weavatrix 0.1.1 → 0.1.3

package/src/security/malware-heuristics.roots.js

@@ -1,142 +1,142 @@
-// Content roots + path-to-package mapping for the malware scanner (split out of
-// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { delimiter, join, relative } from "node:path";
-import { normPath } from "./malware-heuristics.exclusions.js";
-
-const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
-
-// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
-export function pkgOfNodeModulesPath(p) {
-  const s = String(p).replace(/\\/g, "/");
-  const i = s.lastIndexOf("node_modules/");
-  if (i < 0) return "";
-  const rest = s.slice(i + "node_modules/".length).split("/");
-  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
-}
-
-function existingDir(p) {
-  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
-}
-
-function sitePackageRoots(repoPath) {
-  const roots = [];
-  for (const venv of [".venv", "venv", "env"]) {
-    const win = join(repoPath, venv, "Lib", "site-packages");
-    if (existingDir(win)) roots.push(win);
-    try {
-      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
-        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
-        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
-      }
-    } catch { /* no posix venv layout */ }
-  }
-  return [...new Set(roots.map((r) => join(r)))];
-}
-
-function pyTopLevelMap(sitePackagesRoot) {
-  const map = new Map();
-  let entries = [];
-  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
-  for (const e of entries) {
-    if (!/\.dist-info$/i.test(e)) continue;
-    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
-    const canonical = pep503(dist);
-    try {
-      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
-      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
-    } catch { /* metadata often omits top_level.txt */ }
-    try {
-      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
-      const m = meta.match(/^Name:\s*(.+)$/mi);
-      if (m) map.set(dist, pep503(m[1]));
-    } catch { /* no metadata */ }
-  }
-  return map;
-}
-
-function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
-  const rel = normPath(relative(sitePackagesRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  const first = rel.split("/")[0] || "";
-  if (!first || first === "__pycache__") return "";
-  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
-  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
-  return topMap.get(top) || pep503(top);
-}
-
-function vendorModuleNames(installed) {
-  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
-}
-
-function pkgOfVendorPath(file, vendorRoot, moduleNames) {
-  const rel = normPath(relative(vendorRoot, file));
-  if (!rel || rel.startsWith("..")) return "";
-  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
-  const parts = rel.split("/");
-  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
-  return parts.slice(0, 2).join("/") || parts[0] || "";
-}
-
-function goCacheRoots() {
-  const roots = [];
-  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
-  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
-  return [...new Set(roots.filter(existingDir))];
-}
-
-function goModCacheEscape(modulePath) {
-  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
-}
-
-function goModuleSourceRoots(installed) {
-  const roots = [];
-  const caches = goCacheRoots();
-  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
-  for (const p of goPkgs) {
-    const mod = goModCacheEscape(p.name);
-    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
-    for (const cache of caches) {
-      const dir = join(cache, `${mod}@${ver}`);
-      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
-    }
-  }
-  return roots;
-}
-
-export function buildContentRoots(repoPath, installed) {
-  const roots = [];
-  const nmDir = join(repoPath, "node_modules");
-  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
