@dailephd/my-dev-kit-lab 0.2.1 → 0.2.2

package/dist/src/securityValidation/attackScenarios/scenarios/pathTraversalScenario.js

@@ -0,0 +1,119 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { resolveWithinRoot } from "../../../core/pathSafety.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — path traversal scenario.
+//
+// Exercises the existing src/core/pathSafety.ts containment helper
+// (resolveWithinRoot) — used for writes that must stay within a declared
+// root — against the deterministic path-traversal payload corpus, plus a
+// small set of legitimate paths that must continue to be accepted (spaces,
+// safe relative/absolute-within-root paths). Pure path-math only; nothing is
+// read or written to disk.
+// ---------------------------------------------------------------------------
+const LEGITIMATE_PATH_CASES = [
+    { id: "relative-with-spaces", value: "safe sub dir/output.txt", shouldReject: false },
+    { id: "relative-nested", value: "a/b/c/output.json", shouldReject: false },
+];
+export const PATH_TRAVERSAL_SCENARIO = {
+    id: "path-traversal-containment",
+    title: "Path traversal: containment helper rejects escape payloads and accepts legitimate paths",
+    description: "Verifies resolveWithinRoot() rejects the deterministic path-traversal payload corpus and continues to accept legitimate relative paths, including ones with spaces.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Every path-traversal payload throws when passed to resolveWithinRoot(); every legitimate path resolves without throwing.",
+    evidenceRequirements: ["filesystem", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const unrejectedTraversals = [];
+        const wronglyRejectedLegit = [];
+        // Payloads whose escape depends on a URL-decode step that never happens
+        // at the filesystem-path layer (resolveWithinRoot does no decoding, by
+        // design — Node's path module treats "%2f" as a literal filename
+        // character, not a separator). These correctly resolve *inside* root and
+        // are recorded as informational evidence only, not a rejection failure.
+        const payloadsNotApplicableToRawPathResolution = new Set(["path-traversal-encoded"]);
+        // On POSIX (Linux/macOS), "\" is a literal filename character, not a
+        // path separator — Node's posix path implementation never parses
+        // "..\\..\\Windows\\..." as parent-directory components, so it
+        // legitimately resolves inside root there. On win32, "\" IS a separator
+        // and the payload must still be rejected, so this exclusion only applies
+        // off-Windows (verified by the CI cross-platform matrix: this scenario
+        // was passing on windows-latest but failing on ubuntu-latest/macos-latest
+        // for exactly this platform-semantics reason before this fix).
+        if (process.platform !== "win32") {
+            payloadsNotApplicableToRawPathResolution.add("path-traversal-windows-parent");
+        }
+        const traversalPayloads = getPayloadsForGroup("path-traversal");
+        for (const p of traversalPayloads) {
+            let rejected = false;
+            let observed = "";
+            try {
+                const resolved = resolveWithinRoot(ctx.target.targetRoot, p.value);
+                observed = `Resolved to '${resolved}' without being rejected.`;
+            }
+            catch {
+                rejected = true;
+                observed = "Rejected (threw), as expected.";
+            }
+            if (!rejected && !payloadsNotApplicableToRawPathResolution.has(p.id)) {
+                unrejectedTraversals.push(p.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "filesystem",
+                source: `resolveWithinRoot() with payload '${p.id}'`,
+                confidence: "high",
+                expectedBehavior: payloadsNotApplicableToRawPathResolution.has(p.id)
+                    ? "No path separators present without decoding; resolving inside root is safe (not an escape)."
