@event4u/agent-config 9.6.0 → 9.8.0

package/src/scripts/_lib/risk_paths.ts

@@ -0,0 +1,160 @@
+/**
+ * Trust-boundary risk classification — the second axis of rigor.
+ *
+ * `discipline_profile: auto` answers one question: *how much governance can
+ * this host afford?* It is a property of the environment. The question it
+ * cannot ask is *how dangerous is this diff?* — a property of the change.
+ *
+ * The two are orthogonal, and today only one of them is wired. That leaves a
+ * live combination: a weak host plus a diff in the installer's provenance path
+ * resolves to minimum discipline, which is exactly the change class hardened in
+ * 9.6.0 (CWE-426/88/427). The fix went in; the process escalation for the next
+ * change of the same class did not.
+ *
+ * **This module classifies. It does not gate.** It exists to produce the number
+ * that decides whether gating is justified — see
+ * `internal/reports/risk-escalation-shadow.json`. The teeth threshold was
+ * written into the roadmap before the report was first read, so the measurement
+ * cannot be rationalised after the fact.
+ *
+ * Classification is path-based on purpose. A model judgement about whether a
+ * diff "feels risky" is not reproducible from the diff alone; a path match is.
+ */
+
+import { KERNEL_RULE_FILENAMES } from './kernel_rules.js';
+
+/** Risk classes, in ascending severity. `none` is the common case. */
+export type RiskClass = 'none' | 'governance' | 'auth' | 'trust-boundary';
+
+/** Severity order — used to take the max across a multi-file diff. */
+const SEVERITY: Record<RiskClass, number> = {
+    none: 0,
+    governance: 1,
+    auth: 2,
+    'trust-boundary': 3,
+};
+
+export interface RiskVerdict {
+    /** Highest class across every path in the diff. */
+    risk: RiskClass;
+    /** Why — one reason per matched path, for the report. */
+    reasons: { path: string; risk: RiskClass; because: string }[];
+}
+
+/**
+ * Docs-only changes are exempt from escalation.
+ *
+ * Taken from the reference, which carves this out explicitly, and it is the
+ * right carve-out: a paragraph describing the installer does not cross a trust
+ * boundary.
+ *
+ * The exemption is about what a file *is*, not what extension it carries. In
+ * this repo governance is written in markdown — a rule file, `AGENTS.md`, and
+ * the kernel set are all `.md`, and all of them are executable policy rather
+ * than prose about policy. An extension-only test classified
+ * `src/rules/icon-consistency.md` as `none`, which is how the most governed
+ * surface in the tree would have escaped the classifier entirely. Governed
+ * markdown is excluded from the exemption up front.
+ */
+function is_docs_only(p: string): boolean {
+    if (!/\.(md|mdx|txt)$/i.test(p)) return false;
+    if (p.startsWith('src/rules/')) return false;
+    if (/(^|\/)AGENTS\.md$/.test(p)) return false;
+    return true;
+}
+
+/**
+ * Does this path carry authentication, authorization, session, or token logic?
+ * Kept to the names this repo actually uses, so it does not fire on every file
+ * with "user" in it.
+ */
+function is_auth_path(p: string): boolean {
+    return /(^|\/)(auth|authz|session|token|credential|secret)s?[/.]/i.test(p)
+        || /(^|\/)(keys|keychain)\b/i.test(p);
+}
+
+/**
+ * Does this path decide *where framework code comes from* or *whether it is
+ * genuine*? This is the class the reference justifies in its own text as
+ * crossing a downstream trust boundary — the change affects people other than
+ * the one making it, because a consumer installs the result.
+ */
+function is_trust_boundary_path(p: string): boolean {
+    if (p.startsWith('src/install/')) return true;
+    if (/(^|\/)(install|bootstrap|update)r?\.(ts|sh|mjs|cjs)$/i.test(p)) return true;
+    if (/scripts\/install/i.test(p)) return true;
+    if (/(^|\/)(provenance|manifest|integrity|bundle)[.-]/i.test(p)) return true;
+    // Publishing and release automation resolve the source a consumer receives.
