muaddib-scanner 2.11.52 → 2.11.57

package/src/sandbox/index.js

@@ -21,6 +21,7 @@ const { parseGvisorLogs, cleanupGvisorLogs } = require('./gvisor-parser.js');
 const DOCKER_IMAGE = 'muaddib-sandbox';
 const CONTAINER_TIMEOUT = 120000; // 120 seconds
 const SINGLE_RUN_TIMEOUT = 90000; // 90 seconds per run in multi-run mode (gVisor ~30% I/O overhead)
+const WATCHDOG_GRACE_MS = 15000; // grace after a kill before force-resolving INCONCLUSIVE (anti-hang)
 
 // ── Sandbox concurrency limiter ──
 // Prevents Docker container saturation under load (main-path T1a/T1b/T2).
@@ -71,6 +72,47 @@ function getSandboxSemaphore() {
   return _sandboxSemaphore;
 }
 
+// ── Live container registry (OOM leak fix) ──
+// Tracks the docker container name of every in-flight sandbox run. Bounded by
+// SANDBOX_CONCURRENCY_MAX + the deferred slot, so it stays tiny. Lets the daemon's
+// memory circuit breaker force-reap orphaned containers under EMERGENCY pressure —
+// gVisor (runsc) sandboxes can survive a normal `docker kill`, and a wedged one is
+// the dominant off-heap leak. Truncating the in-memory queue does nothing for them.
+const _liveContainers = new Set();
+
+/**
+ * Force-remove every tracked sandbox container (best-effort). Returns the count
+ * a removal was attempted for. Called by daemon.js handleMemoryPressure() at
+ * EMERGENCY level.
+ */
+function killAllSandboxContainers() {
+  const names = Array.from(_liveContainers);
+  for (const name of names) {
+    try { execFileSync('docker', ['rm', '-f', name], { stdio: 'pipe', timeout: 5000 }); } catch { /* already gone */ }
+    _liveContainers.delete(name);
+  }
+  if (names.length > 0) {
+    console.log(`[SANDBOX] killAllSandboxContainers: force-removed ${names.length} orphan container(s)`);
+  }
+  return names.length;
+}
+
+/**
+ * Standard INCONCLUSIVE sandbox result (score -1). A timed-out / aborted / killed
+ * run MUST map to INCONCLUSIVE — never to CLEAN — so a package that deliberately
+ * hangs to evade analysis is not relabelled benign downstream.
+ */
+function inconclusiveResult(detail, evidence) {
+  return {
+    score: -1,
+    severity: 'INCONCLUSIVE',
+    findings: [{ type: 'timeout', severity: 'MEDIUM', detail, evidence: evidence || detail }],
+    raw_report: null,
+    suspicious: false,
+    inconclusive: true
+  };
+}
+
 // Time offsets for multi-run sandbox execution (ms)
 const TIME_OFFSETS = [
   { offset: 0, label: 'immediate' },
@@ -200,6 +242,115 @@ async function buildSandboxImage() {
   });
 }
 
+// ── Docker run argument construction ──
+
+// Build the `docker run` argument vector for a single sandbox execution. Pure: given the run
+// options it returns a string[] with no side effects (the canary helpers it calls are themselves
+// pure), so the isolation flags, the anti-detection hostname, the canary env injection, the gVisor
+// runtime, and the libfaketime/time-offset wiring are all behaviorally testable without spawning
+// Docker. Callers compute containerName + fakeHostname (the kill-ladder needs the former) and pass
+// them in. KEEP IN SYNC with sandbox-runner.sh (caps, tmpfs, env contract).
+function buildDockerArgs(opts = {}) {
+  const {
+    strict = false, canaryTokens = null, timeOffset = 0, gvisorMode = false,
+    containerName, fakeHostname, local = false, localAbsPath = null, packageName, mode
+  } = opts;
+
+  const dockerArgs = [
+    'run',
+    '--rm',
+    `--name=${containerName}`,
+    `--hostname=${fakeHostname}`,
+    '--network=bridge',
+    '--memory=512m',
+    '--cpus=1',
+    '--pids-limit=100',
+    '--cap-drop=ALL'
+  ];
+
+  // gVisor runtime: use runsc instead of default runc.
+  // Performance: configure --directfs and --overlay2=all:memory in daemon.json:
+  //   "runsc": { "path": "/usr/bin/runsc", "runtimeArgs": ["--directfs", "--overlay2=all:memory"] }
+  // --directfs: bypass gofer process for direct filesystem access (fewer RPCs, faster I/O)
+  // --overlay2=all:memory: sandbox writes go to tmpfs instead of host (faster, isolated)
+  // These flags require gVisor >= 2023-06-01.
+  if (gvisorMode) {
+    dockerArgs.push('--runtime=runsc');
+    dockerArgs.push('-e', 'MUADDIB_GVISOR=1');
+  }
+
+  // Inject canary tokens as environment variables
+  if (canaryTokens) {
+    for (const [key, value] of Object.entries(canaryTokens)) {
+      dockerArgs.push('-e', `${key}=${value}`);
+    }
+    // Also inject canary file contents as env vars for the entrypoint to write
+    dockerArgs.push('-e', `CANARY_ENV_CONTENT=${createCanaryEnvFile(canaryTokens).replace(/\r?\n/g, '\\n')}`);
+    dockerArgs.push('-e', `CANARY_NPMRC_CONTENT=${createCanaryNpmrc(canaryTokens).replace(/\r?\n/g, '\\n')}`);
+    dockerArgs.push('-e', `CANARY_AWS_CONTENT=${createCanaryAwsCredentials(canaryTokens).replace(/\r?\n/g, '\\n')}`);
+    dockerArgs.push('-e', `CANARY_SSH_KEY=${createCanarySshKey().replace(/\r?\n/g, '\\n')}`);
+    dockerArgs.push('-e', `CANARY_GITCONFIG=${createCanaryGitconfig().replace(/\r?\n/g, '\\n')}`);
+  }
+
+  // Inject time offset — libfaketime-aware (v2.10.7)
+  // Run 1 (offset=0): no libfaketime, preload.js handles JS-level only
+  // Runs 2+ (offset>0): libfaketime handles C-level time shift for ALL processes
+  //   (Node, Python, bash), preload.js TIME_OFFSET=0 to avoid double acceleration
+  const useFaketime = timeOffset > 0;
+  dockerArgs.push('-e', `NODE_TIMING_OFFSET=${useFaketime ? 0 : timeOffset}`);
+
+  if (useFaketime) {
+    const hours = Math.floor(timeOffset / 3600000);
+    const faketimeStr = hours >= 24
+      ? `+${Math.floor(hours / 24)}d x1000`
+      : `+${hours}h x1000`;
+    dockerArgs.push('-e', `MUADDIB_FAKETIME=${faketimeStr}`);
+    dockerArgs.push('-e', 'MUADDIB_FAKETIME_ACTIVE=1');
+  }
+
+  // Both modes need NET_RAW for tcpdump (runs as root in entrypoint).
+  // gVisor mode: no tcpdump needed — gVisor captures via --strace/--log-packets.
+  // Strict mode also needs NET_ADMIN for iptables network blocking.
+  // SYS_PTRACE is not needed: strace traces its own child (npm install via su).
+  // SETUID + SETGID required for su (privilege drop to sandboxuser).
+  // CHOWN required for chown in sandbox-runner.sh.
+  if (!gvisorMode) {
+    dockerArgs.push('--cap-add=NET_RAW');
+  }
+  dockerArgs.push('--cap-add=SETUID');
+  dockerArgs.push('--cap-add=SETGID');
+  dockerArgs.push('--cap-add=CHOWN');
+  if (strict) {
+    dockerArgs.push('--cap-add=NET_ADMIN');
+  }
+
+  dockerArgs.push('--tmpfs', '/tmp:rw,nosuid,size=64m');
+  dockerArgs.push('--tmpfs', '/sandbox/install:rw,nosuid,size=256m');
+  dockerArgs.push('--tmpfs', '/home/sandboxuser:rw,noexec,nosuid,size=16m');
+  dockerArgs.push('--read-only');
+
+  // /proc/uptime evasion (T1497.003) handled by preload.js monkey-patching
+  // (process.uptime, Date.now, performance.now, process.hrtime)
+
+  dockerArgs.push('--security-opt', 'no-new-privileges');
+
+  if (local && localAbsPath) {
+    dockerArgs.push('-v', `${localAbsPath}:/sandbox/local-pkg:ro`);
+  }
+
+  dockerArgs.push(DOCKER_IMAGE);
+  dockerArgs.push(local ? '/sandbox/local-pkg' : packageName);
+  dockerArgs.push(mode);
+
+  return dockerArgs;
+}
+
+// Realistic hostname to evade sandbox detection (T1497.001). The default Docker hostname is a
+// 12-char hex hash — trivially fingerprinted; we use a dev-laptop-XXXX shape with random hex.
+function generateFakeHostname() {
+  return `dev-laptop-${crypto.randomBytes(2).toString('hex')}`;
+}
+
 // ── Run single sandbox execution ──
 