-  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
-
-  for (const sp of sitePackageRoots(repoPath)) {
-    const topMap = pyTopLevelMap(sp);
-    let packages = 0;
-    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
-    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
-  }
-
-  const vendorRoot = join(repoPath, "vendor");
-  if (existingDir(vendorRoot)) {
-    const modules = vendorModuleNames(installed);
-    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
-  }
-  roots.push(...goModuleSourceRoots(installed));
-  return roots;
-}
-
-export function listPkgDirs(nmDir) {
-  const out = [];
-  let entries;
-  try { entries = readdirSync(nmDir); } catch { return out; }
-  for (const e of entries) {
-    if (e.startsWith(".")) continue;
-    if (e.startsWith("@")) {
-      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
-      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
-    } else out.push({ pkg: e, dir: join(nmDir, e) });
-  }
-  return out;
-}
+// Content roots + path-to-package mapping for the malware scanner (split out of
+// malware-heuristics.js): npm node_modules, Python site-packages, Go vendor/ and module cache.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join, relative } from "node:path";
+import { normPath } from "./malware-heuristics.exclusions.js";
+
+const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
+
+// node_modules/@scope/name/... → @scope/name ; node_modules/name/... → name
+export function pkgOfNodeModulesPath(p) {
+  const s = String(p).replace(/\\/g, "/");
+  const i = s.lastIndexOf("node_modules/");
+  if (i < 0) return "";
+  const rest = s.slice(i + "node_modules/".length).split("/");
+  return rest[0]?.startsWith("@") ? `${rest[0]}/${rest[1] || ""}` : rest[0] || "";
+}
+
+function existingDir(p) {
+  try { return p && existsSync(p) && statSync(p).isDirectory(); } catch { return false; }
+}
+
+function sitePackageRoots(repoPath) {
+  const roots = [];
+  for (const venv of [".venv", "venv", "env"]) {
+    const win = join(repoPath, venv, "Lib", "site-packages");
+    if (existingDir(win)) roots.push(win);
+    try {
+      for (const d of readdirSync(join(repoPath, venv, "lib"))) {
+        const posix = join(repoPath, venv, "lib", String(d), "site-packages");
+        if (/^python/i.test(String(d)) && existingDir(posix)) roots.push(posix);
+      }
+    } catch { /* no posix venv layout */ }
+  }
+  return [...new Set(roots.map((r) => join(r)))];
+}
+
+function pyTopLevelMap(sitePackagesRoot) {
+  const map = new Map();
+  let entries = [];
+  try { entries = readdirSync(sitePackagesRoot); } catch { return map; }
+  for (const e of entries) {
+    if (!/\.dist-info$/i.test(e)) continue;
+    const dist = e.replace(/-\d[\w.!+-]*\.dist-info$/i, "");
+    const canonical = pep503(dist);
+    try {
+      const top = readFileSync(join(sitePackagesRoot, e, "top_level.txt"), "utf8");
+      for (const line of top.split(/\r?\n/).map((x) => x.trim()).filter(Boolean)) map.set(line, canonical);
+    } catch { /* metadata often omits top_level.txt */ }
+    try {
+      const meta = readFileSync(join(sitePackagesRoot, e, "METADATA"), "utf8");
+      const m = meta.match(/^Name:\s*(.+)$/mi);
+      if (m) map.set(dist, pep503(m[1]));
+    } catch { /* no metadata */ }
+  }
+  return map;
+}
+
+function pkgOfSitePackagesPath(file, sitePackagesRoot, topMap) {
+  const rel = normPath(relative(sitePackagesRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  const first = rel.split("/")[0] || "";
+  if (!first || first === "__pycache__") return "";
+  if (/\.dist-info$|\.egg-info$/i.test(first)) return "";
+  const top = first.replace(/\.(py|so|pyd|dll|pth)$/i, "");
+  return topMap.get(top) || pep503(top);
+}
+
+function vendorModuleNames(installed) {
+  return [...new Set((installed || []).filter((p) => p.ecosystem === "Go" && p.name).map((p) => String(p.name)))].sort((a, b) => b.length - a.length);
+}
+
+function pkgOfVendorPath(file, vendorRoot, moduleNames) {
+  const rel = normPath(relative(vendorRoot, file));
+  if (!rel || rel.startsWith("..")) return "";
+  for (const name of moduleNames) if (rel === name || rel.startsWith(`${name}/`)) return name;
+  const parts = rel.split("/");
+  if (parts[0]?.includes(".") && parts.length >= 3) return parts.slice(0, 3).join("/");
+  return parts.slice(0, 2).join("/") || parts[0] || "";
+}
+
+function goCacheRoots() {
+  const roots = [];
+  if (process.env.GOMODCACHE) roots.push(...String(process.env.GOMODCACHE).split(delimiter));
+  for (const gp of String(process.env.GOPATH || join(homedir(), "go")).split(delimiter)) roots.push(join(gp, "pkg", "mod"));
+  return [...new Set(roots.filter(existingDir))];
+}
+
+function goModCacheEscape(modulePath) {
+  return String(modulePath || "").split("/").map((part) => part.replace(/[A-Z]/g, (c) => `!${c.toLowerCase()}`)).join("/");
+}
+
+function goModuleSourceRoots(installed) {
+  const roots = [];
+  const caches = goCacheRoots();
+  const goPkgs = (installed || []).filter((p) => p.ecosystem === "Go" && p.name && p.version);
+  for (const p of goPkgs) {
+    const mod = goModCacheEscape(p.name);
+    const ver = String(p.version).startsWith("v") ? String(p.version) : `v${p.version}`;
+    for (const cache of caches) {
+      const dir = join(cache, `${mod}@${ver}`);
+      if (existingDir(dir)) roots.push({ kind: "Go", root: dir, packages: 1, pathToPkg: () => p.name });
+    }
+  }
+  return roots;
+}
+
+export function buildContentRoots(repoPath, installed) {
+  const roots = [];
+  const nmDir = join(repoPath, "node_modules");
+  const jsPkgDirs = existingDir(nmDir) ? listPkgDirs(nmDir) : [];
+  if (jsPkgDirs.length) roots.push({ kind: "npm", root: nmDir, packages: jsPkgDirs.length, pathToPkg: pkgOfNodeModulesPath });
+
+  for (const sp of sitePackageRoots(repoPath)) {
+    const topMap = pyTopLevelMap(sp);
+    let packages = 0;
+    try { packages = readdirSync(sp).filter((e) => !e.startsWith(".") && !/\.dist-info$|\.egg-info$|__pycache__/i.test(e)).length; } catch { /* unreadable */ }
+    roots.push({ kind: "PyPI", root: sp, packages, pathToPkg: (file) => pkgOfSitePackagesPath(file, sp, topMap) });
+  }
+
+  const vendorRoot = join(repoPath, "vendor");
+  if (existingDir(vendorRoot)) {
+    const modules = vendorModuleNames(installed);
+    roots.push({ kind: "Go", root: vendorRoot, packages: modules.length || 1, pathToPkg: (file) => pkgOfVendorPath(file, vendorRoot, modules) });
+  }
+  roots.push(...goModuleSourceRoots(installed));
+  return roots;
+}
+
+export function listPkgDirs(nmDir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(nmDir); } catch { return out; }
+  for (const e of entries) {
+    if (e.startsWith(".")) continue;
+    if (e.startsWith("@")) {
+      let scoped; try { scoped = readdirSync(join(nmDir, e)); } catch { continue; }
+      for (const s of scoped) out.push({ pkg: `${e}/${s}`, dir: join(nmDir, e, s) });
+    } else out.push({ pkg: e, dir: join(nmDir, e) });
+  }
+  return out;
+}

package/src/security/malware-heuristics.scan.js

@@ -1,87 +1,87 @@
-// scanMalware orchestration (split out of malware-heuristics.js): phase A install scripts +
-// lockfile origins, phase B content sweep, path-aware file heuristics, then scoring.
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { resolveRg } from "../scan/search.js";
-import { classifyInstallScript, classifyResolvedUrl, isCloudSdkMetadataUse } from "./registry-sig.js";
-import { fileHeuristicSweep } from "./malware-file-heuristics.js";
-import { buildMalwareFindings } from "./malware-scoring.js";
-import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, lifecycleScriptSnippet } from "./malware-heuristics.exclusions.js";
-import { buildContentRoots, listPkgDirs } from "./malware-heuristics.roots.js";
-import { rgSweep, nodeSweep } from "./malware-heuristics.sweep.js";
-
-// → { findings, scanMode } ; importedPkgs = Set of packages the repo's own code imports (evidence note).