+    if (/^\.github\/workflows\/(publish|release)/i.test(p)) return true;
+    // The spawn path composes the prompt a subagent runs under, floor included.
+    if (/subagent_(spawn|bundle|floor)/i.test(p)) return true;
+    if (/generate_subagent_floor/i.test(p)) return true;
+    return false;
+}
+
+/** Kernel rules and the safety floor — the invariants everything else rests on. */
+function is_kernel_path(p: string): boolean {
+    const base = p.slice(p.lastIndexOf('/') + 1);
+    if (p.startsWith('src/rules/') && KERNEL_RULE_FILENAMES.has(base)) return true;
+    return /_lib\/kernel_rules\.ts$/.test(p) || /iron_law_sha/.test(p);
+}
+
+/** Governance surfaces — rules, settings schema, and the agent contract files. */
+function is_governance_path(p: string): boolean {
+    if (p.startsWith('src/rules/')) return true;
+    if (/(^|\/)AGENTS\.md$/.test(p)) return true;
+    if (/agent-settings.*\.(yml|yaml|json)$/i.test(p)) return true;
+    if (/schemas\/.*\.schema\.json$/.test(p)) return true;
+    return false;
+}
+
+/** Classify one path. */
+export function classify_path(p: string): { risk: RiskClass; because: string } {
+    // Kernel and spawn paths outrank the docs exemption: a kernel rule IS a
+    // markdown file, so exempting by extension first would classify the most
+    // dangerous surface in the repo as `none`.
+    if (is_kernel_path(p)) {
+        return { risk: 'trust-boundary', because: 'kernel rule or Iron-Law integrity surface' };
+    }
+    if (is_docs_only(p)) return { risk: 'none', because: 'docs-only' };
+    if (is_trust_boundary_path(p)) {
+        return {
+            risk: 'trust-boundary',
+            because: 'installer, provenance, publish, or subagent-spawn path — crosses a downstream trust boundary',
+        };
+    }
+    if (is_auth_path(p)) {
+        return { risk: 'auth', because: 'authentication, session, token, or secret handling' };
+    }
+    if (is_governance_path(p)) {
+        return { risk: 'governance', because: 'rule, settings, or schema surface' };
+    }
+    return { risk: 'none', because: '' };
+}
+
+/** Classify a whole diff — the verdict is the highest class present. */
+export function classify_diff(paths: readonly string[]): RiskVerdict {
+    const reasons: RiskVerdict['reasons'] = [];
+    let risk: RiskClass = 'none';
+    for (const p of paths) {
+        const v = classify_path(p);
+        if (v.risk === 'none') continue;
+        reasons.push({ path: p, risk: v.risk, because: v.because });
+        if (SEVERITY[v.risk] > SEVERITY[risk]) risk = v.risk;
+    }
+    return { risk, reasons };
+}
+
+/**
+ * Combine the host axis with the risk axis.
+ *
+ * The direction is the whole point and is encoded rather than left to a caller:
+ * the host profile sets a floor, a risk trigger may only **raise** it. A weak
+ * host must never be able to lower an escalation, which is the failure mode
+ * that makes the two-axis model worth having at all.
+ */
+export function escalated_floor(hostFloor: number, risk: RiskClass): number {
+    return Math.max(hostFloor, SEVERITY[risk]);
+}
+
+export { SEVERITY as RISK_SEVERITY };

package/src/scripts/_lib/secret_detector.test.ts

@@ -0,0 +1,103 @@
+/**
+ * secret_detector — coverage (secret-hygiene-guardrail Phase 0).
+ *
+ * Positive fixtures: each labelled line carries one fake secret; expectations
+ * come from an in-test label→kind map, NOT from detector output.