 async function runSingleSandbox(packageName, options = {}) {
@@ -214,122 +365,77 @@ async function runSingleSandbox(packageName, options = {}) {
   const timeOffset = options.timeOffset || 0;
   const runTimeout = options.runTimeout || CONTAINER_TIMEOUT;
   const gvisorMode = options.gvisor || false;
+  const signal = options.signal || null;
 
-  return new Promise((resolve) => {
+  return new Promise((_resolve) => {
     let stdout = '';
     let stderr = '';
     let timedOut = false;
+    let settled = false;
+    let timer = null;
+    let forceTimer = null;
     const containerName = `npm-audit-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
 
-    // Realistic hostname to evade sandbox detection (T1497.001)
-    // Default Docker hostname is a 12-char hex hash — easily fingerprinted.
-    const fakeHostname = `dev-laptop-${crypto.randomBytes(2).toString('hex')}`;
-
-    const dockerArgs = [
-      'run',
-      '--rm',
-      `--name=${containerName}`,
-      `--hostname=${fakeHostname}`,
-      '--network=bridge',
-      '--memory=512m',
-      '--cpus=1',
-      '--pids-limit=100',
-      '--cap-drop=ALL'
-    ];
-
-    // gVisor runtime: use runsc instead of default runc.
-    // Performance: configure --directfs and --overlay2=all:memory in daemon.json:
-    //   "runsc": { "path": "/usr/bin/runsc", "runtimeArgs": ["--directfs", "--overlay2=all:memory"] }
-    // --directfs: bypass gofer process for direct filesystem access (fewer RPCs, faster I/O)
-    // --overlay2=all:memory: sandbox writes go to tmpfs instead of host (faster, isolated)
-    // These flags require gVisor >= 2023-06-01.
-    if (gvisorMode) {
-      dockerArgs.push('--runtime=runsc');
-      dockerArgs.push('-e', 'MUADDIB_GVISOR=1');
-    }
-
-    // Inject canary tokens as environment variables
-    if (canaryTokens) {
-      for (const [key, value] of Object.entries(canaryTokens)) {
-        dockerArgs.push('-e', `${key}=${value}`);
+    // Single-settle wrapper: every resolve(...) below routes through this, so
+    // cleanup (timers, abort listener, live-container registry) runs exactly once
+    // no matter which path finishes the run.
+    const resolve = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (forceTimer) clearTimeout(forceTimer);
+      if (signal) { try { signal.removeEventListener('abort', onAbort); } catch { /* not added */ } }
+      _liveContainers.delete(containerName);
+      _resolve(result);
+    };
+
+    // `docker kill` alone leaves the container record, and under gVisor the runsc
+    // sandbox can survive it — rm -f reaps both. --rm makes this a no-op on clean exit.
+    const killContainer = () => {
+      try { execFileSync('docker', ['kill', containerName], { stdio: 'pipe', timeout: 5000 }); } catch { /* may be gone */ }
+      try { execFileSync('docker', ['rm', '-f', containerName], { stdio: 'pipe', timeout: 5000 }); } catch { /* already removed */ }
+    };
+
+    // Kill + arm a watchdog that force-resolves INCONCLUSIVE if the docker client
+    // never emits 'close' after the kill (wedged runsc gofer / stdio held open by a
+    // grandchild — the multi-hour hang that leaked slots and off-heap memory).
+    const triggerKill = (reason) => {
+      if (settled) return;
+      timedOut = true;
+      console.log(`[SANDBOX] ${reason} — killing container ${containerName}...`);
+      try { killContainer(); } catch { /* best-effort */ }
+      if (!forceTimer) {
+        forceTimer = setTimeout(() => {
+          if (settled) return;
+          console.error(`[SANDBOX] Container ${containerName} did not exit after kill — force-resolving INCONCLUSIVE`);
+          try { proc.kill('SIGKILL'); } catch { /* already dead */ }
+          resolve(inconclusiveResult(`Killed (${reason}) but process did not exit within grace`));
+        }, WATCHDOG_GRACE_MS);
       }
-      // Also inject canary file contents as env vars for the entrypoint to write
-      dockerArgs.push('-e', `CANARY_ENV_CONTENT=${createCanaryEnvFile(canaryTokens).replace(/\r?\n/g, '\\n')}`);
-      dockerArgs.push('-e', `CANARY_NPMRC_CONTENT=${createCanaryNpmrc(canaryTokens).replace(/\r?\n/g, '\\n')}`);
-      dockerArgs.push('-e', `CANARY_AWS_CONTENT=${createCanaryAwsCredentials(canaryTokens).replace(/\r?\n/g, '\\n')}`);
-      dockerArgs.push('-e', `CANARY_SSH_KEY=${createCanarySshKey().replace(/\r?\n/g, '\\n')}`);
-      dockerArgs.push('-e', `CANARY_GITCONFIG=${createCanaryGitconfig().replace(/\r?\n/g, '\\n')}`);
-    }
+    };
 
