modelos-secure 0.3.1 → 0.3.3

package/cli.js

@@ -3,9 +3,9 @@ import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
-import { access, appendFile, constants, glob, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
+import { access, appendFile, constants, glob, lstat, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -23,7 +23,7 @@ if (existsSync(resolve(here, "wasm"))) {
 }
 // package.json
 var name = "modelos-secure";
-var version$1 = "0.3.1";
+var version$1 = "0.3.3";
 var type = "module";
 var bin = { "modelos-secure": "dist/cli.js" };
 var exports$1 = { "./hook": "./dist/hook/hook.mjs" };
@@ -335,7 +335,17 @@ var SKIPPED = /* @__PURE__ */ new Set([
 	"e2e",
 	"coverage",
 	".turbo",
-	".cache"
+	".cache",
+	".idea",
+	".vscode",
+	".vs",
+	".terraform",
+	".ruff_cache",
+	".nox",
+	".gradle",
+	".yarn",
+	".svelte-kit",
+	".angular"
 ]);
 var MAX_FILE_BYTES = 1048576;
 var DOCUMENT = /* @__PURE__ */ new Set([
@@ -5621,6 +5631,30 @@ function docOf(node, file) {
 // ../../packages/scan/src/start-candidates.ts
 /** Words a README command starts with that start an app, not install or test one. */
 var STARTS = /^(?:\$\s*)?((?:uvicorn|gunicorn|hypercorn|fastapi (?:dev|run)|flask (?:--app \S+ )?run|streamlit run|chainlit run|gradio|python3? (?:-m )?\S+\.py|python3? -m \S+|(?:npm|pnpm|yarn|bun) (?:run )?(?:dev|start|serve)|node \S+\.(?:m?js|ts)|npx tsx \S+|docker compose up|docker-compose up)\b.*)$/;
+/** The words of an instruction in its list form, or null when it is in the shell form. */
+function listForm(body) {
+	try {
+		const parts = JSON.parse(body);
+		return Array.isArray(parts) ? parts.map(String) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* What a Dockerfile runs, as Docker reads it: the last stage's entrypoint with its command as the
+* arguments, unless the entrypoint is in the shell form, which ignores them. A health check's own
+* CMD is not it. Only arguments, starting with a dash, go to a program in the base image, which is
+* not here to name, so they are no command at all.
+*/
+function dockerCommand(dockerfile) {
+	const lines = dockerfile.replace(/\\\r?\n/g, " ").split(/\r?\n/).map((l) => l.trim());
+	const stage = lines.slice(lines.findLastIndex((l) => /^FROM\s/i.test(l)) + 1);
+	const last = (word) => stage.findLast((l) => new RegExp(`^${word}\\s`, "i").test(l))?.slice(word.length).trim();
+	const entrypoint = last("ENTRYPOINT");
+	if (entrypoint && !listForm(entrypoint)) return entrypoint;
+	const full = [entrypoint, last("CMD")].filter((body) => body !== void 0).map((body) => listForm(body)?.join(" ") ?? body).join(" ");
+	return full && !full.startsWith("-") ? full : null;
+}
 async function startCandidates(look, project) {
 	const files = new Set(project.files.map((f) => f.path));
 	const read = (file) => readFile(join(look.root, file), "utf8").catch(() => null);
@@ -5648,19 +5682,12 @@ async function startCandidates(look, project) {
 			from: `the main block at ${file.path}:${(main + 1).toString()}`
 		});
 	}
-	const cmd = (await read("Dockerfile"))?.split("\n").reverse().find((l) => /^\s*(CMD|ENTRYPOINT)\s/i.test(l));
-	if (cmd) {
-		const body = cmd.replace(/^\s*(CMD|ENTRYPOINT)\s+/i, "").trim();
-		let command = body;
-		try {
-			const parts = JSON.parse(body);
-			if (Array.isArray(parts)) command = parts.map(String).join(" ");
-		} catch {}
-		if (command) found.push({
-			command,
-			from: "the Dockerfile's command"
-		});
-	}
+	const dockerfile = await read("Dockerfile");
+	const command = dockerfile ? dockerCommand(dockerfile) : null;
+	if (command) found.push({
+		command,
+		from: "the Dockerfile's command"
+	});
 	for (const name of [
 		"README.md",
 		"readme.md",
@@ -6395,15 +6422,36 @@ var LIMITS = {
 	maxFileBytes: 1e6
 };
 var CODE_TOOLS = ["grep", "read"];
-/** Every file in the repository the tools could see, skipping what the scan never walks. */
+var NOT_OPENED = "the scan never opens that folder";
+/** Whether the scan opens a folder at all: no part of its path is one it never walks. */
+var opensFolder = (dir) => !dir.split("/").some((part) => SKIPPED.has(part.toLowerCase()));
+/**
+* Every file in the repository the tools could see, and so what --explain counts. All of it by hand
+* rather than by glob, whose `*` leaves out names starting with a dot, which is where settings files
+* are. A link is not a file here: it could lead outside the repository. ADR 0093.