+ * Negative fixtures: every line must be free of high/medium findings (low is
+ * only for placeholder-shaped lines; the `secret-allow` line yields nothing).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { describe, expect, it } from 'vitest';
+
+import { scanText, type SecretFinding } from './secret_detector.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURES = path.join(HERE, 'fixtures', 'secret-detector');
+
+function readFixture(name: string): string {
+    return fs.readFileSync(path.join(FIXTURES, name), 'utf-8');
+}
+
+// Label → expected kind. Keyed by the leading `<label>|` token, so a reordered
+// fixture cannot silently pass.
+const EXPECTED_KIND: Readonly<Record<string, string>> = {
+    aws: 'aws-access-key',
+    github: 'github-pat',
+    stripe: 'stripe-secret-key',
+    google: 'google-api-key',
+    slack: 'slack-token',
+    pem: 'pem-private-key',
+    jwt: 'jwt',
+    dburl: 'db-connection-uri',
+    assignment: 'generic-assignment',
+};
+
+function isReal(f: SecretFinding): boolean {
+    return f.confidence === 'high' || f.confidence === 'medium';
+}
+
+describe('scanText — positives', () => {
+    const text = readFixture('positives.txt');
+    const lines = text.split(/\r\n|\r|\n/);
+    const findings = scanText(text);
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] as string;
+        if (!line.includes('|') || line.startsWith('#')) {
+            continue;
+        }
+        const label = line.slice(0, line.indexOf('|'));
+        const expectedKind = EXPECTED_KIND[label];
+        const lineNo = i + 1;
+
+        it(`flags ${label} as ${expectedKind}`, () => {
+            expect(expectedKind, `no expected kind mapped for label "${label}"`).toBeDefined();
+            const onLine = findings.filter((f) => f.line === lineNo && isReal(f));
+            const kinds = onLine.map((f) => f.kind);
+            expect(
+                kinds,
+                `line ${lineNo} (${label}) expected kind ${expectedKind}, got ${JSON.stringify(onLine)}`,
+            ).toContain(expectedKind);
+        });
+    }
+});
+
+describe('scanText — negatives', () => {
+    const text = readFixture('negatives.txt');
+    const lines = text.split(/\r\n|\r|\n/);
+    const findings = scanText(text);
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] as string;
+        if (line.trim() === '' || line.startsWith('#')) {
+            continue;
+        }
+        const lineNo = i + 1;
+        it(`no high/medium finding on line ${lineNo}`, () => {
+            const real = findings.filter((f) => f.line === lineNo && isReal(f));
+            expect(real, `unexpected real findings: ${JSON.stringify(real)}`).toHaveLength(0);
+        });
+    }
+
+    it('the secret-allow line yields zero findings of any confidence', () => {
+        const allowLineNo = lines.findIndex((l) => l.includes('secret-allow')) + 1;
+        expect(allowLineNo, 'no secret-allow line in fixture').toBeGreaterThan(0);
+        const onLine = findings.filter((f) => f.line === allowLineNo);
+        expect(onLine).toHaveLength(0);
+    });
+});
+
+describe('scanText — masking', () => {
+    it('never reproduces the raw secret in `masked`', () => {
+        const raw = 'AKIA1234567890ABCDEF';
+        const findings = scanText(`aws_key = "${raw}"`);
+        const hit = findings.find((f) => f.kind === 'aws-access-key');
+        expect(hit, 'expected an aws-access-key finding').toBeDefined();
+        const masked = (hit as SecretFinding).masked;
+        expect(masked).not.toBe(raw);
+        expect(masked.includes(raw)).toBe(false);
+    });
+});

package/src/scripts/_lib/secret_detector.ts

@@ -0,0 +1,319 @@
+// VCS-agnostic secret detector (secret-hygiene-guardrail Phase 0).
+//
+// A pure, I/O-free, network-free module: given a blob of text it returns the
+// secrets it finds. Callers (pre-commit hooks, CI scanners, editor lints)
+// decide policy — this module only detects.
+//
+// Three detection layers, in confidence order:
+//   1. Regex rule pack (HIGH) — reuses the exact `_SECRET` patterns from
+//      `lint_mcp_config_security.ts` (sk-ant-, sk-proj-, AKIA, AIza, ghp_, JWT)
+//      and extends them with Stripe, Slack, PEM private-key headers, DB
+//      connection URLs with embedded credentials, and generic secret-ish
+//      assignments. The reused patterns are NOT weakened.
+//   2. Entropy layer (MEDIUM) — Shannon entropy over base64/hex-ish tokens
+//      ≥ ENTROPY_MIN_TOKEN_LENGTH chars, flagging those above a tunable
+//      per-charset threshold (base64 ≥ 4.5 bits/char, hex ≥ 3.0).
+//   3. Keyword/context — a high-entropy token on a line that also mentions a
+//      secret keyword is raised to HIGH; standalone entropy stays MEDIUM.
+//
+// False-positive suppression lives INSIDE the detector: a `secret-allow`
+// marker mutes a line, placeholder-shaped values are demoted to LOW (still
+// returned so callers can choose), and the masked preview never reproduces the
+// full secret.
+
+/** One detected secret. Never carries the raw value — see `masked`. */
+export interface SecretFinding {
+    rule: string;
+    kind: string;
+    line: number;
+    column: number;
+    masked: string;
+    confidence: 'high' | 'medium' | 'low';
+}
+
+/** Options for a scan. `path` lets `.example` / `.sample` files demote hits. */
+export interface ScanOptions {
+    path?: string;
+}
+
+// ---------------------------------------------------------------------
+// Entropy thresholds (exported so callers / tests can tune + assert them).
+// ---------------------------------------------------------------------
+
+/** Minimum token length before the entropy layer even considers a candidate. */
+export const ENTROPY_MIN_TOKEN_LENGTH = 20;
+/** base64/mixed-alphabet tokens above this bits/char are entropy hits. */
+export const BASE64_ENTROPY_THRESHOLD = 4.5;
+/** pure-hex tokens above this bits/char are entropy hits (with keyword ctx). */
+export const HEX_ENTROPY_THRESHOLD = 3.0;
+
+// ---------------------------------------------------------------------
+// Regex rule pack (HIGH-confidence).
+// ---------------------------------------------------------------------
+
+interface Rule {
+    rule: string;
+    kind: string;
+    regex: RegExp; // MUST carry the global flag
+    valueGroup?: number; // capture group holding the sensitive value (default 0)
+}
+
+// Reused verbatim from lint_mcp_config_security.ts `_SECRET` (do NOT weaken),
+// split into individually-kinded rules, plus the extension set from the spec.
+const RULES: readonly Rule[] = [
+    { rule: 'anthropic-api-key', kind: 'anthropic-api-key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+    { rule: 'anthropic-project-key', kind: 'anthropic-api-key', regex: /sk-proj-[A-Za-z0-9_-]{20,}/g },
+    { rule: 'aws-access-key', kind: 'aws-access-key', regex: /AKIA[0-9A-Z]{16}/g },
+    { rule: 'google-api-key', kind: 'google-api-key', regex: /AIza[0-9A-Za-z_-]{35}/g },
+    { rule: 'github-pat', kind: 'github-pat', regex: /ghp_[0-9A-Za-z]{36}/g },
+    {
+        rule: 'jwt',
+        kind: 'jwt',
+        regex: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    },
+    // Extensions.
+    { rule: 'stripe-secret-key', kind: 'stripe-secret-key', regex: /sk_(?:live|test)_[0-9A-Za-z]{16,}/g },
+    { rule: 'slack-token', kind: 'slack-token', regex: /xox[baprs]-[0-9A-Za-z-]{10,}/g },
+    { rule: 'pem-private-key', kind: 'pem-private-key', regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+    {
+        rule: 'db-connection-uri',
+        kind: 'db-connection-uri',
+        regex: /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/g,
+    },
+    {
+        rule: 'generic-assignment',
+        kind: 'generic-assignment',
+        regex: /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?([^'"\s]{8,})['"]?/gi,
+        valueGroup: 1,
+    },
+];
+
+// ---------------------------------------------------------------------
+// Suppression + placeholder detection.
+// ---------------------------------------------------------------------
+
+// A line carrying any comment-style `secret-allow` marker is fully muted.
+const SECRET_ALLOW = /secret-allow/;
+
+// A high-entropy token that looks like a placeholder is demoted to LOW.
+const PLACEHOLDER_PATTERNS: readonly RegExp[] = [
+    /x{4,}/i,
+    /example/i,
+    /changeme/i,
+    /your[_-].*here/i,
+    /<[^>]+>/,
+    /\.\.\./,
+    /^your[_-]/i,
+    /placeholder/i,
+];
+
+// A base64 data URI (embedded image/font) — its payload is not a secret.
+const DATA_URI = /data:[\w.+-]+\/[\w.+-]+;base64,/i;
+
+// A UUID is a benign identifier, not a credential.
+const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+// Secret-context keywords that raise an otherwise-MEDIUM entropy hit to HIGH.
+const KEYWORD_CONTEXT = /password|secret|token|api[_-]?key|credential/i;
+
+// Candidate high-entropy tokens (base64 / hex alphabets). `/` is deliberately
+// excluded — it appears in URL paths far more than in inline credentials, and
+// including it turns every long path slug into a false positive.
+const ENTROPY_TOKEN = /[A-Za-z0-9+=_-]{20,}/g;
+const IS_HEX = /^[0-9a-fA-F]+$/;
+// Common digest lengths (MD5 / SHA-1 / SHA-256 hex). A token of exactly one of
+// these is a hash — a commit SHA, lockfile digest, condensation hash — not a
+// credential. Never flag it, even with a keyword nearby.
+const HASH_HEX_LENGTHS: ReadonlySet<number> = new Set([32, 40, 64]);
+
+function isAllSameChar(value: string): boolean {
+    return value.length > 0 && /^(.)\1*$/.test(value);
+}
+
+// Minimum length + entropy for a `generic-assignment` value to count as a real
+// credential. A bare `secret: moderate` / `token: modelName` / `key: request()`
+// is a keyword-shaped assignment of a low-entropy WORD — not a secret. Real
+// credentials assigned this way are long and high-entropy. Without this gate the
+// generic rule floods on prose, config, and test data (the FP class the council
+// warned about — precision over allowlist growth).
+const GENERIC_MIN_LENGTH = 16;
+const GENERIC_MIN_ENTROPY = 3.3;
+// Code-expression shapes: an assignment RHS that is a reference / call /
+// interpolation, not a literal credential (`opts.apiKey`, `${API_KEY}`,
+// `load()`, `process.env.X`, `$this->get()`). Never a real inline secret.
+const CODE_EXPR = /[()$`{}<>[\];,]|->|=>|\.\w/;
+
+function looksLikeSecretValue(value: string): boolean {
+    if (value.length < GENERIC_MIN_LENGTH) {
+        return false;
+    }
+    if (CODE_EXPR.test(value)) {
+        return false;
+    }
+    // A real credential carries entropy AND is not a plain lowercase word —
+    // it has a digit or mixed case.
+    const hasDigit = /[0-9]/.test(value);
+    const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+    if (!hasDigit && !mixedCase) {
+        return false;
+    }
+    return shannonEntropy(value) >= GENERIC_MIN_ENTROPY;
+}
+
+function isPlaceholderValue(value: string, pathHint?: string): boolean {
+    if (pathHint !== undefined) {
+        if (
+            pathHint.endsWith('.example') ||
+            pathHint.endsWith('.sample') ||
+            pathHint.includes('.env.example')
+        ) {
+            return true;
+        }
+    }
+    if (isAllSameChar(value)) {
+        return true;
+    }
+    return PLACEHOLDER_PATTERNS.some((p) => p.test(value));
+}
+
+/** first ≤4 + `…` + last ≤2; guaranteed never to contain the full value. */
+function maskSecret(value: string): string {
+    const front = value.slice(0, 4);
+    const back = value.length > 6 ? value.slice(-2) : '';
+    if (front.length + back.length >= value.length) {
+        // Too short for a 4+2 window without revealing everything — hide more.
+        return `${value.slice(0, 1)}…`;
+    }
+    return `${front}…${back}`;
+}
+
+function shannonEntropy(value: string): number {
+    const freq = new Map<string, number>();
+    for (const ch of value) {
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    }
+    const n = value.length;
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / n;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+
+function overlaps(spans: ReadonlyArray<[number, number]>, start: number, end: number): boolean {
+    return spans.some(([s, e]) => start < e && s < end);
+}
+
+/**
+ * Scan `text` for secrets. Pure — no I/O, no network. Line and column are
+ * 1-based; column points at the sensitive value, not the surrounding syntax.
+ */
+export function scanText(text: string, opts: ScanOptions = {}): SecretFinding[] {
+    const pathHint = opts.path;
+    const findings: SecretFinding[] = [];
+    const lines = text.split(/\r\n|\r|\n/);
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] as string;
+        const lineNo = i + 1;
+
+        // A `secret-allow` marker mutes the whole line — no findings at all.
+        if (SECRET_ALLOW.test(line)) {
+            continue;
+        }
+
+        const covered: Array<[number, number]> = [];
+
+        // Layer 1 — regex rule pack (HIGH, demoted to LOW for placeholders).
+        for (const rule of RULES) {
+            rule.regex.lastIndex = 0;
+            let m: RegExpExecArray | null;
+            while ((m = rule.regex.exec(line)) !== null) {
+                const value = rule.valueGroup !== undefined ? m[rule.valueGroup] : m[0];
+                if (value === undefined) {
+                    if (m.index === rule.regex.lastIndex) {
+                        rule.regex.lastIndex += 1;
+                    }
+                    continue;
+                }
+                // The keyword-anchored generic rule needs a value-likeness gate:
+                // a low-entropy word after `secret:`/`token:` is not a credential.
+                if (rule.rule === 'generic-assignment' && !looksLikeSecretValue(value)) {
+                    if (m.index === rule.regex.lastIndex) {
+                        rule.regex.lastIndex += 1;
+                    }
+                    continue;
+                }
+                const valueStart = m.index + m[0].indexOf(value);
+                const confidence: SecretFinding['confidence'] = isPlaceholderValue(value, pathHint)
+                    ? 'low'
+                    : 'high';
+                findings.push({
+                    rule: rule.rule,
+                    kind: rule.kind,
+                    line: lineNo,
+                    column: valueStart + 1,
+                    masked: maskSecret(value),
+                    confidence,
+                });
+                covered.push([valueStart, valueStart + value.length]);
+                if (m.index === rule.regex.lastIndex) {
+                    rule.regex.lastIndex += 1;
+                }
+            }
+        }
+
+        // Layer 2 + 3 — entropy, raised by keyword context. Skip data URIs.
+        if (!DATA_URI.test(line)) {
+            const hasKeyword = KEYWORD_CONTEXT.test(line);
+            ENTROPY_TOKEN.lastIndex = 0;
+            let tm: RegExpExecArray | null;
+            while ((tm = ENTROPY_TOKEN.exec(line)) !== null) {
+                const token = tm[0];
+                const start = tm.index;
+                const end = start + token.length;
+                if (token.length < ENTROPY_MIN_TOKEN_LENGTH) {
+                    continue;
+                }
+                if (overlaps(covered, start, end)) {
+                    continue; // already reported by the regex pack
+                }
+                if (UUID.test(token)) {
+                    continue; // benign identifier
+                }
+                const entropy = shannonEntropy(token);
+                const isHex = IS_HEX.test(token);
+                if (isHex && HASH_HEX_LENGTHS.has(token.length)) {
+                    continue; // MD5 / SHA-1 / SHA-256 digest — a hash, not a secret
+                }
+                let confidence: SecretFinding['confidence'] | null = null;
+                if (isHex) {
+                    // Pure hex is usually a SHA / UUID / lockfile hash — only a
+                    // keyword nearby lifts it out of benign territory.
+                    if (entropy >= HEX_ENTROPY_THRESHOLD && hasKeyword) {
+                        confidence = 'high';
+                    }
+                } else if (entropy >= BASE64_ENTROPY_THRESHOLD) {
+                    confidence = hasKeyword ? 'high' : 'medium';
+                }
+                if (confidence === null) {
+                    continue;
+                }
+                if (isPlaceholderValue(token, pathHint)) {
+                    confidence = 'low';
+                }
+                findings.push({
+                    rule: 'entropy',
+                    kind: 'high-entropy-string',
+                    line: lineNo,
+                    column: start + 1,
+                    masked: maskSecret(token),
+                    confidence,
+                });
+            }
+        }
+    }
+
+    return findings;
+}

package/src/scripts/_lib/spawn_env.ts

@@ -14,6 +14,11 @@
  *   - git command-injection (CWE-88): GIT_EXTERNAL_DIFF, GIT_SSH,
  *     GIT_SSH_COMMAND, GIT_PROXY_COMMAND, any GIT_*_COMMAND, GIT_PAGER, PAGER —
  *     git runs these as shell commands (`core.pager` / external-diff RCE).
+ *   - git config-injection (CWE-88): the GIT_CONFIG* family (GIT_CONFIG,
+ *     GIT_CONFIG_GLOBAL/_SYSTEM, and inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n>
+ *     / GIT_CONFIG_VALUE_<n>) sets ANY git config — `core.fsmonitor` runs shell
+ *     on every `git status`; GIT_ALTERNATE_OBJECT_DIRECTORIES / HOSTALIASES
+ *     redirect object stores / hostname resolution.
  *   - runtime auto-exec hooks: NODE_OPTIONS (`--require attacker.js`),
  *     BASH_ENV / ENV (sourced by non-interactive shells), PYTHONPATH /
  *     PYTHONSTARTUP / PYTHONINSPECT, PERL5OPT / PERL5LIB, RUBYOPT.
@@ -45,6 +50,13 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
     'GIT_PROXY_COMMAND',
     'GIT_PAGER',
     'PAGER',
+    // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
+    // attacker-controlled object stores; the GIT_CONFIG* family is handled by
+    // prefix below (it is a general arbitrary-config-injection primitive).
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
+    // redirecting any network fetch the child performs (CWE-427-adjacent).
+    'HOSTALIASES',
     // runtime auto-exec hooks
     'NODE_OPTIONS',
     'BASH_ENV',
@@ -61,14 +73,22 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
 
 /**
  * Prefix families removed by pattern. `LD_` / `DYLD_` cover loader variants we
- * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook
- * (e.g. GIT_ASKPASS is intentionally NOT here — it is a path, not a shell
- * command, and legitimate credential helpers need it; the *_COMMAND family is
- * the shell-executed one).
+ * did not enumerate; `GIT_*_COMMAND` covers every git config-command hook; the
+ * `GIT_CONFIG` family (GIT_CONFIG, GIT_CONFIG_GLOBAL, GIT_CONFIG_SYSTEM, and the
+ * inline GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> trio) is a
+ * general arbitrary-config-injection primitive — an attacker can set ANY git
+ * config key, e.g. `core.fsmonitor` / `core.pager` / `core.sshCommand` /
+ * `core.hooksPath` / `alias.*`, all of which git executes as shell on ordinary
+ * operations (`git status` alone runs `core.fsmonitor`). The plain `GIT_*_COMMAND`
+ * check missed it (no `_COMMAND` suffix), so it is denied by its own prefix.
+ * (GIT_ASKPASS is intentionally NOT denied — it is a path, not a shell command,
+ * and legitimate credential helpers need it; the *_COMMAND family is the
+ * shell-executed one.)
  */
 function isDeniedByFamily(name: string): boolean {
     if (name.startsWith('LD_') || name.startsWith('DYLD_')) return true;
     if (name.startsWith('GIT_') && name.endsWith('_COMMAND')) return true;
+    if (name === 'GIT_CONFIG' || name.startsWith('GIT_CONFIG_')) return true;
     return false;
 }