@bongos/core 1.18.18 → 1.19.2

package/modules/security/tests/artifact_scan.mjs

@@ -0,0 +1,591 @@
+// modules/security/tests/artifact_scan.mjs
+//
+// Task 1002542 (goal 1000055) — the hardened fetch, the quarantine location
+// rules, and the deterministic manifest.
+//
+// These are the FIRST leg of the scan engine, and their whole job is to deny a
+// hostile artifact any chance to act. So the tests assert the security contract
+// directly rather than the happy path: the exact git hardening flags, the
+// refusal rules for where a quarantine may live, that symlinks are never
+// followed, and that a cap trips FAIL-CLOSED instead of truncating quietly.
+//
+// The fetch tests inject a stub runner, so the full argv/env contract is proven
+// with zero network and nothing cloned.
+//
+// Pure (no DB / network) — runs in `node scripts/gds/run-unit-tests.js`.
+// Run directly:  node modules/security/tests/artifact_scan.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const quarantine = require('../artifact-scan/quarantine.js');
+const manifest = require('../artifact-scan/manifest.js');
+const fetchMod = require('../artifact-scan/fetch.js');
+
+const { createQuarantine, siteRefusal, isSyncBacked, isInside, REPO_ROOT, CAPS } = quarantine;
+const { buildManifest, verifyUnchanged, CapExceeded, KIND } = manifest;
+const { validateTargetUrl, hardeningConfig, hardenedEnv, parseLsFiles, fetchArtifact, blockedAddress, assertHostResolvesPublic } = fetchMod;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const tmpDirs = [];
+function mkTmp() {
+  const d = fs.mkdtempSync(path.join(os.tmpdir(), 'as-test-'));
+  tmpDirs.push(d);
+  return fs.realpathSync(d);
+}
+
+// ---------------------------------------------------------------- quarantine
+
+await test('siteRefusal refuses the repository itself', async () => {
+  const r = siteRefusal(path.join(REPO_ROOT, 'sub'), []);
+  assert.ok(r && r.includes('repository'), `expected a repo refusal, got ${r}`);
+});
+
+await test('siteRefusal refuses a cloud-sync folder (it would upload the artifact)', async () => {
+  const r = siteRefusal(path.join(path.sep, 'Users', 'x', 'OneDrive', 'tmp'), []);
+  assert.ok(r && r.includes('sync'), `expected a sync refusal, got ${r}`);
+});
+
+await test('siteRefusal refuses a workspace root — an artifact CLAUDE.md must not auto-load', async () => {
+  const ws = path.join(path.sep, 'work', 'space');
+  const r = siteRefusal(path.join(ws, 'inner'), [ws]);
+  assert.ok(r && r.includes('workspace root'), `expected a workspace refusal, got ${r}`);
+});
+
+await test('siteRefusal allows a clean temp location', async () => {
+  assert.equal(siteRefusal(mkTmp(), []), null);
+});
+
+await test('isSyncBacked matches case-insensitively on a path segment', async () => {
+  assert.equal(isSyncBacked(path.join(path.sep, 'a', 'onedrive', 'b')), true);
+  assert.equal(isSyncBacked(path.join(path.sep, 'a', 'OneDrive', 'b')), true);
+  assert.equal(isSyncBacked(path.join(path.sep, 'a', 'onedriver', 'b')), false);
+});
+
+await test('isInside is directional — a parent is not inside its child', async () => {
+  const root = path.join(path.sep, 'q');
+  assert.equal(isInside(root, path.join(root, 'a', 'b')), true);
+  assert.equal(isInside(root, root), true);
+  assert.equal(isInside(path.join(root, 'a'), root), false);
+  assert.equal(isInside(root, path.join(path.sep, 'other')), false);
+});
+
+await test('createQuarantine builds an EMPTY REAL hooks dir and an empty gitconfig', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    assert.ok(fs.statSync(q.hooksDir).isDirectory(), 'hooksDir must be a real directory (Windows has no /dev/null dir)');
