modelos-secure 0.3.2 → 0.3.3

package/cli.js

@@ -3,9 +3,9 @@ import { _ as lastFinishedStep, a as apiClient, b as status, c as Interrupted, d
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, delimiter, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { basename, delimiter, dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
-import { access, appendFile, constants, glob, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
+import { access, appendFile, constants, glob, lstat, mkdir, readFile, readdir, realpath, rename, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -23,7 +23,7 @@ if (existsSync(resolve(here, "wasm"))) {
 }
 // package.json
 var name = "modelos-secure";
-var version$1 = "0.3.2";
+var version$1 = "0.3.3";
 var type = "module";
 var bin = { "modelos-secure": "dist/cli.js" };
 var exports$1 = { "./hook": "./dist/hook/hook.mjs" };
@@ -335,7 +335,17 @@ var SKIPPED = /* @__PURE__ */ new Set([
 	"e2e",
 	"coverage",
 	".turbo",
-	".cache"
+	".cache",
+	".idea",
+	".vscode",
+	".vs",
+	".terraform",
+	".ruff_cache",
+	".nox",
+	".gradle",
+	".yarn",
+	".svelte-kit",
+	".angular"
 ]);
 var MAX_FILE_BYTES = 1048576;
 var DOCUMENT = /* @__PURE__ */ new Set([
@@ -5621,6 +5631,30 @@ function docOf(node, file) {
 // ../../packages/scan/src/start-candidates.ts
 /** Words a README command starts with that start an app, not install or test one. */
 var STARTS = /^(?:\$\s*)?((?:uvicorn|gunicorn|hypercorn|fastapi (?:dev|run)|flask (?:--app \S+ )?run|streamlit run|chainlit run|gradio|python3? (?:-m )?\S+\.py|python3? -m \S+|(?:npm|pnpm|yarn|bun) (?:run )?(?:dev|start|serve)|node \S+\.(?:m?js|ts)|npx tsx \S+|docker compose up|docker-compose up)\b.*)$/;
+/** The words of an instruction in its list form, or null when it is in the shell form. */
+function listForm(body) {
+	try {
+		const parts = JSON.parse(body);
+		return Array.isArray(parts) ? parts.map(String) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* What a Dockerfile runs, as Docker reads it: the last stage's entrypoint with its command as the
+* arguments, unless the entrypoint is in the shell form, which ignores them. A health check's own
+* CMD is not it. Only arguments, starting with a dash, go to a program in the base image, which is
+* not here to name, so they are no command at all.
+*/
+function dockerCommand(dockerfile) {
+	const lines = dockerfile.replace(/\\\r?\n/g, " ").split(/\r?\n/).map((l) => l.trim());
+	const stage = lines.slice(lines.findLastIndex((l) => /^FROM\s/i.test(l)) + 1);
+	const last = (word) => stage.findLast((l) => new RegExp(`^${word}\\s`, "i").test(l))?.slice(word.length).trim();
+	const entrypoint = last("ENTRYPOINT");
+	if (entrypoint && !listForm(entrypoint)) return entrypoint;
+	const full = [entrypoint, last("CMD")].filter((body) => body !== void 0).map((body) => listForm(body)?.join(" ") ?? body).join(" ");
+	return full && !full.startsWith("-") ? full : null;
+}
 async function startCandidates(look, project) {
 	const files = new Set(project.files.map((f) => f.path));
 	const read = (file) => readFile(join(look.root, file), "utf8").catch(() => null);
@@ -5648,19 +5682,12 @@ async function startCandidates(look, project) {
 			from: `the main block at ${file.path}:${(main + 1).toString()}`
 		});
 	}
-	const cmd = (await read("Dockerfile"))?.split("\n").reverse().find((l) => /^\s*(CMD|ENTRYPOINT)\s/i.test(l));
-	if (cmd) {
-		const body = cmd.replace(/^\s*(CMD|ENTRYPOINT)\s+/i, "").trim();
-		let command = body;
-		try {
-			const parts = JSON.parse(body);
-			if (Array.isArray(parts)) command = parts.map(String).join(" ");
-		} catch {}
-		if (command) found.push({
-			command,
-			from: "the Dockerfile's command"
-		});
-	}
+	const dockerfile = await read("Dockerfile");
+	const command = dockerfile ? dockerCommand(dockerfile) : null;
+	if (command) found.push({
+		command,
+		from: "the Dockerfile's command"
+	});
 	for (const name of [
 		"README.md",
 		"readme.md",
@@ -6395,15 +6422,36 @@ var LIMITS = {
 	maxFileBytes: 1e6
 };
 var CODE_TOOLS = ["grep", "read"];
-/** Every file in the repository the tools could see, skipping what the scan never walks. */
+var NOT_OPENED = "the scan never opens that folder";
+/** Whether the scan opens a folder at all: no part of its path is one it never walks. */
+var opensFolder = (dir) => !dir.split("/").some((part) => SKIPPED.has(part.toLowerCase()));
+/**
+* Every file in the repository the tools could see, and so what --explain counts. All of it by hand
+* rather than by glob, whose `*` leaves out names starting with a dot, which is where settings files
+* are. A link is not a file here: it could lead outside the repository. ADR 0093.
+*/
 async function repositoryFiles(root, pattern = "**/*", most = 5e3) {
 	const found = [];
+	if (pattern === "**/*") {
+		const walk = async (dir) => {
+			const entries = await readdir(join(root, dir), { withFileTypes: true }).catch(() => []);
+			for (const entry of entries) {
+				if (found.length >= most) return;
+				const path = posix.join(dir, entry.name);
+				if (entry.isFile()) found.push(path);
+				else if (entry.isDirectory() && opensFolder(entry.name)) await walk(path);
+			}
+		};
+		await walk("");
+		return found.sort();
+	}
 	for await (const entry of glob(pattern, {
 		cwd: root,
 		exclude: (name) => SKIPPED.has(String(name).split(/[\\/]/).at(-1) ?? "")
 	})) {
 		const path = String(entry).split("\\").join("/");
-		if ((await stat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
+		if (!opensFolder(posix.dirname(path))) continue;
+		if ((await lstat(join(root, path)).catch(() => null))?.isFile()) found.push(path);
 		if (found.length >= most) break;
 	}
 	return found.sort();
@@ -6419,6 +6467,7 @@ function createTools(input) {
 			const dir = String(args.dir ?? ".");
 			const inRepo = await insideRepository(root, dir);
 			if (inRepo === null) return refused(dir, "it is not a folder in this repository");
+			if (!opensFolder(inRepo)) return refused(inRepo, NOT_OPENED);
 			const entries = await readdir(join(root, inRepo), { withFileTypes: true }).catch(() => null);
 			if (!entries) return refused(dir, "it is not a folder in this repository");
 			return {
@@ -6463,6 +6512,7 @@ function createTools(input) {
 			if (inRepo === null) return refused(path, "it is not a file in this repository");
 			const why = neverRead(inRepo);
 			if (why) return refused(inRepo, why);
+			if (!opensFolder(posix.dirname(inRepo))) return refused(inRepo, NOT_OPENED);
 			if ((await stat(join(root, inRepo))).size > LIMITS.maxFileBytes) return refused(inRepo, "it is over 1 MB");
 			const all = (await readFile(join(root, inRepo), "utf8")).split(/\r?\n/);
 			const from = Math.max(1, Number(args.from ?? (args.to === void 0 ? 1 : args.to - LIMITS.readLines + 1)));
@@ -22103,6 +22153,7 @@ async function scanCommand(dir, options) {
 		say(`\nNever sent, whatever is asked (${neverSent.length.toString()}):`);
 		for (const n of neverSent) say(`  ${n.path}, because ${n.why}`);
 		if (neverSent.length === 0) say("  nothing here matches");
+		say("\nThe scan never opens folders such as .git, node_modules and tests, so nothing in them is listed or read.");
 		say(`\nWhat was actually sent on earlier runs is in .modelos-secure/sent.jsonl.`);
 		return;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelos-secure",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Tests AI systems for Security, Safety and Quality. One command connects a system from its code.",
   "license": "UNLICENSED",
   "repository": {