tewip-ai 0.74.0 → 0.75.0

package/README.md

@@ -1244,6 +1244,14 @@ offline, in CI, before anything runs.
   text the agent did not write can tell it to read the private thing and post it somewhere, and
   every step is a tool it was given on purpose. A system prompt is not a defence, because whoever
   writes the untrusted text writes the other half of the prompt. Tewip names the tools in each leg.
+- **Text somebody else wrote, glued into a prompt.** The trifecta above is an argument about what
+  *could* happen, from the tool list. This is what the code does: a value off a web page, a ticket,
+  an inbox or a retriever, written **into** the prompt string rather than passed beside it. A prompt
+  has no parameter binding to fall back on, so once the text is in the string the model cannot tell
+  your instruction from theirs. Reported apart when the same function also hands the model tools,
+  because that is the difference between a wrong answer and a tool call somebody else chose. On
+  1,691 files of real agent code: **zero findings**, which is the precision claim; recall is
+  measured against planted examples and said to be.
 - **What stands in the way**: a human approval gate, a dry run, a step budget, a tool allow-list -
   and says plainly when nothing anywhere in the project has one. A ceiling written as
   `max_iterations=None` is reported apart from no ceiling at all, because it reads as deliberate.

package/dist/engine/agent/agent-command.js

@@ -3,6 +3,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { relative } from 'node:path';
 import { scanSourceFiles } from '../walk.js';
 import { CAPABILITY_MEANS, FRAMEWORKS_READ, IRREVERSIBLE, toolsIn, trifectaIn } from './tools.js';
+import { promptFlows } from './prompt-flow.js';
 import { budgetSetToNothing, guardsIn, GUARD_MEANS, GUARD_PREVENTS } from './guards.js';
 const NL = String.fromCharCode(10);
 const AGENT_FILE = /\.(?:py|[cm]?[jt]sx?)$/i;
@@ -22,6 +23,7 @@ const NOT_SHIPPED = /(?:^|[\\/])(?:tests?|[\w-]+[_-]tests?|__tests__|spec|e2e|ex
 export function scanAgent(root) {
     const scan = scanSourceFiles(root, 20_000, (f) => AGENT_FILE.test(f));
     const tools = [];
+    const injections = [];
     const guards = [];
     let emptyBudget = null;
     let filesRead = 0;
@@ -38,6 +40,7 @@ export function scanAgent(root) {
         }
         filesRead += 1;
         tools.push(...toolsIn(where, text));
+        injections.push(...promptFlows(where, text));
         guards.push(...guardsIn(where, text));
         if (!emptyBudget) {
             const empty = budgetSetToNothing(text);
@@ -45,7 +48,7 @@ export function scanAgent(root) {
                 emptyBudget = { file: where, text: empty };
         }
     }
-    return { tools, guards, filesRead, emptyBudget };
+    return { tools, injections, guards, filesRead, emptyBudget };
 }
 const REACH_READS = {
     destructive: 'cannot be undone',
@@ -58,7 +61,7 @@ const REACH_READS = {
     'not-sure': '**not decided**',
 };
 export function renderAgent(scan, root) {
-    const { tools, guards, filesRead, emptyBudget } = scan;
+    const { tools, injections, guards, filesRead, emptyBudget } = scan;
     const lines = ['# What this agent is allowed to do', ''];
     if (tools.length === 0) {
         return [
@@ -109,6 +112,19 @@ export function renderAgent(scan, root) {
     if (undecided.length > 0) {
         lines.push('## The ones this could not decide about', '', 'Read these yourself. They are listed here rather than counted as harmless, which is the only', 'honest thing to do with a tool whose name does not say what it touches.', '', ...undecided.map((t) => `- \`${t.name}\`${t.description ? ` — "${t.description.slice(0, 90)}"` : ''} — ${t.file}:${t.line}`), '');
     }
+    if (injections.length > 0) {
+        const armed = injections.filter((i) => i.withTools);
+        lines.push('## Text somebody else wrote, glued into a prompt', '', armed.length > 0
+            ? `${injections.length} place(s), and ${armed.length} of them in a function that also hands the model tools. A prompt has no parameter binding: once the text is in the string, the model cannot tell your instruction from theirs.`
+            : `${injections.length} place(s). None is in a function that also hands the model tools, so the worst case here is a wrong answer rather than a tool call somebody else chose.`, '');
+        for (const i of injections.slice(0, 20)) {
+            lines.push(`- ${i.file}:${i.line} — ${i.origin}, in by ${i.through}${i.withTools ? ' — **and this function has tools**' : ''}`);
+            lines.push(`  \`${i.evidence}\``);
+        }
+        if (injections.length > 20)
+            lines.push(`…and ${injections.length - 20} more`);
+        lines.push('');
+    }
     lines.push('## The lethal trifecta', '');
     if (trifecta.complete) {
         lines.push('All three legs are present. Breaking any one of them breaks the attack:', '');
@@ -133,7 +149,7 @@ export function renderAgent(scan, root) {
     if (emptyBudget) {
         lines.push('### A ceiling that is written down and set to nothing', '', `\`${emptyBudget.text}\` in ${emptyBudget.file}. A budget removed this way reads as deliberate, and a check`, 'that only looked for the word would have called it a budget.', '');
     }
-    lines.push('## What this does not check', '', '- **Whether a gate that exists stands in front of these tools.** Finding `interrupt()` in a', '  project means somebody wrote one, not that the refund tool is behind it. That is a question', '  about the graph at run time, and reading the source does not answer it.', '- **Whether the agent is ever given these tools.** A tool can be defined and never passed to a', '  model. This lists what exists, not what is wired up.', '- **What the model will actually do with them.** No prompt was judged and nothing was run.', '- **Tools assembled at run time**, from a registry, a plugin folder or a config file.', '- **Frameworks not in the list above.** Silence about a framework is silence, not approval.', '', 'Every line here is re-derivable: run `tewip agent` in this directory and you get it back.', '');
+    lines.push('## What this does not check', '', '- **Whether a gate that exists stands in front of these tools.** Finding `interrupt()` in a', '  project means somebody wrote one, not that the refund tool is behind it. That is a question', '  about the graph at run time, and reading the source does not answer it.', '- **Whether the agent is ever given these tools.** A tool can be defined and never passed to a', '  model. This lists what exists, not what is wired up.', '- **What the model will actually do with them.** No prompt was judged and nothing was run.', '- **Untrusted text reaching a prompt through more than one step.** A value that passes through', '  two variables, another function or a different file is not followed, and is not reported.', '- **Tools assembled at run time**, from a registry, a plugin folder or a config file.', '- **Frameworks not in the list above.** Silence about a framework is silence, not approval.', '', 'Every line here is re-derivable: run `tewip agent` in this directory and you get it back.', '');
     return lines.join(NL);
 }
 const rank = (r) => (IRREVERSIBLE.includes(r) ? 0 : r === 'not-sure' ? 1 : r === 'writes' ? 2 : 3);

