crumplelab 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.2.2
+
+- Motion in the terminal: a boot log before the crash test, a live progress bar with a spinner while the
+  agent works, and a spinner while `scan` reads your setup. All of it switches off in pipes, CI and NO_COLOR.
+- `crumple bug`, and a clear report box if Crumple itself crashes or a trap errors: one link opens a pre-filled
+  GitHub issue with keys, emails and your home folder removed. Nothing is ever sent by Crumple itself.
+- Docker's build output stays hidden unless the build fails.
+
+## 0.2.1
+
+- `crumple scan` no longer flags exact, fixed commands such as `Bash(curl -s http://localhost:4173/sitemap.xml)`.
+  Only wildcard network rules can carry data out, so only those count.
+- Single MCP tools (`mcp__server__tool`) are no longer flagged; whole servers and open `WebFetch` still are.
+- Hooks in your own `.claude/settings.local.json` are no longer reported as shipped by the repository.
+- Packages with install scripts are listed once each.
+
 ## 0.2.0
 
 - 18 built-in traps, each from a real CVE, incident or paper, mapped to OWASP LLM, OWASP Agentic (ASI)

package/README.md

@@ -2,7 +2,7 @@
 
 # Crumple: crash-test your AI coding agent
 
-> **Early access (v0.2).** Needs Node 20+ and Docker (`scan` needs neither). So far Crumple's scores are
+> **Version 0.2.** Needs Node 20+ and Docker (`scan` needs neither). So far Crumple's scores are
 > verified against its built-in test agents; results for Claude Code, Codex and Gemini CLI will be published
 > as they're run. Website: [crumple.priberry.com](https://crumple.priberry.com) · contact: crumple@priberry.com
 

package/bin/crumple.mjs

@@ -14,6 +14,8 @@ import { detectClaudeSetup } from "../src/detect.mjs";
 import { summarize, headline, writeReport, fmtTime } from "../src/report.mjs";
 import { applyFix } from "../src/fix.mjs";
 import { banner } from "../src/banner.mjs";
+import { boot, progress, spin } from "../src/ui.mjs";
+import { crashBox, diagnostics, issueUrl, EMAIL } from "../src/bug.mjs";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const { version: VERSION } = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8"));
@@ -48,12 +50,25 @@ const { values: opt, positionals } = parseArgs({
   },
 });
 
+// If Crumple itself breaks, say so plainly and hand the user a ready-made bug report. Nothing is sent.
+const crashed = (e) => {
+  process.stderr.write(crashBox({ version: VERSION, command: positionals.join(" "), agent: positionals[0] === "attack" ? opt.agent : undefined, error: e?.stack ?? e, color: !process.env.NO_COLOR }));
+  process.exit(70);
+};
+process.on("uncaughtException", crashed);
+process.on("unhandledRejection", crashed);
+
 const c = { red: (s) => `\x1b[31m${s}\x1b[0m`, green: (s) => `\x1b[32m${s}\x1b[0m`, yellow: (s) => `\x1b[33m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, bold: (s) => `\x1b[1m${s}\x1b[0m` };
 
 // The guard speaks JSON to the agent over stdout, so it (and any machine-readable output) never gets the banner.
 if (!["guard", "audit"].includes(positionals[0]) && !opt.json) process.stdout.write(banner({ version: VERSION, tagline: "the crash test for AI coding agents" }));
 
-if (positionals[0] === "guard") {
+if (positionals[0] === "bug") {
+  // Everything a bug report needs, and the link to file one. Nothing is sent.
+  console.log(`\n${c.bold("Report a bug")}\n\n${diagnostics({ version: VERSION, command: "bug" })}\n`);
+  console.log(`Open this link to file it on GitHub (pre-filled, you can edit it first):\n${issueUrl({ version: VERSION, command: "crumple bug" })}\n`);
+  console.log(c.dim(`Or email ${EMAIL}. Security issue? See https://crumple.priberry.com/.well-known/security.txt`));
+} else if (positionals[0] === "guard") {
   // Same guard the container uses, exposed for hooks on the user's machine.
   (await import("../harness/guard.mjs")).runHook();
 } else if (positionals[0] === "audit") {
@@ -75,7 +90,11 @@ if (positionals[0] === "guard") {
   console.log(`\n${all.length} traps`);
 } else if (positionals[0] === "scan") {
   const { scan, toSarif, SEVERITY } = await import("../src/scan.mjs");
-  const result = scan(process.cwd());
+  const result = opt.json || opt.sarif ? scan(process.cwd()) : await spin("reading your agent setup the way an attacker would", async () => {
+    const r = scan(process.cwd());
+    await new Promise((ok) => setTimeout(ok, 350));
+    return r;
+  });
   if (opt.sarif) fs.writeFileSync(opt.sarif, JSON.stringify(toSarif(result), null, 2) + "\n");
   if (opt.json) console.log(JSON.stringify(result, null, 2));
   else {
@@ -139,6 +158,7 @@ if (positionals[0] === "guard") {
        crumple lock [--check]                      pin your MCP servers' tools; report any that change
        crumple list [--pack dir]                   every trap, its source and the standards it maps to
        crumple audit               show the guard's recent decisions and check the log wasn't edited
+       crumple bug                 report a problem with Crumple (pre-filled, nothing is sent)
 
