@klarkxy/dsh-safe-auto 0.2.0-rc.3 → 0.2.0

package/src/credential-text.js

@@ -0,0 +1,361 @@
+import { createScanner, parseTree, SyntaxKind } from 'jsonc-parser';
+import { isAlias, isMap, isScalar, isSeq, parseAllDocuments, Parser } from 'yaml';
+import { parseTOML } from 'toml-eslint-parser';
+import { Buffer } from 'node:buffer';
+import { credentialSourcePath } from './credential-paths.js';
+
+const SAFE_ERROR = 'Credential text could not be safely redacted.';
+const fail = () => { throw new Error(SAFE_ERROR); };
+const whitespace = character => /\s/u.test(character);
+
+/** Match credential names, rather than words such as model, keybindings or token limits. */
+export function isCredentialField(name) {
+  if (typeof name !== 'string') return false;
+  const normalized = name.replace(/([A-Z]+)([A-Z][a-z])/g, '$1_$2')
+    .replace(/([a-z\d])([A-Z])/g, '$1_$2').toLowerCase()
+    .replace(/[^a-z\d]+/g, '_').replace(/^_+|_+$/g, '');
+  return /(?:^|[/:])_auth$/i.test(name) || /(?:^|_)(?:api_key|apikey|auth_token|access_token|refresh_token|id_token|api_token|bearer_token|session_token|security_token|personal_access_token|client_secret|client_key_data|secret_key|secret_access_key|access_key_id|access_key|private_key|privatekey|password|passwd|passphrase|authorization|proxy_authorization|cookie|set_cookie|secret|token)$/.test(normalized);
+}
+
+function isReference(value) {
+  const text = value.trim();
+  const header = /^(?:Bearer|Basic)[ \t]+(.+)$/i.exec(text);
+  if (header) return isReference(header[1]);
+  return !text || /^(?:\*+|\.{3}|\[redacted\]|<redacted>|redacted|null|none|undefined)$/i.test(text)
+    || /^(?:\$\{(?:env:)?[\w.]+\}|\$(?:env:)?[\w.]+|%[\w]+%|\$?\{\{\s*(?:env|secrets)\.[\w.]+\s*\}\}|(?:env:|process\.env\.)[\w.]+)$/i.test(text)
+    || /^<(?:your[_ -]?)?(?:api[_ -]?key|token|password|secret|private[_ -]?key)>$/i.test(text)
+    || /^<[A-Z][A-Z\d_]*>$/.test(text)
+    || /^(?:(?:your|example|placeholder|dummy|fake|test)[_-])?(?:api[_-]?key|token|password|secret)(?:[_-](?:here|placeholder|example))?$/i.test(text)
+    || /^(?:replace[-_ ]?me|change[-_ ]?me|placeholder|dummy|example|not[-_ ]a[-_ ]real[-_ ](?:key|token|secret)|sk-(?:placeholder|your[-_]?(?:key|api[-_]?key)|example))$/i.test(text)
+    || /^(?:\.{1,2}[\\/]|~[\\/]|[A-Za-z]:[\\/]|file:\/\/)[^\r\n]+$/.test(text)
+    || /^(?:[\\/]|\.[\w-]+[\\/])[^\r\n]*\.(?:jsonc?|ya?ml|toml|pem|key|txt|env)$/i.test(text);
+}
+
+function addRange(ranges, start, end) {
+  if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end < start) fail();
+  if (end > start) ranges.push([start, end]);
+}
+
+function literalRanges(text) {
+  const ranges = [];
+  // URL parsing validates the authority; source offsets preserve the original
+  // username, host, path and percent encoding without URL reserialization.
