weavatrix 0.1.1 → 0.1.2

package/src/mcp-source-tools.mjs

@@ -1,10 +1,14 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
 import { extname, join, relative } from 'node:path'
+import { resolveRepoPath } from './repo-path.js'
+import { childProcessEnv } from './child-env.js'
 
 const SEARCH_SKIP = new Set(['.git', 'node_modules', 'dist', 'build', 'out', '.next', 'coverage', 'vendor', '.venv', 'venv', 'env', 'target', '__pycache__', '.idea', '.vscode', '.cache', 'bin', 'obj', 'weavatrix-graphs'])
 const BINARY_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.pdf', '.zip', '.gz', '.tar', '.exe', '.dll', '.so', '.dylib', '.woff', '.woff2', '.ttf', '.eot', '.mp4', '.mp3', '.wasm', '.class', '.jar', '.node', '.bin'])
 const MAX_SEARCH_FILE_BYTES = 1024 * 1024
+const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
+const MAX_SOURCE_CONTEXT_LINES = 1000
 
 function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
     const rg = resolveRg()
@@ -13,7 +17,7 @@ function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
     if (!isRegex) args.push('--fixed-strings')
     if (glob) args.push('-g', glob)
     args.push('--', query, repoRoot)
-    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000 })
+    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
@@ -122,14 +126,21 @@ export function readSource({ repoRoot, resolveNode, isSymbol }, g, { label, path
     }
     // explicit anchor wins: window = start_line-before .. start_line+after (how a path read escapes the file head)
     if (start_line != null && Number(start_line) > 0) focusLine = Math.floor(Number(start_line))
-    const abs = join(repoRoot, file)
-    if (!existsSync(abs)) return `File not found: ${file}`
+    const resolved = resolveRepoPath(repoRoot, file)
+    if (resolved.reason === 'escape') return `Refusing to read "${file}": path escapes the repository root.`
+    if (resolved.reason === 'not-found') return `File not found: ${file}`
+    if (!resolved.ok) return `Could not resolve ${file} inside the repository root.`
+    const abs = resolved.path
+    let st
+    try { st = statSync(abs) } catch (e) { return `Could not inspect ${file}: ${e.message}` }
+    if (!st.isFile()) return `Could not read ${file}: not a regular file.`
+    if (st.size > MAX_SOURCE_FILE_BYTES) return `Could not read ${file}: file exceeds the ${MAX_SOURCE_FILE_BYTES / 1024 / 1024} MB source-read limit.`
     let text
     try { text = readFileSync(abs, 'utf8') } catch (e) { return `Could not read ${file}: ${e.message}` }
     const lines = text.split(/\r?\n/)
     if (focusLine) focusLine = Math.min(focusLine, lines.length) // an anchor past EOF shows the tail, not nothing
-    const b = Math.max(0, Number(before) || 0)
-    const a = Math.max(1, Number(after) || 40)
+    const b = Math.min(MAX_SOURCE_CONTEXT_LINES, Math.max(0, Number(before) || 0))
+    const a = Math.min(MAX_SOURCE_CONTEXT_LINES, Math.max(1, Number(after) || 40))
     const start = focusLine ? Math.max(1, focusLine - b) : 1
     const end = focusLine ? Math.min(lines.length, focusLine + a) : Math.min(lines.length, 1 + b + a)
     const width = String(end).length

package/src/process.js

@@ -1,5 +1,6 @@
 // Subprocess runner shared by the search engines and security sweeps.
 import { spawn } from "node:child_process";
+import { childProcessEnv } from "./child-env.js";
 
 // Windows: .cmd/.ps1 shims (npx, etc.) can't be spawned directly by Node — they need a
 // shell. With shell:true Node does NOT quote args, so we build a quoted command line ourselves
@@ -18,13 +19,13 @@ export function runCommand(command, args = [], options = {}) {
     const child = needsShell
       ? spawn([command, ...args].map(winQuote).join(" "), [], {
           cwd: options.cwd || undefined,
-          env: { ...process.env, ...(options.env || {}) },
+          env: childProcessEnv(options.env || {}),
           shell: true,
           windowsHide: true
         })
       : spawn(command, args, {
           cwd: options.cwd || undefined,
-          env: { ...process.env, ...(options.env || {}) },
+          env: childProcessEnv(options.env || {}),
           windowsHide: true
         });
 