+*/
 async function repositoryFiles(root, pattern = "**/*", most = 5e3) {
 	const found = [];
+	if (pattern === "**/*") {
+		const walk = async (dir) => {
+			const entries = await readdir(join(root, dir), { withFileTypes: true }).catch(() => []);
+			for (const entry of entries) {
+				if (found.length >= most) return;
+				const path = posix.join(dir, entry.name);
+				if (entry.isFile()) found.push(path);
+				else if (entry.isDirectory() && opensFolder(entry.name)) await walk(path);
+			}
+		};
+		await walk("");
+		return found.sort();
+	}
 	for await (const entry of glob(pattern, {
 		cwd: root,
 		exclude: (name) => SKIPPED.has(String(name).split(/[\\/]/).at(-1) ?? "")
 	})) {
 		const path = String(entry).split("\\").join("/");
-		if ((await stat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
+		if (!opensFolder(posix.dirname(path))) continue;
+		if ((await lstat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
 		if (found.length >= most) break;
 	}
 	return found.sort();
@@ -6419,6 +6467,7 @@ function createTools(input) {
 			const dir = String(args.dir ?? ".");
 			const inRepo = await insideRepository(root, dir);
 			if (inRepo === null) return refused(dir, "it is not a folder in this repository");
+			if (!opensFolder(inRepo)) return refused(inRepo, NOT_OPENED);
 			const entries = await readdir(join(root, inRepo), { withFileTypes: true }).catch(() => null);
 			if (!entries) return refused(dir, "it is not a folder in this repository");
 			return {
@@ -6463,6 +6512,7 @@ function createTools(input) {
 			if (inRepo === null) return refused(path, "it is not a file in this repository");
 			const why = neverRead(inRepo);
 			if (why) return refused(inRepo, why);
+			if (!opensFolder(posix.dirname(inRepo))) return refused(inRepo, NOT_OPENED);
 			if ((await stat(join(root, inRepo))).size > LIMITS.maxFileBytes) return refused(inRepo, "it is over 1 MB");
 			const all = (await readFile(join(root, inRepo), "utf8")).split(/\r?\n/);
 			const from = Math.max(1, Number(args.from ?? (args.to === void 0 ? 1 : args.to - LIMITS.readLines + 1)));
@@ -21996,21 +22046,23 @@ function read(result, understood) {
 		facts: mergeFacts(result.facts, verified.facts).filter((f) => !(f.kind === "way-in" && f.adapter !== "model" && f.function && acts.has(f.function)))
 	};
 }
-// src/commands/scan.ts
-var TOOL_POWERS = [
-	"read",
-	"read private data",
-	"change",
-	"send outside",
-	"move money",
-	"delete"
-];
-var CONSENT_TEXT = "To understand your app, the scan lets a model read your code the way an engineer would, on our own Google Cloud project. It starts from an outline: file paths, the names and signatures of functions and classes, your prompts and the names of your settings. Then it asks for the files and lines it needs, and only those are sent, each through a filter that takes secrets out. It never sends settings files, keys, certificates or credential files, the values of your settings, or files over 1 MB. Every answer it sends is listed in .modelos-secure/sent.jsonl. Run with --explain to see what may be read, or --offline to keep everything here.";
+// src/several-apps.ts
 var AI_DEPENDENCIES = /"(ai|openai|@google\/genai|langchain|@langchain\/[\w-]+|@anthropic-ai\/sdk|@mastra\/core|@openai\/agents)"|^\s*"?(openai|google-genai|langgraph|langchain|anthropic|crewai|pydantic-ai|smolagents|openai-agents|llama-index|autogen-agentchat|litellm)\b/m;
-/** Only for telling a repository of several apps from one app: whether any file imports an AI library. */
+/** Whether a file imports an AI library. */
 var AI_IMPORT = /^\s*(?:import|from)\b[^\n]*\b(openai|anthropic|genai|gemini|langchain|langgraph|llama_index|crewai|pydantic_ai|smolagents|autogen|mastra|ai-sdk|agents|vertexai|litellm|ollama)\b|require\(["'](openai|ai|@anthropic-ai\/sdk)["']\)/m;
-var plural = (n, one, many = `${one}s`) => `${n.toLocaleString("en-GB")} ${n === 1 ? one : many}`;
-/** Folders below the root that are apps of their own. */
+var MANIFESTS = [
+	"package.json",
+	"pyproject.toml",
+	"requirements.txt"
+];
+async function dependsOnAi(folder) {
+	for (const manifest of MANIFESTS) {
+		const text = await readFile(join(folder, manifest), "utf8").catch(() => "");
+		if (AI_DEPENDENCIES.test(text)) return true;
+	}
+	return false;
+}
+/** Folders below the root that are apps of their own. What is inside an app is part of it. */
 async function appsIn(root) {
 	const found = [];
 	const visit = async (dir, depth) => {
@@ -22023,26 +22075,34 @@ async function appsIn(root) {
 				"venv"
 			].includes(entry.name)) continue;
 			const full = join(dir, entry.name);