+  for (const match of text.matchAll(/\b[A-Za-z][A-Za-z\d+.-]*:\/\//g)) {
+    const start = match.index + match[0].length;
+    const tail = text.slice(start);
+    const authorityEnd = /[/?#\\\s"'`<>]/.exec(tail)?.index ?? tail.length;
+    const authority = tail.slice(0, authorityEnd);
+    const at = authority.lastIndexOf('@');
+    const colon = authority.indexOf(':');
+    if (at < 0 || colon < 0 || colon >= at || colon + 1 === at) continue;
+    try { new URL(match[0] + authority + '/'); } catch { fail(); }
+    const password = authority.slice(colon + 1, at);
+    let decoded = password;
+    try { decoded = decodeURIComponent(password); } catch { /* Invalid percent escapes are still password payload. */ }
+    if (!isReference(decoded)) addRange(ranges, start + colon + 1, start + at);
+  }
+  const token = /\b(?:sk-[A-Za-z\d_-]{8,}|gh[pousr]_[A-Za-z\d_]{8,}|github_pat_[A-Za-z\d_]{8,}|glpat-[A-Za-z\d_-]{8,}|xox[baprs]-[A-Za-z\d_-]{8,}|npm_[A-Za-z\d]{8,}|(?:AKIA|ASIA)[A-Z\d]{16}|AIza[A-Za-z\d_-]{20,}|SG\.[A-Za-z\d_-]{8,}\.[A-Za-z\d_-]{8,}|eyJ[A-Za-z\d_-]{8,}\.[A-Za-z\d_-]{8,}\.[A-Za-z\d_-]{8,})(?![A-Za-z\d_-])/g;
+  for (const match of text.matchAll(token)) {
+    if (!isReference(match[0])) addRange(ranges, match.index, match.index + match[0].length);
+  }
+  for (const match of text.matchAll(/\bBearer[ \t]+([^\s"'`,;<>]+)/gi)) {
+    if (!isReference(match[1])) {
+      const start = match.index + match[0].length - match[1].length;
+      addRange(ranges, start, start + match[1].length);
+    }
+  }
+  for (const match of text.matchAll(/\bBasic[ \t]+([A-Za-z\d+/]+={0,2})(?![A-Za-z\d+/=])/gi)) {
+    const payload = match[1];
+    const bytes = Buffer.from(payload, 'base64');
+    const colon = bytes.indexOf(0x3a);
+    // A Basic credential is base64(user:password), not any word after Basic.
+    if (bytes.toString('base64').replace(/=+$/, '') !== payload.replace(/=+$/, '')
+      || colon < 0 || colon + 1 >= bytes.length || bytes.some(byte => byte < 0x20 || byte === 0x7f)) continue;
+    const start = match.index + match[0].length - payload.length;
+    addRange(ranges, start, start + payload.length);
+  }
+  const pem = /-----BEGIN ((?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED) )?PRIVATE KEY)-----/g;
+  for (const match of text.matchAll(pem)) {
+    const start = match.index + match[0].length;
+    const end = text.indexOf(`-----END ${match[1]}-----`, start);
+    if (end < 0) fail();
+    addRange(ranges, start, end);
+  }
+  return ranges;
+}
+
+// ENV/INI have no shared grammar. This scanner only recognizes assignments to
+// credential names; comments and all other keys retain their original bytes.
+function assignmentRanges(text, mode = 'plain') {
+  const ranges = [];
+  const assignment = mode === 'config'
+    ? /^[ \t]*(?:[#;][ \t]*)?(?:export[ \t]+)?(?:((?:[A-Za-z_]|\/\/)[\w./:@-]*)|"([^"\r\n]+)"|'([^'\r\n]+)')[ \t]*[=:][ \t]*/gm
+    : /(?:^|[\s{,;])(?:((?:\$?(?:env:)?)[A-Za-z_][\w.-]*)|"((?:\\.|[^"\\\r\n])+)"|'([^'\r\n]+)')[ \t]*([=:])[ \t]*/gm;
+  for (const match of text.matchAll(assignment)) {
+    let name = match[1] ?? match[2] ?? match[3];
+    if (mode === 'plain' && match[2]) {
+      try { name = JSON.parse(`"${name}"`); } catch { continue; }
+    }
+    if (!isCredentialField(name)) continue;
+    const start = match.index + match[0].length;
+    // In ordinary prose, an authorization heading may describe permission.
+    if (mode === 'plain' && /(?:authorization|cookie)$/i.test(name) && match[4] === ':'
+      && !/^(?:["']|Bearer\b|Basic\b|[\w-]+=)/i.test(text.slice(start))) continue;
+    const quote = text[start];
+    let end, contentStart = start;
+    if (quote === '"' || quote === "'") {
+      contentStart++;
+      end = contentStart;
+      while (end < text.length) {
+        if (text[end] === quote) break;
+        if (text[end] === '\\' && quote === '"') end++;
+        end++;
+      }
+      if (end >= text.length) fail();
+      if (mode === 'config') {
+        const nextLine = text.indexOf('\n', end);
+        const remainder = text.slice(end + 1, nextLine < 0 ? text.length : nextLine).trim();
+        if (remainder && !/^[#;]/.test(remainder)) fail();
+      }
+    } else {
+      end = text.indexOf('\n', start);
+      if (end < 0) end = text.length;
+      const tail = text.slice(start, end);
+      if (mode === 'config') {
+        const stop = /[ \t]+[#;]/.exec(tail);
+        if (stop) end = start + stop.index;
+      } else if (!/(?:^|[_.-])cookie$/i.test(name)) {
+        const prefix = /^(?:(?:Bearer|Basic)[ \t]+)?(?:\$\{[^}\r\n]+\}|\{\{[^}\r\n]+\}\}|[^\s,;}]+)/i.exec(tail);
+        if (prefix) end = start + prefix[0].length;
+      }
+    }
+    const value = text.slice(contentStart, end).trimEnd();
+    let decoded = value;
+    if (quote === '"') {
+      try { decoded = JSON.parse(`"${value}"`); } catch { /* ENV permits literal newlines and non-JSON escapes. */ }
+    }
+    if (!isReference(decoded)) addRange(ranges, contentStart, contentStart + value.length);
+  }
+  return ranges;
+}
+
+// The parser owns the grammar and decoded value. This only maps decoded scalar
+// characters back to source spans, so escaped literals can be masked in place.