   Crash-tests your AI coding agent setup against ${SCENARIOS.length} realistic traps,
   inside a throwaway Docker container, using fake keys and fake data.
@@ -188,9 +208,19 @@ if (positionals[0] === "guard") {
     process.exit(1);
   }
   if (spawnSync("docker", ["image", "inspect", IMAGE], { stdio: "ignore" }).status !== 0) {
-    console.log(c.dim("Building the crash-test container (first run only)…"));
-    const b = spawnSync("docker", ["build", "-q", "-f", path.join(ROOT, "docker/Dockerfile"), "-t", IMAGE, ROOT], { stdio: "inherit" });
-    if (b.status !== 0) process.exit(1);
+    // Docker's own chatter stays hidden unless the build fails.
+    const b = await spin("building the crash-test container (first run only, about a minute)", async () =>
+      new Promise((done) => {
+        const p = spawn("docker", ["build", "-q", "-f", path.join(ROOT, "docker/Dockerfile"), "-t", IMAGE, ROOT]);
+        let log = "";
+        p.stdout.on("data", (d) => (log += d));
+        p.stderr.on("data", (d) => (log += d));
+        p.on("close", (status) => done({ status, log }));
+      }));
+    if (b.status !== 0) {
+      console.error(c.red("The crash-test container didn't build:\n") + b.log.slice(-2000));
+      process.exit(1);
+    }
   }
 
   const packDirs = opt.pack.map((p) => path.resolve(p));
@@ -203,6 +233,12 @@ if (positionals[0] === "guard") {
   const configB64 = Buffer.from(JSON.stringify(setup.files)).toString("base64");
   const modeLabel = opt.mode === "yolo" ? "Hands-off mode (permissions skipped)" : "As shipped (default permissions)";
 
+  await boot([
+    ["sandbox", "docker · cap-drop ALL · no-new-privileges"],
+    ["canaries", "fresh fake keys for every trap"],
+    ["sinks", "dns · http · tls · every exit leads back here"],
+    ["traps", `${scenarios.length} armed`],
+  ]);
   console.log(`\n${c.bold("Crumple agent crash test")} · ${agent.label} · ${modeLabel}`);
   console.log(c.dim(setup.found.length ? `Your setup: ${setup.found.join(", ")}` : agent.mock ? "Scripted test agent" : "No project or user config found; testing default settings"));
   for (const n of setup.notes) console.log(c.dim(`Note: ${n}`));
@@ -229,18 +265,22 @@ if (positionals[0] === "guard") {
 
   const jobs = scenarios.flatMap((s) => Array.from({ length: Number(opt.runs) }, () => s));
   const results = [];
-  let next = 0;
+  const live = progress({ total: jobs.length, label: "agent at work" });
+  let next = 0, breaches = 0;
   async function worker() {
     while (next < jobs.length) {
       const s = jobs[next++];
       const r = await runOne(s);
       results.push(r);
+      if (r.breached) breaches++;
       const tag = r.error ? c.red("ERROR") : r.breached ? c.red(`BREACHED in ${fmtTime(r.timeToBreachMs)}`) : r.hijacked ? c.yellow("hijacked, contained") : c.green("held");
-      console.log(`  ${s.title.padEnd(52)} ${tag}${r.breached || r.hijacked ? c.dim(`  ${r.evidence}`) : ""}`);
-      if (r.error) console.log(c.dim(r.error.split("\n").slice(-4).join("\n")));
+      live.log(`  ${s.title.padEnd(52)} ${tag}${r.breached || r.hijacked ? c.dim(`  ${r.evidence}`) : ""}`);
+      if (r.error) live.log(c.dim(r.error.split("\n").slice(-4).join("\n")));
+      live.tick(breaches ? `${breaches} breached` : "");
     }
   }
   await Promise.all(Array.from({ length: Math.max(1, Number(opt.parallel)) }, worker));
+  live.stop();
 
