deepdebug-local-agent 1.0.23 → 1.2.0

package/src/dlp/rules.js

@@ -0,0 +1,97 @@
+/**
+ * DLP ruleset (versioned). Each rule: { id, class, re, group?, validate? }.
+ *  - id:       stable identifier, used as the metric label and in the placeholder.
+ *  - class:    coarse family, used by LOCAL_AGENT_DLP_BLOCK_CLASSES.
+ *  - re:       global regex (the engine resets lastIndex; never share state).
+ *  - group:    capture group to redact; default is the whole match.
+ *  - validate: optional predicate on the redactable text; false = not a hit.
+ *
+ * Order matters: specific rules run before generic ones, so a Stripe key is
+ * reported as stripe_key and not as a generic secret assignment.
+ * Bump RULESET_VERSION on every change to the list or to a pattern.
+ *
+ * Reimplemented from public token formats; no third-party rule files copied.
+ */
+import {
+    looksLikeLiteralSecret, looksLikeOpaqueKey, realEmail, plausiblePhone,
+    plausibleCard, ibanValid, ptNifValid,
+} from './validators.js';
+
+export const RULESET_VERSION = '2026.10.28-1';
+
+export const RULE_CLASSES = Object.freeze([
+    'private-key', 'cloud-credential', 'vcs-token', 'payment-key', 'saas-token', 'token',
+    'credential', 'connection-string', 'url-credential', 'pii-email', 'pii-phone', 'pii-id',
+    'pii-financial', 'high-entropy',
+]);
+
+const r = (id, cls, re, extra = {}) => Object.freeze({ id, class: cls, re, ...extra });
+
+export const RULES = Object.freeze([
+    // Private keys first: they span lines and may contain other-looking text.
+    r('pem_private_key', 'private-key',
+        /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----|$)/g),
+
+    // Cloud
+    r('aws_access_key_id', 'cloud-credential', /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[A-Z0-9]{16}\b/g),
+    r('aws_secret_access_key', 'cloud-credential',
+        /\baws[_-]?secret[_-]?(?:access[_-]?)?key["']?\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})\b/gi, { group: 1 }),
+    r('gcp_api_key', 'cloud-credential', /\bAIza[0-9A-Za-z_-]{35}\b/g),
+    r('gcp_oauth_token', 'cloud-credential', /\bya29\.[0-9A-Za-z_-]{20,}/g),
+    r('gcp_oauth_client_secret', 'cloud-credential', /\bGOCSPX-[A-Za-z0-9_-]{20,}/g),
+    r('azure_storage_account_key', 'cloud-credential', /\bAccountKey=([A-Za-z0-9+/]{40,}={0,2})/g, { group: 1 }),
+    r('digitalocean_token', 'cloud-credential', /\bdo[opr]_v1_[a-f0-9]{64}\b/g),
+
+    // VCS / package registries
+    r('github_token', 'vcs-token', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g),
+    r('github_fine_grained_pat', 'vcs-token', /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g),
+    r('gitlab_pat', 'vcs-token', /\bglpat-[A-Za-z0-9_-]{20,}/g),
+    r('npm_token', 'vcs-token', /\bnpm_[A-Za-z0-9]{36}\b/g),
+    r('pypi_token', 'vcs-token', /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}/g),
+
+    // Payments / SaaS
+    r('stripe_key', 'payment-key', /\b[sr]k_(?:live|test)_[0-9A-Za-z]{16,}\b/g),
+    r('stripe_webhook_secret', 'payment-key', /\bwhsec_[A-Za-z0-9]{16,}\b/g),
+    r('shopify_token', 'saas-token', /\bshp(?:at|ca|pa|ss)_[a-f0-9]{32}\b/g),