+    assert.equal(fs.readdirSync(q.hooksDir).length, 0, 'hooksDir must be empty');
+    assert.equal(fs.readFileSync(q.gitConfigFile, 'utf8'), '');
+    assert.ok(fs.statSync(q.mirrorDir).isDirectory());
+    assert.equal(fs.existsSync(q.pristineDir), false, 'git clone must create pristineDir itself');
+  } finally { q.cleanup(); }
+});
+
+await test('createQuarantine refuses to build inside a workspace root', async () => {
+  const ws = mkTmp();
+  assert.throws(() => createQuarantine({ tmpRoot: ws, forbiddenRoots: [ws] }), /workspace root/);
+});
+
+await test('forbiddenRoots is REQUIRED — a silent default would disable the defense', async () => {
+  assert.throws(() => createQuarantine({ tmpRoot: mkTmp() }), /requires forbiddenRoots/);
+});
+
+await test('cleanup removes the whole pen', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  const root = q.root;
+  q.cleanup();
+  assert.equal(fs.existsSync(root), false);
+});
+
+// ------------------------------------------------------------------ manifest
+
+function seedTree(root) {
+  fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'README.md'), 'hello\n');
+  fs.writeFileSync(path.join(root, 'src', 'a.js'), 'module.exports = 1;\n');
+  fs.writeFileSync(path.join(root, 'src', 'b.js'), 'module.exports = 2;\n');
+}
+
+await test('manifest paths are POSIX and sorted by UTF-8 bytes, not locale', async () => {
+  const root = mkTmp();
+  seedTree(root);
+  const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  assert.deepEqual(m.entries.map((e) => e.path), ['README.md', 'src/a.js', 'src/b.js']);
+  assert.equal(m.fileCount, 3);
+  assert.ok(m.entries.every((e) => !e.path.includes('\\')), 'no backslashes in manifest paths');
+});
+
+await test('content_hash is stable across rebuilds and changes when a byte changes', async () => {
+  const root = mkTmp();
+  seedTree(root);
+  const a = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  const b = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  assert.equal(a.contentHash, b.contentHash);
+
+  fs.writeFileSync(path.join(root, 'src', 'a.js'), 'module.exports = 99;\n');
+  const c = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  assert.notEqual(a.contentHash, c.contentHash);
+});
+
+await test('verifyUnchanged is what stands between "scan passed" and "here is the command"', async () => {
+  const root = mkTmp();
+  seedTree(root);
+  const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  assert.equal((await verifyUnchanged(root, m)).ok, true);
+
+  fs.writeFileSync(path.join(root, 'evil.js'), 'gotcha\n');
+  assert.equal((await verifyUnchanged(root, m)).ok, false, 'a file added after the scan must invalidate the manifest');
+});
+
+await test('buildManifest refuses an implicit unlimited budget', async () => {
+  await assert.rejects(() => buildManifest(mkTmp(), {}), /fail-closed/);
+});
+
+await test('a file-count cap aborts FAIL-CLOSED rather than truncating', async () => {
+  const root = mkTmp();
+  seedTree(root);
+  try {
+    await buildManifest(root, { maxFiles: 2, maxBytes: 1e6 });
+    assert.fail('expected CapExceeded');
+  } catch (err) {
+    assert.ok(err instanceof CapExceeded);
+    assert.equal(err.code, 'cap_max_files');
+  }
+});
+
+await test('a byte cap aborts FAIL-CLOSED', async () => {
+  const root = mkTmp();
+  seedTree(root);
+  try {
+    await buildManifest(root, { maxFiles: 100, maxBytes: 5 });
+    assert.fail('expected CapExceeded');
+  } catch (err) {
