@blamejs/exceptd-skills 0.19.34 → 0.19.36

package/lib/collectors/ai-api.js

@@ -13,16 +13,40 @@ const os = require("node:os");
 
 const COLLECTOR_ID = "ai-api";
 
-function readSafe(full, max = 256 * 1024) {
+// One definition, named at every call site. Written as a literal in both the
+// default and the callers, the two drift apart the moment the cap is raised,
+// and the only symptom is a credential store that quietly stops being scanned
+// at the old size.
+const SCAN_CAP_BYTES = 256 * 1024;
+
+// `skip` routes a non-read onto the collector_errors channel:
+// { errors, artifact_id, label }. A null return is indistinguishable between
+// "over the cap" and "unreadable", and both mean the file went unscanned — a
+// clean verdict over an unscanned credential store is the failure mode, so the
+// reason travels with the submission. `label` is home-relative: the absolute
+// path is operator-identifying and collector_meta already carries `home`.
+function readSafe(full, max = SCAN_CAP_BYTES, skip = null) {
+  const note = (kind, reason) => {
+    if (!skip || !Array.isArray(skip.errors)) return;
+    const entry = { kind, reason: `${skip.label || path.basename(full)}: ${reason}` };
+    if (skip.artifact_id) entry.artifact_id = skip.artifact_id;
+    skip.errors.push(entry);
+  };
   let fd;
   try {
     fd = fs.openSync(full, "r");
     const s = fs.fstatSync(fd);
-    if (s.size > max) return null;
+    if (s.size > max) {
+      note("file_too_large_skipped", `${s.size} bytes exceeds ${max}-byte scan limit; not scanned`);
+      return null;
+    }
     // readFileSync(fd) loops to EOF; a single readSync can return short on a
     // network or FUSE fd. Reading the open fd keeps fstat-then-read TOCTOU-free.
     return fs.readFileSync(fd, "utf8");
-  } catch { return null; }
+  } catch (e) {
+    note("read_failed", e.message);
+    return null;
+  }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
@@ -30,6 +54,27 @@ function fileExists(full) {
   try { return fs.statSync(full).isFile(); } catch { return false; }
 }
 
+// A credential store is one of three things, and only "absent" is a negative
+// finding. Truthiness collapses the other two: an empty file reads as "" and is
+// a completed scan, not a skipped one, while readSafe signals a skip with null.
+// The distinction is null-vs-string, and it drives the artifact's captured flag
+// and the indicator's verdict together so the two cannot disagree.
+const ABSENT = "absent";
+const UNREAD = "unread";
+const READ = "read";
+function storeState(exists, content) {
+  if (!exists) return ABSENT;
+  return content === null ? UNREAD : READ;
+}
+
+// A store that was never read cannot answer the question its indicator asks.
+// `miss` there is a clean bill of health over an unscanned file; a hit stands
+// on its own evidence and is unaffected by a sibling going unread.
+function verdict(found, undetermined) {
+  if (found) return "hit";
+  return undetermined ? "inconclusive" : "miss";
+}
+
 // Cleartext key exports: `export VAR=value`, `VAR=value`, fish `set -gx VAR value`.
 const AI_KEY_PATTERNS = [
   { id: "openai",       re: /(?:^|\n)\s*(?:export\s+|set\s+-gx\s+)?OPENAI_API_KEY\s*[= ]\s*['"]?sk-[A-Za-z0-9_-]{20,}/m },
@@ -129,7 +174,12 @@ function parseGcloudAdc(content) {
       privateKey: typeof j?.private_key === "string" ? j.private_key : "",
       clientEmail: typeof j?.client_email === "string" ? j.client_email : "",
     };
-  } catch { return { hasServiceAccount: false }; }
+  } catch (e) {
+    // Unparseable ADC is NOT evidence the file holds no service account; the
+    // parse failure travels so `gcp-service-account-json: miss` is not read as
+    // a clean bill of health.
+    return { hasServiceAccount: false, parse_error: e.message };
+  }
 }
 