-export async function scanMalware(repoPath, { installed = [], importedPkgs = new Set(), rgPath = "", forceNode = false, timeoutMs = 60000, malwareExclusions = {} } = {}) {
-  const nmDir = join(repoPath, "node_modules");
-  const contentRoots = buildContentRoots(repoPath, installed);
-  const byPkg = new Map(); // pkg -> [{rule signal, file, line, snippet}]
-  const exclusions = parseMalwareExclusions(malwareExclusions);
-  let excludedSignals = 0;
-  const add = (pkg, sig, file = "", line = 0, snippet = "") => {
-    if (!pkg) return;
-    const signal = { ...sig, file, line, snippet: snippet || sig.snippet || "" };
-    if (isManifestUrlNoise(file, signal) || isDocUrlNoise(file, signal) || isCloudSdkMetadataUse(pkg, signal.key) || isMalwareSignalExcluded(pkg, signal, exclusions)) {
-      excludedSignals++;
-      return;
-    }
-    (byPkg.get(pkg) || byPkg.set(pkg, []).get(pkg)).push(signal);
-  };
-
-  // ---- phase A: install scripts (from node_modules package.jsons) + lockfile resolved origins ----
-  const pkgDirs = existsSync(nmDir) ? listPkgDirs(nmDir) : [];
-  const lockScriptMeta = new Map(
-    (installed || [])
-      .filter((p) => p.ecosystem === "npm" && p.source === "package-lock" && p.hasInstallScript !== undefined)
-      .map((p) => [`${p.name}@${p.version}`, !!p.hasInstallScript])
-  );
-  for (const { pkg, dir } of pkgDirs) {
-    try {
-      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      const scriptSnippet = lifecycleScriptSnippet(pj.scripts);
-      if (scriptSnippet && lockScriptMeta.get(`${pkg}@${pj.version || ""}`) === false) {
-        add(pkg, {
-          key: "install-script-drift",
-          severity: "high",
-          nearZeroFp: false,
-          what: "installed package has lifecycle scripts absent from package-lock metadata",
-          snippet: scriptSnippet,
-        }, join(dir, "package.json"));
-      }
-      for (const sig of classifyInstallScript(pj.scripts)) add(pkg, sig, join(dir, "package.json"));
-    } catch { /* not a package */ }
-  }
-  for (const p of installed) {
-    const sig = p.resolved ? classifyResolvedUrl(p.resolved) : null;
-    if (sig) add(p.name, sig, "package-lock.json");
-  }
-
-  // ---- phase B: content sweep ----
-  let scanMode = "none";
-  if (contentRoots.length) {
-    const rg = forceNode ? null : await resolveRg("auto", rgPath);
-    let swept = false;
-    if (rg) {
-      const { hits, errored, total } = await rgSweep(rg, contentRoots, timeoutMs);
-      if (errored < total) {
-        // honest label: full when every rule ran, partial when some rules failed (don't claim
-        // full coverage we didn't get); every-rule-failed falls through to the Node sweep below.
-        const kinds = [...new Set(contentRoots.map((r) => r.kind))].join("+");
-        scanMode = errored ? `ripgrep-partial (${total - errored}/${total} sweeps; ${kinds})` : `ripgrep-full (${kinds})`;
-        swept = true;
-        for (const h of hits) add(h.pkg, h.rule, h.file, h.line, h.text);
-      }
-    }
-    if (!swept) {
-      scanMode = rg ? "node-limited (ripgrep failed)" : "node-limited";
-      for (const h of nodeSweep(nmDir, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
-    }
-  } else {
-    scanMode = "skipped";
-  }
-
-  // ---- path-aware cheap checks: things that need file names or magic bytes, not just regex text.
-  // These run regardless of rg availability and stay bounded; content regex still does the broad sweep.
-  for (const h of fileHeuristicSweep(contentRoots, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
-
+// scanMalware orchestration (split out of malware-heuristics.js): phase A install scripts +
+// lockfile origins, phase B content sweep, path-aware file heuristics, then scoring.
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveRg } from "../scan/search.js";
+import { classifyInstallScript, classifyResolvedUrl, isCloudSdkMetadataUse } from "./registry-sig.js";
+import { fileHeuristicSweep } from "./malware-file-heuristics.js";
+import { buildMalwareFindings } from "./malware-scoring.js";
+import { parseMalwareExclusions, isManifestUrlNoise, isDocUrlNoise, isMalwareSignalExcluded, lifecycleScriptSnippet } from "./malware-heuristics.exclusions.js";
+import { buildContentRoots, listPkgDirs } from "./malware-heuristics.roots.js";
+import { rgSweep, nodeSweep } from "./malware-heuristics.sweep.js";
+
+// → { findings, scanMode } ; importedPkgs = Set of packages the repo's own code imports (evidence note).
