hackmyagent 0.11.2 → 0.11.3

package/dist/hardening/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AAkF3F,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8HD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAiBlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAMvB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAmSvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAeV,uBAAuB;YAmGvB,aAAa;YAgDb,cAAc;YA+Fd,oBAAoB;YAwDpB,gBAAgB;YA0IhB,oBAAoB;YAgFpB,gBAAgB;YA2IhB,mBAAmB;YA4EnB,iBAAiB;YAyCjB,iBAAiB;YA+DjB,wBAAwB;YA0FxB,wBAAwB;YAmExB,wBAAwB;YAqHxB,oBAAoB;YA+GpB,uBAAuB;YAwIvB,iBAAiB;YA8GjB,oBAAoB;YAsHpB,mBAAmB;YAiGnB,gBAAgB;YAmIhB,oBAAoB;YAoIpB,gBAAgB;YAyHhB,qBAAqB;YA+GrB,eAAe;IAiI7B;;OAEG;YACW,mBAAmB;IA8GjC;;OAEG;YACW,oBAAoB;IAiKlC;;OAEG;YACW,iBAAiB;IA4I/B;;OAEG;YACW,oBAAoB;IAwIlC;;OAEG;YACW,eAAe;IAqJ7B;;OAEG;YACW,eAAe;IAuI7B;;OAEG;YACW,eAAe;IAyG7B;;OAEG;YACW,mBAAmB;IAmHjC,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,YAAY;IAkD1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IAycjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IA2LpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAqVlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IA6VjC;;OAEG;YACW,wBAAwB;IA4OtC;;OAEG;YACW,gBAAgB;IA6J9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IA+JlC;;;OAGG;YACW,iBAAiB;IA6H/B;;;OAGG;YACW,kBAAkB;IA+EhC;;;OAGG;YACW,aAAa;IAuF3B;;OAEG;YACW,gBAAgB;IA+D9B;;;;OAIG;YACW,yBAAyB;CAuWxC"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AAkF3F,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8HD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAiBlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAMvB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAmSvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAeV,uBAAuB;YAmGvB,aAAa;YAgDb,cAAc;YA+Fd,oBAAoB;YAwDpB,gBAAgB;YA0IhB,oBAAoB;YAgFpB,gBAAgB;YA2IhB,mBAAmB;YA4EnB,iBAAiB;YAyCjB,iBAAiB;YA+DjB,wBAAwB;YA0FxB,wBAAwB;YAmExB,wBAAwB;YAqHxB,oBAAoB;YA+GpB,uBAAuB;YAwIvB,iBAAiB;YA8GjB,oBAAoB;YAsHpB,mBAAmB;YAiGnB,gBAAgB;YAmIhB,oBAAoB;YAoIpB,gBAAgB;YAyHhB,qBAAqB;YA+GrB,eAAe;IAiI7B;;OAEG;YACW,mBAAmB;IA8GjC;;OAEG;YACW,oBAAoB;IAiKlC;;OAEG;YACW,iBAAiB;IA4I/B;;OAEG;YACW,oBAAoB;IAwIlC;;OAEG;YACW,eAAe;IAqJ7B;;OAEG;YACW,eAAe;IAuI7B;;OAEG;YACW,eAAe;IAyG7B;;OAEG;YACW,mBAAmB;IAmHjC,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,YAAY;IAkD1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IAycjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IA2LpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAqVlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IA6VjC;;OAEG;YACW,wBAAwB;IA4OtC;;OAEG;YACW,gBAAgB;IA6J9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IA+JlC;;;OAGG;YACW,iBAAiB;IA6H/B;;;OAGG;YACW,kBAAkB;IA+EhC;;;OAGG;YACW,aAAa;IAuF3B;;OAEG;YACW,gBAAgB;IA+D9B;;;;OAIG;YACW,yBAAyB;CA4NxC"}

package/dist/hardening/scanner.js

@@ -6224,12 +6224,7 @@ dist/
      */
     async checkUnicodeSteganography(targetDir, _autoFix) {
         const findings = [];
-        // Scan a broad set of file types for unicode stego -- not just JS/TS
-        const stegoExtensions = [
-            '.js', '.ts', '.mjs', '.cjs', '.tsx', '.jsx',
-            '.py', '.md', '.txt', '.yaml', '.yml', '.json', '.toml',
-        ];
-        const sourceFiles = await this.walkDirectory(targetDir, stegoExtensions);
+        const sourceFiles = await this.findSourceFiles(targetDir, targetDir);
         for (const filePath of sourceFiles) {
             const relativePath = path.relative(targetDir, filePath);
             let rawBuffer;
@@ -6243,69 +6238,18 @@ dist/
             if (rawBuffer.length > MAX_FILE_SIZE)
                 continue;
             // UNICODE-STEGO-001: Invisible Codepoint Detection
-            // Scan for:
-            //   - Zero-width characters: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+FEFF (BOM mid-file)
-            //   - Variation selectors U+FE00-FE0F
-            //   - Tag characters U+E0100-E01EF
-            //   - Bidirectional override chars U+202A-U+202E and U+2066-U+2069
+            // Scan for variation selectors U+FE00-FE0F (UTF-8: EF B8 80-8F)
+            // and tag characters U+E0100-E01EF (UTF-8: F3 A0 84 80 - F3 A0 87 AF)
             let hasVariationSelectors = false;
             let variationSelectorLine = 1;
             let hasTagCharsIn001 = false;
             let tagCharLine001 = 1;
-            let hasZeroWidth = false;
-            let zeroWidthLine = 1;
-            let hasBidiOverride = false;
-            let bidiOverrideLine = 1;
             let currentLine = 1;
             for (let i = 0; i < rawBuffer.length; i++) {
                 if (rawBuffer[i] === 0x0A) {
                     currentLine++;
                     continue;
                 }
-                // Zero-width characters: E2 80 8B (ZWSP), E2 80 8C (ZWNJ), E2 80 8D (ZWJ)
-                if (rawBuffer[i] === 0xE2 &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0x80 &&
-                    rawBuffer[i + 2] >= 0x8B &&