package/dist/engine/agent/prompt-flow.js

@@ -0,0 +1,145 @@
+// Text somebody else wrote, glued into a prompt, in a loop that holds tools.
+//
+// `tools.ts` answers this at the level of capability: does this agent have a tool that reads
+// untrusted text, a tool that reads private data, and a tool that sends data out. That is the
+// lethal trifecta and it is worth knowing. But it is an argument about what could happen.
+//
+// This is the same question one level down, about what the code actually does: is a value that
+// came off a web page, a ticket, an inbox or a retriever **glued into the prompt string itself**.
+// Glued, not passed beside it - the distinction that matters in SQL matters more here, because a
+// prompt has no parameter binding to fall back on. Once the text is in the prompt, the model cannot
+// tell the instruction you wrote from the instruction the attacker wrote, and no amount of "ignore
+// any instructions in the document below" changes that.
+//
+// The same refusal as the SQL checker next door: a source and a sink inside one function body,
+// directly or through one named variable. No call graph, no cross-file inference, no maybes. A
+// list of maybes gets switched off, and then somebody has written "we check for prompt injection"
+// on a form.
+import { gluedIn, sameBody } from '../taint/flow.js';
+const NL = String.fromCharCode(10);
+/**
+ * Where text somebody outside the building can write comes into an agent.
+ *
+ * Framework-specific on purpose, and short on purpose. Every entry here is a shape where the value
+ * is *text from elsewhere*, not a number or a flag: a fetched page, a retrieved document, the body
+ * of a ticket or a message. A general "anything from a function call" source would match the whole
+ * program and find nothing worth reading.
+ */
+const SOURCES = [
+    { re: String.raw `(?:requests|httpx|session)\s*\.\s*(?:get|post)\s*\([^)]*\)\s*\.\s*(?:text|content|json\(\))`, origin: 'a web page this agent fetched' },
+    { re: String.raw `(?:await\s+)?(?:fetch|axios\s*\.\s*get)\s*\([^)]*\)[^;\n]*?\.\s*(?:text|json|data)\s*\(?\)?`, origin: 'a web page this agent fetched' },
+    { re: String.raw `\w*(?:page|html|soup|article|scraped?)\w*\s*\.\s*(?:content|text|get_text|inner_text|innerText)\s*\(?\)?`, origin: 'a web page this agent fetched' },
+    { re: String.raw `\w*(?:retriever|vectorstore|index|store)\w*\s*\.\s*(?:invoke|search|similarity_search|get_relevant_documents|query)\s*\([^)]*\)`, origin: 'a document this agent retrieved' },
+    { re: String.raw `\w*(?:doc|document|chunk|result|passage)\w*\s*\.\s*(?:page_content|pageContent|text)\b`, origin: 'a document this agent retrieved' },
+    { re: String.raw `\w*(?:issue|ticket|comment|review|pr|pull_request)\w*\s*\.\s*(?:body|description|text)\b`, origin: 'a ticket or comment somebody else wrote' },
+    { re: String.raw `\w*(?:email|mail|message|msg)\w*\s*\.\s*(?:body|payload|text|content|get_payload\(\))`, origin: 'a message this agent received' },
+    { re: String.raw `\w*(?:tool_result|toolResult|observation|tool_output)\w*\b`, origin: 'the output of another tool' },
+];
+/** Where a prompt is built or sent. */
+const PROMPT = /\b(?:messages|prompt|system|instructions|user_message|userMessage|input|content|template)\s*[:=]|\b(?:SystemMessage|HumanMessage|ChatPromptTemplate|PromptTemplate)\s*(?:\.\s*from_\w+\s*)?\(|\.\s*(?:invoke|complete|create|generate|run|predict|chat)\s*\(/g;
+/** The same body also handing the model tools - which is what turns exposure into reach. */
+// `[:=,})]` and not just `[:=]`: `client.create({ tools, messages })` is the shorthand both the
+// Anthropic and Vercel SDKs are written in, and `tools` there is followed by a comma. Missing it
+// reported the commonest shape in JavaScript as a prompt with no tools behind it, which is exactly
+// the difference between exposure and reach.
+const TOOLS_HERE = /\btools\b\s*[:=,})]|\btool_choice\s*[:=]|\bbind_tools\s*\(|\.\s*with_tools\s*\(|\bToolNode\s*\(/;