+    assert.equal(err.code, 'cap_max_bytes');
+  }
+});
+
+await test('a symlink is recorded by its link text and its target is NEVER opened', async () => {
+  const root = mkTmp();
+  const secretDir = mkTmp();
+  const secret = path.join(secretDir, 'credentials');
+  fs.writeFileSync(secret, 'AKIA-SUPER-SECRET-TOKEN\n');
+  fs.writeFileSync(path.join(root, 'README.md'), 'hi\n');
+  try {
+    fs.symlinkSync(secret, path.join(root, 'stolen'));
+  } catch {
+    console.log('     (skipped: this platform/account cannot create symlinks)');
+    return;
+  }
+  const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
+  const link = m.entries.find((e) => e.path === 'stolen');
+  assert.equal(link.kind, KIND.SYMLINK);
+  assert.equal(link.sha256, null, 'a symlink must not be hashed — that would read the target');
+  assert.equal(link.linkTarget, secret);
+  const serialized = JSON.stringify(m);
+  assert.ok(!serialized.includes('SUPER-SECRET'), 'the target CONTENTS must appear nowhere in the manifest');
+});
+
+// --------------------------------------------------------------------- fetch
+
+await test('validateTargetUrl accepts https and records the host', async () => {
+  const r = validateTargetUrl('https://github.com/acme/tool');
+  assert.equal(r.ok, true);
+  assert.equal(r.host, 'github.com');
+});
+
+await test('validateTargetUrl refuses every non-https scheme', async () => {
+  for (const u of ['ssh://git@github.com/a/b', 'git://github.com/a/b', 'file:///etc/passwd', 'http://github.com/a/b']) {
+    assert.equal(validateTargetUrl(u).ok, false, `${u} must be refused`);
+  }
+});
+
+await test('validateTargetUrl refuses embedded credentials and loopback', async () => {
+  assert.equal(validateTargetUrl('https://user:pw@github.com/a/b').ok, false);
+  assert.equal(validateTargetUrl('https://localhost/a/b').ok, false);
+  assert.equal(validateTargetUrl('https://127.0.0.1/a/b').ok, false);
+});
+
+// SSRF. The scan URL is attacker-chosen, so an unblocked private range turns
+// the scanner into a metadata-endpoint fetcher and an internal port scanner.
+await test('the cloud metadata endpoint is refused', async () => {
+  const r = validateTargetUrl('https://169.254.169.254/latest/meta-data/');
+  assert.equal(r.ok, false);
+  assert.match(r.refusal, /metadata/);
+});
+
+await test('every private and reserved literal range is refused', async () => {
+  const blocked = [
+    '10.0.0.5', '172.16.0.1', '172.31.255.254', '192.168.1.1',
+    '169.254.169.254', '127.0.0.1', '0.0.0.0', '100.64.0.1', '224.0.0.1',
+  ];
+  for (const host of blocked) {
+    assert.equal(validateTargetUrl(`https://${host}/a/b`).ok, false, `${host} must be refused`);
+  }
+});
+
+await test('IPv6 loopback, unique-local, link-local, and v4-mapped forms are refused', async () => {
+  for (const host of ['[::1]', '[::ffff:127.0.0.1]', '[fc00::1]', '[fd12:3456::1]', '[fe80::1]']) {
+    assert.equal(validateTargetUrl(`https://${host}/a/b`).ok, false, `${host} must be refused`);
+  }
+});
+
+await test('routable public addresses and hostnames still pass', async () => {
+  for (const host of ['github.com', '140.82.121.4', '8.8.8.8', '172.15.0.1', '172.32.0.1', '192.169.0.1']) {
+    assert.equal(validateTargetUrl(`https://${host}/a/b`).ok, true, `${host} must be allowed`);
+  }
+});
+
+await test('blockedAddress is honest about what it cannot catch', async () => {
+  // A NAME that resolves to a private address is not caught here — resolution
+  // happens inside git. This asserts the documented limit rather than pretending.
