@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.45

package/risk/actions/scripts/commands.js

@@ -0,0 +1,182 @@
+// What a `run:` script fetches and runs past what a lockfile or a digest pins,
+// command by command (shell.js), each with its line in the script from 0.
+import { NPM_INSTALLS, fetched, npmToolFinds, optionsOf, projectOf, valuesOf } from './packages.js'
+import { pathFrom, scriptCommands, scriptLines } from './shell.js'
+import { SHELLS as SHELL_NAMES } from '../../files/runs-code.js'
+import { readImage } from '../uses.js'
+
+// A program's file name, lowercase, past its directory and a Windows extension.
+const programOf = word => (word ?? '').split(/[/\\]/u).at(-1).toLowerCase().replace(/\.(?:cmd|exe|bat|ps1)$|@[\w.-]*$/u, '')
+
+const SHELLS = new RegExp(String.raw`^(?:${SHELL_NAMES}|python[\d.]*|node|perl|ruby|php|iex|invoke-expression)$`, 'u')
+const FETCHERS = /^(?:curl|wget|irm|iwr|invoke-restmethod|invoke-webrequest)$/u
+// A script fetched and run on one line: `<(curl …)`, `-c "$(curl …)"`, `iex (irm …)`.
+const FETCHED_AND_RUN = [
+  /\b(?:(?:ba|z|da|k)?sh|source|\.)\s+(?:-\S+\s+)*<\(\s*(?:curl|wget)\b/iu,
+  /\b(?:(?:ba|z|da|k)?sh|python[\d.]*|node|perl|ruby)\s+(?:-\S+\s+)*-c\s+["']?\$\(\s*(?:curl|wget)\b/iu,
+  /\b(?:iex|invoke-expression)\b[^|;]*\b(?:irm|iwr|invoke-restmethod|invoke-webrequest|downloadstring)\b/iu,
+]
+
+// The file curl or wget saves to (`-o f`, `-of`, `--output f`, curl's `-O`,
+// wget's by its URL), or PowerShell's (`-OutFile f`); else null.
+function savedTo(program, argv) {
+  for (let at = 1; at < argv.length; at++) {
+    const outFile = /^-outfile(?::(.+))?$/iu.exec(argv[at]), word = argv[at]
+    if (outFile && !/^(?:curl|wget)$/u.test(program)) return outFile[1] ?? argv[at + 1] ?? null
+    const attached = { curl: /^-[a-zA-Z]*o(.+)$/u, wget: /^-[a-zA-Z]*O(.+)$/u }[program]?.exec(word)
+    if (attached) return attached[1] === '-' ? null : attached[1]
+    if (program === 'curl' && (/^-[a-zA-Z]*o$/u.test(word) || word === '--output')) return argv[at + 1] ?? null
+    if (program === 'wget' && (/^-[a-zA-Z]*O$/u.test(word) || word === '--output-document')) return argv[at + 1] === '-' ? null : argv[at + 1] ?? null
+    const joined = /^(?:--output|--output-document)=(.+)$/u.exec(word)
+    if (joined) return joined[1]
+  }
+  const url = program === 'wget' || (program === 'curl' && argv.some(word => /^-[a-zA-Z]*O[a-zA-Z]*$/u.test(word) || word === '--remote-name')) ? argv.find(word => /^https?:\/\//u.test(word)) : null
+  return url ? URL.parse(url)?.pathname.split('/').at(-1) || null : null
+}
+
+// A path from the current directory, its `./` (PowerShell's `.\`, its `\`
+// read as an escape) taken off.
+const local = path => path.replace(/^\.\/?/u, '')
+
+// Whether a command runs `file`, as a program or a shell's script.
+function runsFile({ argv }, file) {
+  if (local(argv[0]) === local(file) || argv[0] === file) return true
+  return (SHELLS.test(programOf(argv[0])) || argv[0] === 'source' || argv[0] === '.') && argv.slice(1).some(word => local(word) === local(file))
+}
+
+const pythonPackage = text => {
+  if (/^(?:git\+|https?:|file:|\.{0,2}\/)/iu.test(text)) return { name: text, spec: null, exact: /@[\da-f]{40}(?:#|$)/u.test(text), registry: false }
+  const m = /^([\w.-]+)(?:\[[^\]]*\])?\s*(.*)$/u.exec(text)
+  return m && { name: m[1], spec: m[2] || null, exact: /^===?\s*[\w.!+-]+$/u.test(m[2]), registry: true }
+}
+
+// The packages pip installs by name, not a requirements file's or a path.
+const PIP_VALUED = /^(?:-r|--requirement|-c|--constraint|-e|--editable|-i|--index-url|--extra-index-url|-t|--target|--prefix|--root|-f|--find-links)$/u
+const pip = (tool, argv, from) => optionsOf(argv, from, PIP_VALUED).operands.filter(word => !/^\.{1,2}(?:\/|$)/u.test(word))
+  .flatMap(text => fetched(tool, pythonPackage(text), { ecosystem: 'pypi' }))
+// A package named `name@version`, as Go's, crates' and Deno's are.