+    r('slack_token', 'saas-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}/g),
+    r('slack_webhook', 'saas-token', /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g),
+    r('discord_webhook', 'saas-token', /https:\/\/(?:discord|discordapp)\.com\/api\/webhooks\/\d+\/[\w-]+/g),
+    r('sendgrid_key', 'saas-token', /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g),
+    r('twilio_api_key', 'saas-token', /\bSK[0-9a-f]{32}\b/g),
+    r('mailgun_key', 'saas-token', /\bkey-[0-9a-f]{32}\b/g),
+    r('huggingface_token', 'saas-token', /\bhf_[A-Za-z0-9]{34,}\b/g),
+    r('telegram_bot_token', 'saas-token', /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/g),
+    r('anthropic_key', 'saas-token', /\bsk-ant-[A-Za-z0-9_-]{20,}/g),
+    r('openai_key', 'saas-token', /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/g, { validate: (v) => /\d/.test(v) }),
+
+    // Generic tokens
+    r('jwt', 'token', /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g),
+    r('bearer_token', 'token', /\bBearer\s+([A-Za-z0-9._~+/-]{20,}=*)/g, { group: 1 }),
+    r('basic_auth_header', 'token', /\bAuthorization:\s*Basic\s+([A-Za-z0-9+/]{12,}={0,2})/gi, { group: 1 }),
+
+    // Connection strings and URL credentials (before the generic assignment rule)
+    r('db_connection_string', 'connection-string',
+        /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss|amqps?|mssql|sqlserver|cockroachdb):\/\/[^\s"'`<>]+/gi,
+        { validate: (v) => /:\/\/[^/\s]*@/.test(v) }),
+    r('jdbc_password', 'connection-string', /\bjdbc:[a-z0-9]+:[^\s"'`]*?[?&;](?:password|pwd)=([^\s&;"'`]+)/gi, { group: 1 }),
+    r('ado_connection_password', 'connection-string', /(?:^|;)\s*(?:Password|Pwd)\s*=\s*([^;\r\n"']{3,})/gim, { group: 1 }),
+    r('url_credentials', 'url-credential', /\b[a-z][a-z0-9+.-]{0,20}:\/\/([^\s:@/"'`<>]+:[^\s@/"'`<>]+)@/gi, { group: 1, validate: (v) => !/[${}<>]/.test(v) }),
+
+    // Generic "name = literal" assignments
+    r('generic_secret_assignment', 'credential',
+        /\b(?:[A-Za-z0-9_-]{0,40}?(?:password|passwd|pwd|secret|api[_-]?key|apikey|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|token))["']?\s*(?::|=|=>)\s*["']?([^\s"'`,;]{8,})/gi,
+        { group: 1, validate: looksLikeLiteralSecret }),
+
+    // PII
+    r('email', 'pii-email', /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,6}\.[A-Za-z]{2,24}(?![A-Za-z0-9_~./-]|:[A-Za-z0-9_~./-])/g, { validate: realEmail }),
+    r('iban', 'pii-financial', /\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,3})?\b/g, { validate: ibanValid }),
+    r('credit_card', 'pii-financial', /(?<![\d.-])\d{4}(?:[ -]?\d{4}){2}[ -]?\d{1,7}(?![\d-])/g, { validate: plausibleCard }),
+    r('pt_nif', 'pii-id',
+        /\b(?:NIF|NIPC|contribuinte|VAT)\b\s*(?:n[.ºo°]*\s*)?[:=#-]?\s*(?:PT)?(\d{9})\b/gi, { group: 1, validate: ptNifValid }),
+    r('phone_international', 'pii-phone', /(?<![\w.+])(?:\+|00)\d{1,3}(?:[ .-]?\(?\d{1,4}\)?){2,5}(?![\w])/g,
+        { validate: plausiblePhone }),
+
+    // Last: opaque high-entropy blobs
+    r('high_entropy_blob', 'high-entropy', /(?<![A-Za-z0-9+/_=-])[A-Za-z0-9+/_=-]{40,}(?![A-Za-z0-9+/_=-])/g,
+        { validate: looksLikeOpaqueKey }),
+]);