+  assert.equal(blockedAddress('internal.corp.example'), null);
+});
+
+await test('the git hardening contract is present in full', async () => {
+  const cfg = hardeningConfig({ hooksDir: '/q/empty-hooks' }).join(' ');
+  for (const required of [
+    'core.symlinks=false',
+    'core.hooksPath=/q/empty-hooks',
+    'protocol.file.allow=never',
+    'protocol.ext.allow=never',
+    'transfer.fsckObjects=true',
+    'credential.helper=',
+    'filter.lfs.smudge=',
+  ]) {
+    assert.ok(cfg.includes(required), `missing hardening: ${required}`);
+  }
+});
+
+await test("hardenedEnv neutralizes the builder's own git config and LFS", () => {
+  const env = hardenedEnv({ gitConfigFile: '/q/empty-gitconfig' });
+  assert.equal(env.GIT_TERMINAL_PROMPT, '0');
+  assert.equal(env.GIT_CONFIG_GLOBAL, '/q/empty-gitconfig');
+  assert.equal(env.GIT_CONFIG_SYSTEM, '/q/empty-gitconfig');
+  assert.equal(env.GIT_CONFIG_NOSYSTEM, '1');
+  assert.equal(env.GIT_LFS_SKIP_SMUDGE, '1');
+  assert.equal(env.GIT_ASKPASS, '');
+});
+
+await test('hardenedEnv emits no case-insensitive duplicate keys (Windows spawn ENOENT)', async () => {
+  const env = hardenedEnv({ gitConfigFile: '/q/empty-gitconfig' });
+  const lowered = Object.keys(env).map((k) => k.toLowerCase());
+  assert.equal(lowered.length, new Set(lowered).size, 'a duplicate PATH/Path breaks CreateProcess on Windows');
+});
+
+await test('hardenedEnv forwards only what git needs — no ambient secrets', async () => {
+  const KEY = 'ARTIFACT_SCAN_FAKE_SECRET';
+  process.env[KEY] = 'super-secret-token';
+  try {
+    const env = hardenedEnv({ gitConfigFile: '/q/empty-gitconfig' });
+    assert.equal(env[KEY], undefined, 'an ambient secret must NOT reach a subprocess talking to a third-party host');
+    assert.ok(env.PATH || env.Path, 'git still needs PATH');
+  } finally {
+    delete process.env[KEY];
+  }
+});
+
+await test('parseLsFiles reads mode and path, tolerating paths with spaces', async () => {
+  const modes = parseLsFiles('100644 abc 0\tREADME.md\n120000 def 0\tsome dir/link\n');
+  assert.deepEqual(modes, [
+    { mode: '100644', path: 'README.md' },
+    { mode: '120000', path: 'some dir/link' },
+  ]);
+});
+
+
+// Stub runner + stub resolver standing in for git and DNS: the whole argv/env
+// contract is proven with zero network and nothing cloned or resolved.
+const PUBLIC_IP = ['140.82.121.4'];
+const stubResolve = async () => PUBLIC_IP;
+
+function stubRun(q, { modes = '100644 abc 0\tREADME.md\n', sha = 'a'.repeat(40), lsTruncated = false, lsStatus = 0 } = {}) {
+  const calls = [];
+  return {
+    calls,
+    async run(args, opts) {
+      calls.push({ args, opts });
+      if (args.includes('clone')) {
+        fs.mkdirSync(path.join(q.pristineDir, '.git'), { recursive: true });
+        fs.writeFileSync(path.join(q.pristineDir, '.git', 'config'), 'x');
+        fs.writeFileSync(path.join(q.pristineDir, 'README.md'), 'hello\n');
+        return { status: 0, stdout: '', stderr: '', timedOut: false, truncated: false, error: null };
+      }
+      if (args.includes('rev-parse')) return { status: 0, stdout: sha + '\n', stderr: '', timedOut: false, truncated: false, error: null };
+      if (args.includes('ls-files')) return { status: lsStatus, stdout: lsStatus === 0 ? modes : '', stderr: '', timedOut: false, truncated: lsTruncated, error: null };
+      return { status: 1, stdout: '', stderr: 'unexpected', timedOut: false, truncated: false, error: null };
+    },
+  };
+}
+
+await test('fetchArtifact pins a SHA, drops .git, and manifests the content', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q);