-			for (const manifest of [
-				"package.json",
-				"pyproject.toml",
-				"requirements.txt"
-			]) {
-				const text = await readFile(join(full, manifest), "utf8").catch(() => "");
-				if (AI_DEPENDENCIES.test(text)) {
-					found.push(inRepo(root, full));
-					break;
-				}
-			}
-			await visit(full, depth + 1);
+			if (await dependsOnAi(full)) found.push(inRepo(root, full));
+			else await visit(full, depth + 1);
 		}
 	};
 	await visit(root, 1);
 	return found;
 }
-function looksLikeAnApp(result) {
+/** Whether any code here, wherever it sits, builds on an AI library. */
+function usesAi(result) {
 	return result.facts.some((f) => f.kind === "tool" || f.kind === "agent") || result.project.files.some((f) => AI_IMPORT.test(f.text));
 }
+/** Whether the folder is an app itself, beside any apps in its subfolders. */
+async function rootIsAnApp(root, result, apps) {
+	if (await dependsOnAi(root)) return true;
+	const outside = (path) => !apps.some((app) => path === app || path.startsWith(`${app}/`));
+	return result.facts.some((f) => (f.kind === "tool" || f.kind === "agent") && outside(f.file)) || result.project.files.some((f) => outside(f.path) && AI_IMPORT.test(f.text));
+}
+// src/commands/scan.ts
+var TOOL_POWERS = [
+	"read",
+	"read private data",
+	"change",
+	"send outside",
+	"move money",
+	"delete"
+];
+var CONSENT_TEXT = "To understand your app, the scan lets a model read your code the way an engineer would, on our own Google Cloud project. It starts from an outline: file paths, the names and signatures of functions and classes, your prompts and the names of your settings. Then it asks for the files and lines it needs, and only those are sent, each through a filter that takes secrets out. It never sends settings files, keys, certificates or credential files, the values of your settings, or files over 1 MB. Every answer it sends is listed in .modelos-secure/sent.jsonl. Run with --explain to see what may be read, or --offline to keep everything here.";
+var plural = (n, one, many = `${one}s`) => `${n.toLocaleString("en-GB")} ${n === 1 ? one : many}`;
 async function scanCommand(dir, options) {
 	const retry = {
 		yes: options.yes,
@@ -22062,21 +22122,27 @@ async function scanCommand(dir, options) {
 	const result = await scanFolder(dir);
 	say(`${bold("ModelOS Secure")}  scanning ${result.look.name}\n`);
 	step("Look", `${[...result.look.languages, ...result.look.frameworks].join(", ") || "No source found"}, ${plural(result.look.fileCount, "file")}`);
-	if (!looksLikeAnApp(result)) {
-		const apps = await appsIn(dir);
-		if (apps.length > 1) {
-			const chosen = options.yes ? [apps[0]] : await ask(`This repository has ${apps.length.toString()} apps with model calls.`, void 0, [...apps.map((app) => ({
+	const apps = await appsIn(dir);
+	if (apps.length > 1 && !await rootIsAnApp(dir, result, apps)) {
+		const several = `This repository has ${apps.length.toString()} apps with model calls.`;
+		if (options.yes) say(`\n  ${several} --yes takes the first, ${apps[0]}.\n`);
+		const chosen = options.yes ? [apps[0]] : await ask(several, void 0, [
+			...apps.map((app) => ({
 				label: `Pick ${app}`,
 				value: [app]
-			})), {
+			})),
+			{
 				label: `Scan all ${apps.length.toString()} as separate systems`,
 				value: apps
-			}]);
-			for (const app of chosen) await scanCommand(join(dir, app), options);
-			return;
-		}
-		if (apps.length === 1) return scanCommand(join(dir, apps[0]), options);
-	}
+			},
+			{
+				label: "They are one system: scan this whole folder",
+				value: []
+			}
+		]);
+		for (const app of chosen) await scanCommand(join(dir, app), options);
+		if (chosen.length > 0) return;
+	} else if (apps.length === 1 && !usesAi(result)) return scanCommand(join(dir, apps[0]), options);
 	step("Read", `${plural(result.project.files.length, "file")} parsed${result.adapters.some((a) => a !== "http") ? `, with the reader for ${result.adapters.filter((a) => a !== "http").join(" and ")}` : ""}`);
 	const outline = await buildOutline(result.look, result.facts, result.project);
 	if (options.explain) {
@@ -22087,6 +22153,7 @@ async function scanCommand(dir, options) {
 		say(`\nNever sent, whatever is asked (${neverSent.length.toString()}):`);
 		for (const n of neverSent) say(`  ${n.path}, because ${n.why}`);
 		if (neverSent.length === 0) say("  nothing here matches");
+		say("\nThe scan never opens folders such as .git, node_modules and tests, so nothing in them is listed or read.");
 		say(`\nWhat was actually sent on earlier runs is in .modelos-secure/sent.jsonl.`);
 		return;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {