTIME prefix)
+
+| Finding | Severity | When to Report |
+|---------|----------|----------------|
+| RUNTIME-001 | CRITICAL | Code says `USER appuser`, runtime runs as `root` |
+| RUNTIME-002 | CRITICAL | Dockerfile has `USER`, but container runs as root |
+| RUNTIME-003 | HIGH | `runAsNonRoot: true` in K8s, but pod runs as root |
+| RUNTIME-004 | HIGH | ReadOnlyRootFilesystem expected, but writable |
+| RUNTIME-005 | HIGH | Privileged container not expected |
+| RUNTIME-006 | MEDIUM | Port exposed that shouldn't be (e.g., Redis 6379) |
+| RUNTIME-007 | MEDIUM | Environment variables missing or different |
+| RUNTIME-008 | MEDIUM | File permissions too open (777, world-writable) |
+| RUNTIME-009 | LOW | Working directory mismatch |
+| RUNTIME-010 | INFO | Extra processes running not in config |
+
+### Output Format
+
+```json
+{
+  "id": "RUNTIME-001",
+  "title": "Container running as root despite USER directive",
+  "severity": "critical",
+  "category": "runtime-mismatch",
+  "fixOwner": "devops",
+  "fixType": "infrastructure",
+
+  "expected": {
+    "value": "appuser (uid 1000)",
+    "source": "Dockerfile:15 - USER appuser",
+    "code": "USER appuser"
+  },
+
+  "actual": {
+    "value": "root (uid 0)",
+    "source": "docker exec container_name id",
+    "evidence": "uid=0(root) gid=0(root) groups=0(root)"
+  },
+
+  "description": "The Dockerfile specifies USER appuser, but the container is actually running as root. This happened because the docker run command included --user root or the orchestration layer overrode the USER directive.",
+
+  "impact": "Running as root inside the container means any code execution vulnerability (like the DuckDB file read issue) can access ALL files on the system, not just application files. Attackers can read /etc/shadow, modify system configs, and potentially escape the container.",
+
+  "recommendation": "1. Check docker-compose.yml for user: root override\n2. Check K8s deployment for securityContext.runAsUser: 0\n3. Ensure no --user root in docker run commands\n4. Add securityContext.runAsNonRoot: true to K8s",
+
+  "commands": {
+    "verify": "docker exec container_name id",
+    "fix_docker": "docker run --user 1000:1000 ...",
+    "fix_k8s": "kubectl patch deployment app -p '{\"spec\":{\"template\":{\"spec\":{\"securityContext\":{\"runAsNonRoot\":true}}}}}'"
+  }
+}
+```
+
+---
+
+## PHASE 5: Generate Verification Report
+
+Save to `.coverme/runtime-verify.json`:
+
+```json
+{
+  "environment": "production",
+  "host": "user@server.com",
+  "verifiedAt": "2024-01-15T10:30:00Z",
+
+  "summary": {
+    "total": 5,
+    "critical": 1,
+    "high": 2,
+    "medium": 1,
+    "low": 1,
+    "matches": 8
+  },
+
+  "mismatches": [
+    { "...finding objects..." }
+  ],
+
+  "matches": [
+    {
+      "check": "NODE_ENV",
+      "expected": "production",
+      "actual": "production",
+      "status": "match"
+    }
+  ],
+
+  "rawData": {
+    "expected": { "...from code analysis..." },
+    "actual": { "...from SSH commands..." }
+  }
+}
+```
+
+---
+
+## PHASE 6: Display Results
+
+Print summary:
+
+```
+Runtime Verification: production (user@server.com)
+=================================================
+
+CRITICAL MISMATCH: Container running as root!
+
+  Expected: USER appuser (from Dockerfile:15)
+  Actual:   root (uid=0)
+
+  This is why your DuckDB file read vulnerability was exploitable!
+  The code assumed it would run as appuser with limited permissions,
+  but in production it runs as root with access to everything.
+
+  Fix: Add to your deployment:
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+
+--------------------------------------------------
+
+Summary:
+  Matches:    8 configurations match
+  Mismatches: 5 found
+    - 1 CRITICAL (user mismatch)
+    - 2 HIGH (permissions)
+    - 1 MEDIUM (ports)
+    - 1 LOW (working directory)
+
+Full report: .coverme/runtime-verify.json
+```
+
+---
+
+## Security Notes
+
+- SSH credentials are NOT stored by CoverMe
+- Commands are read-only (no modifications to remote system)
+- All SSH output is included in the report for audit
+- Consider using a dedicated read-only SSH user for verification