@bongos/core 1.18.19 → 1.19.3

package/modules/provisioning/provisioning.js

@@ -21,6 +21,14 @@ const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down',
 // standalone — its OWN repo checkout + pinned @cloudbongos/core npm dep, co-located on
 //              the box (ADR 0108 destination model; owner-hosted, $0). See provision.js.
 const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone'];
+// How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
+//   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
+//   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
+//                its history and never overwriting a pre-existing file
+// Load-bearing, not cosmetic: the runner's scaffold branches on it. Before this existed
+// provision.js ran the greenfield path unconditionally and adopting an existing repo
+// always failed as an unrelated-history non-fast-forward (task 1002562).
+const ONBOARD_MODES = ['greenfield', 'adopt'];
 // 'oauth-manifest' (task 2080) is queueable too — the GitHub-App-Manifest onboarding
 // conversion. Today the runner drains it by scanning provisioning_oauth_manifests
 // (drainOAuthManifests), not the intent queue, but it stays a valid action so the
@@ -119,6 +127,11 @@ function publicInstance(row) {
     port: row.port,
     tier: row.tier,
     target_ref: row.target_ref,
+    // Surfaced so a reader can tell WHICH scaffold path a row took — the difference
+    // between "we created this repo" and "we layered onto the owner's" is the first
+    // thing you need when diagnosing a standup (task 1002562). Coalesced for rows read
+    // before provisioning_004 added the column.
+    onboard_mode: row.onboard_mode || 'greenfield',
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -268,17 +281,22 @@ async function listAllInstances(db, { status } = {}) {
 // re-fetches the existing row and returns { created:false } so the ROUTE can
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
-async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier }) {
+async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode }) {
   const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'co-tenant';
+  // Unknown/absent → 'greenfield', matching the column default. Falling back to the
+  // SAFE mode matters: greenfield refuses to push over existing history (no --force
+  // anywhere), whereas defaulting an unknown value to 'adopt' would put the layering
+  // path on a repo nobody said was pre-existing.
+  const mode = ONBOARD_MODES.includes(onboardMode) ? onboardMode : 'greenfield';
   const cost = costEstimateUsd({ hostingShape: shape, tier });
   try {
     const { rows } = await db.query(
       `INSERT INTO provisioning_instances
-         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
        RETURNING *`,
       [ownerBuilderId, slug, targetRef ?? null, shape, domain ?? null,
-       dbName ?? null, port ?? null, tier ?? null, cost]
+       dbName ?? null, port ?? null, tier ?? null, cost, mode]
     );
     return { instance: rows[0], created: true };
   } catch (e) {
@@ -521,8 +539,8 @@ async function costLedger(db, { limit = 500 } = {}) {
 
 module.exports = {
   // constants
-  INSTANCE_STATES, HOSTING_SHAPES, INTENT_ACTIONS, TEARDOWN_FROM, TIER_MONTHLY_USD,
-  CERT_ELIGIBLE_STATES,
+  INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, INTENT_ACTIONS, TEARDOWN_FROM,
+  TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   // pure — GitHub App Manifest flow (task 2080)

package/modules/provisioning/routes/provisioning.js

@@ -231,7 +231,7 @@ module.exports = function provisioningRoutes() {
 
   // GET /provisioning/fleet — the full instance roster across all owners.
   // rank: archon (exposes every owner's instance + cost; the /boxes precedent).
-  router.get('/provisioning/fleet', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/provisioning/fleet', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       const status = req.query.status || undefined;
       const rows = await provisioning.listAllInstances(pool, { status });
@@ -245,7 +245,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total.
   // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
   // Declared among the archon routes (archon-first) for correct auditor classification.
-  router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
@@ -262,7 +262,7 @@ module.exports = function provisioningRoutes() {
   // ENQUEUES a 'teardown' intent for the control-plane runner; the web tier never
   // holds cloud tokens. rank: archon (acts on another owner's infrastructure).
   // Declared among the archon routes (archon-first).
-  router.post('/provisioning/instances/:id/force-teardown', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/provisioning/instances/:id/force-teardown', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -292,7 +292,13 @@ module.exports = function provisioningRoutes() {
   // the runner (task P3) does the real standup. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
-  //         domain?, tier? }.
+  //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
+  //
+  // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
+  // branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner
+  // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
+  // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
+  // 'greenfield', the safe default.
   router.post('/provisioning/instances', auth.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
@@ -300,6 +306,7 @@ module.exports = function provisioningRoutes() {
       hosting_shape: { type: 'string', maxLength: 20 },
       domain: { type: 'string', maxLength: 253 },
       tier: { type: 'string', maxLength: 40 },
+      onboard_mode: { type: 'string', maxLength: 20 },
     })) return;
     const body = req.body || {};
     const slug = String(body.slug || '').trim().toLowerCase();
@@ -310,11 +317,22 @@ module.exports = function provisioningRoutes() {
     if (!provisioning.HOSTING_SHAPES.includes(shape)) {
       return res.fail('bad_hosting_shape', 400, { valid: provisioning.HOSTING_SHAPES });
     }
+    const onboardMode = body.onboard_mode || 'greenfield';
+    if (!provisioning.ONBOARD_MODES.includes(onboardMode)) {
+      return res.fail('bad_onboard_mode', 400, { valid: provisioning.ONBOARD_MODES });
+    }
+    // Adopting is meaningless without knowing WHICH repo to layer onto, and the runner
+    // would fall back to greenfield behavior — so refuse here rather than mislabel the row.
+    if (onboardMode === 'adopt' && !String(body.target_ref || '').trim()) {
+      return res.fail('target_ref_required_for_adopt', 400, {
+        reason: 'adopt layers onto an existing repo, so target_ref (owner/repo) is required',
+      });
+    }
     try {
       const { instance, created } = await provisioning.createInstance(pool, {
         ownerBuilderId: req.builder.id, slug,
         targetRef: body.target_ref, hostingShape: shape,
-        domain: body.domain, tier: body.tier,
+        domain: body.domain, tier: body.tier, onboardMode,
       });
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
@@ -325,7 +343,7 @@ module.exports = function provisioningRoutes() {
       if (created) {
         await provisioning.recordEvent(pool, {
           instanceId: instance.id, ownerBuilderId: req.builder.id, event: 'request',
-          detail: `provision requested (shape=${shape}${body.domain ? `, domain=${body.domain}` : ''})`,
+          detail: `provision requested (shape=${shape}, mode=${onboardMode}${body.domain ? `, domain=${body.domain}` : ''})`,
           actor: 'api:self',
         }).catch(() => {});
       }

package/modules/security/artifact-scan/aggregate.js

@@ -0,0 +1,133 @@
+// modules/security/artifact-scan/aggregate.js — the verdict reducer
+// (task 1002545, goal 1000055).
+//
+// THE LINE THAT MAKES THE VERDICT ARITHMETIC RATHER THAN AN OPINION. No model
+// ever writes a verdict: this reducer takes the MAXIMUM of the floor's floor,
+// the panel's outcome, the tier clamp, and the coverage cap — each computed in
+// code from evidence — and any verdict-shaped field a lens returns is ignored
+// by construction (the reducer never reads one). An artifact whose whole
+// purpose is to talk the scanner into saying "clean" cannot succeed here,
+// because there is no sentence it could produce that this arithmetic reads.
+//
+// Monotone by design: every input can only RAISE the verdict, never lower it.
+
+'use strict';
+
+// Same rank floor.js exports — duplicated as the module's shared source of
+// truth is floor.js; requiring it here keeps the two in lockstep.
+const { VERDICT_RANK } = require('./floor');
+
+const VERDICTS = Object.freeze(['clean', 'caution', 'dangerous']);
+
+// Tiers mirror scan-store.js TIERS. 'low' is the cheapest tier: floor + one
+// triage read, no full panel — static analysis that shallow can never clear an
+// artifact, so 'low' clamps to caution and can NEVER reach clean.
+const TIER_CLAMP = Object.freeze({
+  low: 'caution',
+  default: 'clean',
+  high: 'clean',
+  xhigh: 'clean',
+  max: 'clean',
+});
+
+// A lens that did not finish cleanly contributes caution, never silence: an
+// errored/timed-out/budget-exhausted lens means its surface went UNREVIEWED.
+const LENS_OK = 'ok';
+const LENS_PROBLEM_STATUSES = Object.freeze(['error', 'timeout', 'budget_exhausted']);
+
+const rank = (v) => VERDICT_RANK[v] ?? VERDICT_RANK.dangerous; // unknown → worst
+const maxVerdict = (a, b) => (rank(a) >= rank(b) ? a : b);
+
+// Panel outcome — computed from FINDINGS ONLY. The severity arithmetic is the
+// same as the floor's: any critical → dangerous, any finding → caution, none →
+// clean. A lens's own `verdict` field (or any other model-authored summary
+// judgment) is deliberately never read.
+function panelOutcome(lenses = []) {
+  let out = 'clean';
+  for (const lens of lenses) {
+    const findings = Array.isArray(lens && lens.findings) ? lens.findings : [];
+    for (const f of findings) {
+      out = maxVerdict(out, f && f.severity === 'critical' ? 'dangerous' : 'caution');
+    }
+  }
+  return out;
+}
+
+// Lens health — 'clean' only when a real panel ran to completion. Fails
+// closed on every degenerate shape:
+//   - any lens missing, errored, timed out, or budget-exhausted → caution;
+//   - a status-ok lens whose findings is not an array (malformed payload —
+//     its findings were LOST, not absent) → caution;
+//   - `panelRequired` (a tier whose clamp permits clean) with ZERO ok lenses →
+//     caution. An absent panel is the maximal case of "silence", and without
+//     this the one input that means "the deep review never happened at all"
+//     was the only input in this file that failed open (review finding).
+function lensHealth(lenses = [], { panelRequired = false } = {}) {
+  let okLenses = 0;
+  for (const lens of lenses) {
+    if (!lens || lens.status !== LENS_OK || !Array.isArray(lens.findings)) return 'caution';
+    okLenses++;
+  }
+  if (panelRequired && okLenses === 0) return 'caution';
+  return 'clean';
+}
+
+// Coverage cap — static text analysis cannot clear what it never read.
+// Anything unread or unreadable holds the verdict at caution or above:
+// skipped files/bytes, findings flagged unscannable (MCP commands, remote
+// servers), and declared dependencies the install would fetch.
+function coverageCap({ floorReport = {}, declaredDependencies = null } = {}) {
+  const cov = floorReport.coverage || {};
+  const skipped = Array.isArray(cov.files_skipped) ? cov.files_skipped.length : 0;
+  const findings = Array.isArray(floorReport.findings) ? floorReport.findings : [];
+  const unscannable = findings.filter((f) => f && f.detail && f.detail.unscannable === true).length;
+  const deps = declaredDependencies != null
+    ? Number(declaredDependencies) || 0
+    : findings.filter((f) => f && f.code === 'dependencies_unfetched').length;
+  const reasons = [];
+  if (skipped > 0) reasons.push(`${skipped} file(s) skipped unread`);
+  if (unscannable > 0) reasons.push(`${unscannable} unscannable surface(s) (off-box code)`);
+  if (deps > 0) reasons.push('declared dependencies never fetched');
+  return { verdict: reasons.length > 0 ? 'caution' : 'clean', reasons };
+}
+
+// The reducer. Returns the computed verdict plus each component, so the report
+// can show its arithmetic — an auditable max(), not a narrative.
+function reduceVerdict({ floorReport = {}, lenses = [], tier = 'low', declaredDependencies = null } = {}) {
+  const floor = VERDICTS.includes(floorReport.floor_verdict) ? floorReport.floor_verdict : 'caution';
+  const panel = panelOutcome(lenses);
+  // Own-property lookup so a hostile tier string can never reach the clamp
+  // through the prototype chain; unknown tier → caution, fail closed.
+  const clamp = Object.prototype.hasOwnProperty.call(TIER_CLAMP, tier) ? TIER_CLAMP[tier] : 'caution';
+  // A tier whose clamp permits 'clean' is a tier that RUNS a panel — so on
+  // those tiers an empty panel is a failure, not a pass.
+  const health = lensHealth(lenses, { panelRequired: clamp === 'clean' });
+  const coverage = coverageCap({ floorReport, declaredDependencies });
+
+  let verdict = 'clean';
+  for (const component of [floor, panel, health, clamp, coverage.verdict]) {
+    verdict = maxVerdict(verdict, component);
+  }
+  return {
+    verdict,
+    components: {
+      floor,
+      panel,
+      lens_health: health,
+      tier_clamp: clamp,
+      coverage_cap: coverage.verdict,
+    },
+    coverage_reasons: coverage.reasons,
+  };
+}
+
+module.exports = {
+  VERDICTS,
+  TIER_CLAMP,
+  LENS_OK,
+  LENS_PROBLEM_STATUSES,
+  panelOutcome,
+  lensHealth,
+  coverageCap,
+  reduceVerdict,
+};

package/modules/security/artifact-scan/detectors/capabilities.js

@@ -0,0 +1,53 @@
+// modules/security/artifact-scan/detectors/capabilities.js — the plain
+// capability inventory (task 1002544).
+//
+// PRINTED, NEVER SCORED. The inventory answers "what CAN this artifact do"
+// (spawn processes, touch the filesystem, read env, eval code…) so the human
+// and the panel read the report against an accurate power budget. It emits no
+// findings and never contributes to the verdict floor: capability is not
+// guilt, and scoring it here would double-count the detectors that DO grade
+// specific behaviors.
+
+'use strict';
+
+const CAPABILITY_PATTERNS = Object.freeze([
+  ['process-spawn', /\bchild_process\b|\bexecSync?\s*\(|\bspawnSync?\s*\(|\bexecFile\s*\(|Start-Process|\bsubprocess\b/],
+  ['filesystem', /\brequire\s*\(\s*['"](?:node:)?fs['"]|\bfrom\s+['"](?:node:)?fs['"]|\breadFileSync?\s*\(|\bwriteFileSync?\s*\(/],
+  ['env-read', /\bprocess\.env\b|\bos\.environ\b|\$env:/],
+  ['dynamic-code', /\beval\s*\(|new\s+Function\s*\(|\bvm\.(?:runInContext|runInNewContext|Script)\b/],
+  ['native-addon', /\.node['"]|\bnode-gyp\b|binding\.gyp|\bffi\b/],
+  ['network', /\bfetch\s*\(|\bhttps?\.(?:request|get)\s*\(|\bnet\.connect|XMLHttpRequest|WebSocket|\baxios\b|\bcurl\s+|\bwget\s+/],
+  ['crypto', /\brequire\s*\(\s*['"](?:node:)?crypto['"]|\bfrom\s+['"](?:node:)?crypto['"]/],
+]);
+
+const SCRIPT_EXTENSIONS = Object.freeze(['.sh', '.bash', '.ps1', '.psm1', '.cmd', '.bat']);
+
+const MAX_EXAMPLE_FILES = 5;
+
+// Returns the inventory: [{ capability, count, files: first-5 paths }].
+// Shell/batch scripts are inventoried by extension — their presence means
+// "there is code here meant to be executed by a shell", whatever it says.
+function inventory(corpus) {
+  const byCapability = new Map();
+  const add = (capability, path) => {
+    if (!byCapability.has(capability)) byCapability.set(capability, []);
+    byCapability.get(capability).push(path);
+  };
+
+  for (const file of corpus.files) {
+    const lower = file.path.toLowerCase();
+    if (SCRIPT_EXTENSIONS.some((ext) => lower.endsWith(ext))) add('shell-scripts', file.path);
+    if (file.text === null) continue;
+    for (const [capability, re] of CAPABILITY_PATTERNS) {
+      if (re.test(file.text)) add(capability, file.path);
+    }
+  }
+
+  return [...byCapability.entries()]
+    .map(([capability, files]) => ({ capability, count: files.length, files: files.slice(0, MAX_EXAMPLE_FILES) }))
+    .sort((a, b) => a.capability.localeCompare(b.capability));
+}
+
+// Constants exported as the white-box surface: the reducer/report stages and
+// tests read them to stay in lockstep with what the inventory actually covers.
+module.exports = { inventory, CAPABILITY_PATTERNS, SCRIPT_EXTENSIONS };

package/modules/security/artifact-scan/detectors/config-obfuscation.js

@@ -0,0 +1,41 @@
+// modules/security/artifact-scan/detectors/config-obfuscation.js — obfuscation
+// aimed at a reader who skims the raw config bytes (task 1002544).
+//
+// Runs ONCE over every JSON config in the bundle (not per-key like the
+// individual detectors' parse/grep cross-checks), so an escaped-key finding is
+// emitted a single time per file rather than once per detector that touches it.
+//
+// A JSON config KEY written with backslash escapes (`"postinstall"`,
+// `"postinstall"`) has no legitimate purpose: npm and the harness decode
+// it to the real key and act on it, while a human — and a naive grep — sees
+// something else. That mismatch is the whole point of the trick, so its mere
+// presence is a finding. (The duplicate-key SHADOWING case is separately caught
+// by each detector's escape-decoding grepParseDisagreement.)
+
+'use strict';
+
+const { finding, basename, escapedConfigKeyCount } = require('./shared');
+
+function isJsonConfig(p) {
+  const name = basename(p);
+  if (!name.endsWith('.json')) return false;
+  return name === 'package.json' || name === '.claude.json' || name.startsWith('settings')
+    || name === '.mcp.json' || name === 'mcp.json' || name === 'claude_desktop_config.json'
+    || name === 'managed-settings.json' || p.includes('.claude/') || p.includes('.claude\\');
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isJsonConfig(file.path)) continue;
+    const escaped = escapedConfigKeyCount(file.text);
+    if (escaped > 0) {
+      findings.push(finding('obfuscated_config_key', 'high', file.path,
+        `${escaped} config key(s) use backslash escapes — the harness decodes them to real keys while a skim of the raw bytes reads something else.`,
+        { escaped_key_count: escaped }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, isJsonConfig };

package/modules/security/artifact-scan/detectors/credentials.js

@@ -0,0 +1,112 @@
+// modules/security/artifact-scan/detectors/credentials.js — references to
+// credential stores (task 1002544).
+//
+// The pattern list is CURATED AND NAMED, not clever: each entry is a specific
+// place secrets live — including our own ~/.config/otb/gds-session.json and
+// the Windows stores — spelled the way code spells it. A hit means "this
+// artifact's text names a credential store", nothing more; whether it READS it
+// is runtime behavior a static floor cannot see, and the finding says so.
+//
+// Patterns are tiered by SIGNAL, because the co-occurrence critical (floor.js)
+// must not cry wolf:
+//   FILE  — a concrete on-disk secret store path (.aws/credentials, id_rsa,
+//           gds-session.json). Co-located with a network sink this is the
+//           strong read-then-send shape, so ONLY file-class hits arm the
+//           co-occurrence critical.
+//   ENV   — an environment-variable NAME (GITHUB_TOKEN, NPM_TOKEN). Ordinary
+//           tooling reads these next to a fetch() constantly, so an env hit is
+//           a medium on its own and never on its own arms the critical.
+
+'use strict';
+
+const { finding, lineAt } = require('./shared');
+
+const SEP = String.raw`[\\/]+`;
+
+// [label, regex, class]. Regexes are case-insensitive and separator-agnostic.
+// The SSH pattern is written WITHOUT `.*` before an alternation — a greedy
+// `.*(?:_rsa|_ed25519)` backtracks catastrophically on a long non-matching
+// line (ReDoS) and would hang the floor before any report is persisted; a
+// bounded `[^\\/\n]*` cannot.
+const CREDENTIAL_PATTERNS = Object.freeze([
+  ['our own GDS CLI session token', new RegExp(String.raw`gds-session\.json|\.config${SEP}otb`, 'i'), 'file'],
+  ['SSH private key', new RegExp(String.raw`\.ssh${SEP}[^\\/\n]*(?:_rsa|_ed25519|_ecdsa)|\bid_rsa\b|\bid_ed25519\b|\bid_ecdsa\b`, 'i'), 'file'],
+  ['AWS credentials file', new RegExp(String.raw`\.aws${SEP}credentials`, 'i'), 'file'],
+  ['netrc', new RegExp(String.raw`(?:^|[^\w.])\.?_?netrc\b`, 'i'), 'file'],
+  ['git stored credentials', new RegExp(String.raw`\.git-credentials`, 'i'), 'file'],
+  ['GitHub CLI hosts file', new RegExp(String.raw`\.config${SEP}gh${SEP}hosts\.yml`, 'i'), 'file'],
+  ['kubeconfig file', new RegExp(String.raw`\.kube${SEP}config`, 'i'), 'file'],
+  ['Docker credential store', new RegExp(String.raw`\.docker${SEP}config\.json`, 'i'), 'file'],
+  ['browser credential/cookie store', new RegExp(String.raw`Login Data|moz_logins|\blogins\.json\b|User Data${SEP}Default`, 'i'), 'file'],
+  ['cloud metadata endpoint', metadataEndpointRegex(), 'file'],
+  // The negative lookbehind is load-bearing: without it, `.env` matches inside
+  // `process.env`, misclassifying every env-var access as a credential FILE
+  // read and arming the co-occurrence critical on ordinary Node code.
+  ['generic .env secret file', new RegExp(String.raw`(?<![\w.])\.env(?:\.local|\.production|\.development)?\b`, 'i'), 'file'],
+  // ENV class — variable NAMES, not files. Medium, never arms co-occurrence.
+  ['AWS secret env var', /AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN/, 'env'],
+  ['npm auth env var', /\b_authToken\b|\bNPM_TOKEN\b/, 'env'],
+  ['GitHub token env var', /\bGH_TOKEN\b|\bGITHUB_TOKEN\b/, 'env'],
+  ['kubeconfig env var', /\bKUBECONFIG\b/, 'env'],
+  // Windows / macOS secret-store API calls — execution surface, treated file-class.
+  ['Windows Credential Manager', /\bcmdkey\b|\bvaultcmd\b|\bCredRead\b|\bCredEnumerate\b|Windows\.Security\.Credentials|PasswordVault/i, 'file'],
+  ['Windows DPAPI', /CryptUnprotectData|ProtectedData\.Unprotect/i, 'file'],
+  ['macOS Keychain', /security\s+find-(?:generic|internet)-password|\bKeychain\b/, 'file'],
+]);
+
+// The cloud-metadata endpoint in every form git/Node can reach it: dotted,
+// decimal, hex, octal, IPv6, and the AWS/GCP hostnames. A literal-string match
+// (169.254.169.254 only) is defeated by writing the same address as the integer
+// 2852039166 or 0xa9fea9fe — both of which resolve to the same host.
+function metadataEndpointRegex() {
+  return new RegExp([
+    '169\\.254\\.169\\.254',            // dotted
+    '\\b2852039166\\b',                 // decimal
+    '0xa9fea9fe',                       // hex
+    '0251\\.0376\\.0251\\.0376',        // dotted octal
+    '\\[?fd00:ec2::254\\]?',            // AWS IPv6
+    'metadata\\.google\\.internal',
+    '\\binstance-data\\b',
+    'metadata\\.azure\\.com',
+  ].join('|'), 'i');
+}
+
+// Structured per-file hits for the floor's co-occurrence join. Each hit carries
+// its class so floor.js can arm the critical on file-class hits only.
+//
+// Memoized per corpus object: detect() and floor.coOccurrence() both need this,
+// and re-running every regex over the whole tree twice per scan is pure waste.
+// The corpus is immutable for the life of a scan, so a WeakMap keyed on it is a
+// safe cache that also lets the object be GC'd when the scan ends.
+const _hitsCache = new WeakMap();
+function perFileHits(corpus) {
+  const cached = _hitsCache.get(corpus);
+  if (cached) return cached;
+  const hits = new Map(); // path -> [{ label, line, klass }]
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    for (const [label, re, klass] of CREDENTIAL_PATTERNS) {
+      const m = re.exec(file.text);
+      if (m) {
+        if (!hits.has(file.path)) hits.set(file.path, []);
+        hits.get(file.path).push({ label, line: lineAt(file.text, m.index), klass });
+      }
+    }
+  }
+  _hitsCache.set(corpus, hits);
+  return hits;
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const [path, fileHits] of perFileHits(corpus)) {
+    for (const h of fileHits) {
+      findings.push(finding('credential_store_reference', h.klass === 'file' ? 'high' : 'medium', path,
+        `Names a credential store (${h.label}) at line ${h.line} — whether it is read is runtime behavior this static pass cannot see.`,
+        { store: h.label, line: h.line, klass: h.klass }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, perFileHits, CREDENTIAL_PATTERNS };

package/modules/security/artifact-scan/detectors/dependencies.js

@@ -0,0 +1,115 @@
+// modules/security/artifact-scan/detectors/dependencies.js — the declared
+// dependency list and registry configuration (task 1002544).
+//
+// The scan never fetches dependencies, so every declared dependency is code
+// the install would pull that NOBODY here read — that alone caps coverage.
+// Within the list, specs are graded by how much the install outcome can drift
+// from what a reviewer might have vetted: a git/http/file spec fetches from an
+// arbitrary place (high), a floating spec ('*', 'latest', ranges) means the
+// registry decides the bytes at install time (wildcards medium, ranges low —
+// ranges are ecosystem-normal). A .npmrc registry override redirects EVERY
+// package to a server the artifact's author chose — the classic dependency-
+// confusion delivery vehicle (high).
+
+'use strict';
+
+const { finding, excerpt, basename, parseJsonStrict } = require('./shared');
+
+const DEP_SECTIONS = Object.freeze([
+  'dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies',
+]);
+
+function specSeverity(spec) {
+  const s = String(spec).trim();
+  // Protocol / shorthand sources that fetch from an arbitrary place, not the
+  // registry version the reviewer might have vetted.
+  if (/^(?:git\+|git:|github:|gitlab:|bitbucket:|https?:|file:|link:|portal:|workspace:|patch:)/i.test(s)) {
+    return { severity: 'high', kind: 'non-registry source' };
+  }
+  // `npm:pkg@range` alias — the installed package is NOT the one this key names.
+  if (/^npm:/i.test(s)) return { severity: 'high', kind: 'aliased package' };
+  // Bare `user/repo` (optionally `#ref`) with no protocol is GitHub shorthand.
+  if (/^[\w.-]+\/[\w.-]+(?:#.+)?$/.test(s) && !/^[\d]/.test(s)) {
+    return { severity: 'high', kind: 'github shorthand' };
+  }
+  if (s === '' || s === '*' || s === 'latest' || s === 'next' || /^[x*]$/i.test(s)) {
+    return { severity: 'medium', kind: 'wildcard' };
+  }
+  if (/^(?:\^|~|>=?|<=?)/.test(s) || /\.(x|\*)/i.test(s) || /\s*\|\|\s*/.test(s) || /\s-\s/.test(s)) {
+    return { severity: 'low', kind: 'floating range' };
+  }
+  return null; // pinned exact version — inventoried via the declared count, not a finding
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null) continue;
+    const name = basename(file.path);
+
+    if (name === 'package.json') {
+      const parsed = parseJsonStrict(file.text);
+      // No config_unparseable here (asymmetric with hooks/mcp on purpose):
+      // npm-lifecycle.js already emits it for every unparseable package.json,
+      // and this detector fires on the SAME files — a second copy would only
+      // inflate the count.
+      if (!parsed.ok || !parsed.value || typeof parsed.value !== 'object') continue;
+      let declared = 0;
+      for (const section of DEP_SECTIONS) {
+        const deps = parsed.value[section];
+        if (!deps || typeof deps !== 'object' || Array.isArray(deps)) continue;
+        for (const [dep, spec] of Object.entries(deps)) {
+          declared++;
+          const graded = specSeverity(spec);
+          if (graded) {
+            findings.push(finding('dependency_floating_spec', graded.severity, file.path,
+              `${section}.${excerpt(dep, 80)} = "${excerpt(String(spec), 80)}" (${graded.kind}) — the installed bytes are decided at install time, not here.`,
+              { section, dep: excerpt(dep, 80), spec: excerpt(String(spec), 80), kind: graded.kind }));
+          }
+        }
+      }
+      if (declared > 0) {
+        findings.push(finding('dependencies_unfetched', 'medium', file.path,
+          `${declared} declared dependencies were never fetched or read — the install would pull code nobody here reviewed.`,
+          { declared, unscannable: true }));
+      }
+      const overrides = parsed.value.overrides || parsed.value.resolutions;
+      if (overrides && typeof overrides === 'object') {
+        findings.push(finding('dependency_overrides', 'medium', file.path,
+          `package.json pins transitive dependencies via overrides/resolutions — the tree the lockfile implies is not the tree npm resolves.`,
+          null));
+      }
+      const pubReg = parsed.value.publishConfig && parsed.value.publishConfig.registry;
+      if (typeof pubReg === 'string') {
+        findings.push(finding('registry_override', 'high', file.path,
+          `publishConfig.registry points at ${excerpt(pubReg)}.`, { registry: excerpt(pubReg) }));
+      }
+    }
+
+    if (name === '.npmrc' || name === 'npmrc') {
+      // .npmrc is INI-ish; the floor greps line-wise rather than trusting any
+      // parser — every line is checked raw, so there is no parse/grep gap.
+      const lines = file.text.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (/^(?:@[^:]+:)?registry\s*=/.test(line)) {
+          findings.push(finding('registry_override', 'high', file.path,
+            `.npmrc redirects package resolution (line ${i + 1}): ${excerpt(line)} — the dependency-confusion delivery vehicle.`,
+            { line: i + 1, text: excerpt(line) }));
+        }
+        if (/_authToken|_auth\s*=|always-auth/.test(line)) {
+          findings.push(finding('npmrc_auth_config', 'medium', file.path,
+            `.npmrc carries auth configuration (line ${i + 1}): ${excerpt(line)}.`,
+            { line: i + 1 }));
+        }
+        if (/^ignore-scripts\s*=\s*false/.test(line)) {
+          findings.push(finding('npmrc_scripts_enabled', 'high', file.path,
+            `.npmrc explicitly re-enables install scripts (line ${i + 1}).`, { line: i + 1 }));
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, specSeverity, DEP_SECTIONS };