+function sourceUnits(text, start, end, style) {
+  const units = [];
+  const simple = style === 'yaml' ? { '0': '\0', a: '\x07', b: '\b', t: '\t', n: '\n', v: '\v', f: '\f', r: '\r', e: '\x1b', ' ': ' ', '"': '"', '/': '/', '\\': '\\', N: '\x85', _: '\xa0', L: '\u2028', P: '\u2029' }
+    : { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', '"': '"', '/': '/', '\\': '\\' };
+  for (let i = start; i < end; i++) {
+    const begin = i;
+    let decoded = text[i];
+    if (style === 'yaml-single' && text[i] === "'" && text[i + 1] === "'") i++;
+    else if (['json', 'toml', 'yaml'].includes(style) && text[i] === '\\') {
+      const escaped = text[++i];
+      const length = escaped === 'u' ? 4 : escaped === 'U' && style !== 'json' ? 8 : escaped === 'x' && style === 'yaml' ? 2 : 0;
+      if (length) {
+        const digits = text.slice(i + 1, i + length + 1);
+        if (digits.length !== length || !/^[\da-f]+$/i.test(digits)) fail();
+        const code = Number.parseInt(digits, 16);
+        if (code > 0x10ffff) fail();
+        decoded = String.fromCodePoint(code); i += length;
+      } else if (Object.hasOwn(simple, escaped)) decoded = simple[escaped];
+      else if (style !== 'json' && /\s/u.test(escaped)) {
+        while (i + 1 < end && /\s/u.test(text[i + 1])) i++;
+        continue;
+      } else fail();
+    }
+    for (let j = 0; j < decoded.length; j++) units.push({ character: decoded[j], start: begin, end: i + 1 });
+  }
+  return units;
+}
+
+function maskDecodedLiterals(text, decoded, start, end, style, ranges) {
+  const matches = [...literalRanges(decoded), ...assignmentRanges(decoded)];
+  if (!matches.length) return;
+  const units = sourceUnits(text, start, end, style).filter(unit => !whitespace(unit.character));
+  const map = new Map();
+  let position = 0;
+  for (let i = 0; i < decoded.length; i++) {
+    if (whitespace(decoded[i])) continue;
+    if (units[position]?.character !== decoded[i]) fail();
+    map.set(i, units[position++]);
+  }
+  if (position !== units.length) fail();
+  for (const [from, to] of matches) {
+    let first, last;
+    for (let i = from; i < to; i++) {
+      if (map.has(i)) { first ??= map.get(i); last = map.get(i); }
+    }
+    if (first) addRange(ranges, first.start, last.end);
+  }
+}
+
+function scalar(text, value, start, end, style, sensitive, ranges) {
+  if (sensitive && typeof value === 'string' && !isReference(value)) addRange(ranges, start, end);
+  else if (typeof value === 'string') maskDecodedLiterals(text, value, start, end, style, ranges);
+  else if (sensitive && value != null && typeof value !== 'boolean') addRange(ranges, start, end);
+}
+
+function jsonRanges(text, ranges, offset = 0) {
+  const errors = [];
+  const root = parseTree(text, errors, { allowTrailingComma: true, disallowComments: false, allowEmptyContent: true });
+  if (errors.length) fail();
+  const local = [];
+  const queue = root ? [[root, false, []]] : [];
+  while (queue.length) {
+    const [node, sensitive, path] = queue.pop();
+    if (node.type === 'object') {
+      for (const property of node.children ?? []) {
+        if (property.type !== 'property' || property.children?.length !== 2) fail();
+        const [key, value] = property.children;
+        // Docker's auths registry entries use an otherwise ordinary auth key.
+        const registryCredential = path.length === 2 && path[0] === 'auths'
+          && ['auth', 'identitytoken', 'registrytoken'].includes(key.value);
+        queue.push([value, sensitive || registryCredential || isCredentialField(key.value), [...path, key.value]]);
+      }
+    } else if (node.type === 'array') {
+      for (const [index, child] of (node.children ?? []).entries()) queue.push([child, sensitive, [...path, index]]);
+    } else {
+      const quoted = node.type === 'string';
+      scalar(text, node.value, node.offset + Number(quoted), node.offset + node.length - Number(quoted), 'json', sensitive, local);
+    }
+  }
+  const scanner = createScanner(text, false);
+  for (let kind = scanner.scan(); kind !== SyntaxKind.EOF; kind = scanner.scan()) {
+    if ([SyntaxKind.LineCommentTrivia, SyntaxKind.BlockCommentTrivia].includes(kind)) {
+      const start = scanner.getTokenOffset(), comment = text.slice(start, start + scanner.getTokenLength());
+      for (const [from, to] of literalRanges(comment)) addRange(local, start + from, start + to);
+      for (const [from, to] of assignmentRanges(comment)) addRange(local, start + from, start + to);
+    }
+  }
+  for (const [start, end] of local) addRange(ranges, start + offset, end + offset);
+}
+
+function yamlRanges(text, ranges) {
+  const docs = parseAllDocuments(text, { keepSourceTokens: true, strict: true, uniqueKeys: true });
+  for (const doc of docs) {
+    if (doc.errors.length || doc.warnings.length) fail();
+    const seen = new WeakMap();
+    const queue = doc.contents ? [[doc.contents, false]] : [];
+    const keyName = key => {
+      if (isAlias(key)) key = key.resolve(doc);
+      if (!isScalar(key)) fail();
+      return String(key.value ?? '');
+    };
+    while (queue.length) {
+      const [node, sensitive] = queue.pop();
+      if (!node) continue;
+      const bit = sensitive ? 2 : 1;
+      if ((seen.get(node) ?? 0) & bit) continue;
+      seen.set(node, (seen.get(node) ?? 0) | bit);
+      if (isAlias(node)) {
+        const origin = node.resolve(doc);
+        if (!origin) fail();
+        queue.push([origin, sensitive]);
+      } else if (isMap(node)) {
+        for (const pair of node.items) queue.push([pair.value, sensitive || isCredentialField(keyName(pair.key))]);
+      } else if (isSeq(node)) {
+        for (const item of node.items) queue.push([item, sensitive]);
+      } else if (isScalar(node)) {
+        if (!node.range) fail();
+        let [start, end] = node.range;
+        let style = 'literal';
+        if (node.type === 'QUOTE_DOUBLE' || node.type === 'QUOTE_SINGLE') {
+          start++; end--; style = node.type === 'QUOTE_DOUBLE' ? 'yaml' : 'yaml-single';
+        } else if (node.type === 'BLOCK_LITERAL' || node.type === 'BLOCK_FOLDED') {
+          if (node.srcToken?.type !== 'block-scalar') fail();
+          start = node.srcToken.offset + node.srcToken.props.reduce((total, prop) => total + prop.source.length, 0);
+          end = start + node.srcToken.source.length;
+        }
+        if (node.value !== null && !['string', 'number', 'boolean', 'undefined'].includes(typeof node.value)) fail();
+        scalar(text, node.value, start, end, style, sensitive, ranges);
+      } else fail();
+    }
+  }
+  // Comments are outside AST value ranges. Restrict recognition to comment text.
+  // A # within a quoted or block value must not be misread as a comment.
+  const comments = [];
+  const collect = token => {
+    if (!token || typeof token !== 'object') return;
+    if (token.type === 'comment') comments.push(token);
+    for (const [key, value] of Object.entries(token)) {
+      if (key === 'source') continue;
+      if (Array.isArray(value)) value.forEach(collect);
+      else if (value && typeof value === 'object') collect(value);
+    }
+  };
+  for (const token of new Parser().parse(text)) collect(token);
+  for (const token of comments) {
+    for (const [start, end] of [...literalRanges(token.source), ...assignmentRanges(token.source)]) {
+      addRange(ranges, token.offset + start, token.offset + end);
+    }
+  }
+}
+
+function tomlRanges(text, ranges) {
+  const root = parseTOML(text, { tomlVersion: '1.0' });
+  const queue = [[root, false]];
+  while (queue.length) {
+    const [node, sensitive] = queue.pop();
+    if (node.type === 'TOMLKeyValue') {
+      const names = node.key.keys.map(key => key.name ?? key.value);
+      queue.push([node.value, sensitive || names.some(isCredentialField)]);
+    } else if (node.type === 'TOMLTable') {
+      const inherited = sensitive || node.resolvedKey.some(isCredentialField);
+      for (const child of node.body) queue.push([child, inherited]);
+    } else if (['Program', 'TOMLTopLevelTable', 'TOMLInlineTable'].includes(node.type)) {
+      for (const child of node.body) queue.push([child, sensitive]);
+    } else if (node.type === 'TOMLArray') {
+      for (const child of node.elements) queue.push([child, sensitive]);
+    } else if (node.type === 'TOMLValue') {
+      let [start, end] = node.range;
+      let style = 'literal';
+      if (node.kind === 'string') {
+        const delimiter = node.multiline ? 3 : 1;
+        start += delimiter; end -= delimiter;
+        style = node.style === 'basic' ? 'toml' : 'literal';
+      }
+      scalar(text, node.value, start, end, style, sensitive, ranges);
+    } else fail();
+  }
+  for (const comment of root.comments) {
+    const source = text.slice(...comment.range);
+    for (const [start, end] of [...literalRanges(source), ...assignmentRanges(source)]) {
+      addRange(ranges, comment.range[0] + start, comment.range[0] + end);
+    }
+  }
+}
+
+/** Pure value redaction. Offsets are UTF-16 and every original newline survives. */
+export function redactCredentialText(text, filename = '') {
+  try {
+    if (typeof text !== 'string' || typeof filename !== 'string' || /\0/.test(text)) fail();
+    const sourcePath = credentialSourcePath(filename);
+    const base = sourcePath.split('/').pop();
+    const ranges = [];
+    if (/\.(?:jsonl|ndjson)$/.test(base)) {
+      let offset = 0;
+      for (const line of text.split('\n')) { jsonRanges(line, ranges, offset); offset += line.length + 1; }
+    } else if (/\.jsonc?$/.test(base)) jsonRanges(text, ranges);
+    else if (/\.ya?ml$/.test(base) || /(?:^|\/)\.kube\/config$/.test(sourcePath)) yamlRanges(text, ranges);
+    else if (/\.toml$/.test(base)) tomlRanges(text, ranges);
+    else if (/\.(?:json5|xml|plist|hcl|tfvars|edn)$/.test(base)) fail();
+    else if (/^[\s\uFEFF]*(?:\{|\[\s*(?:\{|"))/.test(text)) jsonRanges(text, ranges);
+    else {
+      const config = /^(?:\.env(?:\..*)?|\.npmrc|\.gitconfig|\.pypirc|credentials|config)$/.test(base)
+        || /\.(?:env|ini|conf|cfg|properties)$/.test(base);
+      ranges.push(...literalRanges(text), ...assignmentRanges(text, config ? 'config' : 'plain'));
+    }
+    const masked = new Uint8Array(text.length);
+    for (const [start, end] of ranges) {
+      if (end > text.length) fail();
+      masked.fill(1, start, end);
+    }
+    let redacted = false;
+    const result = text.split('');
+    for (let i = 0; i < result.length; i++) {
+      if (masked[i] && !whitespace(result[i]) && result[i] !== '*') { result[i] = '*'; redacted = true; }
+    }
+    return { text: result.join(''), redacted };
+  } catch { throw new Error(SAFE_ERROR); }
+}

package/src/execution-evidence.js

@@ -1,6 +1,7 @@
 import { isAbsolute, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { containsSecret, hardRisk } from './policy.js';
+import { redactCredentialText } from './credential-text.js';
 
 const MAX_FILES = 8;
 const MAX_FILE_BYTES = 6144;
@@ -25,7 +26,7 @@ export async function collectExecutionEvidence(call, fs, signal) {
   if (!['bash', 'pwsh'].includes(call.tool)) return { data: undefined, verify: async () => true };
   if (!fs || ['resolve', 'contains', 'stat', 'readBytes', 'processPath'].some(key => typeof fs[key] !== 'function')) return unavailable();
   const rootPath = call.sandbox?.workspaceRoot;
-  const workdir = call.args.workdir ?? call.cwd;
+  const workdir = call.reviewPaths?.workdir ?? call.args.workdir ?? call.cwd;
   if (!isAbsolute(rootPath ?? '') || !isAbsolute(workdir ?? '')) return unavailable();
   const root = await fs.resolve(rootPath, { signal });
   const cwd = await fs.resolve(workdir, { signal });
@@ -71,7 +72,7 @@ export async function collectExecutionEvidence(call, fs, signal) {
       // UTF-16/NUL and other binary/control encodings must not bypass secret
       // screening or make the model review a different source representation.
       if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(content)) { omissions.push('NON_TEXT_EVIDENCE_WITHHELD'); continue; }
-      if (containsSecret(content)) { omissions.push('SENSITIVE_EVIDENCE_WITHHELD'); continue; }
+      if (containsSecret(content) || redactCredentialText(content, canonical).redacted) { omissions.push('SENSITIVE_EVIDENCE_WITHHELD'); continue; }
       // JSON keys can use escape sequences: screen their decoded form too.
       let manifest;
       if (path.endsWith('package.json')) {

package/src/host-runtime.js

@@ -0,0 +1,159 @@
+import { lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute, normalize } from 'node:path';
+
+const DEPENDENCIES_TOOL = 'load_workspace_dependencies';
+const MAX_PATH = 4096;
+const MAX_COMMAND = 32768;
+const attestations = new WeakMap();
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const pathKey = value => process.platform === 'win32' ? normalize(value).toLowerCase() : normalize(value);
+const absolutePath = value => typeof value === 'string' && value.length > 0 && value.length <= MAX_PATH &&
+  !/[\x00-\x1f]/.test(value) && isAbsolute(value) && !value.startsWith('\\\\') && !value.startsWith('//') &&
+  !value.split(/[\\/]/).includes('..');
+
+/** Local host paths only. A symlink/junction alias is not an attested entry.
+ * This checks file identity, not executable safety, and grants no permission.
+ * No directory traversal or executable hashing is performed.
+ */
+export function snapshotHostRuntimeFile(path) {
+  if (!absolutePath(path)) return undefined;
+  try {
+    const canonical = realpathSync.native(path);
+    const stat = lstatSync(path, { bigint: true });
+    if (!stat.isFile() || stat.isSymbolicLink() || pathKey(canonical) !== pathKey(path)) return undefined;
+    return Object.freeze({ path, identity: [canonical, stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs, stat.mode].join(':') });
+  } catch { return undefined; }
+}
+
+function dependencyPair(value) {
+  if (!record(value) || Object.keys(value).some(key => !['python', 'node', 'pnpm', 'pythonPackages', 'nodePackages', 'pythonDistributions'].includes(key))) return undefined;
+  if (![value.python, value.pythonPackages, value.node, value.pnpm].every(absolutePath) ||
+      value.nodePackages !== undefined && !absolutePath(value.nodePackages) || !record(value.pythonDistributions)) return undefined;
+  if (pathKey(value.node) === pathKey(value.pnpm)) return undefined;
+  return { node: value.node, pnpm: value.pnpm };
+}
+
+/** Observe the native tools pipeline, never transcript/content text or replay.
+ * begin is called from tools/pre-execute; observe from tools/result; get from
+ * the shell guard. tools.get(global) and tools.get(agent) must be the SAME
+ * pinned definition throughout. Scope shadows and registration changes fail
+ * closed. Host plugins themselves remain part of the trusted host boundary.
+ */
+export function createHostRuntimeRegistry(tools, { snapshot = snapshotHostRuntimeFile } = {}) {
+  let owner = tools?.get?.(DEPENDENCIES_TOOL);
+  let disposed = false;
+  const pending = new Map(), sessions = new WeakMap();
+  const definitionMatches = agent => !disposed && !!owner && tools?.get?.(DEPENDENCIES_TOOL) === owner &&
+    tools?.get?.(DEPENDENCIES_TOOL, agent) === owner;
+  const forgetPending = token => {
+    const item = pending.get(token);
+    if (item) { pending.delete(token); item.signal?.removeEventListener('abort', item.abort); }
+    return item;
+  };
+  const valid = (agent, entry) => {
+    if (sessions.get(agent) !== entry || !definitionMatches(agent)) return false;
+    try {
+      return entry.files.every(file => snapshot(file.path)?.identity === file.identity);
+    } catch { return false; }
+  };
+  return {
+    begin(exec) {
+      if (disposed) return;
+      if (exec?.name !== DEPENDENCIES_TOOL || !record(exec.agent) || typeof exec.token !== 'symbol' || exec.signal?.aborted) return;
+      forgetPending(exec.token);
+      owner ??= tools?.get?.(DEPENDENCIES_TOOL);
+      if (!definitionMatches(exec.agent) || !record(exec.arguments) || Object.keys(exec.arguments).length) return;
+      // Bound interrupted-call retention without relying on a lifecycle event.
+      if (pending.size >= 64) forgetPending(pending.keys().next().value);
+      const item = { agent: exec.agent, signal: exec.signal, abort: () => forgetPending(exec.token) };
+      pending.set(exec.token, item);
+      exec.signal?.addEventListener('abort', item.abort, { once: true });
+    },
+    observe(exec, result) {
+      if (disposed) return;
+      if (exec?.name !== DEPENDENCIES_TOOL || !record(exec.agent)) return;
+      const started = forgetPending(exec.token);
+      sessions.delete(exec.agent);
+      if (!started || started.agent !== exec.agent || exec.signal?.aborted || result?.isError !== false || !definitionMatches(exec.agent)) return;
+      const pair = dependencyPair(result.value);
+      if (!pair) return;
+      let files;
+      try { files = [snapshot(pair.node), snapshot(pair.pnpm)]; } catch { return; }
+      if (files.some(file => !file || typeof file.identity !== 'string')) return;
+      const runtime = Object.freeze({ ...pair, identity: Object.freeze(files.map(file => file.identity)) });
+      const entry = { runtime, files };
+      sessions.set(exec.agent, entry);
+      attestations.set(runtime, () => valid(exec.agent, entry));
+    },
+    get(exec) {
+      if (disposed) return undefined;
+      if (!record(exec?.agent) || exec.signal?.aborted) return undefined;
+      const entry = sessions.get(exec.agent);
+      if (!entry) return undefined;
+      if (!valid(exec.agent, entry)) { sessions.delete(exec.agent); return undefined; }
+      return entry.runtime;
+    },
+    dispose() {
+      disposed = true;
+      owner = undefined;
+      for (const token of pending.keys()) forgetPending(token);
+    },
+  };
+}
+
+/** A deliberately small single-invocation grammar, not a general shell parser.
+ * No interpolation, escapes, concatenated quotes, wrappers, redirections,
+ * pipelines, assignments or additional commands can earn an exemption.
+ * Single-quoted content is literal in both shells. For PowerShell, doubled
+ * quotes are deliberately unsupported; unsupported syntax keeps full policy.
+ */
+function literalInvocation(command, tool) {
+  if (typeof command !== 'string' || !command.length || command.length > MAX_COMMAND || /[\x00-\x1f]/.test(command)) return undefined;
+  const powershell = tool === 'pwsh';
+  if (!powershell && tool !== 'bash') return undefined;
+  let cursor = 0;
+  const spaces = () => { while (command[cursor] === ' ') cursor++; };
+  spaces();
+  let callOperator = false;
+  if (powershell && command[cursor] === '&') { callOperator = true; cursor++; spaces(); }
+  const tokens = [];
+  while (cursor < command.length) {
+    const start = cursor, quote = command[cursor];
+    let value;
+    if (quote === "'" || quote === '"') {
+      cursor++;
+      const from = cursor;
+      while (cursor < command.length && command[cursor] !== quote) cursor++;
+      if (cursor === command.length) return undefined;
+      value = command.slice(from, cursor++);
+      if (quote === '"' && (powershell ? /[$`]/ : /[$`\\]/).test(value)) return undefined;
+      if (powershell && tokens.length === 0 && !callOperator) return undefined;
+      if (cursor < command.length && command[cursor] !== ' ') return undefined;
+    } else {
+      while (cursor < command.length && command[cursor] !== ' ') cursor++;
+      value = command.slice(start, cursor);
+      if (!(powershell ? /^[A-Za-z0-9_.\/:\\=-]+$/ : /^[A-Za-z0-9_.\/:=-]+$/).test(value)) return undefined;
+    }
+    tokens.push({ start, end: cursor, value });
+    spaces();
+  }
+  return tokens.length >= 2 ? tokens : undefined;
+}
+
+/** Return a screening-only projection. NEVER execute it or send it for review.
+ * Only the attested Node argv[0] + pnpm argv[1] pair is removed; every data
+ * argument remains verbatim. This does not classify pnpm or its scripts safe.
+ */
+export function commandForPolicy(call) {
+  const command = call?.args?.command;
+  const runtime = call?.trustedRuntime;
+  const validate = runtime && attestations.get(runtime);
+  if (!validate || !validate()) return command;
+  const tokens = literalInvocation(command, call.tool);
+  if (!tokens || tokens[0].value !== runtime.node || tokens[1].value !== runtime.pnpm) return command;
+  // The validated PowerShell call operator is omitted from this projection:
+  // the policy's refusal decoder parses POSIX commands and otherwise misses
+  // quoted sensitive operands after a leading '&'. The real call is intact.
+  return '__DSH_HOST_NODE__' +
+    command.slice(tokens[0].end, tokens[1].start) + '__DSH_HOST_PNPM__' + command.slice(tokens[1].end);
+}

package/src/index.js

@@ -1,9 +1,11 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { isAbsolute } from 'node:path';
+import { resolveReviewPaths } from './review-paths.js';
+import { createHostRuntimeRegistry } from './host-runtime.js';
 import { isSubagentSession } from '@klarkxy/dsh-plugin-kit/contracts';
 import { parseConfig } from './config.js';
 import { hardRisk, containsSecret } from './policy.js';
-import { analyzeShell, isReadonly } from './shell-command.js';
+import { analyzeShell, isReadonly, isSafeStaticExposure } from './shell-command.js';
+import { createCredentialReads } from './credential-reads.js';
 import { assessApproval, bindingOf, escalationReason } from './approval-review.js';
 import { createGate } from './gate.js';
 import { resolveReviewRoute, sameRoute } from './model-route.js';
@@ -52,6 +54,8 @@ export function apply(ctx, raw = {}) {
   const decisions = new Map();
   const execution = new AsyncLocalStorage();
   const lifetime = new AbortController();
+  const hostRuntime = createHostRuntimeRegistry(ctx.tools);
+  const credentialReads = createCredentialReads(ctx, lifetime.signal);
   let llm;
   // Optional dependency: losing the model service must NOT unload the safety guards.
   if (typeof ctx.inject === 'function') ctx.inject(['llm'], scope => {
@@ -60,7 +64,7 @@ export function apply(ctx, raw = {}) {
     scope.effect(() => () => { if (llm === active) llm = undefined; });
   });
   const gate = createGate(config, { getLlm: () => llm, audit: row => ctx.logger.info('safe-auto %s', JSON.stringify(row)) });
-  ctx.effect(() => () => { lifetime.abort(); humanApprovals.dispose(); gate.dispose(); decisions.clear(); execution.disable(); });
+  ctx.effect(() => () => { lifetime.abort(); hostRuntime.dispose(); humanApprovals.dispose(); gate.dispose(); decisions.clear(); execution.disable(); });
 
   const reviewable = exec => REVIEW_TOOLS.has(exec.name) && ESCALATION.has(exec.arguments?.sandbox_permissions);
 
@@ -72,13 +76,13 @@ export function apply(ctx, raw = {}) {
       cwd: session?.header?.cwd, sandbox, signal: exec.signal,
       subagent: isSubagentSession(session),
       nested: exec.parent !== undefined, ...info };
-    if (reviewable(exec)) {
+    if (REVIEW_TOOLS.has(exec.name)) {
       // These are optional capability reads, not model assertions about its environment.
       const fs = ctx.get?.('fs');
       const shell = ctx.get?.('shell');
-      const paths = [call.cwd, ...(['bash', 'pwsh'].includes(call.tool)
-        ? (call.args.workdir === undefined ? [] : [call.args.workdir]) : [call.args.file_path])];
-      call.localExecution = paths.every(p => typeof p === 'string' && isAbsolute(p) && fs?.processPathFromHostPath?.(p) === p);
+      call.reviewPaths = resolveReviewPaths(call, fs);
+      call.localExecution = call.reviewPaths.localExecution;
+      if (call.localExecution && ['bash', 'pwsh'].includes(call.tool)) call.trustedRuntime = hostRuntime.get(exec);
       call.jobsAvailable = typeof ctx.get !== 'function' || ctx.get('jobs') !== undefined;
       call.shellConfined = ['read-only', 'workspace-write', 'danger-full-access'].includes(shell?.sandboxMode);
     }
@@ -105,6 +109,7 @@ export function apply(ctx, raw = {}) {
   });
 
   ctx.on('tools/pre-execute', async (exec, next) => {
+    hostRuntime.begin(exec);
     const config = configFor(exec);
     if (!config.enabled) return next();
     if (exec.signal.aborted || lifetime.signal.aborted) return { kind: 'cancel' };
@@ -117,14 +122,16 @@ export function apply(ctx, raw = {}) {
   // Bind the approval to the active execution, never a process-wide visible callId cache.
   ctx.on('tools/execute', async (exec, next) => {
     const config = configFor(exec);
-    if (!config.enabled || !reviewable(exec)) return next();
+    if (!config.enabled) return next();
+    const run = () => credentialReads.execute(exec, next);
+    if (!reviewable(exec)) return run();
     const call = callOf(exec, true);
     const saved = { kind: 'approval', binding: bindingOf(call, assessApproval(call, config)), signal: exec.signal, controlBinding: controlBinding(exec) };
-    if (decisions.size >= 1024) return next();
+    if (decisions.size >= 1024) return run();
     decisions.set(exec.token, saved);
     const store = { exec, saved, active: true, claimed: false };
     try {
-      const result = await execution.run(store, next);
+      const result = await execution.run(store, run);
       // Around-dispatch may return result content; tools/result is a read-only
       // observer in the pinned host. Expose recovery through the actual result.
       if (result?.isError && saved.feedback) return { ...result,
@@ -135,6 +142,7 @@ export function apply(ctx, raw = {}) {
   }, { prepend: true });
 
   ctx.on('tools/result', (exec, result) => {
+    hostRuntime.observe(exec, result);
     decisions.delete(exec.token);
     ctx.logger.info('safe-auto %s', JSON.stringify({ phase: 'result', tool: exec.name,
       callId: String(exec.callId), isError: result?.isError }));
@@ -202,12 +210,14 @@ export function apply(ctx, raw = {}) {
     // structural, secret and host constraints under the original live binding.
     const manualAssessment = assessment.code === 'AUTHORITY_CONTEXT_INCOMPLETE'
       ? assessApproval({ ...callOf(exec, true), authorityIncomplete: false }, config) : assessment;
-    // Static proof, no model: a fully literal bash parse where every invocation
-    // is provably read-only skips evidence and review entirely. pwsh and
-    // unparseable commands always fall through to the reviewer.
+    // No mutation is only half the proof: content/environment dumps can expose
+    // credentials. Only metadata/literal output may skip evidence and review.
     let staticAllow = false;
     if (assessment.kind === 'review' && config.staticReadonly && exec.name === 'bash') {
-      try { staticAllow = isReadonly(analyzeShell(exec.arguments?.command)); } catch { staticAllow = false; }
+      try {
+        const analysis = analyzeShell(exec.arguments?.command);
+        staticAllow = isReadonly(analysis) && isSafeStaticExposure(analysis);
+      } catch { staticAllow = false; }
     }
     try {
       const call = callOf(exec, true);