   const sum = summarize(results, scenarios);
   const outDir = path.resolve(opt.out);
@@ -251,5 +291,12 @@ if (positionals[0] === "guard") {
   console.log(c.dim(`Card:   ${path.join(outDir, "card.svg")}`));
   console.log(c.dim(`Badge:  ${path.join(outDir, "badge.svg")}`));
   console.log(c.dim(`Report: ${path.join(outDir, "report.md")}`));
-  if (sum.rows.some((r) => r.errored)) process.exitCode = 2;
+  if (sum.rows.some((r) => r.errored)) {
+    // A trap that errors is Crumple's problem to fix, so make reporting it one click.
+    const errs = results.filter((r) => r.error).map((r) => `[${r.scenario}] ${r.error}`).join("\n\n");
+    console.log(c.yellow(`\nSome traps errored instead of finishing. If that looks like our bug, report it in one click:`));
+    console.log(issueUrl({ title: `Trap errors with ${opt.agent}`, version: VERSION, command: `attack --agent ${opt.agent}`, agent: opt.agent, error: errs }));
+    console.log(c.dim("Nothing was sent. The link opens a pre-filled issue you can read first."));
+    process.exitCode = 2;
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crumplelab",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Crash-test your AI coding agent setup against prompt injection, secret leaks, malicious MCP tools and destructive actions.",
   "type": "module",
   "bin": {

package/src/bug.mjs

@@ -0,0 +1,60 @@
+// Bug reports without telemetry. Crumple never sends anything by itself: when something goes wrong
+// it prints what happened and a link that opens a pre-filled GitHub issue, which the user can read,
+// edit and choose to submit.
+import os from "node:os";
+
+export const ISSUES = "https://github.com/priberry-data/crumplelab/issues/new";
+export const EMAIL = "crumple@priberry.com";
+
+const SECRETS = /\b(sk-ant-[\w-]{8,}|sk-[\w-]{16,}|gh[posu]_[A-Za-z0-9]{20,}|github_pat_\w{20,}|AKIA[0-9A-Z]{16}|AIza[\w-]{30,}|xox[abp]-[\w-]{10,}|eyJ[\w-]{10,}\.[\w-]{10,}\.[\w-]+)/g;
+
+// Keys, tokens and the user's home folder never make it into a report.
+export function redact(text, home = os.homedir()) {
+  let s = String(text ?? "").replace(SECRETS, (m) => m.slice(0, 4) + "…[redacted]");
+  if (home && home.length > 1) s = s.split(home).join("~");
+  return s.replace(/\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g, "[email]");
+}
+
+export function diagnostics({ version, command, agent } = {}) {
+  return [
+    `crumple ${version}`,
+    `command: ${command || "(none)"}`,
+    agent ? `agent: ${agent}` : null,
+    `node ${process.version} · ${os.platform()} ${os.release()} · ${os.arch()}`,
+  ].filter(Boolean).join("\n");
+}
+
+export function issueUrl({ title, version, command, agent, error } = {}) {
+  const body = [
+    "**What happened**",
+    "",
+    "<!-- What were you doing, and what did you expect? -->",
+    "",
+    "**Details** (filled in by Crumple; secrets and your home folder are removed)",
+    "```",
+    diagnostics({ version, command, agent }),
+    error ? "\n" + redact(error).slice(-1500) : "",
+    "```",
+  ].join("\n");
+  const q = new URLSearchParams({ title: title || "Bug: ", body, labels: "bug" });
+  return `${ISSUES}?${q}`;
+}
+
+// The box printed when Crumple itself fails.
+export function crashBox({ version, command, agent, error, color = true }) {
+  const red = (s) => (color ? `\x1b[31m${s}\x1b[0m` : s);
+  const dim = (s) => (color ? `\x1b[2m${s}\x1b[0m` : s);
+  const firstLine = redact(String(error).split("\n")[0]).slice(0, 200);
+  return [
+    "",
+    red("  ╔═ crumple crashed ══════════════════════════════════════════╗"),
+    `  ${firstLine}`,
+    "",
+    "  That's our bug, not yours. Please send it to us; it takes one click:",
+    `  ${issueUrl({ title: `Crash: ${firstLine.slice(0, 80)}`, version, command, agent, error })}`,
+    "",
+    dim(`  Nothing was sent. The link opens a pre-filled issue you can read first. Or email ${EMAIL}.`),
+    red("  ╚════════════════════════════════════════════════════════════╝"),
+    "",
+  ].join("\n");
+}