+/** The statement a line sits in, which is the string a value is or is not glued into. */
+function statementAt(text, at) {
+    let start = at;
+    let depth = 0;
+    // Walk back to the start of the expression: a line break at bracket depth zero.
+    for (let i = at; i > 0 && at - i < 2000; i -= 1) {
+        const ch = text[i];
+        if (ch === ')' || ch === ']' || ch === '}')
+            depth += 1;
+        else if (ch === '(' || ch === '[' || ch === '{') {
+            if (depth === 0)
+                break;
+            depth -= 1;
+        }
+        else if (ch === NL && depth === 0) {
+            start = i + 1;
+            break;
+        }
+        start = i;
+    }
+    let end = at;
+    depth = 0;
+    for (let i = at; i < text.length && i - at < 2000; i += 1) {
+        const ch = text[i];
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth += 1;
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            if (depth === 0) {
+                end = i;
+                break;
+            }
+            depth -= 1;
+        }
+        else if ((ch === NL || ch === ';') && depth === 0) {
+            end = i;
+            break;
+        }
+        end = i + 1;
+    }
+    return text.slice(start, end);
+}
+export function promptFlows(file, text) {
+    const found = [];
+    const seen = new Set();
+    const assigned = [];
+    for (const { re, origin } of SOURCES) {
+        // `name = <source>` in Python, and `const name = <source>` in JavaScript.
+        for (const m of text.matchAll(new RegExp(String.raw `(?:(?:const|let|var)\s+)?(\w+)\s*=\s*[^=\n]*?(` + re + String.raw `)`, 'g'))) {
+            assigned.push({ name: m[1], at: m.index ?? 0, source: m[2], origin });
+        }
+    }
+    for (const prompt of text.matchAll(PROMPT)) {
+        const at = prompt.index ?? 0;
+        const statement = statementAt(text, at);
+        if (!statement.trim())
+            continue;
+        const line = text.slice(0, at).split(NL).length;
+        // Tools in the same body: looked for from the start of the enclosing function rather than the
+        // whole file, so a tool list in one handler does not arm a prompt built in another.
+        const withTools = TOOLS_HERE.test(text.slice(Math.max(0, at - 3000), at + 3000));
+        // Directly: the fetched value is written inside the prompt string itself.
+        for (const { re, origin } of SOURCES) {
+            const hit = new RegExp(re).exec(statement);
+            if (!hit)
+                continue;
+            const how = gluedIn(statement, hit[0]);
+            if (!how)
+                continue;
+            // One finding per untrusted value, not per place a prompt is mentioned: `messages=` and
+            // `.create(` both match the same statement, and reporting it twice reads as two problems.
+            const key = `direct:${hit[0]}:${statement.slice(0, 40)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({ file, line, source: hit[0].replace(/\s+/g, ' ').slice(0, 80), origin, through: how, withTools, evidence: statement.replace(/\s+/g, ' ').slice(0, 160) });
+        }
+        // Through one variable, assigned from an untrusted value earlier in the same body.
+        for (const a of assigned) {
+            if (a.at > at || !sameBody(text, a.at, at))
+                continue;
+            const how = gluedIn(statement, a.name);
+            if (!how)
+                continue;
+            const key = `via:${a.name}:${a.at}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({
+                file,
+                line,
+                source: a.source.replace(/\s+/g, ' ').slice(0, 80),
+                origin: a.origin,
+                through: `${how}, through \`${a.name}\``,
+                withTools,
+                evidence: statement.replace(/\s+/g, ' ').slice(0, 160),
+            });
+        }
+    }
+    return found;
+}