@@ -46,7 +47,7 @@ export function runCommand(command, args = [], options = {}) {
     const killTree = () => {
       if (process.platform === "win32" && child.pid) {
         try {
-          spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true });
+          spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true, env: childProcessEnv() });
         } catch {
           try { child.kill(); } catch { /* process may already be gone */ }
         }

package/src/repo-path.js

@@ -0,0 +1,53 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+export function isPathInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+// Cache the canonical root for callers that resolve many graph-derived paths.
+export function createRepoBoundary(repoRoot) {
+  let root;
+  let rootError;
+  try {
+    root = realpathSync.native(repoRoot);
+  } catch (error) {
+    rootError = error;
+  }
+
+  return {
+    root,
+    resolve(candidate) {
+      if (!root) return { ok: false, reason: "invalid-root", error: rootError };
+      const input = String(candidate ?? "");
+      if (!input || input.includes("\0")) return { ok: false, reason: "invalid-path" };
+      if (isAbsolute(input)) return { ok: false, reason: "escape" };
+
+      let lexical;
+      try {
+        lexical = resolve(root, input);
+      } catch (error) {
+        return { ok: false, reason: "invalid-path", error };
+      }
+      if (!isPathInside(root, lexical)) return { ok: false, reason: "escape" };
+
+      let target;
+      try {
+        target = realpathSync.native(lexical);
+      } catch (error) {
+        return { ok: false, reason: error?.code === "ENOENT" ? "not-found" : "unreadable", error };
+      }
+      if (!isPathInside(root, target)) return { ok: false, reason: "escape" };
+
+      return { ok: true, path: target };
+    },
+  };
+}
+
+// Resolve one existing repo-relative path without allowing lexical traversal or
+// symlink/junction escapes. Callers get a reason instead of an exception so MCP
+// tools can refuse the read without exposing host filesystem details.
+export function resolveRepoPath(repoRoot, candidate) {
+  return createRepoBoundary(repoRoot).resolve(candidate);
+}

package/src/security/installed.js

@@ -2,10 +2,11 @@
 // (package-lock v1/v2/v3, basic yarn.lock, requirements.txt ==pins, go.sum), plus a top-level
 // node_modules walk — which also yields the lockfile-DRIFT signal (installed ≠ locked → tampering or
 // stale install). Parsers are pure + exported for tests; collectInstalled is the thin fs wrapper.
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
 import { uniqueBy } from "../util.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 const pep503 = (name) => String(name).toLowerCase().replace(/[-_.]+/g, "-"); // PyPI canonical name
 
@@ -144,21 +145,19 @@ export function parseGoModPackages(text) {
 }
 
 // Top-level node_modules walk (incl. @scopes): the ground truth of what is REALLY on disk.
-function walkNodeModules(repoPath) {
+function walkNodeModules(repoPath, { readJsonFile = readJson, readdir = readdirSync } = {}) {
   const out = [];
   const nm = join(repoPath, "node_modules");
   const readPkg = (dir, name) => {
-    try {
-      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      if (pj && pj.version) out.push({ ecosystem: "npm", name: pj.name || name, version: pj.version, dev: false, integrity: "", source: "node_modules" });
-    } catch { /* not a package dir */ }
+    const pj = readJsonFile(join(dir, "package.json"));
+    if (pj && pj.version) out.push({ ecosystem: "npm", name: pj.name || name, version: pj.version, dev: false, integrity: "", source: "node_modules" });
   };
   let entries;
-  try { entries = readdirSync(nm); } catch { return out; }
+  try { entries = readdir(nm); } catch { return out; }
   for (const e of entries) {
     if (e.startsWith(".")) continue;
     if (e.startsWith("@")) {
-      let scoped; try { scoped = readdirSync(join(nm, e)); } catch { continue; }
+      let scoped; try { scoped = readdir(join(nm, e)); } catch { continue; }
       for (const s of scoped) readPkg(join(nm, e, s), `${e}/${s}`);
     } else readPkg(join(nm, e), e);
   }
@@ -170,58 +169,72 @@ const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } ca
 