 function parseKubeStaticToken(content) {
@@ -170,7 +220,17 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     for (const e of fs.readdirSync(fishConfD)) {
       if (e.endsWith(".fish")) shellRcs.push(path.join(fishConfD, e));
     }
-  } catch { /* fish not present */ }
+  } catch (e) {
+    // No fish conf.d is the normal case. A permission or I/O failure on one that
+    // IS there means those fragments went unscanned for key exports.
+    if (e.code !== "ENOENT") {
+      errors.push({
+        artifact_id: "shell-rc-files",
+        kind: "readdir_failed",
+        reason: `.config/fish/conf.d: ${e.message} — fragments not scanned`,
+      });
+    }
+  }
 
   const dotfileKeys = [
     ".openai", ".anthropic",
@@ -180,13 +240,24 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     path.join(".config", "azure-openai"),
   ].map(rel => path.join(home, rel));
 
-  const allKeyCarriers = [...shellRcs, ...dotfileKeys];
+  // Two artifacts share one scan loop. The carrier's own artifact_id travels
+  // with it so a skipped `~/.anthropic` is reported against dotfile-api-keys
+  // rather than pointing the operator at the shell-rc row.
+  const allKeyCarriers = [
+    ...shellRcs.map(p => ({ path: p, artifact_id: "shell-rc-files" })),
+    ...dotfileKeys.map(p => ({ path: p, artifact_id: "dotfile-api-keys" })),
+  ];
   const cleartextHitsByFile = {};
+  const cleartextUnread = [];
   let cleartextFp = null;
-  for (const p of allKeyCarriers) {
+  for (const { path: p, artifact_id } of allKeyCarriers) {
     if (!fileExists(p)) continue;
-    const c = readSafe(p);
-    if (c == null) continue;
+    const c = readSafe(p, SCAN_CAP_BYTES, {
+      errors, artifact_id, label: path.relative(home, p),
+    });
+    // Present but unread: the file could still hold a key, so it is a gap in
+    // the scan rather than a carrier with nothing in it.
+    if (c === null) { cleartextUnread.push(path.relative(home, p)); continue; }
     const hits = scanShellRc(c);
     if (hits.length > 0) {
       cleartextHitsByFile[path.relative(home, p)] = hits;
@@ -200,24 +271,64 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const cleartextAnyHit = Object.keys(cleartextHitsByFile).length > 0;
 
   const awsCredsPath = path.join(home, ".aws", "credentials");
-  const awsCredsContent = fileExists(awsCredsPath) ? readSafe(awsCredsPath) : null;
+  const awsCredsExists = fileExists(awsCredsPath);
+  const awsCredsContent = awsCredsExists
+    ? readSafe(awsCredsPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "aws-credentials", label: path.relative(home, awsCredsPath),
+    })
+    : null;
   const awsParsed = parseAwsCredentials(awsCredsContent);
   const longLivedAws = awsParsed.staticProfiles.length > 0;
 
   const gcloudAdcPath = path.join(home, ".config", "gcloud", "application_default_credentials.json");
-  const gcloudContent = fileExists(gcloudAdcPath) ? readSafe(gcloudAdcPath) : null;
+  const gcloudAdcExists = fileExists(gcloudAdcPath);
+  const gcloudContent = gcloudAdcExists
+    ? readSafe(gcloudAdcPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "gcp-credentials", label: path.relative(home, gcloudAdcPath),
+    })
+    : null;
   const gcloudParsed = parseGcloudAdc(gcloudContent);
+  if (gcloudParsed.parse_error) {
+    errors.push({
+      artifact_id: "gcp-credentials",
+      kind: "parse_failed",
+      reason: `${path.relative(home, gcloudAdcPath)}: ${gcloudParsed.parse_error} — service-account presence undetermined, not absent`,
+    });
+  }
 
   const kubeCfgPath = (env && env.KUBECONFIG) || path.join(home, ".kube", "config");
-  const kubeContent = fileExists(kubeCfgPath) ? readSafe(kubeCfgPath) : null;
+  // KUBECONFIG can point outside $HOME, where a home-relative label degrades to
+  // a `..` chain; the basename is enough to name the file that went unread.
+  // The separator is required: a bare prefix test also matches a SIBLING whose
+  // name merely starts with $HOME ("/home/rob" vs "/home/robert-backup"), which
+  // produces exactly the `../…` chain this branch exists to avoid — and leaks
+  // another account's directory name into the warning.
+  const kubeInHome = kubeCfgPath === home || kubeCfgPath.startsWith(home + path.sep);
+  const kubeLabel = kubeInHome ? path.relative(home, kubeCfgPath) : path.basename(kubeCfgPath);
+  const kubeCfgExists = fileExists(kubeCfgPath);
+  const kubeContent = kubeCfgExists
+    ? readSafe(kubeCfgPath, SCAN_CAP_BYTES, {
+      errors, artifact_id: "kube-config", label: kubeLabel,
+    })
+    : null;
   const kubeParsed = parseKubeStaticToken(kubeContent);
   const kubeStaticToken = kubeParsed.found;
 