+    const res = await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    assert.equal(res.sha, 'a'.repeat(40));
+    assert.equal(fs.existsSync(path.join(q.pristineDir, '.git')), false, '.git must be removed after the SHA is captured');
+    assert.deepEqual(res.manifest.entries.map((e) => e.path), ['README.md']);
+
+    const cloneArgs = stub.calls[0].args.join(' ');
+    assert.ok(cloneArgs.includes('--depth 1'));
+    assert.ok(cloneArgs.includes('--no-recurse-submodules'));
+    assert.ok(cloneArgs.includes('core.symlinks=false'));
+    assert.ok(cloneArgs.includes(' -- '), 'the URL must sit after -- so it can never be read as a flag');
+  } finally { q.cleanup(); }
+});
+
+await test('ls-files runs BEFORE .git is deleted — it is the only symlink witness', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q);
+    await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    const order = stub.calls.map((c) => (c.args.includes('clone') ? 'clone' : c.args.includes('rev-parse') ? 'rev-parse' : 'ls-files'));
+    assert.deepEqual(order, ['clone', 'rev-parse', 'ls-files']);
+  } finally { q.cleanup(); }
+});
+
+await test('a gitlink and a symlink each become a reported finding', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q, { modes: '120000 abc 0\tstolen\n160000 def 0\tvendor/sub\n' });
+    const res = await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    const codes = res.findings.map((f) => f.code);
+    assert.ok(codes.includes('symlink_in_artifact'));
+    assert.ok(codes.includes('submodule_not_fetched'), 'an unfetched submodule is unreviewed code and must be surfaced');
+  } finally { q.cleanup(); }
+});
+
+await test('the gitlink finding carries unscannable so the coverage cap can see wholly unreviewed submodule code', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q, { modes: '160000 def 0\tvendor/sub\n' });
+    const res = await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    const sub = res.findings.find((f) => f.code === 'submodule_not_fetched');
+    // A gitlink materializes as an EMPTY dir, so the manifest records nothing
+    // for it — this flag is the only thing that keeps it off a clean verdict.
+    assert.equal(sub.detail.unscannable, true);
+  } finally { q.cleanup(); }
+});
+
+await test('a TRUNCATED git index is a finding — a submodule past the cut must never read as "none"', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    // The clipped listing shows only regular files; the real gitlink sat past
+    // the 1 MiB capture cap and is invisible. Silence here was a fail-open.
+    const stub = stubRun(q, { lsTruncated: true });
+    const res = await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    const f = res.findings.find((x) => x.code === 'git_index_truncated');
+    assert.ok(f, 'a truncated index listing must be surfaced');
+    assert.equal(f.severity, 'high');
+    assert.equal(f.detail.unscannable, true);
+  } finally { q.cleanup(); }
+});
+
+await test('a FAILED git index read is a finding, not an empty list of modes', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q, { lsStatus: 128 });
+    const res = await fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve });
+    const f = res.findings.find((x) => x.code === 'git_index_unread');
+    assert.ok(f, 'an unreadable index must be surfaced');
+    assert.equal(f.detail.unscannable, true);
+  } finally { q.cleanup(); }
+});
+
+// DNS. A literal-only block is trivially bypassed by pointing an A record at a
+// private address, so resolution is checked before git is ever invoked.
+await test('a hostname RESOLVING to cloud metadata is refused before git runs', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    let ran = false;
+    await assert.rejects(
+      () => fetchArtifact('https://evil.example.com/a/b', {
+        quarantine: q,
+        run: async () => { ran = true; return { status: 0 }; },
+        resolveHost: async () => ['169.254.169.254'],
+      }),
+      /resolves to .*metadata/
+    );
+    assert.equal(ran, false, 'git must never be invoked once the name resolves private');
+  } finally { q.cleanup(); }
+});
+
+await test('a hostname resolving to RFC 1918 is refused, even if one answer is public', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    await assert.rejects(
+      () => fetchArtifact('https://evil.example.com/a/b', {
+        quarantine: q,
+        run: async () => ({ status: 0 }),
+        resolveHost: async () => ['140.82.121.4', '10.0.0.5'],
+      }),
+      /host_resolves_private|RFC 1918/
+    );
+  } finally { q.cleanup(); }
+});
+
+await test('an unresolvable host aborts with a finding rather than reaching git', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    await assert.rejects(
+      () => fetchArtifact('https://nope.invalid/a/b', {
+        quarantine: q,
+        run: async () => ({ status: 0 }),
+        resolveHost: async () => { throw new Error('ENOTFOUND'); },
+      }),
+      (err) => err.code === 'host_unresolvable' && err.finding.severity === 'high'
+    );
+  } finally { q.cleanup(); }
+});
+
+await test('assertHostResolvesPublic passes a genuinely public answer through', async () => {
+  const addrs = await assertHostResolvesPublic('github.com', stubResolve);
+  assert.deepEqual(addrs, PUBLIC_IP);
+});
+
+await test('a clone timeout aborts the scan rather than reporting on nothing', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const run = async () => ({ status: null, stdout: '', stderr: '', timedOut: true, error: 'ETIMEDOUT' });
+    await assert.rejects(
+      () => fetchArtifact('https://github.com/acme/tool', { quarantine: q, run, resolveHost: stubResolve }),
+      /exceeded the .*cap/
+    );
+  } finally { q.cleanup(); }
+});
+
+await test('EVERY abort carries a .finding — a dead scan must be recordable, not silent', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const cases = [
+      ['clone_timeout', async () => ({ status: null, stdout: '', stderr: '', timedOut: true, error: 'ETIMEDOUT' })],
+      ['clone_failed', async () => ({ status: 128, stdout: '', stderr: 'repository not found', timedOut: false, error: null })],
+    ];
+    for (const [code, run] of cases) {
+      await assert.rejects(
+        () => fetchArtifact('https://github.com/acme/tool', { quarantine: q, run, resolveHost: stubResolve }),
+        (err) => err.code === code && err.finding?.code === code && err.finding.severity === 'high'
+      );
+    }
+  } finally { q.cleanup(); }
+});
+
+await test("git stderr stays out of the thrown message and only a capped excerpt survives", async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const secret = 'internal-host-42.corp.local';
+    const run = async () => ({ status: 128, stdout: '', stderr: `fatal: could not read from ${secret}`, timedOut: false, error: null });
+    await assert.rejects(
+      () => fetchArtifact('https://github.com/acme/tool', { quarantine: q, run, resolveHost: stubResolve }),
+      (err) => {
+        assert.ok(!err.message.includes(secret), 'stderr must not land in a message a caller might echo');
+        assert.ok(err.finding.detail.stderr_excerpt.includes(secret), 'the excerpt is still available for the record');
+        assert.ok(err.finding.detail.stderr_excerpt.length <= 300);
+        return true;
+      }
+    );
+  } finally { q.cleanup(); }
+});
+
+await test('chunked hashing matches a whole-file hash exactly', async () => {
+  const root = mkTmp();
+  // Comfortably larger than one 1 MiB hash chunk, so the loop really iterates.
+  const big = Buffer.alloc(3 * 1024 * 1024 + 12345, 0x61);
+  fs.writeFileSync(path.join(root, 'big.bin'), big);
+  const m = await buildManifest(root, { maxFiles: 10, maxBytes: 10 * 1024 * 1024 });
+  const expected = crypto.createHash('sha256').update(big).digest('hex');
+  assert.equal(m.entries[0].sha256, expected);
+});
+
+await test('the shared hash buffer does not bleed between files', async () => {
+  const root = mkTmp();
+  const big = Buffer.alloc(2 * 1024 * 1024, 0x62);
+  const small = Buffer.from('tiny\n');
+  fs.writeFileSync(path.join(root, 'a-big.bin'), big);
+  fs.writeFileSync(path.join(root, 'b-small.txt'), small);
+  const m = await buildManifest(root, { maxFiles: 10, maxBytes: 10 * 1024 * 1024 });
+  const byPath = Object.fromEntries(m.entries.map((e) => [e.path, e.sha256]));
+  assert.equal(byPath['a-big.bin'], crypto.createHash('sha256').update(big).digest('hex'));
+  assert.equal(byPath['b-small.txt'], crypto.createHash('sha256').update(small).digest('hex'));
+});
+
+await test('concurrent manifests do not corrupt each other (per-call hash buffer)', async () => {
+  // Async made concurrency possible, so a module-level shared buffer would let
+  // two interleaved walks overwrite each other's chunks mid-digest.
+  const mk = (fill, size) => {
+    const root = mkTmp();
+    const body = Buffer.alloc(size, fill);
+    fs.writeFileSync(path.join(root, 'blob.bin'), body);
+    return { root, body };
+  };
+  const a = mk(0x61, 2 * 1024 * 1024 + 7);
+  const b = mk(0x62, 3 * 1024 * 1024 + 11);
+  const opts = { maxFiles: 10, maxBytes: 16 * 1024 * 1024 };
+  const [ma, mb] = await Promise.all([buildManifest(a.root, opts), buildManifest(b.root, opts)]);
+  assert.equal(ma.entries[0].sha256, crypto.createHash('sha256').update(a.body).digest('hex'));
+  assert.equal(mb.entries[0].sha256, crypto.createHash('sha256').update(b.body).digest('hex'));
+});
+
+await test('symlinks count against maxFiles too — a cap on regular files only is bypassable', async () => {
+  const root = mkTmp();
+  fs.writeFileSync(path.join(root, 'a.txt'), 'a');
+  try {
+    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l1'));
+    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l2'));
+  } catch {
+    console.log('     (skipped: this platform/account cannot create symlinks)');
+    return;
+  }
+  await assert.rejects(() => buildManifest(root, { maxFiles: 2, maxBytes: 1e6 }), /entry cap/);
+});
+
+await test('a cap trip surfaces as a fail-closed abort carrying its finding', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    const stub = stubRun(q);
+    await assert.rejects(
+      () => fetchArtifact('https://github.com/acme/tool', { quarantine: q, run: stub.run, resolveHost: stubResolve, maxFiles: 0 }),
+      (err) => /cannot produce an honest verdict/.test(err.message) && err.finding.code === 'cap_max_files'
+    );
+  } finally { q.cleanup(); }
+});
+
+await test('fetchArtifact refuses a non-https target before doing anything', async () => {
+  const q = createQuarantine({ tmpRoot: mkTmp(), forbiddenRoots: [] });
+  try {
+    let ran = false;
+    let resolved = false;
+    await assert.rejects(
+      () => fetchArtifact('file:///etc/passwd', {
+        quarantine: q,
+        run: async () => { ran = true; return { status: 0 }; },
+        resolveHost: async () => { resolved = true; return PUBLIC_IP; },
+      }),
+      /Only https/
+    );
+    assert.equal(ran, false, 'git must never be invoked for a refused URL');
+    assert.equal(resolved, false, 'a refused URL must not even be resolved');
+  } finally { q.cleanup(); }
+});
+
+await test('CAPS are finite — no accidental unlimited default', async () => {
+  assert.ok(Number.isFinite(CAPS.maxFiles) && CAPS.maxFiles > 0);
+  assert.ok(Number.isFinite(CAPS.maxBytes) && CAPS.maxBytes > 0);
+  assert.ok(Number.isFinite(CAPS.cloneTimeoutMs) && CAPS.cloneTimeoutMs > 0);
+});
+
+for (const d of tmpDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
+
+console.log(`\nartifact_scan: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);