@bongos/core 1.18.19 → 1.19.2

package/modules/security/artifact-scan/detectors/credentials.js

@@ -0,0 +1,112 @@
+// modules/security/artifact-scan/detectors/credentials.js — references to
+// credential stores (task 1002544).
+//
+// The pattern list is CURATED AND NAMED, not clever: each entry is a specific
+// place secrets live — including our own ~/.config/otb/gds-session.json and
+// the Windows stores — spelled the way code spells it. A hit means "this
+// artifact's text names a credential store", nothing more; whether it READS it
+// is runtime behavior a static floor cannot see, and the finding says so.
+//
+// Patterns are tiered by SIGNAL, because the co-occurrence critical (floor.js)
+// must not cry wolf:
+//   FILE  — a concrete on-disk secret store path (.aws/credentials, id_rsa,
+//           gds-session.json). Co-located with a network sink this is the
+//           strong read-then-send shape, so ONLY file-class hits arm the
+//           co-occurrence critical.
+//   ENV   — an environment-variable NAME (GITHUB_TOKEN, NPM_TOKEN). Ordinary
+//           tooling reads these next to a fetch() constantly, so an env hit is
+//           a medium on its own and never on its own arms the critical.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const SEP = String.raw`[\\/]+`;
+
+// [label, regex, class]. Regexes are case-insensitive and separator-agnostic.
+// The SSH pattern is written WITHOUT `.*` before an alternation — a greedy
+// `.*(?:_rsa|_ed25519)` backtracks catastrophically on a long non-matching
+// line (ReDoS) and would hang the floor before any report is persisted; a
+// bounded `[^\\/\n]*` cannot.
+const CREDENTIAL_PATTERNS = Object.freeze([
+  ['our own GDS CLI session token', new RegExp(String.raw`gds-session\.json|\.config${SEP}otb`, 'i'), 'file'],
+  ['SSH private key', new RegExp(String.raw`\.ssh${SEP}[^\\/\n]*(?:_rsa|_ed25519|_ecdsa)|\bid_rsa\b|\bid_ed25519\b|\bid_ecdsa\b`, 'i'), 'file'],
+  ['AWS credentials file', new RegExp(String.raw`\.aws${SEP}credentials`, 'i'), 'file'],
+  ['netrc', new RegExp(String.raw`(?:^|[^\w.])\.?_?netrc\b`, 'i'), 'file'],
+  ['git stored credentials', new RegExp(String.raw`\.git-credentials`, 'i'), 'file'],
+  ['GitHub CLI hosts file', new RegExp(String.raw`\.config${SEP}gh${SEP}hosts\.yml`, 'i'), 'file'],
+  ['kubeconfig file', new RegExp(String.raw`\.kube${SEP}config`, 'i'), 'file'],
+  ['Docker credential store', new RegExp(String.raw`\.docker${SEP}config\.json`, 'i'), 'file'],
+  ['browser credential/cookie store', new RegExp(String.raw`Login Data|moz_logins|\blogins\.json\b|User Data${SEP}Default`, 'i'), 'file'],
+  ['cloud metadata endpoint', metadataEndpointRegex(), 'file'],
+  // The negative lookbehind is load-bearing: without it, `.env` matches inside
+  // `process.env`, misclassifying every env-var access as a credential FILE
+  // read and arming the co-occurrence critical on ordinary Node code.
+  ['generic .env secret file', new RegExp(String.raw`(?<![\w.])\.env(?:\.local|\.production|\.development)?\b`, 'i'), 'file'],
+  // ENV class — variable NAMES, not files. Medium, never arms co-occurrence.
+  ['AWS secret env var', /AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN/, 'env'],
+  ['npm auth env var', /\b_authToken\b|\bNPM_TOKEN\b/, 'env'],
+  ['GitHub token env var', /\bGH_TOKEN\b|\bGITHUB_TOKEN\b/, 'env'],
+  ['kubeconfig env var', /\bKUBECONFIG\b/, 'env'],
+  // Windows / macOS secret-store API calls — execution surface, treated file-class.
+  ['Windows Credential Manager', /\bcmdkey\b|\bvaultcmd\b|\bCredRead\b|\bCredEnumerate\b|Windows\.Security\.Credentials|PasswordVault/i, 'file'],
+  ['Windows DPAPI', /CryptUnprotectData|ProtectedData\.Unprotect/i, 'file'],
+  ['macOS Keychain', /security\s+find-(?:generic|internet)-password|\bKeychain\b/, 'file'],
+]);
+
+// The cloud-metadata endpoint in every form git/Node can reach it: dotted,
+// decimal, hex, octal, IPv6, and the AWS/GCP hostnames. A literal-string match
+// (169.254.169.254 only) is defeated by writing the same address as the integer
+// 2852039166 or 0xa9fea9fe — both of which resolve to the same host.
+function metadataEndpointRegex() {
+  return new RegExp([
+    '169\\.254\\.169\\.254',            // dotted
+    '\\b2852039166\\b',                 // decimal
+    '0xa9fea9fe',                       // hex
+    '0251\\.0376\\.0251\\.0376',        // dotted octal
+    '\\[?fd00:ec2::254\\]?',            // AWS IPv6
+    'metadata\\.google\\.internal',
+    '\\binstance-data\\b',
+    'metadata\\.azure\\.com',
+  ].join('|'), 'i');
+}
+
+// Structured per-file hits for the floor's co-occurrence join. Each hit carries
+// its class so floor.js can arm the critical on file-class hits only.
+//
+// Memoized per corpus object: detect() and floor.coOccurrence() both need this,
+// and re-running every regex over the whole tree twice per scan is pure waste.
+// The corpus is immutable for the life of a scan, so a WeakMap keyed on it is a
+// safe cache that also lets the object be GC'd when the scan ends.
+const _hitsCache = new WeakMap();
+function perFileHits(corpus) {
+  const cached = _hitsCache.get(corpus);
+  if (cached) return cached;
+  const hits = new Map(); // path -> [{ label, line, klass }]
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    for (const [label, re, klass] of CREDENTIAL_PATTERNS) {
+      const m = re.exec(file.text);
+      if (m) {
+        if (!hits.has(file.path)) hits.set(file.path, []);
+        hits.get(file.path).push({ label, line: lineAt(file.text, m.index), klass });
+      }
+    }
+  }
+  _hitsCache.set(corpus, hits);
+  return hits;
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const [path, fileHits] of perFileHits(corpus)) {
+    for (const h of fileHits) {
+      findings.push(finding('credential_store_reference', h.klass === 'file' ? 'high' : 'medium', path,
+        `Names a credential store (${h.label}) at line ${h.line} — whether it is read is runtime behavior this static pass cannot see.`,
+        { store: h.label, line: h.line, klass: h.klass }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, perFileHits, CREDENTIAL_PATTERNS };

package/modules/security/artifact-scan/detectors/dependencies.js

@@ -0,0 +1,115 @@
+// modules/security/artifact-scan/detectors/dependencies.js — the declared
+// dependency list and registry configuration (task 1002544).
+//
+// The scan never fetches dependencies, so every declared dependency is code
+// the install would pull that NOBODY here read — that alone caps coverage.
+// Within the list, specs are graded by how much the install outcome can drift
+// from what a reviewer might have vetted: a git/http/file spec fetches from an
+// arbitrary place (high), a floating spec ('*', 'latest', ranges) means the
+// registry decides the bytes at install time (wildcards medium, ranges low —
+// ranges are ecosystem-normal). A .npmrc registry override redirects EVERY
+// package to a server the artifact's author chose — the classic dependency-
+// confusion delivery vehicle (high).
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict } = require('./shared');
+
+const DEP_SECTIONS = Object.freeze([
+  'dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies',
+]);
+
+function specSeverity(spec) {
+  const s = String(spec).trim();
+  // Protocol / shorthand sources that fetch from an arbitrary place, not the
+  // registry version the reviewer might have vetted.
+  if (/^(?:git\+|git:|github:|gitlab:|bitbucket:|https?:|file:|link:|portal:|workspace:|patch:)/i.test(s)) {
+    return { severity: 'high', kind: 'non-registry source' };
+  }
+  // `npm:pkg@range` alias — the installed package is NOT the one this key names.
+  if (/^npm:/i.test(s)) return { severity: 'high', kind: 'aliased package' };
+  // Bare `user/repo` (optionally `#ref`) with no protocol is GitHub shorthand.
+  if (/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(s) && !/^[\d]/.test(s)) {
+    return { severity: 'high', kind: 'github shorthand' };
+  }
+  if (s === '' || s === '*' || s === 'latest' || s === 'next' || /^[x*]$/i.test(s)) {
+    return { severity: 'medium', kind: 'wildcard' };
+  }
+  if (/^(?:\^|~|>=?|<=?)/.test(s) || /\.(x|\*)/i.test(s) || /\s*\|\|\s*/.test(s) || /\s-\s/.test(s)) {
+    return { severity: 'low', kind: 'floating range' };
+  }
+  return null; // pinned exact version — inventoried via the declared count, not a finding
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    const name = basename(file.path);
+
+    if (name === 'package.json') {
+      const parsed = parseJsonStrict(file.text);
+      // No config_unparseable here (asymmetric with hooks/mcp on purpose):
+      // npm-lifecycle.js already emits it for every unparseable package.json,
+      // and this detector fires on the SAME files — a second copy would only
+      // inflate the count.
+      if (!parsed.ok || !parsed.value || typeof parsed.value !== 'object') continue;
+      let declared = 0;
+      for (const section of DEP_SECTIONS) {
+        const deps = parsed.value[section];
+        if (!deps || typeof deps !== 'object' || Array.isArray(deps)) continue;
+        for (const [dep, spec] of Object.entries(deps)) {
+          declared++;
+          const graded = specSeverity(spec);
+          if (graded) {
+            findings.push(finding('dependency_floating_spec', graded.severity, file.path,
+              `${section}.${excerpt(dep, 80)} = "${excerpt(String(spec), 80)}" (${graded.kind}) — the installed bytes are decided at install time, not here.`,
+              { section, dep: excerpt(dep, 80), spec: excerpt(String(spec), 80), kind: graded.kind }));
+          }
+        }
+      }
+      if (declared > 0) {
+        findings.push(finding('dependencies_unfetched', 'medium', file.path,
+          `${declared} declared dependencies were never fetched or read — the install would pull code nobody here reviewed.`,
+          { declared, unscannable: true }));
+      }
+      const overrides = parsed.value.overrides || parsed.value.resolutions;
+      if (overrides && typeof overrides === 'object') {
+        findings.push(finding('dependency_overrides', 'medium', file.path,
+          `package.json pins transitive dependencies via overrides/resolutions — the tree the lockfile implies is not the tree npm resolves.`,
+          null));
+      }
+      const pubReg = parsed.value.publishConfig && parsed.value.publishConfig.registry;
+      if (typeof pubReg === 'string') {
+        findings.push(finding('registry_override', 'high', file.path,
+          `publishConfig.registry points at ${excerpt(pubReg)}.`, { registry: excerpt(pubReg) }));
+      }
+    }
+
+    if (name === '.npmrc' || name === 'npmrc') {
+      // .npmrc is INI-ish; the floor greps line-wise rather than trusting any
+      // parser — every line is checked raw, so there is no parse/grep gap.
+      const lines = file.text.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (/^(?:@[^:]+:)?registry\s*=/.test(line)) {
+          findings.push(finding('registry_override', 'high', file.path,
+            `.npmrc redirects package resolution (line ${i + 1}): ${excerpt(line)} — the dependency-confusion delivery vehicle.`,
+            { line: i + 1, text: excerpt(line) }));
+        }
+        if (/_authToken|_auth\s*=|always-auth/.test(line)) {
+          findings.push(finding('npmrc_auth_config', 'medium', file.path,
+            `.npmrc carries auth configuration (line ${i + 1}): ${excerpt(line)}.`,
+            { line: i + 1 }));
+        }
+        if (/^ignore-scripts\s*=\s*false/.test(line)) {
+          findings.push(finding('npmrc_scripts_enabled', 'high', file.path,
+            `.npmrc explicitly re-enables install scripts (line ${i + 1}).`, { line: i + 1 }));
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, specSeverity, DEP_SECTIONS };

package/modules/security/artifact-scan/detectors/hooks.js

@@ -0,0 +1,116 @@
+// modules/security/artifact-scan/detectors/hooks.js — Claude Code hook
+// definitions bundled inside an artifact (task 1002544).
+//
+// A hook in .claude/settings.json runs a SHELL COMMAND every time the harness
+// fires the matching event — installing an artifact that carries one is
+// granting it standing code execution inside every future session. The floor
+// quotes every hook command verbatim (scrubbed + capped) and names the matcher
+// breadth, because "PreToolUse on *" and "PostToolUse on Edit:src/foo.js" are
+// wildly different grants that render identically in a quick skim.
+//
+// The walk is shape-generic (any "hooks" key anywhere in any .claude/ JSON or
+// a root settings.json): the schema has evolved and an artifact aiming at a
+// FUTURE schema still deserves a finding today.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, grepParseDisagreement } = require('./shared');
+
+function isClaudeConfig(p) {
+  const name = basename(p);
+  if (p.includes('.claude/') || p.includes('.claude\\')) return name.endsWith('.json');
+  return name === 'settings.json' || name === 'settings.local.json'
+    || name === 'managed-settings.json' || name === '.claude.json';
+}
+
+// A matcher that matches everything: '*', empty, or missing.
+function matcherBreadth(matcher) {
+  if (matcher === undefined || matcher === null || matcher === '' || matcher === '*') return 'ALL tool calls';
+  return `matcher "${excerpt(matcher, 80)}"`;
+}
+
+// Same cap as shared.countKeysDeep: a legitimate hooks config never nests this
+// deep, and an unbounded walk over hostile (but JSON.parse-valid) nesting is a
+// stack overflow. Depth past the cap is UNREVIEWED, surfaced as a finding.
+const MAX_TREE_DEPTH = 40;
+
+// Collect { matcher, command, event } from any hooks-shaped subtree. In the
+// live schema the matcher sits on an ANCESTOR of the command node
+// ([{ matcher, hooks: [{ type, command }] }]), so the nearest enclosing
+// matcher is threaded down to each command it governs. `state` is
+// { hooks: [], truncated: false }; truncated flips when the depth cap stopped
+// the walk, so detect() can report the unreviewed subtree.
+function collectHooks(value, event, matcher, state, depth = 0) {
+  if (value === null || typeof value !== 'object') return;
+  if (depth > MAX_TREE_DEPTH) { state.truncated = true; return; }
+  if (Array.isArray(value)) {
+    for (const item of value) collectHooks(item, event, matcher, state, depth + 1);
+    return;
+  }
+  const m = typeof value.matcher === 'string' ? value.matcher : matcher;
+  // A `command` key that is present but not a string is an unreviewable grant,
+  // not a non-event: record it as opaque so a sibling string command can never
+  // let it slip out of the report silently.
+  if (Object.prototype.hasOwnProperty.call(value, 'command')) {
+    if (typeof value.command === 'string') state.hooks.push({ event, matcher: m, command: value.command });
+    else state.hooks.push({ event, matcher: m, command: null, opaque: true });
+  }
+  for (const [k, v] of Object.entries(value)) {
+    if (k !== 'command') collectHooks(v, event, m, state, depth + 1);
+  }
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isClaudeConfig(file.path)) continue;
+    const parsed = parseJsonStrict(file.text);
+
+    const hooksNode = parsed.ok && parsed.value && typeof parsed.value === 'object' ? parsed.value.hooks : undefined;
+    if (hooksNode && typeof hooksNode === 'object') {
+      for (const [event, subtree] of Object.entries(hooksNode)) {
+        const state = { hooks: [], truncated: false };
+        collectHooks(subtree, event, undefined, state);
+        const collected = state.hooks;
+        if (state.truncated) {
+          findings.push(finding('config_depth_cap', 'high', file.path,
+            `"hooks.${event}" nests deeper than the ${MAX_TREE_DEPTH}-level review cap — the deeper subtree is an unreviewable hook grant.`,
+            { event, reason: 'depth_cap' }));
+        }
+        for (const h of collected) {
+          if (h.opaque) {
+            findings.push(finding('claude_hook_opaque', 'high', file.path,
+              `${h.event} hook on ${matcherBreadth(h.matcher)} has a non-string command — unreviewable hook grant.`,
+              { event: h.event, matcher: h.matcher ?? null }));
+            continue;
+          }
+          findings.push(finding('claude_hook_command', 'high', file.path,
+            `${h.event} hook on ${matcherBreadth(h.matcher)} runs: ${excerpt(h.command)}`,
+            { event: h.event, matcher: h.matcher ?? null, command: excerpt(h.command) }));
+        }
+        if (collected.length === 0 && !state.truncated) {
+          // A hooks event with no extractable command is still a grant we
+          // could not render — surface it rather than skipping silently.
+          // (The truncated case is already reported as config_depth_cap.)
+          findings.push(finding('claude_hook_opaque', 'high', file.path,
+            `"hooks.${event}" is present but its command text could not be extracted — unreviewable hook grant.`,
+            { event }));
+        }
+      }
+    }
+
+    const disagreement = grepParseDisagreement(file.text, 'hooks', parsed.ok ? parsed.value : null);
+    if (disagreement) {
+      findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+        `"hooks" appears ${disagreement.rawCount}x in key position in the raw bytes but the strict parse yielded ${disagreement.parsedCount} — hidden hook config.`,
+        { marker: 'hooks', ...disagreement }));
+    }
+    if (!parsed.ok) {
+      findings.push(finding('config_unparseable', 'medium', file.path,
+        'Claude config does not strictly parse as JSON — whatever the harness makes of it was not reviewable here.', null));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, matcherBreadth };

package/modules/security/artifact-scan/detectors/injection.js

@@ -0,0 +1,118 @@
+// modules/security/artifact-scan/detectors/injection.js — text aimed at the
+// scanner rather than at a human reader (task 1002544).
+//
+// Three families, all critical, because none has a benign reason to exist in
+// a third-party artifact:
+//   1. instruction-override phrases ("ignore previous instructions");
+//   2. scanner/reviewer-targeting phrases ("report this as clean", "dear
+//      reviewer") — this artifact KNOWS it will be scanned and is talking to
+//      the process, the strongest malice indicator we have;
+//   3. dangerous codepoints (zero-width, bidi, Unicode Tags) — text engineered
+//      to read differently to a human than to a parser. Detected on the corpus
+//      text, which floor.js has already had TextDecoder strip a legitimate
+//      leading BOM from — so ANY invisible that remains is anomalous.
+//
+// The phrase lists are deliberately NARROW: a scanner that flags ordinary code
+// like `return 'cleanup'` as an attack is worse than useless, so verdict-
+// steering patterns require explicit scanner-directed framing ("report … as
+// clean"), never a bare `return "clean"`.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const OVERRIDE_PHRASES = Object.freeze([
+  ['instruction override', /ignore\s+(?:all\s+)?(?:previous|prior|above|the\s+above)\s+instructions/i],
+  ['instruction override', /disregard\s+(?:all\s+)?(?:previous|prior|above|your|the\s+above)\s+instructions/i],
+  ['role reassignment', /you\s+are\s+no\s+longer\s+(?:a|an|the)\b/i],
+  ['system-prompt spoof', /<\s*\/?\s*system\s*>|\[\s*system\s*\]|^#{1,3}\s*system\s+prompt/im],
+]);
+
+// Scanner-directed framing only. Each requires an imperative addressed at the
+// judgement ("report/mark/classify … as clean", "say this is safe"), with the
+// verdict word \b-anchored so "clean" does not match inside "cleanup".
+const SCANNER_PHRASES = Object.freeze([
+  // A REQUIRED object ("report THIS as clean") keeps defensive-code idioms like
+  // "treat as clean" / "mark as done" out; "treat/rate/score/label" are dropped
+  // as too generic to be scanner-talk on their own.