 const SUBPROJECT_SKIP = new Set([".git", ".idea", ".vscode", ".venv", "venv", "env", "node_modules", "vendor", "dist", "build", "coverage", "__pycache__", ".tox", "testdata"]);
 
-function projectDirs(repoPath) {
-  const dirs = [repoPath];
+function projectDirs(boundary) {
+  const dirs = boundary.root ? [boundary.root] : [];
   let entries = [];
-  try { entries = readdirSync(repoPath, { withFileTypes: true }); } catch { return dirs; }
+  try { entries = readdirSync(boundary.root, { withFileTypes: true }); } catch { return dirs; }
   for (const e of entries) {
     if (!e.isDirectory() || e.name.startsWith(".") || SUBPROJECT_SKIP.has(e.name)) continue;
-    dirs.push(join(repoPath, e.name));
+    const resolved = boundary.resolve(e.name);
+    if (resolved.ok) dirs.push(resolved.path);
     if (dirs.length >= 101) break;
   }
   return dirs;
 }
 
-function collectReqFiles(dir) {
+function collectReqFiles(dir, readdir = readdirSync) {
   const reqFiles = [];
-  try { for (const n of readdirSync(dir)) if (/^requirements[\w.-]*\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, n)); } catch { /* unreadable root */ }
-  try { for (const n of readdirSync(join(dir, "requirements"))) if (/\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, "requirements", n)); } catch { /* no requirements/ dir */ }
+  try { for (const n of readdir(dir)) if (/^requirements[\w.-]*\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, n)); } catch { /* unreadable root */ }
+  try { for (const n of readdir(join(dir, "requirements"))) if (/\.(txt|in)$/i.test(n)) reqFiles.push(join(dir, "requirements", n)); } catch { /* no requirements/ dir */ }
   return reqFiles;
 }
 
