weavatrix 0.3.6 → 0.3.7

package/docs/releases/v0.3.7.md

@@ -0,0 +1,37 @@
+# Weavatrix 0.3.7
+
+0.3.7 fixes three defects surfaced by cross-repository validation: a
+reverse-shell detection gap, an unbounded ripgrep-path probe that could hang the
+server, and a `search_code` path that excluded `node_modules` only through the
+gitignore stack.
+
+## Reverse-shell pre-filter now covers the confirming regex
+
+The malware content sweep uses each rule's `pattern` as the ripgrep pre-filter
+and only then applies the stricter `re` to confirm. The reverse-shell `pattern`
+had drifted narrower than its `re`: it required `SOCK_STREAM` followed by
+`/bin/sh` or `exec`, so socket-backed shells using `connect`, `subprocess`,
+`pty.spawn` or `os.dup2` — and default `socket.socket()` calls with no
+`SOCK_STREAM` literal — were dropped before they could be confirmed. The
+pre-filter is now a superset of the confirming regex, and a new invariant test
+asserts that every payload the confirming regex flags is also surfaced by the
+pre-filter.
+
+A separate, deeper case is deliberately left for a follow-up: multi-line reverse
+shells, where ripgrep's per-line matching cannot span a `socket` call and the
+shell invocation on different lines.
+
+## Bounded ripgrep-path probe
+
+The `where`/`which rg` fallback in the MCP ripgrep resolver ran `spawnSync`
+without a timeout on the main thread, so a slow or unreachable PATH entry (for
+example a disconnected network drive) could hang the server. The probe now runs
+with a three-second timeout and `windowsHide`.
+
+## search_code excludes node_modules explicitly
+
+The `search_code` ripgrep invocation passed `--hidden` with only a `.git`
+exclusion, leaving `node_modules` out of results solely through ripgrep's
+implicit gitignore stack — which fails for repositories that commit their
+dependency tree or lack a gitignore. An explicit `!node_modules` glob is now
+applied; a caller-supplied glob is still appended afterward and wins.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: reusable architecture graph for fast application understanding, Health, dead code, clones, history, blast radius and architecture safeguards.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -40,6 +40,7 @@
     "docs/releases/v0.3.4.md",
     "docs/releases/v0.3.5.md",
     "docs/releases/v0.3.6.md",
+    "docs/releases/v0.3.7.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/mcp-rg.mjs

@@ -43,7 +43,7 @@ export function createRgResolver(selfDir) {
         } catch { /* optional packaged ripgrep path */ }
         for (const c of editorRgCandidates()) if (existsSync(c)) return (rgPath = c)
         try {
-            const probe = spawnSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {encoding: 'utf8', env: childProcessEnv()})
+            const probe = spawnSync(process.platform === 'win32' ? 'where' : 'which', ['rg'], {encoding: 'utf8', env: childProcessEnv(), timeout: 3000, windowsHide: true})
             const p = probe.status === 0 ? probe.stdout.split(/\r?\n/)[0].trim() : ''
             if (p && existsSync(p)) return (rgPath = p)
         } catch { /* optional PATH probe */ }

package/src/mcp-source-tools.mjs

@@ -14,7 +14,10 @@ const MAX_SOURCE_CONTEXT_LINES = 1000
 function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = spawnSync) {
     const rg = resolveRg()
     if (!rg) return null
-    const args = ['--line-number', '--no-heading', '--color', 'never', '--hidden', '-g', '!.git/**', '-m', '100', '-i']
+    // Exclude node_modules explicitly: --hidden + the default gitignore stack is the only thing that
+    // keeps a dependency tree out, which fails for repos that commit node_modules or lack a gitignore.
+    // A caller-supplied glob is appended after this and still wins (rg: last matching glob decides).
+    const args = ['--line-number', '--no-heading', '--color', 'never', '--hidden', '-g', '!.git/**', '-g', '!node_modules', '-m', '100', '-i']
     if (!isRegex) args.push('--fixed-strings')
     if (glob) args.push('-g', glob)
     // Run from the repository root and search `.` so path globs such as `src/**` are evaluated

package/src/security/registry-sig.rules.js

@@ -35,7 +35,10 @@ export const CONTENT_RULES = [
     nearZeroFp: true,
     // canonical reverse/bind shells — a shell wired to a socket. Essentially never legitimate inside a
     // published package: /dev/tcp redirection, netcat -e, interactive-shell redirect, mkfifo pipe shell.
-    pattern: "/dev/tcp/[0-9]|\\bnc(at)?\\s+-e\\b|\\b(ba)?sh\\s+-i\\b\\s*(2)?>&|mkfifo\\b.{0,60}(ba)?sh\\b|0<&196|socket\\.socket\\(.{0,40}(SOCK_STREAM).{0,80}(/bin/sh|exec)",
+    // The rg pre-filter must stay a superset of `re` below: rg surfaces lines matching this string and
+    // only then is `re` applied to confirm, so a narrower pre-filter silently drops real reverse shells
+    // (e.g. socket + pty.spawn / os.dup2 / subprocess, or a default socket.socket() without SOCK_STREAM).
+    pattern: "/dev/tcp/[0-9]|\\bnc(at)?\\s+-e\\b|\\b(ba)?sh\\s+-i\\b\\s*(2)?>&|mkfifo\\b.{0,60}(ba)?sh\\b|0<&196|socket\\.socket\\(.{0,120}(connect|SOCK_STREAM).{0,180}(/bin/sh|subprocess|pty\\.spawn|os\\.dup2)",
     re: /\/dev\/tcp\/[0-9]|\bnc(at)?\s+-e\b|\b(ba)?sh\s+-i\b\s*(2)?>&|mkfifo\b[\s\S]{0,60}?\b(ba)?sh\b|0<&196|socket\.socket\([\s\S]{0,120}?(connect|SOCK_STREAM)[\s\S]{0,180}?(\/bin\/sh|subprocess|pty\.spawn|os\.dup2)/i,
     what: "reverse/bind-shell pattern (interactive shell wired to a socket)",
   },