+const atVersion = (text, exact) => {
+  const at = text.lastIndexOf('@')
+  const spec = at > 0 ? text.slice(at + 1) : null
+  return { name: at > 0 ? text.slice(0, at) : text, spec, exact: spec !== null && exact(spec), registry: true }
+}
+
+function python(program, argv) {
+  if (program === 'pip' || /^pip\d/u.test(program)) return argv[1] === 'install' ? pip(program, argv, 2) : []
+  if (/^python[\d.]*$/u.test(program) && argv[1] === '-m' && /^pip\d?$/u.test(argv[2] ?? '') && argv[3] === 'install') return pip(`${program} -m pip`, argv, 4)
+  if (program === 'uv' && argv[1] === 'pip' && argv[2] === 'install') return pip('uv pip', argv, 3)
+  if (program === 'uvx' || (program === 'uv' && argv[1] === 'tool' && /^(?:run|install)$/u.test(argv[2] ?? ''))) {
+    const options = optionsOf(argv, program === 'uvx' ? 1 : 3, /^--(?:from|python|with)$/u), [spec] = [...valuesOf(options, '--from'), ...options.operands]
+    return fetched(program === 'uvx' ? 'uvx' : `uv tool ${argv[2]}`, spec && pythonPackage(spec), { ecosystem: 'pypi' })
+  }
+  if (program === 'pipx' && /^(?:run|install)$/u.test(argv[1] ?? '')) {
+    const options = optionsOf(argv, 2, /^--(?:spec|python)$/u), [spec] = [...valuesOf(options, '--spec'), ...options.operands]
+    return fetched(`pipx ${argv[1]}`, spec && pythonPackage(spec), { ecosystem: 'pypi' })
+  }
+  return []
+}
+
+
+const EXACT_SEMVER = text => /^=?\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/u.test(text)
+
+// `go install x@v y@v`, `go run x@v`, a version held to Go's checksum database.
+function go(argv) {
+  const { operands } = optionsOf(argv, 2, /^-(?:o|modfile|tags|ldflags|gcflags|C|exec)$/u)
+  return (argv[1] === 'run' ? operands.slice(0, 1) : operands).filter(target => target.includes('@'))
+    .flatMap(target => fetched(`go ${argv[1]}`, atVersion(target, spec => /^v\d+\.\d+\.\d+/u.test(spec)), { ecosystem: 'go' }))
+}
+
+// `cargo install`: each crate by its version, or a repository by its commit;
+// `locked` with `--locked`.
+function cargo(argv) {
+  if (argv.includes('--path')) return []
+  const options = optionsOf(argv, 2, /^--(?:version|git|branch|rev|tag|root|features|registry|index|bin|example|target|profile|jobs)$|^-[jF]$/u)
+  const [git = null] = valuesOf(options, '--git'), [version = null] = valuesOf(options, '--version'), [ref = null] = valuesOf(options, '--rev', '--tag', '--branch')
+  const specs = git ? [{ name: git, spec: ref, exact: /^[\da-f]{40}$/u.test(valuesOf(options, '--rev')[0] ?? ''), registry: false }] : options.operands.map(crate => atVersion(crate, EXACT_SEMVER))
+  return specs.flatMap(spec => fetched(`cargo ${argv[1]}`, { ...spec, spec: spec.spec ?? version, exact: spec.exact || (!git && EXACT_SEMVER(version ?? '')), locked: argv.includes('--locked') }, { ecosystem: 'crates' }))
+}
+
+// `gem install x [-v 1.2.3]`.
+function gem(argv) {
+  const options = optionsOf(argv, 2, /^(?:-v|--version|-i|--install-dir|-s|--source|-n|--bindir)$/u), [version = null] = valuesOf(options, '-v', '--version')
+  return options.operands.flatMap(name => fetched('gem install', { name, spec: version, exact: /^=?\s*\d+(?:\.\d+)+$/u.test(version ?? ''), registry: true }, { ecosystem: 'rubygems' }))
+}
+
+// `deno run|install|x` of a URL or a registry's package.
+function deno(argv) {
+  const target = argv.slice(2).find(word => /^(?:https?:\/\/|npm:|jsr:)/u.test(word))
+  if (!target) return []
+  return fetched(`deno ${argv[1]}`, /^(?:npm|jsr):/u.test(target) ? atVersion(target.replace(/^(?:npm|jsr):/u, ''), EXACT_SEMVER)
+    : { name: target, spec: null, exact: /@v?\d+\.\d+\.\d+/u.test(target), registry: false }, { ecosystem: 'deno' })
+}
+
+function others(program, argv) {
+  if (program === 'go' && /^(?:install|run)$/u.test(argv[1] ?? '')) return go(argv)
+  if (program === 'cargo' && /^(?:install|binstall)$/u.test(argv[1] ?? '')) return cargo(argv)
+  if (program === 'gem' && argv[1] === 'install') return gem(argv)
+  return program === 'deno' && /^(?:run|install|x|compile)$/u.test(argv[1] ?? '') ? deno(argv) : []
+}
+
+// What a command fetches or runs unpinned, but a script fetched and run.
+function commandFinds(command) {
+  const { argv } = command
+  const program = programOf(argv[0])
+  if (/^(?:docker|podman)$/u.test(program) && /^(?:run|pull|create)$/u.test(argv[1] ?? '')) {
+    const image = argv.slice(2).find((word, at, words) => !word.startsWith('-') && !/^(?:-[evpwulhm]|--(?:env|volume|publish|workdir|user|label|hostname|memory|name|network|entrypoint|platform|mount|env-file|cpus|add-host|cap-add|device|dns|gpus|ipc|pid|restart|runtime|pull|security-opt|shm-size|tmpfs|ulimit|volumes-from|log-driver))$/u.test(words[at - 1] ?? ''))
+    return image ? [{ kind: 'image', text: image, read: readImage(image) }] : []
+  }
+  if (program === 'git' && argv[1] === 'clone') return [{ kind: 'clone', url: argv.slice(2).find(word => /^(?:https?:|git@|git:|ssh:)/u.test(word)) ?? null }]
+  return [...npmToolFinds(program, argv), ...python(program, argv), ...others(program, argv)]
+}
+
+const INSTALLS = { npm: new RegExp(`^(?:ci|clean-install|ic|install-clean|${NPM_INSTALLS})$`, 'u'), pnpm: /^(?:i|install|add)$/u, bun: /^(?:i|install|add)$/u }
+// An install's options that leave the project's node_modules as they are.
+const NOT_LOCAL = /^(?:-g|--location=global|--(?:global|package-lock-only|lockfile-only|dry-run)(?:=true)?)$/u
+
+// A script's installs of a project's packages: each one's `order`, the
+// directory it installs into, by its `cd`s and the one it names (`into`, a
+// path from the step's, '' for it), and whether it leaves devDependencies out
+// (`prod`), by an option or NODE_ENV production (the step's `production`).
+export function installsOf(script, production = false) {
+  const found = []
+  let exported = production
+  for (const { argv, dir, env, order } of scriptCommands(script)) {
+    const program = programOf(argv[0])
+    if (program === 'export') for (const word of argv) if (word.startsWith('NODE_ENV=')) exported = word === 'NODE_ENV=production'
+    const options = optionsOf(argv, 1), [command] = options.operands
+    if (argv.some(word => NOT_LOCAL.test(word)) || !(program === 'yarn' ? command === undefined || command === 'install' : INSTALLS[program]?.test(command ?? ''))) continue
+    // npm installs what `--include` names whatever leaves it out.
+    const prod = !valuesOf(options, '--include').includes('dev') && (valuesOf(options, '--omit').includes('dev') || /^prod(?:uction)?$/u.test(valuesOf(options, '--only')[0] ?? '')
+      || argv.some(word => /^--prod(?:uction)?$/u.test(word)) || (env.NODE_ENV ?? (exported ? 'production' : '')) === 'production')
+    const project = projectOf(argv)
+    found.push({ order, into: project === null ? dir : pathFrom(dir, project), prod })
+  }
+  return found
+}
+
+// A script's line, as a finding names what it runs, cut short.
+const excerpt = text => { const trimmed = text.trim().replaceAll(/\s+/gu, ' '); return trimmed.length > 120 ? `${trimmed.slice(0, 119)}…` : trimmed }
+
+// Everything a script fetches and runs past a pin, in its order.
+export function scriptFinds(script) {
+  const found = []
+  const lines = new Map(scriptLines(script).map(({ text, line }) => [line, text]))
+  for (const [line, text] of lines) {
+    if (FETCHED_AND_RUN.some(pattern => pattern.test(text))) found.push({ kind: 'remote-script', line, command: excerpt(text) })
+  }
+  const saved = new Map()
+  for (const command of scriptCommands(script)) {
+    const program = programOf(command.argv[0])
+    if (FETCHERS.test(program) && command.pipedTo.some(each => SHELLS.test(programOf(each.argv[0])))) found.push({ kind: 'remote-script', line: command.line, command: excerpt(lines.get(command.line) ?? '') })
+    const file = FETCHERS.test(program) ? savedTo(program, command.argv) ?? command.out : null
+    if (file) saved.set(file, command.line)
+    for (const [name, at] of saved) {
+      if (FETCHERS.test(program) || !runsFile(command, name)) continue
+      found.push({ kind: 'remote-script', line: command.line, command: excerpt(lines.get(at) ?? '') })
+      saved.delete(name)
+    }
+    for (const each of commandFinds(command)) found.push({ ...each, line: command.line, order: command.order, dir: command.dir })
+  }
+  const told = new Set()
+  return found.filter(({ order: _order, ...each }) => { const key = JSON.stringify(each); return !told.has(key) && told.add(key) }).toSorted((a, b) => a.line - b.line)
+}

package/risk/actions/scripts/grade.js

@@ -0,0 +1,113 @@
+// What a `run:` script fetches and runs (commands.js), graded (README.md).
+import { HOST_TAGS, npmExfiltration, npmHostTags } from '../../files/hosts.js'
+import { lineOf } from '../../files/script.js'
+import { installsOf, scriptFinds } from './commands.js'
+
+// The events a workflow runs on with its secrets for anyone's pull request.
+const PRIVILEGED_TRIGGERS = new Set(['pull_request_target', 'workflow_run', 'issue_comment', 'issues', 'discussion', 'discussion_comment',
+  'pull_request_review', 'pull_request_review_comment', 'fork', 'watch'])
+
+// The expressions anyone can write: a title, a body, a branch's name, a
+// commit's message, a fork's description.
+const INDEX = String.raw`(?:\s*\[[^\]]*\]|\.\*)`
+const AUTHOR = String.raw`(?:author|committer)\.(?:email|name)`
+const UNTRUSTED = new RegExp(String.raw`\bgithub\s*\.\s*(?:head_ref|event\s*\.\s*(?:`
+  + [String.raw`issue\.(?:title|body)`,
+    String.raw`pull_request\.(?:title|body|head\.(?:ref|label|repo\.(?:default_branch|description|homepage)))`,
+    String.raw`(?:comment|review|review_comment)\.body`,
+    String.raw`pages${INDEX}\.page_name`,
+    String.raw`commits${INDEX}\.(?:message|${AUTHOR})`,
+    String.raw`head_commit\.(?:message|${AUTHOR})`,
+    String.raw`workflow_run\.(?:head_branch|display_title|head_commit\.(?:message|${AUTHOR})|head_repository\.(?:description|homepage|default_branch)|pull_requests${INDEX}\.head\.ref)`,
+    String.raw`discussion\.(?:title|body)`].join('|')
+  + String.raw`))(?![\w-])`, 'gu')
+
+// An expression with its index syntax's properties (`github['event']`) as
+// dereferences, as GitHub reads either.
+export const dotted = text => text.replaceAll(/\[\s*'([\w-]+)'\s*\]/gu, '.$1')
+
+// Each expression anyone can write in a script's `text`, a finding with
+// the `index` its `${{` is at: red where the workflow runs with its secrets
+// for anyone (`triggers`), else orange.
+export function scriptInjections(text, triggers) {
+  if (typeof text !== 'string' || !text.includes('${{')) return []
+  const severity = triggers.some(event => PRIVILEGED_TRIGGERS.has(event)) ? 'critical' : 'high'
+  return [...text.matchAll(/\$\{\{([\s\S]*?)\}\}/gu)].flatMap(({ 1: inner, index }) =>
+    [...dotted(inner).matchAll(UNTRUSTED)].map(({ 0: expression }) => ({ id: 'script-injection', severity, expression: expression.replaceAll(/\s+/gu, ''), index })))
+}
+
+// A ref or a repository naming a pull request's own code, as
+// `actions/checkout` checks it out: its head's commit or branch (a
+// `workflow_run`'s pull requests' too), or the fork's repository, whose
+// default branch it is then.
+const PULL_HEAD = new RegExp(String.raw`\bgithub\.(?:head_ref|event\.(?:number|pull_request\.(?:number|merge_commit_sha|head\.(?:sha|ref|repo\.(?:full_name|owner\.login)))|workflow_run\.(?:head_sha|head_branch|head_commit\.id|pull_requests\[[^\]]*\]\.head\.(?:sha|ref)|head_repository\.(?:full_name|owner\.login))))\b`
+  .replaceAll('\\.', String.raw`\s*\.\s*`) + String.raw`|refs\/pull\/`, 'u')
+export const namesPullHead = text => typeof text === 'string' && PULL_HEAD.test(dotted(text))
+
+// Programs whose package is named otherwise: `npx tsc` runs typescript's.
+const KNOWN_BINS = new Map([['tsc', 'typescript'], ['tsserver', 'typescript'], ['ng', '@angular/cli'], ['nest', '@nestjs/cli'],
+  ['changeset', '@changesets/cli'], ['biome', '@biomejs/biome'], ['svelte-kit', '@sveltejs/kit'], ['api-extractor', '@microsoft/api-extractor'],
+  ['commitlint', '@commitlint/cli'], ['attw', '@arethetypeswrong/cli'], ['ncu', 'npm-check-updates'], ['vue-cli-service', '@vue/cli-service'],
+  ['firebase', 'firebase-tools'], ['netlify', 'netlify-cli'], ['cdk', 'aws-cdk'], ['sls', 'serverless'], ['playwright', '@playwright/test'],
+  ['eas', 'eas-cli'], ['expo', 'expo'], ['vsce', '@vscode/vsce'], ['wdio', '@wdio/cli'], ['lhci', '@lhci/cli'], ['tsx', 'tsx'], ['webpack', 'webpack-cli']])
+const PACKAGING = new Set(['pip', 'setuptools', 'wheel'])
+
+// Whether `locked` (a Set) has what npx runs by `name`, or the package giving it.
+export const lockedName = (locked, name) => locked.has(name) || (KNOWN_BINS.has(name) && locked.has(KNOWN_BINS.get(name)))
+
+// How severe fetching a package is; null for none.
+function packageSeverity(found, { locked, installed, external }) {
+  const runsOwn = found.ecosystem === 'npm' && found.localFirst && found.registry && (found.spec === null || found.exact)
+  if (runsOwn && (external ? installed : locked && installed)) return null
+  if (found.ecosystem === 'go' && found.exact) return null
+  if (found.ecosystem === 'crates' && found.exact && found.locked) return null
+  if (found.ecosystem === 'pypi' && PACKAGING.has(found.name.toLowerCase())) return 'notice'
+  // A version a variable names may be one, set elsewhere in the workflow.
+  return found.exact || found.spec?.includes('$') ? 'moderate' : 'high'
+}
+
+// The findings of one find of a script, `locked` what a lockfile says of it.
+function graded(found, context, locked) {
+  if (found.kind === 'package') {
+    const { tool, name, spec, localFirst } = found, installed = context.installed
+    const severity = packageSeverity(found, { locked, installed, external: context.external })
+    return severity ? [{ id: 'fetched-package', severity, tool, name, spec, ...localFirst ? { localFirst, locked, installed } : {} }] : []
+  }
+  if (found.kind === 'unlocked-install') return [{ id: 'unlocked-install', severity: /^(?:yarn|bun)\b/u.test(found.tool) ? 'low' : 'moderate', tool: found.tool }]
+  if (found.kind === 'remote-script') return [{ id: 'remote-script', severity: 'high', command: found.command }]
+  if (found.kind === 'image') return found.read?.digest ? [] : [imageFinding(found.text, found.read)]
+  return found.kind === 'clone' ? [{ id: 'clone', severity: 'low', url: found.url }] : []
+}
+
+// An image run by a tag: orange with none or `latest`, else yellow.
+export const imageFinding = (text, read) => ({ id: 'unpinned-image', severity: !read || read.tag === null || read.tag === 'latest' ? 'high' : 'moderate', image: text })
+
+// The file's line a script's line is on: a `|` block scalar's own, else `run:`'s.
+const fileLine = (run, line) => run.start === null ? run.line : run.start + line
+
+// Whether `dir` is `directory` or above it, as node finds a package there;
+// null for anywhere.
+export const within = (dir, directory) => dir === null || dir === '' || directory === dir || directory.startsWith(`${dir}/`)
+
+// Every finding of a `run` script (workflow.js runOf); `context`'s
+// `locked(name, dir)` whether a lockfile there locks it (`dev` where
+// devDependencies alone need it), `installed(dev, dir)` whether an install
+// ran before that installs such a package there, `dir` a path from the
+// step's directory, as a `cd` moves to.
+export function scriptFindings(run, context) {
+  const findings = []
+  // An install earlier in the script counts as one in a step before.
+  const installs = installsOf(run.script, run.production)
+  for (const found of scriptFinds(run.script)) {
+    const dir = found.dir ?? ''
+    const locked = found.kind === 'package' && found.ecosystem === 'npm' && found.localFirst && context.locked(found.exact ? `${found.name}@${found.spec.replace(/^[v=]/u, '')}` : found.name, dir)
+    const before = context.installed(locked === 'dev', dir) || installs.some(({ order, into, prod }) => order < found.order && within(into, dir) && !(prod && locked === 'dev'))
+    for (const finding of graded(found, { ...context, installed: before }, Boolean(locked))) findings.push({ ...finding, line: fileLine(run, found.line) })
+  }
+  for (const [tag, services] of npmHostTags(npmExfiltration('run.sh', run.script, true))) {
+    findings.push({ id: 'hosts', severity: HOST_TAGS.get(tag), tag, services: [...services.keys()], line: fileLine(run, Math.min(...[...services.values()].flat()) - 1) })
+  }
+  const line = lineOf(run.script)
+  for (const { index, ...finding } of scriptInjections(run.script, context.triggers)) findings.push({ ...finding, line: fileLine(run, line(index) - 1) })
+  return findings
+}

package/risk/actions/scripts/packages.js

@@ -0,0 +1,123 @@
+// What a command of npm's tools fetches and runs past what a lockfile locks
+// (commands.js), npx's and its kin's the project's own where installed
+// (`localFirst`), and an install that resolves anew (`unlocked`).
+import { isExactVersion } from '@preventive/upstream/semver.js'
+
+// A package spec's name and spec, `exact` for a version, `registry: false` for
+// a URL, a path, git or a GitHub shorthand.
+export function npmSpec(text) {
+  if (/^(?:\.{0,2}\/|~|[a-z][\w+.-]*:|[\w.-]+\/[\w.-]+(?:#.*)?$)/iu.test(text) && !/^@[\w.-]+\//u.test(text)) {
+    return { name: text, spec: null, exact: false, registry: false }
+  }
+  const at = text.indexOf('@', text.startsWith('@') ? 1 : 0)
+  const name = at === -1 ? text : text.slice(0, at)
+  const spec = at === -1 ? null : text.slice(at + 1)
+  if (!/^(?:@[\w.-]+\/)?[\w.-]+$/u.test(name)) return null
+  return { name, spec, exact: spec !== null && isExactVersion(spec.replace(/^[v=]/u, '')), registry: true }
+}
+
+// A package a tool fetches, as a script's find; none for none.
+export const fetched = (tool, spec, { ecosystem = 'npm', localFirst = false, ...more } = {}) => spec ? [{ kind: 'package', tool, ecosystem, localFirst, ...more, ...spec }] : []
+
+// What `npm create x` runs: `create-x`, `@s/create` for `@s`, `@s/create-x`.
+function createPackage(text) {
+  const scoped = /^(@[\w.-]+)(?:@(.+))?$/u.exec(text)
+  if (scoped) return npmSpec(`${scoped[1]}/create${scoped[2] ? `@${scoped[2]}` : ''}`)
+  const spec = npmSpec(text)
+  if (!spec?.registry) return spec
+  const [scope, name] = spec.name.startsWith('@') ? spec.name.split('/') : [null, spec.name]
+  const named = scope ? (name ? `${scope}/create-${name}` : `${scope}/create`) : `create-${name}`
+  return { ...spec, name: named }
+}
+
+// Options of npm's tools that take a value.
+const VALUED = /^(?:-[pcwC]|--(?:package|call|cache|userconfig|registry|workspace|prefix|filter|dir|global-dir|store-dir|loglevel|cwd|spec|location|include|omit|only))$/u
+const GLOBAL = /^(?:-g|--global|--location=global)$/u
+
+// A command's words past `from`: those not options (`operands`), all past
+// `--` too, and each option's values (`values`), of `--x=v`, and `--x v` for
+// one `valued` names.
+export function optionsOf(argv, from, valued = VALUED) {
+  const operands = [], values = new Map()
+  for (let at = from; at < argv.length; at++) {
+    const [, name, joined] = /^(--[\w-]+)=(.*)$/u.exec(argv[at]) ?? [], word = argv[at]
+    if (word === '--') return { operands: [...operands, ...argv.slice(at + 1)], values }
+    if (name || valued.test(word)) values.set(name ?? word, [...values.get(name ?? word) ?? [], joined ?? argv[++at] ?? ''])
+    else if (!word.startsWith('-')) operands.push(word)
+  }
+  return { operands, values }
+}
+const positional = (argv, from) => optionsOf(argv, from).operands
+// The values of `names`' options, in their order.
+export const valuesOf = ({ values }, ...names) => names.flatMap(name => values.get(name) ?? [])
+
+// What an exec (npx, `npm exec`, bunx, dlx) fetches: its `--package`s, else
+// its command's; none with `--no`, `--offline`, or a command line (`-c`).
+function execPackages(tool, argv, from, localFirst) {
+  if (argv.some(word => /^(?:--no|--no-install|--offline)$/u.test(word))) return []
+  const named = valuesOf(optionsOf(argv, 1), '-p', '--package').filter(Boolean)
+  if (named.length === 0 && argv.some(word => word === '-c' || word === '--call')) return []
+  return (named.length > 0 ? named : positional(argv, from).slice(0, 1)).flatMap(text => fetched(tool, npmSpec(text), { localFirst }))
+}
+
+// The directory an install names for its project (`--prefix`, `-C`, `--dir`,
+// `--cwd`); null for the one it runs in, `.` too.
+export function projectOf(argv) {
+  const [dir = null] = valuesOf(optionsOf(argv, 1), '-C', '--prefix', '--dir', '--cwd')
+  return dir === null || /^\.\/?$/u.test(dir) ? null : dir
+}
+
+const installs = (tool, words) => words.flatMap(text => fetched(tool, npmSpec(text)))
+// npm's install command and its aliases (commands.js installsOf).
+export const NPM_INSTALLS = 'i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|add|it|install-test'
+const created = (tool, text) => text ? fetched(tool, createPackage(text)) : []
+const unlocked = tool => [{ kind: 'unlocked-install', tool }]
+const isInstalled = word => /^(?:\.{1,2}(?:\/|$)|file:|link:|workspace:)/u.test(word)
+
+function npm(argv) {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === 'exec' || command === 'x') return execPackages(`npm ${command}`, argv, argv.indexOf(command) + 1, true)
+  if (/^(?:create|init|innit)$/u.test(command)) return created(`npm ${command}`, rest[0])
+  if (new RegExp(`^(?:${NPM_INSTALLS})$`, 'u').test(command)) {
+    const named = rest.filter(word => !isInstalled(word))
+    if (argv.some(word => GLOBAL.test(word))) return installs(`npm ${command} -g`, named)
+    return named.length > 0 ? installs(`npm ${command}`, named) : unlocked(`npm ${command}`)
+  }
+  return /^(?:update|up|upgrade|udpate)$/u.test(command) ? unlocked(`npm ${command}`) : []
+}
+
+// pnpm's and bun's, by the word each runs a package with (`exec`), what an
+// install resolving anew is told by (`anew`, null for none), and its updates.
+const pnpmLike = (program, exec, localFirst, anew, updates) => argv => {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === exec) return execPackages(`${program} ${exec}`, argv, argv.indexOf(exec) + 1, localFirst)
+  if (command === 'create') return created(`${program} create`, rest[0])
+  const global = argv.some(word => GLOBAL.test(word)), installing = command === 'install' || command === 'i'
+  if (command === 'add' || (installing && rest.length > 0)) return installs(`${program} ${command}${global ? ' -g' : ''}`, rest.filter(word => !isInstalled(word)))
+  if (installing && anew(argv) !== null) return unlocked(`${program} ${command}${anew(argv)}`)
+  return updates.test(command) ? unlocked(`${program} ${command}`) : []
+}
+const pnpm = pnpmLike('pnpm', 'dlx', false, argv => argv.includes('--no-frozen-lockfile') ? ' --no-frozen-lockfile' : null, /^(?:update|up|upgrade)$/u)
+const bun = pnpmLike('bun', 'x', true, argv => argv.some(word => word === '--frozen-lockfile' || word === '--ci') ? null : '', /^update$/u)
+
+function yarn(argv) {
+  const [command = '', ...rest] = positional(argv, 1)
+  if (command === 'dlx') return execPackages('yarn dlx', argv, argv.indexOf('dlx') + 1, false)
+  if (command === 'create') return created('yarn create', rest[0])
+  if (command === 'global' && rest[0] === 'add') return installs('yarn global add', rest.slice(1))
+  if (command === 'add') return installs('yarn add', rest.filter(word => !isInstalled(word)))
+  const frozen = argv.some(word => /^--(?:frozen-lockfile|immutable)$/u.test(word))
+  if ((command === '' || command === 'install') && !frozen) return unlocked(command ? 'yarn install' : 'yarn')
+  return /^(?:upgrade|up)$/u.test(command) ? unlocked(`yarn ${command}`) : []
+}
+
+// The tools that run a package (whether one installed first), and the rest.
+const EXECS = new Map([['npx', true], ['bunx', true], ['pnpx', false]])
+const TOOLS = new Map([['npm', npm], ['pnpm', pnpm], ['yarn', yarn], ['bun', bun]])
+
+// What a command of npm's tools fetches, by its program's name: packages and
+// installs resolving anew.
+export function npmToolFinds(program, argv) {
+  if (EXECS.has(program)) return execPackages(program, argv, 1, EXECS.get(program))
+  return TOOLS.get(program)?.(argv) ?? []
+}

package/risk/actions/scripts/shell.js

@@ -0,0 +1,165 @@
+// A `run:` script read into the commands it runs, as a shell would split
+// them, for commands.js. A quick read, not a shell's parse: a command built
+// as the script runs goes unseen.
+import { SHELLS } from '../../files/runs-code.js'
+import { resolved } from '../../npm/files.js'
+
+// A shell, by its program, wherever it is, Windows' `.exe` too (risk's
+// runs-code.js SHELLS).
+const SHELL = new RegExp(String.raw`^(?:.*[\/\\])?${SHELLS}(?:\.exe)?$`, 'iu')
+
+// A line of a script, its continuations joined (an escaped line's end, or a
+// pipe, `&&` or `||` the next line goes on from), and the line it starts
+// on, counting from 0.
+export function scriptLines(script) {
+  const lines = script.split('\n')
+  const joined = []
+  for (let at = 0; at < lines.length; at++) {
+    const start = at
+    let text = lines[at].replace(/\r$/u, '')
+    for (;;) {
+      const escaped = /(?:^|[^\\])(?:\\\\)*[\\`^]$/u.test(text), piped = /(?:\||&&)\s*$/u.test(text) && !/(?:^|\s)#/u.test(text)
+      if (!(escaped || piped) || at + 1 === lines.length) break
+      text = `${escaped ? text.slice(0, -1) : text} ${lines[++at].replace(/\r$/u, '')}`
+    }
+    joined.push({ text, line: start })
+  }
+  return joined
+}
+
+const WRAPPERS = new Set(['sudo', 'env', 'time', 'nohup', 'exec', 'command', 'nice', 'stdbuf', 'xvfb-run', 'timeout', 'corepack'])
+// A wrapper's options taking a value, as `sudo -u user`, `timeout 10m` do.
+const WRAPPER_VALUES = new Map([['sudo', /^-[ugCDhpRrTU]$/u], ['env', /^-[uC]$/u], ['nice', /^-n$/u], ['timeout', /^-[sk]$/u]])
+
+// What a command runs (`argv`): its words past settings, kept (`env`), and
+// wrappers, a wrapper's options and their values, and `timeout`'s duration.
+function argvOf(words) {
+  const env = {}
+  let at = 0
+  for (;;) {
+    for (; at < words.length && /^[A-Za-z_]\w*=/u.test(words[at]); at++) env[words[at].slice(0, words[at].indexOf('='))] = words[at].slice(words[at].indexOf('=') + 1)
+    const wrapper = words[at]?.replace(/^.*\//u, '')
+    if (!WRAPPERS.has(wrapper)) return { argv: words.slice(at), env }
+    at++
+    while (at < words.length && words[at].startsWith('-')) at += WRAPPER_VALUES.get(wrapper)?.test(words[at]) ? 2 : 1
+    if (wrapper === 'timeout' && /^\d/u.test(words[at] ?? '')) at++
+  }
+}
+
+// A command's words, quotes taken off, redirections dropped, and the file
+// its output is written to (`> file`, `>> file`), or null.
+function wordsOf(text) {
+  const words = []
+  let quote = null, word = null
+  for (let at = 0; at <= text.length; at++) {
+    const char = text[at]
+    if (quote) {
+      if (char === quote) quote = null
+      else if (char === undefined) break
+      else word += quote === '"' && char === '\\' && /["\\$`]/u.test(text[at + 1] ?? '') ? text[++at] : char
+    } else if (char === undefined || /\s/u.test(char)) {
+      if (word !== null) words.push(word)
+      word = null
+    } else if (char === '"' || char === "'") { quote = char; word ??= '' }
+    // A redirection joined to a word before it (`url>file`) starts its own.
+    else if ((char === '>' || char === '<') && word !== null && !/^\d*&?$|[<>]$/u.test(word)) { words.push(word); word = char }
+    else word = (word ?? '') + (char === '\\' && at + 1 < text.length ? text[++at] : char)
+  }
+  const kept = []
+  let out = null
+  for (let at = 0; at < words.length; at++) {
+    const redirect = /^(\d*)(>>?|<<?|&>>?)(.*)$/u.exec(words[at])
+    if (!redirect) { kept.push(words[at]); continue }
+    const target = redirect[3] === '' ? words[++at] : redirect[3]
+    if (redirect[2].includes('>') && (redirect[1] === '' || redirect[1] === '1') && target && !target.startsWith('&')) out = target
+  }
+  return { words: kept, out }
+}
+
+// Where a `$(…)` starting at `from` (its `(`) closes, or the line's end.
+function closing(text, from) {
+  let depth = 0, quote = null
+  for (let at = from; at < text.length; at++) {
+    const char = text[at]
+    if (quote) { if (char === quote) quote = null; else if (char === '\\') at++ }
+    else if (char === "'" || char === '"') quote = char
+    else if (char === '(') depth++
+    else if (char === ')' && --depth === 0) return at
+  }
+  return text.length
+}
+
+// A line's commands, each `{ argv, env, piped, out, nested }`, `env` the
+// settings it runs with, `piped` where a pipe feeds it, `out` the file it writes its output to and `nested` its
+// command substitutions' text, to read as lines of their own; and those of
+// none of them (`nested`).
+function commandsOf(text) {
+  const commands = []
+  let nested = [], piped = false, quote = null, start = 0
+  const end = (at, next) => {
+    const { words, out } = wordsOf(text.slice(start, at))
+    const { argv, env } = argvOf(words)
+    if (argv.length > 0) { commands.push({ argv, env, piped, out, nested }); nested = [] }
+    piped = next
+  }
+  for (let at = 0; at < text.length; at++) {
+    const char = text[at]
+    if (quote === "'") { if (char === "'") quote = null; continue }
+    if (char === '\\') { at++; continue }
+    if (char === '$' && text[at + 1] === '(') {
+      const close = closing(text, at + 1)
+      nested.push(text.slice(at + 2, close))
+      at = close
+    } else if (quote === '"') { if (char === '"') quote = null }
+    else if (char === '"' || char === "'") quote = char
+    else if (char === '#' && (at === 0 || /\s/u.test(text[at - 1]))) { end(at, false); start = text.length; break }
+    else if ((char === '&' || char === '|') && text[at + 1] === char) { end(at, false); start = ++at + 1 }
+    else if (char === ';' || (char === '&' && !/[<>]/u.test(text[at - 1] ?? '') && text[at + 1] !== '>')) { end(at, false); start = at + 1 }
+    else if (char === '|') { end(at, true); start = at + (text[at + 1] === '&' ? 2 : 1); if (text[at + 1] === '&') at++ }
+  }
+  if (start < text.length) end(text.length, false)
+  return { commands, nested }
+}
+
+// The command line a shell is given to run (`bash -euc '…'`, `pwsh
+// -Command '…'`), else null.
+function shellLine([program, ...words]) {
+  if (!SHELL.test(program)) return null
+  const option = /(?:pwsh|powershell)(?:\.exe)?$/iu.test(program) ? /^-(?:c|command)$/iu : /^-[a-z]*c[a-z]*$/u
+  const at = words.findIndex(word => option.test(word))
+  return at === -1 ? null : words[at + 1] ?? null
+}
+
+// A path `to` from `dir`, both from the step's directory ('' for it); as
+// written where a variable, `~`, `-` or an absolute path names it.
+export const pathFrom = (dir, to) => /^[$~/-]/u.test(to) ? to : resolved(dir ? dir.split('/') : [], to)?.join('/') ?? [dir, to].filter(Boolean).join('/')
+
+// Each command of a script, in the order they run (`order`): its `line` from
+// 0, the directory the `cd`s before it moved to (`dir`, by pathFrom), and
+// `pipedTo`, the commands its output is piped through; a command
+// substitution's before its command's, a shell's command line's (`sh -c`)
+// after it.
+export function scriptCommands(script) {
+  const found = []
+  let dir = '', read = 0
+  // A substitution's or a shell's command line (`apart`) moves no `cd` of its caller's.
+  const readLine = (text, line, apart = false) => {
+    if (read++ >= 64) return
+    const outer = dir, { commands, nested } = commandsOf(text)
+    commands.forEach(({ nested: substituted, ...command }, at) => {
+      for (const each of substituted) readLine(each, line, true)
+      const end = commands.findIndex((each, after) => after > at && !each.piped)
+      found.push({ ...command, line, dir, order: found.length, pipedTo: commands.slice(at + 1, end === -1 ? undefined : end) })
+      if (command.argv[0] === 'cd') dir = pathFrom(dir, command.argv.slice(1).find(word => !/^-[LPe@]+$/u.test(word)) ?? '~')
+      const shell = shellLine(command.argv)
+      if (shell) readLine(shell, line, true)
+    })
+    for (const each of nested) readLine(each, line, true)
+    if (apart) dir = outer
+  }
+  for (const { text, line } of scriptLines(script)) {
+    read = 0
+    readLine(text, line)
+  }
+  return found
+}