-                    rawBuffer[i + 2] <= 0x8D) {
-                    if (!hasZeroWidth) {
-                        hasZeroWidth = true;
-                        zeroWidthLine = currentLine;
-                    }
-                }
-                // BOM / Zero-width no-break space U+FEFF: EF BB BF (only suspicious mid-file)
-                if (rawBuffer[i] === 0xEF &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0xBB &&
-                    rawBuffer[i + 2] === 0xBF &&
-                    i > 0) {
-                    if (!hasZeroWidth) {
-                        hasZeroWidth = true;
-                        zeroWidthLine = currentLine;
-                    }
-                }
-                // Bidirectional override chars U+202A-U+202E: E2 80 AA-AE
-                if (rawBuffer[i] === 0xE2 &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0x80 &&
-                    rawBuffer[i + 2] >= 0xAA &&
-                    rawBuffer[i + 2] <= 0xAE) {
-                    if (!hasBidiOverride) {
-                        hasBidiOverride = true;
-                        bidiOverrideLine = currentLine;
-                    }
-                }
-                // Bidirectional isolate chars U+2066-U+2069: E2 81 A6-A9
-                if (rawBuffer[i] === 0xE2 &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0x81 &&
-                    rawBuffer[i + 2] >= 0xA6 &&
-                    rawBuffer[i + 2] <= 0xA9) {
-                    if (!hasBidiOverride) {
-                        hasBidiOverride = true;
-                        bidiOverrideLine = currentLine;
-                    }
-                }
                 // Variation selectors: EF B8 80-8F
                 if (rawBuffer[i] === 0xEF &&
                     i + 2 < rawBuffer.length &&
@@ -6329,39 +6273,24 @@ dist/
                     }
                 }
             }
-            if (hasZeroWidth || hasVariationSelectors || hasTagCharsIn001 || hasBidiOverride) {
+            if (hasVariationSelectors || hasTagCharsIn001) {
                 const detectedTypes = [];
-                if (hasZeroWidth)
-                    detectedTypes.push('zero-width characters (U+200B-U+200D, U+FEFF)');
-                if (hasBidiOverride)
-                    detectedTypes.push('bidirectional overrides (U+202A-U+202E, U+2066-U+2069)');
                 if (hasVariationSelectors)
                     detectedTypes.push('variation selectors (U+FE00-FE0F)');
                 if (hasTagCharsIn001)
                     detectedTypes.push('tag characters (U+E0100-E01EF)');
-                const lineNumbers = [];
-                if (hasZeroWidth)
-                    lineNumbers.push(zeroWidthLine);
-                if (hasBidiOverride)
-                    lineNumbers.push(bidiOverrideLine);
-                if (hasVariationSelectors)
-                    lineNumbers.push(variationSelectorLine);
-                if (hasTagCharsIn001)
-                    lineNumbers.push(tagCharLine001);
-                const earliestLine = Math.min(...lineNumbers);
-                const severity = hasBidiOverride || hasVariationSelectors || hasTagCharsIn001 ? 'critical' : 'high';
                 findings.push({
                     checkId: 'UNICODE-STEGO-001',
                     name: 'Invisible Unicode Codepoints Detected',
-                    description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (zero-width characters, bidirectional overrides, variation selectors, or tag characters)',
-                    category: 'supply-chain',
-                    severity,
+                    description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (GlassWorm attack vector)',
+                    category: 'unicode-stego',
+                    severity: 'critical',
                     passed: false,
                     message: `Found ${detectedTypes.join(' and ')} in ${relativePath}`,
                     file: relativePath,
-                    line: earliestLine,
+                    line: hasVariationSelectors ? variationSelectorLine : tagCharLine001,
                     fixable: false,
-                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + relativePath + ' | grep -iE "e280 8[bcd]|efbb bf|e280 a[a-e]|e281 a[6-9]|efb8 8|f3a0"',
+                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + relativePath + ' | grep -E "fe0[0-9a-f]|f3a0"',
                 });
             }
             // UNICODE-STEGO-002: GlassWorm Decoder Pattern
@@ -6390,7 +6319,7 @@ dist/
                     checkId: 'UNICODE-STEGO-002',
                     name: 'GlassWorm Decoder Pattern Detected',
                     description: 'Source file contains .codePointAt() usage combined with Unicode variation selector or tag character hex literals - this is the decoder half of a GlassWorm attack',
-                    category: 'supply-chain',
+                    category: 'unicode-stego',
                     severity: 'critical',
                     passed: false,