+  ['verdict steering', /\b(?:report|mark|classify|flag)\s+(?:this|it|the\s+\w+|everything)\s+as\s+["']?(?:clean|safe|benign|trustworthy|harmless|not\s+malicious)\b/i],
+  ['verdict steering', /\b(?:say|state|declare|respond|conclude)\s+(?:that\s+)?(?:this|it)\s+is\s+["']?(?:clean|safe|benign|harmless|not\s+malicious)\b/i],
+  ['verdict steering', /\bno\s+(?:findings|issues|threats|vulnerabilities)\s+(?:were\s+)?(?:found|detected|present)\s+here\b/i],
+  ['reviewer-addressed', /\bdear\s+(?:reviewer|auditor|scanner|ai|assistant|claude|security\s+\w+)\b/i],
+  ['reviewer-addressed', /\b(?:to|for)\s+the\s+(?:ai|llm|model|scanner|reviewer|auditor)\s+(?:reading|reviewing|scanning|analyz)/i],
+  ['scanner-aware', /\bif\s+you(?:'re|\s+are)\s+(?:an?\s+)?(?:ai|llm|language\s+model|scanner|security\s+reviewer|assistant)\b/i],
+]);
+
+// Codepoints that read differently than they parse, tiered by attack class:
+//   critical — bidi overrides/isolates + the Unicode Tags block (U+E0000–E007F,
+//              invisible characters that can carry a hidden instruction);
+//   high     — zero-width space / word-joiner / a BOM anywhere (the legitimate
+//              leading BOM was already consumed by the decoder);
+//   medium   — ZWJ/ZWNJ, RLM/LRM, C0/C1 controls, line/paragraph separators —
+//              classes with occasional legitimate use that still must not reach
+//              the mirror.
+// Counts and CLASSES are reported, never the characters themselves.
+const CODEPOINT_PATTERN =
+  '[' +
+    '\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f-\\x9f' + // C0/C1 controls
+    '\\u200b-\\u200f\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff' + // zw/bidi (fence-local set)
+    '\\u2028\\u2029' + // line/paragraph separators
+  ']' +
+  '|[\\u{e0000}-\\u{e007f}]'; // Unicode Tags block
+
+function classifyCodepoint(cp) {
+  if (cp >= 0xe0000 && cp <= 0xe007f) return { tier: 'critical', cls: 'unicode-tag' };
+  if ((cp >= 0x202a && cp <= 0x202e) || (cp >= 0x2066 && cp <= 0x2069)) return { tier: 'critical', cls: 'bidi-override' };
+  if (cp === 0x200b || cp === 0x2060 || cp === 0xfeff) return { tier: 'high', cls: 'invisible' };
+  if (cp === 0x200c || cp === 0x200d) return { tier: 'medium', cls: 'zero-width-joiner' };
+  if (cp === 0x200e || cp === 0x200f) return { tier: 'medium', cls: 'bidi-mark' };
+  if (cp === 0x2028 || cp === 0x2029) return { tier: 'medium', cls: 'line-separator' };
+  return { tier: 'medium', cls: 'control' };
+}
+
+// Compiled once; lastIndex is reset at each entry to codepointClasses so the
+// stateful 'g' flag cannot leak scan position between calls.
+const CODEPOINT_SCANNER = new RegExp(CODEPOINT_PATTERN, 'gu');
+
+function codepointClasses(text) {
+  const tiers = { critical: new Map(), high: new Map(), medium: new Map() };
+  const re = CODEPOINT_SCANNER;
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const { tier, cls } = classifyCodepoint(m[0].codePointAt(0));
+    tiers[tier].set(cls, (tiers[tier].get(cls) || 0) + 1);
+  }
+  return tiers;
+}
+
+const ALL_PHRASES = Object.freeze([...OVERRIDE_PHRASES, ...SCANNER_PHRASES]);
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+
+    for (const [family, re] of ALL_PHRASES) {
+      const m = re.exec(file.text);
+      if (m) {
+        const line = lineAt(file.text, m.index);
+        findings.push(finding('injection_phrase', 'critical', file.path,
+          `${family} phrase at line ${line} — text addressed to the scanning process, not a human reader.`,
+          { family, line }));
+      }
+    }
+
+    const tiers = codepointClasses(file.text);
+    for (const [tier, classes] of Object.entries(tiers)) {
+      if (classes.size === 0) continue;
+      const summary = [...classes.entries()].map(([cls, n]) => `${n} ${cls}`).join(', ');
+      findings.push(finding('dangerous_codepoints', tier, file.path,
+        `Invisible/reordering codepoints (${summary}) — can read differently to a human than to a parser.`,
+        { classes: Object.fromEntries(classes) }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, OVERRIDE_PHRASES, SCANNER_PHRASES, codepointClasses };

package/modules/security/artifact-scan/detectors/mcp.js

@@ -0,0 +1,102 @@
+// modules/security/artifact-scan/detectors/mcp.js — MCP server entries bundled
+// in an artifact (task 1002544).
+//
+// An MCP server entry is not config, it is a grant: a `command` is a process
+// the harness will spawn on the builder's machine; a `url` is a remote whose
+// code lives off-box. NEITHER is scannable by a static read of this artifact —
+// the command's binary and the remote's behavior are outside these bytes — so
+// both are flagged unscannable (the reducer caps coverage over them), with the
+// entry quoted verbatim so the reader sees exactly what would be granted.
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict, grepParseDisagreement } = require('./shared');
+
+function isMcpConfig(p) {
+  const name = basename(p);
+  return name === '.mcp.json' || name === 'mcp.json' || name === 'claude_desktop_config.json'
+    || name === '.claude.json'
+    || ((p.includes('.claude/') || p.includes('.claude\\')) && name.endsWith('.json'));
+}
+
+// Same cap as shared.countKeysDeep: an unbounded walk over hostile (but
+// JSON.parse-valid) nesting is a stack overflow; depth past the cap is
+// UNREVIEWED and must surface as a finding, never a silent stop.
+const MAX_TREE_DEPTH = 40;
+
+// Collect MCP-server-shaped entries: any object under an "mcpServers" (or
+// "servers") key whose members carry command/url. Returns { servers,
+// truncated } — truncated flips when the depth cap stopped the walk.
+function collectServers(root) {
+  const servers = [];
+  let truncated = false;
+  const visit = (value, depth) => {
+    if (value === null || typeof value !== 'object') return;
+    if (depth > MAX_TREE_DEPTH) { truncated = true; return; }
+    if (Array.isArray(value)) { for (const item of value) visit(item, depth + 1); return; }
+    for (const [k, v] of Object.entries(value)) {
+      if ((k === 'mcpServers' || k === 'servers') && v && typeof v === 'object' && !Array.isArray(v)) {
+        for (const [name, entry] of Object.entries(v)) {
+          if (entry && typeof entry === 'object') servers.push({ name, entry });
+        }
+      }
+      visit(v, depth + 1);
+    }
+  };
+  visit(root, 0);
+  return { servers, truncated };
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isMcpConfig(file.path)) continue;
+    const parsed = parseJsonStrict(file.text);
+
+    if (parsed.ok) {
+      const { servers, truncated } = collectServers(parsed.value);
+      if (truncated) {
+        findings.push(finding('config_depth_cap', 'high', file.path,
+          `MCP config nests deeper than the ${MAX_TREE_DEPTH}-level review cap — deeper entries were not reviewable.`,
+          { reason: 'depth_cap', unscannable: true }));
+      }
+      for (const { name, entry } of servers) {
+        if (typeof entry.command === 'string') {
+          // Cap the arg COUNT here; finding() caps total length regardless, but
+          // an unbounded join would otherwise be truncated mid-token.
+          const args = Array.isArray(entry.args) ? entry.args.slice(0, 8) : [];
+          const argv = args.map((a) => excerpt(a, 60)).join(' ');
+          findings.push(finding('mcp_server_command', 'high', file.path,
+            `MCP server "${excerpt(name, 60)}" spawns a process — UNSCANNABLE (its code is not in these bytes): ${excerpt(entry.command)}${argv ? ` ${argv}` : ''}`,
+            { server: excerpt(name, 60), command: excerpt(entry.command), unscannable: true }));
+        }
+        if (typeof entry.url === 'string') {
+          findings.push(finding('mcp_server_url', 'medium', file.path,
+            `MCP server "${excerpt(name, 60)}" points at a remote — UNSCANNABLE (its code is off-box): ${excerpt(entry.url)}`,
+            { server: excerpt(name, 60), url: excerpt(entry.url), unscannable: true }));
+        }
+        if (typeof entry.command !== 'string' && typeof entry.url !== 'string') {
+          findings.push(finding('mcp_server_opaque', 'medium', file.path,
+            `MCP server "${excerpt(name, 60)}" has neither a readable command nor url — unreviewable entry.`,
+            { server: excerpt(name, 60), unscannable: true }));
+        }
+      }
+    }
+
+    for (const key of ['mcpServers', 'servers']) {
+      const disagreement = grepParseDisagreement(file.text, key, parsed.ok ? parsed.value : null);
+      if (disagreement) {
+        findings.push(finding('parse_grep_disagreement', 'critical', file.path,
+          `"${key}" appears ${disagreement.rawCount}x in key position in the raw bytes but the strict parse yielded ${disagreement.parsedCount} — hidden MCP config.`,
+          { marker: key, ...disagreement }));
+      }
+    }
+    if (!parsed.ok) {
+      findings.push(finding('config_unparseable', 'medium', file.path,
+        'MCP config does not strictly parse as JSON — whatever the harness makes of it was not reviewable here.', null));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/network.js

@@ -0,0 +1,67 @@
+// modules/security/artifact-scan/detectors/network.js — network egress sinks
+// (task 1002544).
+//
+// A network sink alone is a medium: most tools talk to the network for honest
+// reasons, and the floor's job is inventory, not judgment. The signal that
+// matters is computed by floor.js: a file that BOTH names a credential store
+// AND carries an egress sink is flagged same-file co-occurrence — labeled
+// exactly that, never claimed as proven dataflow, because co-location in a
+// file is evidence of opportunity, not a taint analysis.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const NETWORK_PATTERNS = Object.freeze([
+  ['fetch()', /\bfetch\s*\(/],
+  ['XMLHttpRequest', /XMLHttpRequest/],
+  ['WebSocket', /\bnew\s+WebSocket\s*\(/],
+  ['axios', /\baxios\b/],
+  ['node http/https request', /\bhttps?\.(?:request|get)\s*\(/],
+  // Importing http/https at all is an egress capability — catches the
+  // destructured/aliased form `const { get } = require('node:https')` that has
+  // no literal `https.get(` token for the pattern above to see.
+  ['node http/https import', /require\s*\(\s*['"](?:node:)?https?['"]\s*\)|from\s+['"](?:node:)?https?['"]/],
+  ['raw socket', /\bnet\.(?:connect|createConnection)\s*\(|\bnew\s+net\.Socket\b/],
+  ['UDP socket', /\bdgram\.createSocket\s*\(/],
+  ['curl', /\bcurl\s+/],
+  ['wget', /\bwget\s+/],
+  ['PowerShell web request', /Invoke-WebRequest|Invoke-RestMethod|System\.Net\.WebClient/i],
+  ['navigator.sendBeacon', /sendBeacon\s*\(/],
+  ['undici', /\bundici\b/],
+  ['http client lib', /\b(?:got|ky|node-fetch|needle|superagent|request-promise|phin)\b/],
+]);
+
+// Memoized per corpus object — detect() and floor.coOccurrence() share the
+// result rather than each re-scanning the whole tree (see credentials.js).
+const _hitsCache = new WeakMap();
+function perFileHits(corpus) {
+  const cached = _hitsCache.get(corpus);
+  if (cached) return cached;
+  const hits = new Map(); // path -> [{ label, line }]
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    for (const [label, re] of NETWORK_PATTERNS) {
+      const m = re.exec(file.text);
+      if (m) {
+        if (!hits.has(file.path)) hits.set(file.path, []);
+        hits.get(file.path).push({ label, line: lineAt(file.text, m.index) });
+      }
+    }
+  }
+  _hitsCache.set(corpus, hits);
+  return hits;
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const [path, fileHits] of perFileHits(corpus)) {
+    const labels = fileHits.map((h) => h.label);
+    findings.push(finding('network_sink', 'medium', path,
+      `Network egress sink(s): ${labels.join(', ')} (first at line ${fileHits[0].line}).`,
+      { sinks: labels, line: fileHits[0].line }));
+  }
+  return findings;
+}
+
+module.exports = { detect, perFileHits, NETWORK_PATTERNS };