 // → { installed: [{ecosystem,name,version,dev,source}], drift: [{name, locked, installed}] }
 export function collectInstalled(repoPath) {
-  const dirs = projectDirs(repoPath);
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return { installed: [], drift: [] };
+  const inside = (path) => boundary.resolve(relative(boundary.root, path) || ".");
+  const boundedText = (path) => { const resolved = inside(path); return resolved.ok ? readText(resolved.path) : null; };
+  const boundedJson = (path) => { const resolved = inside(path); return resolved.ok ? readJson(resolved.path) : null; };
+  const boundedReaddir = (path, options) => {
+    const resolved = inside(path);
+    if (!resolved.ok) throw new Error("path is outside the repository");
+    return readdirSync(resolved.path, options);
+  };
+  const dirs = projectDirs(boundary);
   const lock = [];
   const yarn = [];
   const disk = [];
   for (const dir of dirs) {
-    const lockHere = parsePackageLock(readJson(join(dir, "package-lock.json")) || {});
+    const lockHere = parsePackageLock(boundedJson(join(dir, "package-lock.json")) || {});
     lock.push(...lockHere);
-    if (!lockHere.length) yarn.push(...parseYarnLock(readText(join(dir, "yarn.lock")) || ""));
-    disk.push(...walkNodeModules(dir));
+    if (!lockHere.length) yarn.push(...parseYarnLock(boundedText(join(dir, "yarn.lock")) || ""));
+    disk.push(...walkNodeModules(dir, { readJsonFile: boundedJson, readdir: boundedReaddir }));
   }
   // Python: venv site-packages = the ground truth (exact installed versions); requirements*.txt (root +
   // a requirements/ dir) and poetry/uv/Pipfile locks fill in when there's no venv. venv wins per name.
-  const venvPy = dirs.flatMap((dir) => collectVenvPackages(dir));
-  const reqFiles = dirs.flatMap((dir) => collectReqFiles(dir));
+  const venvPy = dirs.flatMap((dir) => collectVenvPackages(dir, { readdir: boundedReaddir }));
+  const reqFiles = dirs.flatMap((dir) => collectReqFiles(dir, boundedReaddir));
   const venvNames = new Set(venvPy.map((p) => p.name));
   const pyDeclared = [
-    ...reqFiles.flatMap((f) => parseRequirements(readText(f) || "")),
-    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "poetry.lock")) || "", "poetry-lock")),
-    ...dirs.flatMap((dir) => parseTomlLockPackages(readText(join(dir, "uv.lock")) || "", "uv-lock")),
-    ...dirs.flatMap((dir) => parsePipfileLock(readJson(join(dir, "Pipfile.lock")) || null)),
+    ...reqFiles.flatMap((f) => parseRequirements(boundedText(f) || "")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(boundedText(join(dir, "poetry.lock")) || "", "poetry-lock")),
+    ...dirs.flatMap((dir) => parseTomlLockPackages(boundedText(join(dir, "uv.lock")) || "", "uv-lock")),
+    ...dirs.flatMap((dir) => parsePipfileLock(boundedJson(join(dir, "Pipfile.lock")) || null)),
   ].filter((p) => !venvNames.has(p.name)); // installed version supersedes the declared pin
   const py = [...venvPy, ...pyDeclared];
   // Go: go.sum (exact, hashed) first, then go.mod require versions as a fallback. Walk the repo root
   // AND its immediate subdirectories so a Go MONOREPO (per-folder modules, no root go.mod — e.g. gpro)
   // still scans; dedupe() collapses the go.sum/go.mod overlap and cross-module shared deps.
-  const goFromDir = (dir) => [...parseGoSum(readText(join(dir, "go.sum")) || ""), ...parseGoModPackages(readText(join(dir, "go.mod")) || "")];
-  const go = [...goFromDir(repoPath)];
-  if (!go.length || existsSync(join(repoPath, "go.work"))) {
+  const goFromDir = (dir) => [...parseGoSum(boundedText(join(dir, "go.sum")) || ""), ...parseGoModPackages(boundedText(join(dir, "go.mod")) || "")];
+  const go = [...goFromDir(boundary.root)];
+  if (!go.length || boundary.resolve("go.work").ok) {
     let subs = [];
-    try { subs = readdirSync(repoPath, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "vendor", "dist", "build", "testdata"].includes(e.name)); } catch { /* unreadable root */ }
-    for (const s of subs.slice(0, 100)) go.push(...goFromDir(join(repoPath, s.name)));
+    try { subs = boundedReaddir(boundary.root, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !["node_modules", "vendor", "dist", "build", "testdata"].includes(e.name)); } catch { /* unreadable root */ }
+    for (const s of subs.slice(0, 100)) {
+      const resolved = boundary.resolve(s.name);
+      if (resolved.ok) go.push(...goFromDir(resolved.path));
+    }
   }
 
   // lockfile wins as the version source; disk fills gaps + powers the drift signal. A package