+  const awsState = storeState(awsCredsExists, awsCredsContent);
+  const gcloudState = storeState(gcloudAdcExists, gcloudContent);
+  const kubeState = storeState(kubeCfgExists, kubeContent);
+
   const signal_overrides = {
-    "cleartext-api-key-in-dotfile": cleartextAnyHit ? "hit" : "miss",
-    "long-lived-aws-keys": longLivedAws ? "hit" : "miss",
-    "gcp-service-account-json": gcloudParsed.hasServiceAccount ? "hit" : "miss",
-    "kubeconfig-with-static-token": kubeStaticToken ? "hit" : "miss",
+    "cleartext-api-key-in-dotfile": verdict(cleartextAnyHit, cleartextUnread.length > 0),
+    "long-lived-aws-keys": verdict(longLivedAws, awsState === UNREAD),
+    // Unread and unparseable are the same answer here: nothing in the file was
+    // validated, so its service-account presence is undetermined rather than
+    // absent. JSON.parse never runs on an unread store, so the state carries it.
+    "gcp-service-account-json": verdict(
+      gcloudParsed.hasServiceAccount,
+      gcloudState === UNREAD || Boolean(gcloudParsed.parse_error),
+    ),
+    "kubeconfig-with-static-token": verdict(kubeStaticToken, kubeState === UNREAD),
   };
 
   // Per-indicator __fp_checks attestation. Path checks hold because every store
@@ -271,15 +382,32 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
       value: dotfileKeys.filter(p => fileExists(p)).map(p => path.relative(home, p)).join(", ") || "no AI vendor dotfile carriers found at the canonical paths",
       captured: true,
     },
-    "aws-credentials": awsCredsContent
+    // A null content is two different worlds: the store is not there, or it IS
+    // there and went unread (over the scan cap, permissions, I/O). Only the
+    // first is an absence. The second is captured:false with the reason on
+    // collector_errors — asserting "absent" over a credential file that exists
+    // is the same clean-verdict-over-an-unscanned-store failure the error
+    // channel was added to close.
+    "aws-credentials": awsState === READ
       ? { value: `${awsParsed.staticProfiles.length} long-lived profile(s): ${awsParsed.staticProfiles.join(", ") || "none"}`, captured: true }
-      : { value: "~/.aws/credentials absent", captured: true },
-    "gcp-credentials": gcloudContent
+      : awsState === UNREAD
+        ? { value: "~/.aws/credentials present but unread — profile inventory undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+        : { value: "~/.aws/credentials absent", captured: true },
+    // Read-but-unparseable is a fourth outcome, distinct from read, unread and
+    // absent: the bytes arrived and nothing in them was validated. Reporting
+    // captured:true there states service_account=false about a file never parsed.
+    "gcp-credentials": gcloudState === READ && !gcloudParsed.parse_error
       ? { value: `application_default_credentials.json present; service_account=${gcloudParsed.hasServiceAccount}`, captured: true }
-      : { value: "no gcloud ADC at the canonical path", captured: true, reason: "credentials.db / legacy_credentials/*/adc.json inspection deferred (no stdlib SQLite reader)" },
-    "kube-config": kubeContent
+      : gcloudState === READ
+        ? { value: "application_default_credentials.json present but unparseable — service-account presence undetermined, not absent", captured: false, reason: "JSON parse failed; see collector_errors for the reason" }
+        : gcloudState === UNREAD
+          ? { value: "application_default_credentials.json present but unread — service-account presence undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+          : { value: "no gcloud ADC at the canonical path", captured: true, reason: "credentials.db / legacy_credentials/*/adc.json inspection deferred (no stdlib SQLite reader)" },
+    "kube-config": kubeState === READ
       ? { value: `kubeconfig present; static_token=${kubeStaticToken}`, captured: true }
-      : { value: "no kubeconfig at the canonical path", captured: true },
+      : kubeState === UNREAD
+        ? { value: "kubeconfig present but unread — static-token presence undetermined, not absent", captured: false, reason: "read skipped or failed; see collector_errors for the reason" }
+        : { value: "no kubeconfig at the canonical path", captured: true },
     "ai-sdk-inventory": {
       value: "skipped — npm/pip global listing deferred to operator/AI evidence",
       captured: false,

package/lib/collectors/cicd-pipeline-compromise.js

@@ -17,40 +17,57 @@ const OIDC_WALK_EXCLUDES = codeExcludeSet();
 
 const COLLECTOR_ID = "cicd-pipeline-compromise";
 
+// Returns { text } when the file was read, otherwise { skipped, reason }: a file
+// that is never scanned reads as a "miss" on every indicator it would have
+// flipped, so the caller has to record the skip rather than drop it.
 function readSafe(p, max = 512 * 1024) {
   let fd;
   try {
     fd = fs.openSync(p, "r");
     const s = fs.fstatSync(fd);
-    if (s.size > max) return null;
+    if (s.size > max) return { skipped: "file_too_large", reason: `${s.size} bytes exceeds the ${max}-byte scan limit; not scanned` };
     // readFileSync(fd) loops read() to EOF; a single readSync can return short on
     // a network or FUSE fd. Reading the open fd keeps fstat-then-read TOCTOU-free.
-    return fs.readFileSync(fd, "utf8");
-  } catch { return null; }
+    return { text: fs.readFileSync(fd, "utf8") };
+  } catch (e) { return { skipped: "read_error", reason: (e && e.message) || String(e) }; }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
-function walkWorkflows(root) {
+function skipEntry(artifact_id, rel, r) {
+  return {
+    artifact_id,
+    kind: r.skipped === "file_too_large" ? "file_too_large_skipped" : "read_failed",
+    reason: `${rel}: ${r.reason}`,
+  };
+}
+
+function walkWorkflows(root, errors = []) {
   const out = [];
   const wfDir = path.join(root, ".github", "workflows");
   if (fs.existsSync(wfDir)) {
     let entries;
     try { entries = fs.readdirSync(wfDir, { withFileTypes: true }); }
-    catch { entries = []; }
+    catch (e) {
+      entries = [];
+      errors.push({ artifact_id: "workflow-yaml-inventory", kind: "readdir_failed", reason: `.github/workflows: ${e.message}` });
+    }
     for (const e of entries) {
       if (!e.isFile()) continue;
       if (!/\.(ya?ml)$/i.test(e.name)) continue;
       const full = path.join(wfDir, e.name);
-      const content = readSafe(full);
-      if (content != null) out.push({ full, rel: path.relative(root, full).replace(/\\/g, "/"), content });
+      const rel = path.relative(root, full).replace(/\\/g, "/");
+      const r = readSafe(full);
+      if (r.text != null) out.push({ full, rel, content: r.text });
+      else errors.push(skipEntry("workflow-yaml-inventory", rel, r));
     }
   }
   // Also recognise the most common single-file CI YAMLs at repo root.
   for (const top of [".gitlab-ci.yml", ".circleci/config.yml"]) {
     const full = path.join(root, top);
     if (fs.existsSync(full)) {
-      const content = readSafe(full);
-      if (content != null) out.push({ full, rel: top, content });
+      const r = readSafe(full);
+      if (r.text != null) out.push({ full, rel: top, content: r.text });
+      else errors.push(skipEntry("workflow-yaml-inventory", top, r));
     }
   }
   return out;
@@ -184,7 +201,7 @@ function scanWorkflow(content, rel) {
   return hits;
 }
 
-function scanOidcPolicies(root) {
+function scanOidcPolicies(root, errors = []) {
   // Walks the infra dirs to depth 4 for *.json naming
   // token.actions.githubusercontent.com with a wildcarded sub-claim.
   const rootDirs = ["infra", "terraform", "policies", ".aws", ".github"].map(d => path.join(root, d));
@@ -193,7 +210,14 @@ function scanOidcPolicies(root) {
     if (depth > 4 || finds.length > 5) return;
     let entries;
     try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch { return; }
+    catch (e) {
+      errors.push({
+        artifact_id: "oidc-trust-policy-inventory",
+        kind: "readdir_failed",
+        reason: `${path.relative(root, dir).replace(/\\/g, "/")}: ${e.message}`,
+      });
+      return;
+    }
     for (const e of entries) {
       if (OIDC_WALK_EXCLUDES.has(e.name)) continue;
       const full = path.join(dir, e.name);
@@ -204,15 +228,17 @@ function scanOidcPolicies(root) {
         continue;
       }
       if (!e.isFile() || !/\.json$/i.test(e.name)) continue;
-      const text = readSafe(full);
-      if (!text) continue;
+      const rel = path.relative(root, full).replace(/\\/g, "/");
+      const r = readSafe(full);
+      if (r.text == null) { errors.push(skipEntry("oidc-trust-policy-inventory", rel, r)); continue; }
+      const text = r.text;
       // Each pattern is bound to the leading `"` of the JSON key, so a lookalike
       // issuer like `"eviltoken.actions…"` cannot match.
       const subWildcard =
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"\*"/.test(text) ||
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"repo:\*[^"]*"/.test(text) ||
         /"token\.actions\.githubusercontent\.com:sub"\s*:\s*"repo:[^"]*\/\*:[^"]*"/.test(text);
-      if (subWildcard) finds.push({ file: path.relative(root, full).replace(/\\/g, "/"), snippet: "OIDC sub-claim wildcarded across repos or branches" });
+      if (subWildcard) finds.push({ file: rel, snippet: "OIDC sub-claim wildcarded across repos or branches" });
     }
   }
   for (const rd of rootDirs) if (fs.existsSync(rd)) walk(rd, 0);
@@ -245,7 +271,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     };
   }
 
-  const workflows = walkWorkflows(root);
+  const workflows = walkWorkflows(root, errors);
   const aggregateHits = {
     "workflow-injection-sink": [],
     "pull-request-target-with-pr-checkout": [],
@@ -257,14 +283,25 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     for (const [k, v] of Object.entries(h)) aggregateHits[k].push(...v);
   }
 
-  const oidcWildcards = scanOidcPolicies(root);
+  const oidcWildcards = scanOidcPolicies(root, errors);
+
+  // A workflow this collector could not read may hold the very thing each
+  // indicator looks for, so `miss` over an incomplete inventory is a clean
+  // verdict on evidence that was never examined. collector_errors are advisory
+  // and change no verdict on their own; the gap has to reach the signal. A hit
+  // stands on what WAS read and is unaffected.
+  const workflowScanIncomplete = errors.some(
+    (e) => e.artifact_id === "workflow-yaml-inventory");
+  const oidcScanIncomplete = errors.some(
+    (e) => e.artifact_id === "oidc-trust-policy-inventory");
+  const verdict = (found, incomplete) => (found ? "hit" : incomplete ? "inconclusive" : "miss");
 
   const signal_overrides = {
-    "workflow-injection-sink": aggregateHits["workflow-injection-sink"].length > 0 ? "hit" : "miss",
-    "pull-request-target-with-pr-checkout": aggregateHits["pull-request-target-with-pr-checkout"].length > 0 ? "hit" : "miss",
-    "actions-floating-tag-pin": aggregateHits["actions-floating-tag-pin"].length > 0 ? "hit" : "miss",
-    "secret-exposed-to-fork-pr": aggregateHits["secret-exposed-to-fork-pr"].length > 0 ? "hit" : "miss",
-    "wildcarded-oidc-sub-claim": oidcWildcards.length > 0 ? "hit" : "miss",
+    "workflow-injection-sink": verdict(aggregateHits["workflow-injection-sink"].length > 0, workflowScanIncomplete),
+    "pull-request-target-with-pr-checkout": verdict(aggregateHits["pull-request-target-with-pr-checkout"].length > 0, workflowScanIncomplete),
+    "actions-floating-tag-pin": verdict(aggregateHits["actions-floating-tag-pin"].length > 0, workflowScanIncomplete),
+    "secret-exposed-to-fork-pr": verdict(aggregateHits["secret-exposed-to-fork-pr"].length > 0, workflowScanIncomplete),
+    "wildcarded-oidc-sub-claim": verdict(oidcWildcards.length > 0, oidcScanIncomplete),
   };
 
   // File locations for every indicator flipped to "hit", so a SARIF result points
@@ -280,14 +317,20 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   const artifacts = {
     "workflow-yaml-inventory": {
-      value: workflows.length ? workflows.map(w => w.rel).join(", ") : "no workflow files found at cwd",
-      captured: true,
+      value: workflowScanIncomplete
+        ? `${workflows.length} workflow(s) read, at least one skipped — inventory incomplete, see collector_errors`
+        : workflows.length ? workflows.map(w => w.rel).join(", ") : "no workflow files found at cwd",
+      captured: !workflowScanIncomplete,
+      ...(workflowScanIncomplete ? { reason: "one or more workflow files or the workflow directory could not be read" } : {}),
     },
     "oidc-trust-policy-inventory": {
-      value: oidcWildcards.length
-        ? `${oidcWildcards.length} wildcarded sub-claim(s): ${oidcWildcards.map(f => f.file).join(", ")}`
-        : "no wildcarded OIDC sub-claim found in infra / terraform / policies",
-      captured: true,
+      value: oidcScanIncomplete
+        ? `${oidcWildcards.length} wildcarded sub-claim(s) found, at least one policy file skipped — inventory incomplete, see collector_errors`
+        : oidcWildcards.length
+          ? `${oidcWildcards.length} wildcarded sub-claim(s): ${oidcWildcards.map(f => f.file).join(", ")}`
+          : "no wildcarded OIDC sub-claim found in infra / terraform / policies",
+      captured: !oidcScanIncomplete,
+      ...(oidcScanIncomplete ? { reason: "one or more trust-policy files or directories could not be read" } : {}),
     },
     "actions-sha-pinning": {
       value: `${aggregateHits["actions-floating-tag-pin"].length} non-SHA third-party uses: reference(s) across ${workflows.length} workflow(s)`,
@@ -319,7 +362,9 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     // authorization scope, and the playbook gates the precondition `on_fail: halt`.
     precondition_checks: {
       "cwd-is-repo": true,
-      "ci-config-readable": true,
+      // An attestation that the CI configuration was readable, so it cannot
+      // stay true over a file this collector failed to open.
+      "ci-config-readable": !workflowScanIncomplete,
       "operator-owns-ci-fleet": args.attestOwnership === true || args["attest-ownership"] === true,
     },
     artifacts,

package/lib/collectors/library-author.js

@@ -14,7 +14,6 @@ const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require(
 
 const COLLECTOR_ID = "library-author";
 
-const DEFAULT_MAX_DEPTH = 6;
 // Applied to the vendor-tree walk, so a cache nested under `vendor/` is not
 // mistaken for vendored provenance state.
 const DEFAULT_EXCLUDES = codeExcludeSet();
@@ -96,7 +95,104 @@ function stripYamlComments(content) {
   return content.replace(/#.*$/gm, "");
 }
 
-function scanPublishWorkflow(content, rel) {
+// Splits comment-stripped workflow text into individual shell commands, so a
+// flag on one install cannot vouch for another. A workflow that hash-pins its
+// build requirements and then resolves its runtime ones must still report the
+// unpinned command, which a whole-file flag test would suppress.
+function shellCommands(code) {
+  const out = [];
+  const lines = code.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    // A real `run:` line is never KBs long; skipping overlong ones keeps a
+    // crafted whitespace run from driving regex backtracking.
+    if (lines[i].length > 4096) continue;
+    // A backslash-continued command is ONE command: a `pip install \` whose
+    // `-r` sits on the next line is otherwise two fragments that each match
+    // nothing. The continuation lines are consumed, never re-emitted.
+    const startLine = i + 1;
+    let raw = lines[i];
+    while (/\\[ \t]*$/.test(raw) && i + 1 < lines.length &&
+           lines[i + 1].length <= 4096 && raw.length <= 8192) {
+      raw = `${raw.replace(/\\[ \t]*$/, " ")}${lines[i + 1].trim()}`;
+      i++;
+    }
+    for (const seg of raw.split(/&&|\|\||[;|]/)) {
+      const cmd = seg.trim();
+      // Comment stripping preserves line breaks, so the index still addresses
+      // the line the command STARTS on in the file an operator opens.
+      if (cmd) out.push({ cmd, line: startLine });
+    }
+  }
+  return out;
+}
+
+// Evidence snippets are read in a report, so a pathological one-line script
+// cannot be pasted in whole.
+function snippetOf(cmd, max = 200) {
+  return cmd.length > max ? `${cmd.slice(0, max)}…` : cmd;
+}
+
+// pip enters hash-checking mode as soon as ONE requirement carries a hash, so
+// `pip install -r <file>` against a `pip-compile --generate-hashes` output is
+// already reproducible. Resolves the named file one level only: a nested `-r`
+// include is not followed, and an unreadable path counts as unhashed.
+// pip accepts the requirement file attached (`-rreq.txt`) as well as separated
+// (`-r req.txt`, `--requirement=req.txt`). One definition for both the detection
+// predicate and the hash lookup: two regexes for one flag drift, and the pair
+// that drifts silently is a command examined by neither.
+// `(?:^|\s)-r` rather than `\b-r` so the `-r` inside `--requirement` is not read
+// as the short form with `equirement...` as its filename.
+const PIP_REQUIREMENT_RE = /(?:^|\s)(?:-r\s*=?\s*|--requirement[=\s]*)['"]?([^'"\s]+)/;
+
+function pipRequirementTarget(cmd) {
+  const m = cmd.match(PIP_REQUIREMENT_RE);
+  return m ? m[1] : null;
+}
+
+// `working-directory:`, at job defaults or on a single step, is what a `run:`
+// command resolves its relative paths against. Collected as a set of candidate
+// bases rather than bound to the step that declared it: the scanner is
+// line-based, so attributing one to a specific command would need the step
+// nesting it does not track.
+// Matches the block form and the flow form (`{ run: { working-directory: x } }`)
+// alike. A key-shaped string inside a `run:` command matches too; that only adds
+// a base that does not resolve, and an unresolvable base is skipped.
+function workingDirectories(code) {
+  const dirs = [];
+  for (const m of code.matchAll(/working-directory:\s*['"]?([^'"\n,}]+?)['"]?\s*(?=$|[,}])/gm)) {
+    const d = m[1].trim();
+    if (d && d !== "." && !path.isAbsolute(d)) dirs.push(d);
+  }
+  return dirs;
+}
+
+// True only when every candidate that EXISTS is hash-pinned, and at least one
+// does. Requiring all of them keeps a hashed copy in one working directory from
+// vouching for an unhashed copy in another — over-suppression here reports an
+// unpinned release as reproducible, which is the direction that costs something.
+// A target that resolves nowhere stays unproven, so the caller still reports it.
+function requirementsFileIsHashed(cmd, root, extraBases = []) {
+  if (!root) return false;
+  const target = pipRequirementTarget(cmd);
+  if (!target) return false;
+  if (path.isAbsolute(target)) return false;
+
+  let found = 0;
+  for (const base of [root, ...extraBases.map((d) => path.resolve(root, d))]) {
+    // Never read outside the scanned tree, whatever `../` the workflow names —
+    // for the base itself as well as the target resolved against it.
+    if (base !== root && !base.startsWith(root + path.sep)) continue;
+    const full = path.resolve(base, target);
+    if (full !== root && !full.startsWith(root + path.sep)) continue;
+    const body = readSafe(full);
+    if (body === null) continue;
+    found++;
+    if (!/--hash=/.test(body)) return false;
+  }
+  return found > 0;
+}
+
+function scanPublishWorkflow(content, rel, root) {
   // Whole-content probes read `code`; the `uses:` scan below stays on raw lines.
   const code = stripYamlComments(content);
   const hits = {
@@ -140,11 +236,51 @@ function scanPublishWorkflow(content, rel) {
     }
   }
 