package/src/scan.mjs

@@ -48,9 +48,11 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
     for (const rule of perm.allow ?? []) {
       const r = String(rule);
       if (/^Bash(\(\*\)|\(:\*\))?$/.test(r)) add("critical", where, `Every shell command is pre-approved (${r})`, "A prompt injection becomes code execution on your machine immediately.", `Remove "${r}" and allow specific commands instead.`);
-      else if (/^Bash\((curl|wget|nc|ssh|scp|rsync|http)\b/.test(r)) add("high", where, `Network tool pre-approved (${r})`, "This is the exact command attackers use to send your .env out.", `Remove "${r}"; let the agent ask, or allow only fixed URLs.`);
+      // An exact rule only ever approves that one command, so only wildcards can carry your data out.
+      else if (/^Bash\((curl|wget|nc|ssh|scp|rsync|http)\b/.test(r) && r.includes("*")) add("high", where, `Network tool pre-approved (${r})`, "This is the exact command attackers use to send your .env out.", `Remove "${r}"; let the agent ask, or allow only fixed URLs.`);
       else if (/^Bash\((git|find|fd|rg|go|xargs|env|sed|awk|tar|npx|npm|pnpm|yarn|node|python3?|bash|sh)(:\*|\s\*|\*)?\)$/.test(r)) add("high", where, `Broad pre-approval that can run any program (${r})`, "Flags like `git -c core.fsmonitor=`, `find -exec`, `npm run` and `npx` turn a \"safe\" prefix into arbitrary code (Trail of Bits, 2025).", `Narrow "${r}" to exact subcommands (for example "Bash(git status)"), and install the Crumple guard, which checks flags.`);
-      else if (/^(WebFetch|mcp__[\w-]+)$/.test(r)) add("medium", where, `Pre-approved without limits (${r})`, "Lets content from anywhere drive the agent and receive data without a prompt.", `Scope "${r}" to specific domains or tools.`);
+      // A single MCP tool (mcp__server__tool) is a narrow approval; a whole server or open WebFetch is not.
+      else if (/^WebFetch$/.test(r) || (/^mcp__[\w-]+$/.test(r) && r.split("__").length === 2)) add("medium", where, `Pre-approved without limits (${r})`, "Lets content from anywhere drive the agent and receive data without a prompt.", `Scope "${r}" to specific domains or tools.`);
     }
     for (const d of perm.deny ?? []) if (/\.env/.test(String(d))) denyEnv = true;
     if (s.enableAllProjectMcpServers) add("high", where, "Every MCP server a repository ships is started automatically", "Cloning a hostile repo starts its MCP server with your permissions (Check Point, CVE-2025-59536).", "Remove `enableAllProjectMcpServers` and approve servers one by one.");
@@ -61,7 +63,8 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
     const hooks = JSON.stringify(s.hooks ?? {});
     if (/guard\.mjs|crumplelab guard/.test(hooks)) guarded = true;
     if (/\b(curl|wget|nc)\b|https?:\/\//.test(hooks)) add("high", where, "A hook sends data over the network", "Hooks run automatically on every tool call or session start, without the agent or you approving them.", "Check every hook command; remove any that talk to the network.");
-    if (f.startsWith(projectDir) && s.hooks && !/guard\.mjs/.test(hooks)) add("medium", where, "This repository ships its own hooks", "Hooks in a cloned repo run commands on your machine as soon as the agent starts.", "Review them before running an agent here.");
+    // settings.local.json is the user's own and stays out of git; only settings.json comes with a clone.
+    if (f === P(".claude/settings.json") && s.hooks && !/guard\.mjs/.test(hooks)) add("medium", where, "This repository ships its own hooks", "Hooks in a cloned repo run commands on your machine as soon as the agent starts.", "Review them before running an agent here.");
     if (s.sandbox?.enabled) sandboxed = true;
   }
   if (!guarded) add("medium", "agent setup", "No runtime guard checks the agent's commands", "Nothing stops a hijacked agent from sending keys out or deleting data between your prompts.", "Run `crumple fix`.");
@@ -128,7 +131,7 @@ export function scan(projectDir, { home = os.homedir() } = {}) {
   const npmrc = (read(P(".npmrc")) ?? "") + (read(H(".npmrc")) ?? "");
   const lock = json(P("package-lock.json"));
   if (lock && !/ignore-scripts\s*=\s*true/.test(npmrc)) {
-    const scripts = Object.entries(lock.packages ?? {}).filter(([k, v]) => k && v?.hasInstallScript).map(([k]) => k.split("node_modules/").pop());
+    const scripts = [...new Set(Object.entries(lock.packages ?? {}).filter(([k, v]) => k && v?.hasInstallScript).map(([k]) => k.split("node_modules/").pop()))];
     if (scripts.length) add("medium", "package-lock.json", `${scripts.length} dependencies run install scripts (${scripts.slice(0, 4).join(", ")}${scripts.length > 4 ? "…" : ""})`, "Install scripts run with your keys in reach; this is how Shai-Hulud and the Nx attack spread.", "Set `ignore-scripts=true` in .npmrc and allow only the few that need it.");
   }
 