package/src/dlp/validators.js

@@ -0,0 +1,123 @@
+/**
+ * DLP validators: pure helpers that cut false positives after a regex matched.
+ * No I/O, no state.
+ */
+
+/** Shannon entropy in bits per character. */
+export function shannonEntropy(s) {
+    if (!s) return 0;
+    const freq = new Map();
+    for (const ch of s) freq.set(ch, (freq.get(ch) || 0) + 1);
+    let h = 0;
+    for (const n of freq.values()) {
+        const p = n / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+
+/** Luhn checksum over a digit string. */
+export function luhnValid(digits) {
+    if (!/^\d{13,19}$/.test(digits)) return false;
+    let sum = 0;
+    let alt = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (alt) {
+            d *= 2;
+            if (d > 9) d -= 9;
+        }
+        sum += d;
+        alt = !alt;
+    }
+    return sum % 10 === 0;
+}
+
+/** ISO 13616 mod-97 check for an IBAN (spaces allowed). */
+export function ibanValid(raw) {
+    const s = raw.replace(/\s+/g, '').toUpperCase();
+    if (!/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(s)) return false;
+    const rearranged = s.slice(4) + s.slice(0, 4);
+    let rem = 0;
+    for (const ch of rearranged) {
+        const v = ch >= 'A' && ch <= 'Z' ? String(ch.charCodeAt(0) - 55) : ch;
+        for (const c of v) rem = (rem * 10 + (c.charCodeAt(0) - 48)) % 97;
+    }
+    return rem === 1;
+}
+
+/** Portuguese NIF/NIPC checksum (9 digits, mod 11). */
+export function ptNifValid(digits) {
+    if (!/^\d{9}$/.test(digits)) return false;
+    const okPrefix = '1235689'.includes(digits[0]) || /^(?:45|70|71|72|74|75|77|79)/.test(digits);
+    if (!okPrefix) return false;
+    let sum = 0;
+    for (let i = 0; i < 8; i++) sum += (digits.charCodeAt(i) - 48) * (9 - i);
+    const check = 11 - (sum % 11);
+    const expected = check >= 10 ? 0 : check;
+    return expected === digits.charCodeAt(8) - 48;
+}
+
+const PLACEHOLDER_PREFIX = /^(?:\$|\{|<|%|\[|\(|process\.env|os\.getenv|env\[|getenv|config\.|settings\.|this\.|self\.|args\.|params\.|req\.|request\.|\.\.\.)/i;
+const PLACEHOLDER_WORDS = /^(?:\*+|x{3,}|null|undefined|none|true|false|string|required|optional|redacted|changeme|change_me|your[-_ ].*|example.*|placeholder.*|dummy.*|secret|password|token|apikey|api_key)$/i;
+
+/**
+ * Decide whether the value assigned to a secret-looking name is a literal
+ * credential or just code (identifier, call, template, placeholder).
+ */
+export function looksLikeLiteralSecret(value) {
+    const v = value.replace(/^["'`]+|["'`]+$/g, '');
+    if (v.length < 8) return false;
+    if (PLACEHOLDER_PREFIX.test(v) || PLACEHOLDER_WORDS.test(v)) return false;
+    if (v.includes('REDACTED') || v.includes('***')) return false;
+    if (/[()]/.test(v)) return false;             // function call / expression
+    if (/^[A-Za-z_][A-Za-z0-9_.]*$/.test(v) && !/\d/.test(v)) {
+        // plain identifier or dotted path (getPassword, config.password): code, not a secret
+        return false;
+    }
+    if (/^[a-z]+(?:[-_][a-z]+)+$/.test(v)) return false; // kebab/snake names (secret ids, flags), not values
+    const hasDigit = /\d/.test(v);
+    const hasSymbol = /[!@#$%^&*+/=~\-]/.test(v);
+    if (hasDigit || hasSymbol) return true;
+    return v.length >= 16 && shannonEntropy(v) >= 3.5;
+}
+
+/** High-entropy blob heuristic (opaque keys); excludes hashes, UUIDs and paths. */
+export function looksLikeOpaqueKey(token) {
+    if (token.length < 40) return false;
+    if (/^sha\d+-/i.test(token)) return false;                 // npm/SRI integrity hashes
+    if (/^[0-9a-f]+$/i.test(token)) return false;              // hex digests / git SHAs
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(token)) return false; // UUID
+    if (token.startsWith('/') || token.includes('//')) return false; // path / URL remnants
+    // Standard base64 never has - or _, URL-safe never has /: a mix means a path or URL fragment.
+    if (token.includes('/') && /[-_]/.test(token)) return false;
+    if (!/[a-z]/.test(token) || !/[A-Z]/.test(token) || !/\d/.test(token)) return false;
+    return shannonEntropy(token) >= 4.5;
+}
+
+const NON_MAIL_TLDS = new Set(['png', 'jpg', 'jpeg', 'gif', 'svg', 'webp', 'ico', 'css', 'js', 'ts', 'json', 'map', 'woff', 'woff2', 'ttf', 'eot', 'html', 'md']);
+const DOC_DOMAINS = /(?:^|\.)(?:example\.(?:com|org|net)|test|invalid|localhost|local)$/i;
+
+/** E-mail: reject asset names (logo@2x.png) and reserved documentation domains. */
+export function realEmail(addr) {
+    const at = addr.lastIndexOf('@');
+    const domain = addr.slice(at + 1);
+    const tld = domain.slice(domain.lastIndexOf('.') + 1).toLowerCase();
+    if (NON_MAIL_TLDS.has(tld)) return false;
+    if (DOC_DOMAINS.test(domain)) return false;
+    return true;
+}
+
+/** International phone: leading +, 9 to 15 digits overall. */
+export function plausiblePhone(raw) {
+    const digits = raw.replace(/\D/g, '');
+    return digits.length >= 9 && digits.length <= 15;
+}
+
+/** Card number candidates: Luhn + plausible leading digit, separators ignored. */
+export function plausibleCard(raw) {
+    const digits = raw.replace(/[ -]/g, '');
+    if (!/^[2-6]/.test(digits)) return false;
+    if (/^(\d)\1+$/.test(digits)) return false;
+    return luhnValid(digits);
+}