+  // npm alone stays a whole-file test, because its suppressor is a DIFFERENT
+  // command rather than a flag: `npm ci` elsewhere in the workflow is the
+  // frozen install, and the `npm install` line beside it is usually tooling.
   if (/\bnpm\s+install\b/.test(code) && !/\bnpm\s+ci\b/.test(code)) {
     hits["release-workflow-non-frozen-install"].push({ file: rel, line: 0, snippet: "publish workflow uses `npm install` rather than `npm ci` — lockfile is not enforced" });
   }
-  if (/\bcargo\s+(?:build|install)\b/.test(code) && !/--locked\b/.test(code) && !/--frozen\b/.test(code)) {
-    hits["release-workflow-non-frozen-install"].push({ file: rel, line: 0, snippet: "cargo build/install without --locked / --frozen" });
+
+  // Bundler's frozen mode can be set once for the job rather than per command
+  // (`bundle config set frozen/deployment`, or the BUNDLE_ env equivalents), so
+  // that suppressor is genuinely file-scoped; the flags below are not.
+  // The setting has to be turned ON. `bundle config set frozen false` names the
+  // key and disables it, so matching the key alone reads an explicit opt-out as
+  // the protection it opts out of — the env form already required a value.
+  const bundlerFrozenConfig =
+    /\bbundle\s+config\b[^\n]*\b(?:frozen|deployment)\s+['"]?(?:true|1)\b/.test(code) ||
+    /\bBUNDLE_(?:FROZEN|DEPLOYMENT)\s*[:=]\s*['"]?(?:true|1)\b/i.test(code);
+
+  const runBases = workingDirectories(code);
+
+  // Every remaining ecosystem is probed one command at a time. The playbook
+  // indicator names npm / pnpm / pip -r / bundle; cargo is probed on the same
+  // --locked / --frozen predicate.
+  for (const { cmd, line } of shellCommands(code)) {
+    if (/\bcargo\s+(?:build|install)\b/.test(cmd) && !/--locked\b/.test(cmd) && !/--frozen\b/.test(cmd)) {
+      hits["release-workflow-non-frozen-install"].push({ file: rel, line, snippet: `cargo build/install without --locked / --frozen: ${snippetOf(cmd)}` });
+    }
+    // Without --require-hashes the requirement set resolves at release time, so
+    // the artifact is not reproducible — unless the named file is hash-pinned,
+    // which switches pip into hash-checking mode on its own.
+    if (/\b(?:pip3?|python3?\s+-m\s+pip)\s+install\b/.test(cmd) &&
+        pipRequirementTarget(cmd) !== null &&
+        !/--require-hashes\b/.test(cmd) &&
+        !requirementsFileIsHashed(cmd, root, runBases)) {
+      hits["release-workflow-non-frozen-install"].push({ file: rel, line, snippet: `pip install -r without --require-hashes — requirements are resolved at release time: ${snippetOf(cmd)}` });
+    }
+    // pnpm defaults to --frozen-lockfile when CI is set, which GitHub Actions
+    // always sets — so a bare `pnpm install` here is already frozen and only an
+    // explicit opt-out resolves at release time.
+    if (/\bpnpm\s+(?:install|i)\b/.test(cmd) &&
+        /--no-frozen-lockfile\b|--frozen-lockfile[=\s]+false\b/.test(cmd)) {
+      hits["release-workflow-non-frozen-install"].push({ file: rel, line, snippet: `pnpm install opts out of the frozen lockfile: ${snippetOf(cmd)}` });
+    }
+    if (/\bbundle\s+install\b/.test(cmd) && !/--deployment\b/.test(cmd) && !/--frozen\b/.test(cmd) && !bundlerFrozenConfig) {
+      hits["release-workflow-non-frozen-install"].push({ file: rel, line, snippet: `bundle install without --deployment / --frozen: ${snippetOf(cmd)}` });
+    }
   }
 
   if (/runs-on:\s*['"]?(?:self-hosted|\[?\s*self-hosted)/i.test(code)) {
@@ -193,7 +329,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   // OIDC capability is evaluated per publish workflow, never repo-wide: a sibling
   // workflow's `id-token: write` gives nothing to a job using a static token.
   for (const w of publishWorkflows) {
-    const h = scanPublishWorkflow(w.content, w.rel);
+    const h = scanPublishWorkflow(w.content, w.rel, root);
     for (const [id, list] of Object.entries(h)) workflowHits[id].push(...list);
   }