package/src/security/malware-heuristics.exclusions.js

@@ -1,134 +1,134 @@
-// Allowlist/exclusion parsing and URL/doc-noise filters for the malware scanner (split out of
-// malware-heuristics.js; see that file for the scanner overview).
-import { NOISY_URL_KEYS, isDocFile, isBenignUrlContext } from "./registry-sig.js";
-
-export const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
-const URL_RULE_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url", "hardcoded-url"]);
-const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
-const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
-const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
-const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
-const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
-
-function cleanUrlToken(value) {
-  return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
-}
-
-function splitAllowlistText(value) {
-  if (Array.isArray(value)) return value.flatMap(splitAllowlistText);
-  return String(value || "")
-    .split(/[\r\n,]+/)
-    .map((line) => line.replace(/\s+#.*$/, "").trim())
-    .filter(Boolean);
-}
-
-function normalizeHost(value) {
-  let s = String(value || "").trim().toLowerCase();
-  if (!s) return "";
-  try {
-    if (/^https?:\/\//i.test(s)) s = new URL(s).host;
-  } catch { /* keep raw */ }
-  return s.replace(/^\*\./, "").replace(/^\./, "").replace(/:\d+$/, "");
-}
-
-function normalizeUrl(value) {
-  const raw = cleanUrlToken(value);
-  if (!raw) return "";
-  try {
-    const u = new URL(raw);
-    const path = u.pathname.replace(/\/+$/, "");
-    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${path}${u.search || ""}`;
-  } catch {
-    return raw.toLowerCase().replace(/\/+$/, "");
-  }
-}
-
-function extractUrls(text) {
-  return [...String(text || "").matchAll(URL_RE)].map((m) => cleanUrlToken(m[0])).filter(Boolean);
-}
-
-function urlMatchesAllow(allowUrl, candidate) {
-  const a = normalizeUrl(allowUrl);
-  const c = normalizeUrl(candidate);
-  if (!a || !c) return false;
-  return c === a || c.startsWith(`${a}/`) || a.startsWith(`${c}/`);
-}
-
-function hostMatchesAllow(allowHost, candidate) {
-  const a = normalizeHost(allowHost);
-  const c = normalizeHost(candidate);
-  return !!(a && c && (c === a || c.endsWith(`.${a}`)));
-}
-
-export function parseMalwareExclusions(input = {}) {
-  const out = { urls: [], hosts: [], packages: [], rules: [] };
-  const add = (raw) => {
-    const s = cleanUrlToken(raw);
-    if (!s) return;
-    const lower = s.toLowerCase();
-    if (lower.startsWith("pkg:")) { out.packages.push(s.slice(4).trim()); return; }
-    if (lower.startsWith("package:")) { out.packages.push(s.slice(8).trim()); return; }
-    if (lower.startsWith("rule:")) { out.rules.push(s.slice(5).trim()); return; }
-    if (lower.startsWith("host:")) { out.hosts.push(normalizeHost(s.slice(5))); return; }
-    if (lower.startsWith("domain:")) { out.hosts.push(normalizeHost(s.slice(7))); return; }
-    if (/^https?:\/\//i.test(s)) { out.urls.push(normalizeUrl(s)); out.hosts.push(normalizeHost(s)); return; }
-    if (!s.includes("/") && s.includes(".")) { out.hosts.push(normalizeHost(s)); return; }
-    out.packages.push(s);
-  };
-  if (typeof input === "string" || Array.isArray(input)) {
-    for (const line of splitAllowlistText(input)) add(line);
-  } else if (input && typeof input === "object") {
-    for (const line of splitAllowlistText(input.urls || input.url || "")) add(line);
-    for (const line of splitAllowlistText(input.domains || input.domain || "")) add(`host:${line}`);
-    for (const line of splitAllowlistText(input.packages || input.package || "")) add(/^pkg(age)?:/i.test(line) ? line : `pkg:${line}`);
-    for (const line of splitAllowlistText(input.rules || input.rule || "")) add(`rule:${line}`);
-  }
-  return {
-    urls: [...new Set(out.urls.filter(Boolean))],
-    hosts: [...new Set(out.hosts.filter(Boolean))],
-    packages: [...new Set(out.packages.map((p) => p.trim()).filter(Boolean))],
-    rules: [...new Set(out.rules.map((r) => r.trim()).filter(Boolean))],
-  };
-}
-