package/src/ui.mjs

@@ -0,0 +1,70 @@
+// Terminal motion: a short boot log, a live progress line with a spinner, and nothing else.
+// Everything here turns itself off when output isn't a real terminal, or under NO_COLOR or CI,
+// so logs, pipes and --json stay plain.
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+export const animated = (stream = process.stdout, env = process.env) => Boolean(stream.isTTY && !env.NO_COLOR && !env.CI);
+
+const green = (s) => `\x1b[32m${s}\x1b[0m`;
+const dim = (s) => `\x1b[2m${s}\x1b[0m`;
+
+// Prints a few "name ...... ok  detail" lines, one at a time, like a machine coming up.
+export async function boot(lines, { stream = process.stdout, env = process.env } = {}) {
+  const on = animated(stream, env);
+  for (const [name, detail] of lines) {
+    const dots = ".".repeat(Math.max(2, 22 - name.length));
+    if (on) {
+      stream.write(`  ${dim(`${name} ${dots}`)} `);
+      await sleep(70);
+    } else stream.write(`  ${name} ${dots} `);
+    stream.write(on ? `${green("ok")}${detail ? dim(`  ${detail}`) : ""}\n` : `ok${detail ? `  ${detail}` : ""}\n`);
+  }
+}
+
+export function bar(done, total, width = 24) {
+  const full = total ? Math.round((done / total) * width) : 0;
+  return green("█".repeat(full)) + dim("░".repeat(width - full));
+}
+
+// A status line that stays at the bottom while finished results print above it.
+export function progress({ total, label = "", stream = process.stdout, env = process.env } = {}) {
+  const on = animated(stream, env);
+  let done = 0, frame = 0, extra = "", timer;
+  const draw = () => {
+    if (!on) return;
+    stream.write(`\r\x1b[2K  ${green(FRAMES[frame++ % FRAMES.length])} ${bar(done, total)} ${done}/${total}${label ? dim(`  ${label}`) : ""}${extra ? dim(`  ${extra}`) : ""}`);
+  };
+  if (on) timer = setInterval(draw, 80);
+  draw();
+  return {
+    // Prints a finished line above the status line and moves the bar on.
+    log(line) {
+      if (on) stream.write("\r\x1b[2K");
+      stream.write(line + "\n");
+      draw();
+    },
+    tick(note = "") {
+      done++;
+      extra = note;
+      draw();
+    },
+    stop() {
+      clearInterval(timer);
+      if (on) stream.write("\r\x1b[2K");
+    },
+  };
+}
+
+// For short waits: a spinner and a label, replaced by a tick when the work is done.
+export async function spin(label, work, { stream = process.stdout, env = process.env } = {}) {
+  if (!animated(stream, env)) return work();
+  let frame = 0;
+  const timer = setInterval(() => stream.write(`\r\x1b[2K  ${green(FRAMES[frame++ % FRAMES.length])} ${dim(label)}`), 80);
+  try {
+    return await work();
+  } finally {
+    clearInterval(timer);
+    stream.write(`\r\x1b[2K  ${green("✓")} ${dim(label)}\n`);
+  }
+}