-    // Inject time offset — libfaketime-aware (v2.10.7)
-    // Run 1 (offset=0): no libfaketime, preload.js handles JS-level only
-    // Runs 2+ (offset>0): libfaketime handles C-level time shift for ALL processes
-    //   (Node, Python, bash), preload.js TIME_OFFSET=0 to avoid double acceleration
-    const useFaketime = timeOffset > 0;
-    dockerArgs.push('-e', `NODE_TIMING_OFFSET=${useFaketime ? 0 : timeOffset}`);
-
-    if (useFaketime) {
-      const hours = Math.floor(timeOffset / 3600000);
-      const faketimeStr = hours >= 24
-        ? `+${Math.floor(hours / 24)}d x1000`
-        : `+${hours}h x1000`;
-      dockerArgs.push('-e', `MUADDIB_FAKETIME=${faketimeStr}`);
-      dockerArgs.push('-e', 'MUADDIB_FAKETIME_ACTIVE=1');
-    }
+    const onAbort = () => triggerKill('Aborted by signal');
 
-    // Both modes need NET_RAW for tcpdump (runs as root in entrypoint).
-    // gVisor mode: no tcpdump needed — gVisor captures via --strace/--log-packets.
-    // Strict mode also needs NET_ADMIN for iptables network blocking.
-    // SYS_PTRACE is not needed: strace traces its own child (npm install via su).
-    // SETUID + SETGID required for su (privilege drop to sandboxuser).
-    // CHOWN required for chown in sandbox-runner.sh.
-    if (!gvisorMode) {
-      dockerArgs.push('--cap-add=NET_RAW');
-    }
-    dockerArgs.push('--cap-add=SETUID');
-    dockerArgs.push('--cap-add=SETGID');
-    dockerArgs.push('--cap-add=CHOWN');
-    if (strict) {
-      dockerArgs.push('--cap-add=NET_ADMIN');
+    // Early abort: signal already tripped before we spawned anything.
+    if (signal && signal.aborted) {
+      resolve(inconclusiveResult('Aborted before launch'));
+      return;
     }
 
-    dockerArgs.push('--tmpfs', '/tmp:rw,nosuid,size=64m');
-    dockerArgs.push('--tmpfs', '/sandbox/install:rw,nosuid,size=256m');
-    dockerArgs.push('--tmpfs', '/home/sandboxuser:rw,noexec,nosuid,size=16m');
-    dockerArgs.push('--read-only');
-
-    // /proc/uptime evasion (T1497.003) handled by preload.js monkey-patching
-    // (process.uptime, Date.now, performance.now, process.hrtime)
+    const fakeHostname = generateFakeHostname();
 
-    dockerArgs.push('--security-opt', 'no-new-privileges');
-
-    if (local && localAbsPath) {
-      dockerArgs.push('-v', `${localAbsPath}:/sandbox/local-pkg:ro`);
-    }
-
-    dockerArgs.push(DOCKER_IMAGE);
-    dockerArgs.push(local ? '/sandbox/local-pkg' : packageName);
-    dockerArgs.push(mode);
+    const dockerArgs = buildDockerArgs({
+      strict, canaryTokens, timeOffset, gvisorMode,
+      containerName, fakeHostname, local, localAbsPath, packageName, mode
+    });
 
     const proc = spawn('docker', dockerArgs);
+    _liveContainers.add(containerName);
+    if (signal) signal.addEventListener('abort', onAbort, { once: true });
     let gvisorContainerId = null;
 
-    // Timeout: kill container
-    const timer = setTimeout(() => {
-      timedOut = true;
-      console.log(`[SANDBOX] Timeout (${runTimeout / 1000}s). Killing container ${containerName}...`);
-      try {
-        execFileSync('docker', ['kill', containerName], { stdio: 'pipe', timeout: 5000 });
-      } catch {
-        // docker kill failed (container in intermediate state) — force remove
-        try {
-          execFileSync('docker', ['rm', '-f', containerName], { stdio: 'pipe', timeout: 5000 });
-        } catch {
-          // Last resort: kill the docker client process (container may survive as orphan)
-          proc.kill('SIGKILL');
-        }
-      }
-    }, runTimeout);
+    // Timeout: kill container + arm anti-hang watchdog (see triggerKill).
+    timer = setTimeout(() => triggerKill(`Timeout (${runTimeout / 1000}s)`), runTimeout);
 
     proc.stdout.on('data', (data) => {
       stdout += data.toString();
@@ -348,6 +454,7 @@ async function runSingleSandbox(packageName, options = {}) {
       }
 
       // Forward sandbox progress logs (sanitize ANSI escape sequences)
+      // eslint-disable-next-line no-control-regex -- ESC control byte required to match ANSI sequences
       const text = data.toString().replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '');
       for (const line of text.split(/\r?\n/)) {
         if (line.includes('[SANDBOX]')) {
@@ -491,8 +598,6 @@ async function runSingleSandbox(packageName, options = {}) {
           findings.push(finding);
         }
         // Add preload score (capped at 100 with the rest)
-        const combinedScore = Math.min(100, score + preloadResult.score);
-        // We'll use combinedScore below instead of score
         report._preloadScore = preloadResult.score;
       }
 
@@ -663,6 +768,10 @@ async function runSandbox(packageName, options = {}) {
     let bestResult = cleanResult;
 
     for (let i = 0; i < effectiveRuns; i++) {
+      if (options.signal && options.signal.aborted) {
+        console.log(`[SANDBOX] Aborted — stopping before run ${i + 1}/${effectiveRuns}`);
+        break;
+      }
       const { offset, label } = TIME_OFFSETS[i];
       console.log(`[SANDBOX] Run ${i + 1}/${TIME_OFFSETS.length} (${label})...`);
 
@@ -674,7 +783,8 @@ async function runSandbox(packageName, options = {}) {
         displayName,
         timeOffset: offset,
         runTimeout: SINGLE_RUN_TIMEOUT,
-        gvisor: useGvisor
+        gvisor: useGvisor,
+        signal: options.signal || null
       });
 
       allRuns.push({
@@ -716,6 +826,11 @@ async function runSandbox(packageName, options = {}) {
       };
     }
 
+    // Aborted before any run could conclude → INCONCLUSIVE, never CLEAN.
+    if (options.signal && options.signal.aborted && bestResult.score <= 0) {
+      bestResult = inconclusiveResult('Sandbox aborted before completing a run');
+    }
+
     // Attach multi-run metadata
     bestResult.all_runs = allRuns;
 
@@ -1060,4 +1175,4 @@ function displayResults(result) {
   }
 }
 
-module.exports = { buildSandboxImage, runSandbox, runSingleSandbox, scoreFindings, generateNetworkReport, EXFIL_PATTERNS, SAFE_DOMAINS, getSeverity, displayResults, isDockerAvailable, imageExists, isGvisorAvailable, STATIC_CANARY_TOKENS, detectStaticCanaryExfiltration, analyzePreloadLog, TIME_OFFSETS, SAFE_SANDBOX_CMDS, SANDBOX_CONCURRENCY_MAX, acquireSandboxSlot, tryAcquireSandboxSlot, releaseSandboxSlot, resetSandboxLimiter, getSandboxSemaphore };
+module.exports = { buildSandboxImage, runSandbox, runSingleSandbox, buildDockerArgs, generateFakeHostname, scoreFindings, generateNetworkReport, EXFIL_PATTERNS, SAFE_DOMAINS, getSeverity, displayResults, isDockerAvailable, imageExists, isGvisorAvailable, STATIC_CANARY_TOKENS, detectStaticCanaryExfiltration, analyzePreloadLog, TIME_OFFSETS, SAFE_SANDBOX_CMDS, SANDBOX_CONCURRENCY_MAX, acquireSandboxSlot, tryAcquireSandboxSlot, releaseSandboxSlot, resetSandboxLimiter, getSandboxSemaphore, killAllSandboxContainers };

package/src/scanner/ai-config.js

@@ -43,13 +43,31 @@ const AI_CONFIG_FILES = [
 // These are distinct from AI_CONFIG_FILES: they contain machine-readable hooks
 // that execute code on project open, not human-readable prompt injection.
 // Technique: Shai-Hulud (TeamPCP, May 2026) — .claude/settings.json SessionStart hook.
+// Additional mai 2026 surfaces (Cursor / Windsurf / Continue / root Claude Desktop)
+// added after the TrapDoor + Bitwarden CLI campaigns confirmed cross-agent targeting.
 const IDE_HOOK_FILES = [
   '.claude/settings.json',
   '.claude/settings.local.json',
   '.vscode/tasks.json',
-  '.kiro/settings/mcp.json'
+  '.kiro/settings/mcp.json',
+  '.cursor/mcp.json',
+  '.continue/config.json',
+  '.windsurf/mcp.json',
+  'mcp.json',
+  'claude_desktop_config.json'
 ];
 
+// Paths that follow the standard MCP `mcpServers.{name}.command` schema.
+// A package shipping any of these with a `command` entry is hostile: legitimate
+// npm/PyPI packages never ship per-user MCP configurations.
+const MCP_STANDARD_PATHS = new Set([
+  '.kiro/settings/mcp.json',
+  '.cursor/mcp.json',
+  '.windsurf/mcp.json',
+  'mcp.json',
+  'claude_desktop_config.json'
+]);
+
 // Dangerous shell command patterns in AI config files
 const SHELL_COMMAND_PATTERNS = [
   // Download and execute
@@ -120,7 +138,7 @@ function scanAIConfig(targetPath) {
 
     const relPath = configFile;
     // Normalize invisible Unicode BEFORE running regex patterns.
-    // Without this, an attacker can split keywords with U+200B (`cu​rl`) to
+    // Without this, an attacker can split keywords with U+200B (`cu<ZWSP>rl`) to
     // evade /curl\s+/ — the exact TrapDoor (mai 2026) .cursorrules vector.
     const invisibleCount = countInvisibleUnicode(content);
     const normalized = invisibleCount > 0 ? stripInvisibleUnicode(content) : content;
@@ -209,9 +227,46 @@ function analyzeIDEHookFile(content, relPath) {
     }
   }
 
-  // .kiro/settings/mcp.json
+  // Standard MCP config family:
+  //   .kiro/settings/mcp.json | .cursor/mcp.json | .windsurf/mcp.json
+  //   | root mcp.json (Claude Desktop project mode)
+  //   | root claude_desktop_config.json (Claude Desktop global, hostile if shipped)
   // Structure: { mcpServers: { name: { command, args } } }
-  if (relPath.includes('.kiro/') && relPath.endsWith('mcp.json')) {
+  if (MCP_STANDARD_PATHS.has(relPath)) {
+    const mcpServers = parsed.mcpServers;
+    if (mcpServers && typeof mcpServers === 'object') {
+      for (const [name, config] of Object.entries(mcpServers)) {
+        if (config && typeof config === 'object' && config.command) {
+          threats.push({
+            type: 'ide_hook_autoexec',
+            severity: 'CRITICAL',
+            message: `IDE auto-exec hook: ${relPath} server "${name}" executes "${config.command}" on project open`,
+            file: relPath
+          });
+        }
+      }
+    }
+  }
+
+  // .continue/config.json — Continue.dev schema. Two MCP surfaces:
+  //   1. experimental.modelContextProtocolServers[].transport.command (canonical)
+  //   2. mcpServers.{name}.command (newer alias)
+  if (relPath === '.continue/config.json') {
+    const exp = parsed.experimental;
+    const mcps = exp && Array.isArray(exp.modelContextProtocolServers)
+      ? exp.modelContextProtocolServers
+      : [];
+    for (const srv of mcps) {
+      const cmd = srv && srv.transport && srv.transport.command;
+      if (cmd) {
+        threats.push({
+          type: 'ide_hook_autoexec',
+          severity: 'CRITICAL',
+          message: `IDE auto-exec hook: .continue/config.json modelContextProtocolServer transport executes "${cmd}" on project open`,
+          file: relPath
+        });
+      }
+    }
     const mcpServers = parsed.mcpServers;
     if (mcpServers && typeof mcpServers === 'object') {
       for (const [name, config] of Object.entries(mcpServers)) {
@@ -219,7 +274,7 @@ function analyzeIDEHookFile(content, relPath) {
           threats.push({
             type: 'ide_hook_autoexec',
             severity: 'CRITICAL',
-            message: `IDE auto-exec hook: .kiro/settings/mcp.json server "${name}" executes "${config.command}" on project open`,
+            message: `IDE auto-exec hook: .continue/config.json mcpServers "${name}" executes "${config.command}" on project open`,
             file: relPath
           });
         }

package/src/scanner/ast-detectors/constants.js

@@ -136,6 +136,17 @@ const SENSITIVE_AI_CONFIG_FILES_UNIQUE = [
   'claude.md', 'claude_desktop_config.json',
   'mcp.json',
   '.cursorrules', '.windsurfrules',
+  'copilot-instructions.md',
+  'agents.md', 'agent.md'
+];
+
+// Agent prompt files that live at any directory level — written by TrapDoor-style
+// post-install hooks to the user's home or cwd. Detected via a "standalone" branch
+// that does NOT require an MCP_CONFIG_PATHS dir prefix (otherwise homedir + .cursorrules
+// slips through because '.cursorrules'.includes('.cursor/') is false).
+const AGENT_PROMPT_FILENAMES = [
+  '.cursorrules', '.windsurfrules',
+  'claude.md', 'agents.md', 'agent.md',
   'copilot-instructions.md'
 ];
 const SENSITIVE_AI_CONFIG_FILES_ROOT_ONLY = [
@@ -256,6 +267,7 @@ module.exports = {
   NODE_HOOKABLE_CLASSES,
   MCP_CONFIG_PATHS,
   MCP_CONTENT_PATTERNS,
+  AGENT_PROMPT_FILENAMES,
   SENSITIVE_AI_CONFIG_FILES_UNIQUE,
   SENSITIVE_AI_CONFIG_FILES_ROOT_ONLY,
   GIT_HOOKS,

package/src/scanner/ast-detectors/handle-assignment-expression.js

@@ -8,7 +8,6 @@ const {
   NODE_HOOKABLE_CLASSES
 } = require('./constants.js');
 const {
-  extractStringValue,
   resolveStringConcat,
   extractStringValueDeep
 } = require('./helpers.js');