-export function isManifestUrlNoise(file, signal) {
-  if (!URL_RULE_KEYS.has(signal?.key)) return false;
-  const f = normPath(file).toLowerCase();
-  const text = `${signal?.snippet || ""}`.trim();
-  if (/(^|\/)package\.json$/.test(f)) {
-    if (PACKAGE_JSON_SCRIPT_RE.test(text)) return false;
-    return PACKAGE_JSON_METADATA_URL_RE.test(text) || !NETWORK_CALL_RE.test(text);
-  }
-  return /(^|\/)(pkg-info|metadata)$/.test(f);
-}
-
-export function lifecycleScriptSnippet(scripts = {}) {
-  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
-    const s = String(scripts?.[hook] || "").trim();
-    if (s) return `${hook}: ${s}`.slice(0, 200);
-  }
-  return "";
-}
-
-// weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
-// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
-// Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
-export function isDocUrlNoise(file, signal) {
-  if (!NOISY_URL_KEYS.has(signal?.key)) return false;
-  return isDocFile(file) || isBenignUrlContext(signal?.snippet || "");
-}
-
-export function isMalwareSignalExcluded(pkg, signal, exclusions = {}) {
-  const ex = exclusions.urls || exclusions.hosts || exclusions.packages || exclusions.rules ? exclusions : parseMalwareExclusions(exclusions);
-  if (signal?.key && ex.rules.includes(signal.key)) return true;
-  if (ex.packages.some((p) => p.toLowerCase() === String(pkg || "").toLowerCase()) && signal?.noisy) return true;
-  if (!URL_RULE_KEYS.has(signal?.key)) return false;
-  const text = `${signal?.snippet || ""}\n${signal?.file || ""}`;
-  const urls = extractUrls(text);
-  for (const url of urls) {
-    if (ex.urls.some((allowed) => urlMatchesAllow(allowed, url))) return true;
-    if (ex.hosts.some((allowed) => hostMatchesAllow(allowed, url))) return true;
-  }
-  if (!urls.length && ex.hosts.some((host) => host && text.toLowerCase().includes(host))) return true;
-  return false;
-}
+// Allowlist/exclusion parsing and URL/doc-noise filters for the malware scanner (split out of
+// malware-heuristics.js; see that file for the scanner overview).
+import { NOISY_URL_KEYS, isDocFile, isBenignUrlContext } from "./registry-sig.js";
+
+export const normPath = (p) => String(p || "").replace(/\\/g, "/").replace(/\/+$/, "");
+const URL_RULE_KEYS = new Set(["exfil-url", "exfil-ip", "cloud-metadata-url", "network-url", "hardcoded-url"]);
+const URL_RE = /https?:\/\/[^\s'"`)\\<>]+/gi;
+const PACKAGE_JSON_SCRIPT_RE = /["']?(preinstall|install|postinstall|prepare|prepack|postpack|prepublish|prepublishonly)["']?\s*:/i;
+const PACKAGE_JSON_METADATA_URL_RE = /["']?(bugs|homepage|repository|funding|author|contributors|maintainers|publishConfig|license)["']?\s*:|["']?url["']?\s*:/i;
+const NETWORK_CALL_RE = /\b(fetch|axios\.|XMLHttpRequest|sendBeacon|https?\.request|request\(|curl\b|wget\b|iwr\b|invoke-webrequest)\b/i;
+const LIFECYCLE_SCRIPT_HOOKS = ["preinstall", "install", "postinstall", "prepare"];
+
+function cleanUrlToken(value) {
+  return String(value || "").trim().replace(/[.,;:!?]+$/g, "").replace(/[)\]}]+$/g, "");
+}
+
+function splitAllowlistText(value) {
+  if (Array.isArray(value)) return value.flatMap(splitAllowlistText);
+  return String(value || "")
+    .split(/[\r\n,]+/)
+    .map((line) => line.replace(/\s+#.*$/, "").trim())
+    .filter(Boolean);
+}
+
+function normalizeHost(value) {
+  let s = String(value || "").trim().toLowerCase();
+  if (!s) return "";
+  try {
+    if (/^https?:\/\//i.test(s)) s = new URL(s).host;
+  } catch { /* keep raw */ }
+  return s.replace(/^\*\./, "").replace(/^\./, "").replace(/:\d+$/, "");
+}
+
+function normalizeUrl(value) {
+  const raw = cleanUrlToken(value);
+  if (!raw) return "";
+  try {
+    const u = new URL(raw);
+    const path = u.pathname.replace(/\/+$/, "");
+    return `${u.protocol.toLowerCase()}//${u.host.toLowerCase()}${path}${u.search || ""}`;
+  } catch {
+    return raw.toLowerCase().replace(/\/+$/, "");
+  }
+}
+
+function extractUrls(text) {
+  return [...String(text || "").matchAll(URL_RE)].map((m) => cleanUrlToken(m[0])).filter(Boolean);
+}
+
+function urlMatchesAllow(allowUrl, candidate) {
+  const a = normalizeUrl(allowUrl);