+                    : "Path-traversal payloads must be rejected (thrown), never silently resolved.",
+                observedBehavior: observed,
+                rawPreview: p.value,
+            }));
+        }
+        for (const c of LEGITIMATE_PATH_CASES) {
+            let accepted = false;
+            let observed = "";
+            try {
+                const resolved = resolveWithinRoot(ctx.target.targetRoot, c.value);
+                accepted = true;
+                observed = `Resolved to '${resolved}' as expected.`;
+            }
+            catch (err) {
+                observed = `Unexpectedly rejected: ${err instanceof Error ? err.message : String(err)}`;
+            }
+            if (!accepted) {
+                wronglyRejectedLegit.push(c.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "filesystem",
+                source: `resolveWithinRoot() with legitimate path '${c.id}'`,
+                confidence: "high",
+                expectedBehavior: "Legitimate relative paths (including ones with spaces) must be accepted.",
+                observedBehavior: observed,
+                rawPreview: c.value,
+            }));
+        }
+        if (unrejectedTraversals.length > 0 || wronglyRejectedLegit.length > 0) {
+            const parts = [];
+            if (unrejectedTraversals.length > 0) {
+                parts.push(`${unrejectedTraversals.length} traversal payload(s) were not rejected: ${unrejectedTraversals.join(", ")}`);
+            }
+            if (wronglyRejectedLegit.length > 0) {
+                parts.push(`${wronglyRejectedLegit.length} legitimate path(s) were wrongly rejected: ${wronglyRejectedLegit.join(", ")}`);
+            }
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: parts.join("; "),
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/reportPoisoningScenario.js

@@ -0,0 +1,176 @@
+import { makeEvidence, stripUnsafeControlChars } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { renderJsonReport, renderTextReport, sanitizeForTextReport } from "../../report/renderSecurityReport.js";
+import { SAFE_BASELINE_CONTENT, detectJsonStructuralInjection } from "../reportSchemaGuard.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — report poisoning scenario.
+//
+// Registered under checkId "boundary" — the AttackScenario contract supports
+// only one primary check id per scenario, and report-rendering safety is a
+// boundary-of-trust concern (untrusted scanned/attacker content must not
+// escape into trusted report structure), same family as Batch 3's
+// configInjectionScenario (which covers a narrower slice of this: malformed
+// CLI config + basic JSON-breakout safety). This scenario is the dedicated,
+// broader check: ANSI/terminal escapes, fake section headers, HTML/script-
+// like content, markdown-link-like content, and JSON structural integrity —
+// all exercised through the real renderJsonReport()/renderTextReport()
+// functions with controlled, non-destructive mock findings (no payload is
+// ever written into target source files).
+// ---------------------------------------------------------------------------
+const REAL_VERDICT_BLOCK = ["=".repeat(72), "21. RELEASE VERDICT", "=".repeat(72)].join("\n");
+function makePoisonedReport(payloadValue) {
+    const now = new Date().toISOString();
+    return {
+        metadata: {
+            toolRoot: "/tool/root",
+            toolPackageName: "my-dev-kit-lab",
+            toolPackageVersion: "0.2.1",
+            targetRoot: "/tool/root",
+            targetDescription: "self (my-dev-kit-lab)",
+            packageName: "my-dev-kit-lab",
+            packageVersion: "0.2.1",
+            branch: "feature/security-validate-config-surface",
+            commit: "abc1234",
+            isSelf: true,
+            generatedAt: now,
+            totalDurationMs: 1,
+        },
+        sections: [],
+        allChecks: [
+            {
+                id: "report-poisoning-fixture",
+                name: payloadValue,
+                category: "artifact-safety",
+                status: "failed",
+                severity: "major",
+                startedAt: now,
+                finishedAt: now,
+                durationMs: 0,
+                findings: [
+                    {
+                        id: "report-poisoning-fixture-finding",
+                        title: payloadValue,
+                        severity: "major",
+                        category: "artifact-safety",
+                        description: payloadValue,
+                        recommendation: payloadValue,
+                        releaseImpact: "Should fix before release",
+                    },
+                ],
+                skippedReason: payloadValue,
+            },
+        ],
+        allFindings: [],
+        verdict: "ready-except-optional-manual-checks",
+        recommendedNextStep: payloadValue,
+        attackResults: [
+            {
+                scenarioId: "report-poisoning-fixture-scenario",
+                scenarioTitle: payloadValue,
+                checkId: "boundary",
+                profileId: "node-cli-package",
+                status: "failed",
+                severity: "major",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({ kind: "observation", source: "fixture", confidence: "low", rawPreview: payloadValue }),
+                ],
+                category: "artifact-safety",
+                recommendation: payloadValue,
+                skippedReason: payloadValue,
+            },
+        ],
+    };
+}
+export const REPORT_POISONING_SCENARIO = {
+    id: "report-poisoning-safety",
+    title: "Report poisoning: renderer treats payload content as untrusted data, never trusted structure",
+    description: "Renders text and JSON reports with report-poisoning payloads (ANSI escapes, fake section headers, JSON breakout, HTML/script-like, markdown-link-like) embedded in check/finding/attack-result fields, and confirms: JSON stays parseable with no extra top-level keys, text rendering never crashes, the real RELEASE VERDICT block is structurally intact, and no raw ANSI control bytes reach the final text output.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Report-poisoning payloads are rendered as inert content; they never corrupt JSON structure, crash rendering, or forge a trusted verdict/section.",
+    evidenceRequirements: ["output", "observation"],
+    run: async () => {
+        const evidence = [];
+        const problems = [];
+        const payloads = getPayloadsForGroup("report-poisoning");
+        // Baseline-diff check (v0.2.2 Batch 6): compare each poisoned render's
+        // top-level JSON keys against an identically-shaped render carrying an
+        // inert placeholder instead of the payload. A payload can only widen the
+        // top-level shape by actually breaking out of its string context —
+        // legitimate additive schema fields appear in both and are never
+        // flagged, so this doesn't need to know the current field list at all.
+        const baselineJson = renderJsonReport(makePoisonedReport(SAFE_BASELINE_CONTENT));
+        for (const payload of payloads) {
+            let jsonOk = true;
+            let jsonExtraKeys = [];
+            let textOk = true;
+            let textError;
+            let verdictBlockIntact = true;
+            let rawAnsiLeaked = false;
+            const report = makePoisonedReport(payload.value);
+            try {
+                const json = renderJsonReport(report);
+                const injection = detectJsonStructuralInjection(baselineJson, json);
+                jsonExtraKeys = injection.injectedTopLevelKeys;
+                jsonOk = injection.parseable && jsonExtraKeys.length === 0;
+            }
+            catch {
+                jsonOk = false;
+            }
+            let text = "";
+            try {
+                text = renderTextReport(report);
+            }
+            catch (err) {
+                textOk = false;
+                textError = err instanceof Error ? err.message : String(err);
+            }
+            if (textOk) {
+                verdictBlockIntact = text.includes(REAL_VERDICT_BLOCK);
+                rawAnsiLeaked = /\x1b\[[0-9;]*[a-zA-Z]/.test(text);
+            }
+            const payloadProblem = !jsonOk || !textOk || !verdictBlockIntact || rawAnsiLeaked;
+            if (payloadProblem) {
+                problems.push(payload.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "output",
+                source: `renderJsonReport()/renderTextReport() with payload '${payload.id}'`,
+                confidence: "high",
+                expectedBehavior: "JSON parseable with no extra top-level keys; text rendering does not crash; real verdict block intact; no raw ANSI bytes in text output.",
+                observedBehavior: `jsonOk=${jsonOk}${jsonExtraKeys.length > 0 ? ` (extraKeys=${jsonExtraKeys.join(",")})` : ""}, textOk=${textOk}${textError ? ` (${textError})` : ""}, verdictBlockIntact=${verdictBlockIntact}, rawAnsiLeaked=${rawAnsiLeaked}`,
+                rawPreview: payload.value,
+            }));
+        }
+        // Direct regression check on the sanitizer itself, independent of the
+        // full report pipeline above.
+        const ansiPayload = payloads.find((p) => p.id === "report-poisoning-ansi-escape");
+        if (ansiPayload) {
+            const sanitized = sanitizeForTextReport(ansiPayload.value);
+            const stillHasAnsi = /\x1b\[[0-9;]*[a-zA-Z]/.test(sanitized);
+            const stillHasAnsiViaStrip = /\x1b\[[0-9;]*[a-zA-Z]/.test(stripUnsafeControlChars(ansiPayload.value));
+            if (stillHasAnsi || stillHasAnsiViaStrip) {
+                problems.push("ansi-sanitizer-regression");
+            }
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: "sanitizeForTextReport() / stripUnsafeControlChars() direct check",
+                confidence: "high",
+                expectedBehavior: "ANSI escape sequences are removed by the sanitizer.",
+                observedBehavior: stillHasAnsi || stillHasAnsiViaStrip ? "ANSI bytes survived sanitization." : "ANSI bytes removed.",
+            }));
+        }
+        if (problems.length > 0) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: `Report rendering is not safe against payload(s): ${problems.join(", ")}. Fix before treating generated reports as safe to share.`,
+            };
+        }
+        return { status: "passed", confidence: "high", evidence };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/secretLeakageScenario.js

@@ -0,0 +1,143 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { collectBoundedSourceFiles, lineNumberAt } from "../boundedSourceScan.js";
+const SEVERITY_FOR_KIND = {
+    "private-key": "blocker",
+    "github-token": "blocker",
+    "openai-token": "blocker",
+    "aws-key": "blocker",
+    "generic-secret-assignment": "major",
+};
+const SECRET_PATTERNS = [
+    { kind: "private-key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { kind: "github-token", regex: /gh[pousr]_[A-Za-z0-9]{16,}/g },
+    { kind: "openai-token", regex: /sk-[A-Za-z0-9]{16,}/g },
+    { kind: "aws-key", regex: /AKIA[0-9A-Z]{12,}/g },
+    {
+        kind: "generic-secret-assignment",
+        regex: /(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*["']?([A-Za-z0-9_\-]{8,})["']?/gi,
+    },
+];
+const PLACEHOLDER_MARKERS = [
+    /\bexample\b/i,
+    /change[-_]?me/i,
+    /\bdummy\b/i,
+    /\btest\b/i,
+    /\bfake\b/i,
+    /your[-_]?api[-_]?key/i,
+    /<[a-z_]+>/i,
+    /\bxxxx+\b/i,
+    /\bplaceholder\b/i,
+    /\bsample\b/i,
+    /\bredacted\b/i,
+];
+function isPlaceholder(text) {
+    return PLACEHOLDER_MARKERS.some((p) => p.test(text));
+}
+const SEVERITY_RANK = {
+    blocker: 4,
+    major: 3,
+    minor: 2,
+    informational: 1,
+    skipped: 0,
+};
+function scanFileForSecrets(relativePath, content) {
+    const findings = [];
+    for (const { kind, regex } of SECRET_PATTERNS) {
+        // Each pattern object's `regex` is reused across files; reset lastIndex
+        // via a fresh exec loop to stay correct for global regexes.
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+            const matchedText = match[0];
+            // For the generic assignment pattern, judge placeholder-ness on the
+            // captured value; for shaped tokens, judge on the whole match.
+            const judgedText = kind === "generic-secret-assignment" ? (match[1] ?? matchedText) : matchedText;
+            if (isPlaceholder(judgedText) || isPlaceholder(matchedText)) {
+                // Downgrade: not a high-confidence finding, skip entirely rather
+                // than add noise — placeholders are expected in source/config.
+                continue;
+            }
+            // Guard against zero-length matches looping forever.
+            if (matchedText.length === 0) {
+                re.lastIndex += 1;
+                continue;
+            }
+            findings.push({
+                kind,
+                file: relativePath,
+                line: lineNumberAt(content, match.index),
+                matchedText,
+                matchLength: matchedText.length,
+                severity: SEVERITY_FOR_KIND[kind],
+            });
+        }
+    }
+    return findings;
+}
+export const SECRET_LEAKAGE_SCENARIO = {
+    id: "secret-leakage-bounded-scan",
+    title: "Secret leakage: bounded static scan finds no high-confidence secret-shaped literals",
+    description: "Scans a bounded, deterministic set of project files (manifests, tsconfig, src/, scripts/, .env*) for high-confidence secret-shaped literal values (private keys, GitHub/OpenAI/AWS-style tokens, generic password/token/secret assignments). Placeholder values and bare env-var-name references are excluded from findings.",
+    checkId: "secrets",
+    applicableProfiles: [],
+    severityBaseline: "informational",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "No high-confidence secret-shaped literal values are present in the bounded glob set inspected.",
+    evidenceRequirements: ["secret-leak", "observation"],
+    run: async (ctx) => {
+        const files = collectBoundedSourceFiles(ctx.target.targetRoot);
+        if (files.length === 0) {
+            return {
+                status: "passed",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({
+                        kind: "observation",
+                        source: "bounded secret scan file collection",
+                        confidence: "low",
+                        expectedBehavior: "At least one file would be scanned for a meaningful bounded-scan claim.",
+                        observedBehavior: "0 files matched the bounded glob set (package.json/tsconfig/src/scripts/.env*). No findings because there was nothing to scan — this does not prove the target has no secrets elsewhere.",
+                    }),
+                ],
+            };
+        }
+        const allFindings = [];
+        for (const file of files) {
+            allFindings.push(...scanFileForSecrets(file.relativePath, file.content));
+        }
+        allFindings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+        const evidence = [
+            makeEvidence({
+                kind: "observation",
+                source: "bounded secret scan",
+                confidence: "medium",
+                expectedBehavior: "Bounded scan of manifests/tsconfig/src/scripts/.env* files.",
+                observedBehavior: `${files.length} file(s) scanned; ${allFindings.length} high-confidence secret-shaped finding(s).`,
+            }),
+            ...allFindings.slice(0, 20).map((f) => makeEvidence({
+                kind: "secret-leak",
+                source: `pattern '${f.kind}'`,
+                filePath: f.file,
+                line: f.line,
+                confidence: "high",
+                expectedBehavior: "No literal high-confidence secret values in scanned source paths.",
+                // Manually pre-redacted: never pass the raw matched text through —
+                // some generic-assignment matches are shorter than the 32-char
+                // generic redaction threshold in redactPreview(), so we redact
+                // explicitly here rather than relying on it for this scenario.
+                rawPreview: `${f.kind} match in ${f.file}:${f.line} [REDACTED:${f.matchLength}chars]`,
+            })),
+        ];
+        if (allFindings.length === 0) {
+            return { status: "passed", confidence: "medium", evidence };
+        }
+        const worstSeverity = allFindings.reduce((worst, f) => (SEVERITY_RANK[f.severity] > SEVERITY_RANK[worst] ? f.severity : worst), "informational");
+        return {
+            status: "failed",
+            confidence: "high",
+            evidence,
+            severity: worstSeverity,
+            recommendation: `Remove or rotate ${allFindings.length} high-confidence secret-shaped value(s) found in the scanned bounded file set; move secrets to environment variables or a secret manager, never literal source/config values.`,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/subprocessInjectionScenario.js

@@ -0,0 +1,117 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { runSecurityCommand } from "../../commandRunner.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — subprocess injection scenario.
+//
+// Non-destructive by construction: never executes a payload as a shell
+// command. Instead it runs `node -e "..."` with each subprocess-injection
+// payload passed as a single argv element (via spawn's argument array, the
+// same mechanism runSecurityCommand/runMeasuredCommand use), and confirms
+// the child process receives it back as exactly one literal argument — proof
+// that no shell re-interpreted it (splitting it into multiple commands via
+// `;`, `&&`, backticks, `$()`, or `|`).
+//
+// Also does a bounded static check that the command-execution helpers this
+// scenario exercises are built with `shell: false` (source inspection of a
+// known-small file, not a general code scanner).
+// ---------------------------------------------------------------------------
+const ECHO_ARGV_SCRIPT = "process.stdout.write(JSON.stringify(process.argv.slice(1)))";
+function commandRunnerSourcePath() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "commandRunner.ts");
+}
+export const SUBPROCESS_INJECTION_SCENARIO = {
+    id: "subprocess-injection-safety",
+    title: "Subprocess injection: shell metacharacter payloads are passed as literal arguments",
+    description: "Runs a benign argv-echoing Node script with each subprocess-injection payload as a single spawn argument and confirms it round-trips as exactly one literal string, proving no shell re-interpretation. Also checks that commandRunner.ts constructs subprocess calls with shell:false.",
+    checkId: "subprocess",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Every subprocess-injection payload round-trips as a single literal argv element; commandRunner.ts uses shell:false.",
+    evidenceRequirements: ["command", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const notLiteral = [];
+        const payloads = getPayloadsForGroup("subprocess-injection");
+        for (const p of payloads) {
+            const cmd = await runSecurityCommand({
+                command: process.execPath,
+                args: ["-e", ECHO_ARGV_SCRIPT, p.value],
+                cwd: ctx.toolRoot,
+                timeoutMs: 10_000,
+            });
+            let roundTrippedCorrectly = false;
+            try {
+                const parsed = JSON.parse(cmd.stdout.trim());
+                roundTrippedCorrectly = parsed.length === 1 && parsed[0] === p.value;
+            }
+            catch {
+                roundTrippedCorrectly = false;
+            }
+            if (!roundTrippedCorrectly) {
+                notLiteral.push(p.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "command",
+                source: `runSecurityCommand() argv round-trip for payload '${p.id}'`,
+                commandCwd: ctx.toolRoot,
+                commandSummary: "node -e <argv-echo-script> <payload>",
+                exitCode: cmd.exitCode,
+                confidence: "high",
+                expectedBehavior: "Payload must round-trip as exactly one literal argv element.",
+                observedBehavior: roundTrippedCorrectly
+                    ? "Round-tripped as a single literal argument, as expected."
+                    : "Did NOT round-trip as a single literal argument — possible shell interpretation.",
+                rawPreview: p.value,
+            }));
+        }
+        let shellFalseConfirmed = false;
+        let sourceReadable = true;
+        try {
+            const source = fs.readFileSync(commandRunnerSourcePath(), "utf8");
+            shellFalseConfirmed = /shell:\s*false/.test(source);
+        }
+        catch {
+            sourceReadable = false;
+        }
+        evidence.push(makeEvidence({
+            kind: "observation",
+            source: "static check: src/securityValidation/commandRunner.ts",
+            confidence: sourceReadable ? "high" : "low",
+            expectedBehavior: "Subprocess calls should be constructed with shell:false.",
+            observedBehavior: sourceReadable
+                ? shellFalseConfirmed
+                    ? "shell:false found in commandRunner.ts."
+                    : "shell:false NOT found in commandRunner.ts."
+                : "Could not read commandRunner.ts source for static confirmation.",
+        }));
+        if (notLiteral.length > 0 || (sourceReadable && !shellFalseConfirmed)) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: notLiteral.length > 0
+                    ? `Investigate argument construction — payload(s) did not round-trip literally: ${notLiteral.join(", ")}.`
+                    : "commandRunner.ts must construct child_process.spawn calls with shell:false.",
+            };
+        }
+        if (!sourceReadable) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence,
+                recommendation: "Could not statically confirm shell:false; argv round-trip evidence is still valid.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};