                     message: `Found GlassWorm decoder pattern (.codePointAt + hex range literals) in ${relativePath}`,
@@ -6444,7 +6373,7 @@ dist/
                         checkId: 'UNICODE-STEGO-003',
                         name: 'Eval on String with Hidden Payload',
                         description: 'eval() or Function() is called with a string that has very few visible characters but a large byte footprint - indicates invisible Unicode payload',
-                        category: 'supply-chain',
+                        category: 'unicode-stego',
                         severity: 'critical',
                         passed: false,
                         message: `Found eval/Function with ${visibleChars} visible chars but ${byteLength} bytes in ${relativePath}`,
@@ -6486,7 +6415,7 @@ dist/
                         checkId: 'UNICODE-STEGO-004',
                         name: 'Unicode Tag Character Block Detected',
                         description: 'Source file contains characters from the Unicode Tag block (U+E0000-U+E01EF) which have no visible rendering and can be used to hide data',
-                        category: 'supply-chain',
+                        category: 'unicode-stego',
                         severity: 'high',
                         passed: false,
                         message: `Found Unicode tag block characters in ${relativePath}`,
@@ -6498,69 +6427,6 @@ dist/
                 }
             }
         }
-        // UNICODE-STEGO-005: Homoglyph Substitution Detection
-        // Detect Cyrillic/Greek/fullwidth letters that look identical to Latin letters.
-        // Only scan code files where identifiers matter.
-        const codeExtensions = new Set(['.js', '.ts', '.mjs', '.cjs', '.tsx', '.jsx', '.py']);
-        const codeFiles = sourceFiles.filter((f) => codeExtensions.has(path.extname(f).toLowerCase()));
-        const HOMOGLYPHS = {
-            0x0430: 'a', 0x0435: 'e', 0x043E: 'o', 0x0440: 'p',
-            0x0441: 'c', 0x0443: 'y', 0x0445: 'x', 0x0456: 'i',
-            0x0455: 's', 0x04BB: 'h', 0x0501: 'd', 0x051B: 'q',
-            0x03B1: 'a', 0x03BF: 'o', 0x03C1: 'p',
-            0xFF41: 'a', 0xFF45: 'e', 0xFF4F: 'o',
-        };
-        const homoglyphCodes = new Set(Object.keys(HOMOGLYPHS).map(Number));
-        for (const filePath of codeFiles) {
-            const relativePath = path.relative(targetDir, filePath);
-            let content;
-            try {
-                content = await fs.readFile(filePath, 'utf-8');
-            }
-            catch {
-                continue;
-            }
-            if (content.length > MAX_FILE_SIZE)
-                continue;
-            const lines = content.split('\n');
-            const foundHomoglyphs = [];
-            for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
-                const line = lines[lineIdx];
-                if (line.length > MAX_LINE_LENGTH)
-                    continue;
-                const trimmed = line.trimStart();
-                if (trimmed.startsWith('//') || trimmed.startsWith('#') || trimmed.startsWith('*'))
-                    continue;
-                for (const ch of line) {
-                    const cp = ch.codePointAt(0);
-                    if (homoglyphCodes.has(cp)) {
-                        foundHomoglyphs.push({ line: lineIdx + 1, lookalike: HOMOGLYPHS[cp], cp });
-                        break;
-                    }
-                }
-                if (foundHomoglyphs.length >= 5)
-                    break;
-            }
-            if (foundHomoglyphs.length > 0) {
-                const examples = foundHomoglyphs
-                    .slice(0, 3)
-                    .map((h) => `U+${h.cp.toString(16).toUpperCase().padStart(4, '0')} (looks like '${h.lookalike}') at line ${h.line}`)
-                    .join(', ');
-                findings.push({
-                    checkId: 'UNICODE-STEGO-005',
-                    name: 'Homoglyph Character Substitution Detected',
-                    description: 'Source file contains non-Latin characters (Cyrillic, Greek, or fullwidth) that visually mimic Latin letters. This can disguise malicious identifiers or imports.',
-                    category: 'supply-chain',
-                    severity: 'high',
-                    passed: false,
-                    message: `Found ${foundHomoglyphs.length} homoglyph substitution(s) in ${relativePath}: ${examples}`,
-                    file: relativePath,
-                    line: foundHomoglyphs[0].line,
-                    fixable: false,
-                    fix: 'Replace non-Latin lookalike characters with their ASCII equivalents. Run: node -e "const s=require(\'fs\').readFileSync(\'' + relativePath + '\',\'utf8\');[...s].forEach((c,i)=>{const cp=c.codePointAt(0);if(cp>0x7F&&cp<0xFFFF)console.log(\'offset\',i,\'U+\'+cp.toString(16),JSON.stringify(c))})"',
-                });
-            }
-        }
         return findings;
     }
 }