+  const c = normalizeUrl(candidate);
+  if (!a || !c) return false;
+  return c === a || c.startsWith(`${a}/`) || a.startsWith(`${c}/`);
+}
+
+function hostMatchesAllow(allowHost, candidate) {
+  const a = normalizeHost(allowHost);
+  const c = normalizeHost(candidate);
+  return !!(a && c && (c === a || c.endsWith(`.${a}`)));
+}
+
+export function parseMalwareExclusions(input = {}) {
+  const out = { urls: [], hosts: [], packages: [], rules: [] };
+  const add = (raw) => {
+    const s = cleanUrlToken(raw);
+    if (!s) return;
+    const lower = s.toLowerCase();
+    if (lower.startsWith("pkg:")) { out.packages.push(s.slice(4).trim()); return; }
+    if (lower.startsWith("package:")) { out.packages.push(s.slice(8).trim()); return; }
+    if (lower.startsWith("rule:")) { out.rules.push(s.slice(5).trim()); return; }
+    if (lower.startsWith("host:")) { out.hosts.push(normalizeHost(s.slice(5))); return; }
+    if (lower.startsWith("domain:")) { out.hosts.push(normalizeHost(s.slice(7))); return; }
+    if (/^https?:\/\//i.test(s)) { out.urls.push(normalizeUrl(s)); out.hosts.push(normalizeHost(s)); return; }
+    if (!s.includes("/") && s.includes(".")) { out.hosts.push(normalizeHost(s)); return; }
+    out.packages.push(s);
+  };
+  if (typeof input === "string" || Array.isArray(input)) {
+    for (const line of splitAllowlistText(input)) add(line);
+  } else if (input && typeof input === "object") {
+    for (const line of splitAllowlistText(input.urls || input.url || "")) add(line);
+    for (const line of splitAllowlistText(input.domains || input.domain || "")) add(`host:${line}`);
+    for (const line of splitAllowlistText(input.packages || input.package || "")) add(/^pkg(age)?:/i.test(line) ? line : `pkg:${line}`);
+    for (const line of splitAllowlistText(input.rules || input.rule || "")) add(`rule:${line}`);
+  }
+  return {
+    urls: [...new Set(out.urls.filter(Boolean))],
+    hosts: [...new Set(out.hosts.filter(Boolean))],
+    packages: [...new Set(out.packages.map((p) => p.trim()).filter(Boolean))],
+    rules: [...new Set(out.rules.map((r) => r.trim()).filter(Boolean))],
+  };
+}
+
+export function isManifestUrlNoise(file, signal) {
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const f = normPath(file).toLowerCase();
+  const text = `${signal?.snippet || ""}`.trim();
+  if (/(^|\/)package\.json$/.test(f)) {
+    if (PACKAGE_JSON_SCRIPT_RE.test(text)) return false;
+    return PACKAGE_JSON_METADATA_URL_RE.test(text) || !NETWORK_CALL_RE.test(text);
+  }
+  return /(^|\/)(pkg-info|metadata)$/.test(f);
+}
+
+export function lifecycleScriptSnippet(scripts = {}) {
+  for (const hook of LIFECYCLE_SCRIPT_HOOKS) {
+    const s = String(scripts?.[hook] || "").trim();
+    if (s) return `${hook}: ${s}`.slice(0, 200);
+  }
+  return "";
+}
+
+// weak URL rules only: URL evidence in a license/prose file or in comment/doc-link context is
+// documentation, not behavior (LICENSE:5 "http://www.apache.org/licenses/" was the hot FP).
+// Strong rules (miner/shell/exfil-url) are untouched and still scan those same files.
+export function isDocUrlNoise(file, signal) {
+  if (!NOISY_URL_KEYS.has(signal?.key)) return false;
+  return isDocFile(file) || isBenignUrlContext(signal?.snippet || "");
+}
+
+export function isMalwareSignalExcluded(pkg, signal, exclusions = {}) {
+  const ex = exclusions.urls || exclusions.hosts || exclusions.packages || exclusions.rules ? exclusions : parseMalwareExclusions(exclusions);
+  if (signal?.key && ex.rules.includes(signal.key)) return true;
+  if (ex.packages.some((p) => p.toLowerCase() === String(pkg || "").toLowerCase()) && signal?.noisy) return true;
+  if (!URL_RULE_KEYS.has(signal?.key)) return false;
+  const text = `${signal?.snippet || ""}\n${signal?.file || ""}`;
+  const urls = extractUrls(text);
+  for (const url of urls) {
+    if (ex.urls.some((allowed) => urlMatchesAllow(allowed, url))) return true;
+    if (ex.hosts.some((allowed) => hostMatchesAllow(allowed, url))) return true;
+  }
+  if (!urls.length && ex.hosts.some((host) => host && text.toLowerCase().includes(host))) return true;
+  return false;
+}

package/src/security/malware-heuristics.js

@@ -1,15 +1,15 @@
-// Heuristic malware scanner over INSTALLED dependencies (defensive): install-script beacons, crypto-
-// miner signatures, exfiltration endpoints, obfuscation markers, non-registry install sources.
-// Phase A (always, cheap): every installed package's package.json scripts + lockfile `resolved` origin.
-// Phase B (content): ripgrep sweep of node_modules when rg is available (full coverage), else a bounded
-// Node fallback over each package's entry files. Multi-signal scoring per package: high/critical needs
-// a near-zero-FP rule OR >=2 independent rule keys; the allowlist downgrades ONLY noisy rules.
-// This catches known PATTERNS — it is not a sandbox or a reputation service (honest limit, in the UI).
-// Split into sibling modules (this file stays the import path):
-//   malware-heuristics.exclusions.js - allowlist parsing + URL/doc noise filters
-//   malware-heuristics.roots.js      - content roots + path-to-package mapping
-//   malware-heuristics.sweep.js      - ripgrep / Node content sweeps
-//   malware-heuristics.scan.js       - scanMalware orchestration
-export { parseMalwareExclusions, isMalwareSignalExcluded } from "./malware-heuristics.exclusions.js";
-export { pkgOfNodeModulesPath } from "./malware-heuristics.roots.js";
-export { scanMalware } from "./malware-heuristics.scan.js";
+// Heuristic malware scanner over INSTALLED dependencies (defensive): install-script beacons, crypto-
+// miner signatures, exfiltration endpoints, obfuscation markers, non-registry install sources.
+// Phase A (always, cheap): every installed package's package.json scripts + lockfile `resolved` origin.
+// Phase B (content): ripgrep sweep of node_modules when rg is available (full coverage), else a bounded
+// Node fallback over each package's entry files. Multi-signal scoring per package: high/critical needs
+// a near-zero-FP rule OR >=2 independent rule keys; the allowlist downgrades ONLY noisy rules.
+// This catches known PATTERNS — it is not a sandbox or a reputation service (honest limit, in the UI).
+// Split into sibling modules (this file stays the import path):
+//   malware-heuristics.exclusions.js - allowlist parsing + URL/doc noise filters
+//   malware-heuristics.roots.js      - content roots + path-to-package mapping
+//   malware-heuristics.sweep.js      - ripgrep / Node content sweeps
+//   malware-heuristics.scan.js       - scanMalware orchestration
+export { parseMalwareExclusions, isMalwareSignalExcluded } from "./malware-heuristics.exclusions.js";
+export { pkgOfNodeModulesPath } from "./malware-heuristics.roots.js";
+export { scanMalware } from "./malware-heuristics.scan.js";