+export async function scanMalware(repoPath, { installed = [], importedPkgs = new Set(), rgPath = "", forceNode = false, timeoutMs = 60000, malwareExclusions = {} } = {}) {
+  const nmDir = join(repoPath, "node_modules");
+  const contentRoots = buildContentRoots(repoPath, installed);
+  const byPkg = new Map(); // pkg -> [{rule signal, file, line, snippet}]
+  const exclusions = parseMalwareExclusions(malwareExclusions);
+  let excludedSignals = 0;
+  const add = (pkg, sig, file = "", line = 0, snippet = "") => {
+    if (!pkg) return;
+    const signal = { ...sig, file, line, snippet: snippet || sig.snippet || "" };
+    if (isManifestUrlNoise(file, signal) || isDocUrlNoise(file, signal) || isCloudSdkMetadataUse(pkg, signal.key) || isMalwareSignalExcluded(pkg, signal, exclusions)) {
+      excludedSignals++;
+      return;
+    }
+    (byPkg.get(pkg) || byPkg.set(pkg, []).get(pkg)).push(signal);
+  };
+
+  // ---- phase A: install scripts (from node_modules package.jsons) + lockfile resolved origins ----
+  const pkgDirs = existsSync(nmDir) ? listPkgDirs(nmDir) : [];
+  const lockScriptMeta = new Map(
+    (installed || [])
+      .filter((p) => p.ecosystem === "npm" && p.source === "package-lock" && p.hasInstallScript !== undefined)
+      .map((p) => [`${p.name}@${p.version}`, !!p.hasInstallScript])
+  );
+  for (const { pkg, dir } of pkgDirs) {
+    try {
+      const pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      const scriptSnippet = lifecycleScriptSnippet(pj.scripts);
+      if (scriptSnippet && lockScriptMeta.get(`${pkg}@${pj.version || ""}`) === false) {
+        add(pkg, {
+          key: "install-script-drift",
+          severity: "high",
+          nearZeroFp: false,
+          what: "installed package has lifecycle scripts absent from package-lock metadata",
+          snippet: scriptSnippet,
+        }, join(dir, "package.json"));
+      }
+      for (const sig of classifyInstallScript(pj.scripts)) add(pkg, sig, join(dir, "package.json"));
+    } catch { /* not a package */ }
+  }
+  for (const p of installed) {
+    const sig = p.resolved ? classifyResolvedUrl(p.resolved) : null;
+    if (sig) add(p.name, sig, "package-lock.json");
+  }
+
+  // ---- phase B: content sweep ----
+  let scanMode = "none";
+  if (contentRoots.length) {
+    const rg = forceNode ? null : await resolveRg("auto", rgPath);
+    let swept = false;
+    if (rg) {
+      const { hits, errored, total } = await rgSweep(rg, contentRoots, timeoutMs);
+      if (errored < total) {
+        // honest label: full when every rule ran, partial when some rules failed (don't claim
+        // full coverage we didn't get); every-rule-failed falls through to the Node sweep below.
+        const kinds = [...new Set(contentRoots.map((r) => r.kind))].join("+");
+        scanMode = errored ? `ripgrep-partial (${total - errored}/${total} sweeps; ${kinds})` : `ripgrep-full (${kinds})`;
+        swept = true;
+        for (const h of hits) add(h.pkg, h.rule, h.file, h.line, h.text);
+      }
+    }
+    if (!swept) {
+      scanMode = rg ? "node-limited (ripgrep failed)" : "node-limited";
+      for (const h of nodeSweep(nmDir, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
+    }
+  } else {
+    scanMode = "skipped";
+  }
+
+  // ---- path-aware cheap checks: things that need file names or magic bytes, not just regex text.
+  // These run regardless of rg availability and stay bounded; content regex still does the broad sweep.
+  for (const h of fileHeuristicSweep(contentRoots, pkgDirs)) add(h.pkg, h.rule, h.file, h.line, h.text);
+
   return buildMalwareFindings({ byPkg, importedPkgs, contentRoots, scanMode, excludedSignals });
 }