package/src/exec-utils.js

@@ -156,10 +156,27 @@ export async function compileAndTest({ language, buildTool, cwd, skipTests = fal
                 }
             }
 
-            // -e flag shows full error stack traces from Maven
+            // Speed flags — these stack:
+            //  -q                              quiet output (only ERROR-level)
+            //  --no-snapshot-updates           skip "checking for updates" of
+            //                                  SNAPSHOT deps that we already have
+            //                                  in ~/.m2 (saves seconds per run)
+            //  -T 1C                           one thread per CPU core (no-op on
+            //                                  single-module poms but harmless)
+            //  -Dmaven.compiler.useIncremental
+            //                          Compilation=true
+            //                                  default since Maven 3.9 — set
+            //                                  explicitly for older runners
+            //  -e                              show full stack on compile errors
+            const speedFlags = [
+                "-q",
+                "--no-snapshot-updates",
+                "-T", "1C",
+                "-Dmaven.compiler.useIncrementalCompilation=true"
+            ];
             const args = skipTests
-                ? ["compile", "-DskipTests", "-e", ...javaCompatFlags]
-                : ["test", "-e", ...javaCompatFlags];
+                ? ["compile", "-DskipTests", "-e", ...speedFlags, ...javaCompatFlags]
+                : ["test", "-e", ...speedFlags, ...javaCompatFlags];
 
             console.log(`[BUILD] [COMPILE] Running: ${mvnCmd} ${args.join(" ")}`);
             result = await run(mvnCmd, args, cwd, 10 * 60 * 1000, mavenEnv);
@@ -257,7 +274,12 @@ export async function compileAndTest({ language, buildTool, cwd, skipTests = fal
         else if (language === "swift" || language === "ios") {
             // SPM projects: try `swift build` if the Swift toolchain is available.
             // Xcode projects (xcodebuild) need macOS — not available on Linux Cloud Run.
-            if (buildTool === "spm" || buildTool === "swift") {
+            // Accept all three SPM marker values: "spm" (legacy), "swift" (generic),
+            // "swiftpm" (current detector output from detectors.js for Package.swift).
+            // Pre-Phase-11 bug: detectProject emits "swiftpm" but this branch only
+            // matched "spm"/"swift", so SwiftPM projects fell through to the Xcode
+            // branch (swiftc -typecheck) instead of using swift build.
+            if (buildTool === "spm" || buildTool === "swift" || buildTool === "swiftpm") {
                 console.log(`[BUILD] [COMPILE] Attempting: swift build`);
                 const swiftCheck = await run("which", ["swift"], cwd, 3000);
                 if (swiftCheck.code === 0) {