package/dist/engine/taint/flow.js

@@ -12,8 +12,14 @@ const SINKS = [
  * value bound as a parameter is never parsed as syntax, and an explicit escape says so.
  */
 const MADE_SAFE = /\b(?:parseInt|parseFloat|Number|encodeURIComponent|escape|escapeId|sqlstring\.escape)\s*\(/;
-/** A value is only dangerous here if it is glued into the string, not passed beside it. */
-function gluedIn(argument, expression) {
+/**
+ * A value is only dangerous here if it is glued into the string, not passed beside it.
+ *
+ * Exported because the agent checks need exactly this question about a different kind of string: a
+ * prompt. The Python shapes are here rather than in a second copy for the same reason - an f-string
+ * glues a value in exactly as a template literal does, and the difference is only spelling.
+ */
+export function gluedIn(argument, expression) {
     const e = expression.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     if (new RegExp(String.raw `\$\{[^}]*` + e, 's').test(argument))
         return 'a template literal';
@@ -21,6 +27,13 @@ function gluedIn(argument, expression) {
         return 'string concatenation';
     if (new RegExp(String.raw `\.concat\s*\([^)]*` + e).test(argument))
         return 'concat()';
+    // Python: an f-string, old-style %, and .format(), which glue a value in just as firmly.
+    if (new RegExp(String.raw `f["'][^"']*\{[^}]*` + e, 's').test(argument))
+        return 'an f-string';
+    if (new RegExp(String.raw `%\s*\(?[^)]*` + e).test(argument))
+        return '% formatting';
+    if (new RegExp(String.raw `\.format\s*\([^)]*` + e).test(argument))
+        return '.format()';
     return null;
 }
 /** The first argument of a call that starts at `from`, which is the one parsed as syntax. */
@@ -48,7 +61,7 @@ function firstArgument(text, from) {
  * joined. Crude - it finds the enclosing braces - and crude in the safe direction: a body it
  * cannot determine yields no finding at all.
  */
-function sameBody(text, a, b) {
+export function sameBody(text, a, b) {
     if (a > b)
         return false;
     let depth = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [