@reneturcios/hookcheck 0.1.10 → 0.1.12

package/dist/core.js

@@ -6,7 +6,7 @@
  */
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
-export const VERSION = "0.1.10";
+export const VERSION = "0.1.12";
 export const RISKY_RULES = [
     { id: "DECODE-PIPE-SH", pattern: /\bbase64\s+(-d|--decode|-D)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "decodes a base64 payload and pipes it straight into an interpreter", severe: true, remote: true },
     { id: "CURL-PIPE-SH", pattern: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "pipes a network download straight into an interpreter", severe: true, remote: true },
@@ -95,13 +95,60 @@ function inRanges(idx, ranges) {
 function refOutsideData(seg, name, segStart, dataRanges) {
     return refOutsideRanges(seg, name, segStart, dataRanges);
 }
-function refOutsideRanges(seg, name, segStart, ranges) {
+/**
+ * Positions (global indices) of genuine references to `name` inside
+ * `seg`: occurrences that do not begin inside an excluded range, are
+ * not a property name (obj.name reads a property of obj, never the
+ * variable), and are not an object or dict KEY or a parameter
+ * declaration (a name followed by ":" whose previous non-space
+ * character is "{", ",", "(", or a line start is a binding or a key,
+ * not a read). The key rule is the n8n set-latest shape (P-110): a
+ * response variable named `body` tainted by a local helper call made
+ * every fetch options object with a `body:` key read as a flow of
+ * that variable into the send. A ternary value (cond ? name : other)
+ * keeps counting: its previous character is "?", not a key context.
+ */
+function refPositions(seg, name, segStart, ranges) {
+    const out = [];
     const re = new RegExp(`\\b${name.replace(/\$/g, "\\$")}\\b`, "g");
     for (const m of seg.matchAll(re)) {
-        if (!inRanges(segStart + (m.index ?? 0), ranges))
-            return true;
+        const idx = m.index ?? 0;
+        if (inRanges(segStart + idx, ranges))
+            continue;
+        if (idx > 0 && seg[idx - 1] === ".")
+            continue;
+        let j = idx + name.length;
+        while (j < seg.length && (seg[j] === " " || seg[j] === "\t"))
+            j++;
+        if (seg[j] === ":") {
+            let k = idx - 1;
+            while (k >= 0 && (seg[k] === " " || seg[k] === "\t"))
+                k--;
+            if (k < 0 || seg[k] === "{" || seg[k] === "," || seg[k] === "(" || seg[k] === "\n")
+                continue;
+        }
+        // An assignment target is a binding, not a read: a name at a
+        // statement position followed by a single "=" (not "==" or
+        // "=>") is being bound by this statement, so a send statement
+        // that ASSIGNS its result from a command substitution carrying
+        // an authenticated curl (id_token_status="$(curl ...)") does not
+        // flow the variable anywhere by mentioning its own name.
+        if (seg[j] === "=" && seg[j + 1] !== "=" && seg[j + 1] !== ">") {
+            let k = idx - 1;
+            while (k >= 0 && (seg[k] === " " || seg[k] === "\t"))
+                k--;
+            if (k < 0 || seg[k] === ";" || seg[k] === "\n" || seg[k] === "," || seg[k] === "{" || seg[k] === "(")
+                continue;
+            const prevWord = seg.slice(Math.max(0, k - 6), k + 1).match(/(?:^|\s)(?:let|const|var|export)$/);
+            if (prevWord)
+                continue;
+        }
+        out.push(segStart + idx);
     }
-    return false;
+    return out;
+}
+function refOutsideRanges(seg, name, segStart, ranges) {
+    return refPositions(seg, name, segStart, ranges).length > 0;
 }
 function blankRanges(text, ranges) {
     if (ranges.length === 0)
@@ -543,17 +590,193 @@ function fetchPositions(text, depth = 0) {
     }
     return out;
 }
-/** True when a CURL-PIPE-SH match in `codeJoined` starts a real fetch. */
-function curlPipeIsCommandFetch(codeJoined, positions) {
+/**
+ * True when a CURL-PIPE-SH match starts a real fetch and feeds an
+ * interpreter that executes stdin. Matches run on the newline
+ * preserving code text (the same text fetchPositions indexes), so
+ * the pipe target's own line bounds its argument tail: the next
+ * line of a block step is a new statement, never a target operand.
+ */
+function curlPipeIsCommandFetch(codeText, positions) {
     if (positions.size === 0)
         return false;
-    for (const m of codeJoined.matchAll(/\b(curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|node|python3?|perl|ruby)\b/g)) {
+    for (const m of codeText.matchAll(/\b(curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/g)) {
         const at = m.index + m[0].indexOf(m[1]);
-        if (positions.has(at))
+        if (!positions.has(at))
+            continue;
+        if (pipeTargetExecutesStdin(m[2], pipeTail(codeText, m.index + m[0].length)))
+            return true;
+    }
+    return false;
+}
+/** True when any DECODE-PIPE-SH match feeds an interpreter that executes stdin. */
+function decodePipeExecutesStdin(codeText) {
+    for (const m of codeText.matchAll(/\bbase64\s+(?:-d|--decode|-D)\b[^|]*\|\s*(?:sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/g)) {
+        if (pipeTargetExecutesStdin(m[1], pipeTail(codeText, m.index + m[0].length)))
             return true;
     }
     return false;
 }
+/**
+ * The text of the pipeline segment that follows a pipe target
+ * interpreter word, cut at the next unquoted pipe, statement
+ * separator, or redirection (quoted program text is kept whole).
+ */
+function pipeTail(text, from) {
+    let quote = "";
+    for (let i = from; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === "\\" && quote === '"') {
+                i++;
+                continue;
+            }
+            if (c === quote)
+                quote = "";
+            continue;
+        }
+        if (c === "'" || c === '"' || c === "`") {
+            quote = c;
+            continue;
+        }
+        if (c === "|" || c === ";" || c === "&" || c === ">" || c === "<" || c === "\n")
+            return text.slice(from, i);
+    }
+    return text.slice(from);
+}
+/** Quote aware spans of the whitespace separated tokens in `seg`. */
+function shellTokenSpans(seg) {
+    const out = [];
+    let i = 0;
+    while (i < seg.length) {
+        while (i < seg.length && /\s/.test(seg[i]))
+            i++;
+        if (i >= seg.length)
+            break;
+        const start = i;
+        let quote = "";
+        while (i < seg.length) {
+            const c = seg[i];
+            if (quote) {
+                if (c === "\\" && quote === '"') {
+                    i += 2;
+                    continue;
+                }
+                if (c === quote)
+                    quote = "";
+                i++;
+                continue;
+            }
+            if (c === "'" || c === '"' || c === "`") {
+                quote = c;
+                i++;
+                continue;
+            }
+            if (/\s/.test(c))
+                break;
+            i++;
+        }
+        out.push({ start, end: i, text: seg.slice(start, i) });
+    }
+    return out;
+}
+function unquoteToken(t) {
+    if (t.length >= 2 && ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))))
+        return t.slice(1, -1);
+    return t;
+}
+/**
+ * True when an inline program handed to an interpreter (-e, -c)
+ * itself executes what arrives on stdin: an exec or eval construct
+ * combined with a stdin reference. A constant program that only
+ * READS stdin as data (the MC-6 shape: JSON.parse of the piped
+ * response) does not execute it.
+ */
+function programExecutesStdin(program) {
+    const execy = /\bexec\w*\s*\(|\beval\s*\(|\bFunction\s*\(|runInThisContext|runInNewContext|\bVM\b.*\brun\b/;
+    const stdiny = /stdin|\/dev\/stdin|<&0|os\.read\(\s*0|read\(\s*0\s*[,)]/;
+    return execy.test(program) && stdiny.test(program);
+}
+/**
+ * Pipe target analysis (P-109d, completing the MC-6 calibration).
+ * A pipe into an interpreter is download-then-execute only when the
+ * interpreter reads its PROGRAM from stdin: a bare interpreter, a
+ * lone dash, or an interpreter carrying only mode flags (-s, -x,
+ * -u and friends). When the invocation supplies its program
+ * another way, stdin is data the program parses, not code it runs:
+ *   - a -c or -e inline program (unless that program itself
+ *     executes stdin, which programExecutesStdin catches);
+ *   - a -m module (python3 -m json.tool is the canonical data
+ *     parser shape, the jq role with a different binary);
+ *   - a script file operand (node script.js, bash setup.sh).
+ * The OpenHands mock LLM health checks pipe a loopback curl
+ * response into python3 -m json.tool; on 0.1.11 that match alone
+ * carried CURL-PIPE-SH and the top verdict.
+ */
+function pipeTargetExecutesStdin(interp, tail) {
+    // The interpreter word can sit inside a quoted command string
+    // handed to an interpreter (execSync('curl ... | sh')): the tail
+    // then opens with the string's closing quote and call punctuation,
+    // which is the end of the target invocation, not an operand.
+    const tt = tail.trimStart();
+    if (tt === "" || /^['"`)\];,}]/.test(tt))
+        return true;
+    const toks = shellTokenSpans(tt);
+    if (toks.length === 0)
+        return true;
+    const shell = interp === "sh" || interp === "bash" || interp === "zsh";
+    for (let i = 0; i < toks.length; i++) {
+        const t = unquoteToken(toks[i].text);
+        if (t === "-")
+            return true; // a lone dash: the program comes from stdin
+        if (t === "--")
+            return true; // only positional arguments follow; the program is still stdin
+        if (t.startsWith("-") && t.length > 1) {
+            const cluster = t.replace(/^-+/, "");
+            const name = cluster.split("=")[0];
+            const attached = cluster.includes("=") ? cluster.slice(cluster.indexOf("=") + 1) : cluster.length > name.length ? cluster.slice(name.length) : "";
+            const programOf = () => {
+                if (attached)
+                    return attached;
+                const next = toks[i + 1];
+                return next ? unquoteToken(next.text) : "";
+            };
+            if (shell) {
+                // sh and bash take their program from -c; -o takes a value.
+                if (/(^|[^a-zA-Z])c$/.test(name) || name === "c")
+                    return programExecutesStdin(programOf());
+                if (name.endsWith("o")) {
+                    i++;
+                    continue;
+                }
+                continue;
+            }
+            if (interp === "node" || interp === "bun") {
+                if (name === "e" || name === "eval" || name === "p" || name === "print")
+                    return programExecutesStdin(programOf());
+                continue;
+            }
+            if (interp === "python" || interp === "python3") {
+                if (name === "c")
+                    return programExecutesStdin(programOf());
+                if (name === "m")
+                    return false; // a module is the program; stdin is its data
+                if (name === "W" || name === "X") {
+                    i++;
+                    continue;
+                }
+                continue;
+            }
+            // perl and ruby take their program from -e.
+            if (name === "e")
+                return programExecutesStdin(programOf());
+            continue;
+        }
+        // A bare operand is a script file: it is the program, stdin is data.
+        return false;
+    }
+    return true;
+}
 /**
  * Content ranges of echo and printf string arguments in shell text:
  * output data, blanked in the code view, unless the pipeline ends in a
@@ -607,6 +830,122 @@ function shellEchoDataRanges(text) {
     }
     return ranges;
 }
+const SEARCH_HEADS = new Set(["grep", "egrep", "fgrep", "rg", "ag", "ack"]);
+/** Short search flags whose next token is a value that is not the pattern (counts, context widths). */
+const SEARCH_VALUE_FLAGS = new Set(["m", "A", "B", "C", "d", "D"]);
+/**
+ * Search pattern and search input ranges in shell text (P-108).
+ * A search command (grep, egrep, fgrep, rg, ag, ack in command
+ * position, the P-062 discipline) reads its pattern as DATA to
+ * match against, and its file operands as data to search: neither
+ * is behavior. github/docs lints its lockfile by grepping .npmrc
+ * and package-lock.json for Microsoft feed URL patterns so it can
+ * BLOCK them; on 0.1.11 the .npmrc operand fired CRED-ACCESS and a
+ * URL inside a pattern could fire REMOTE-URL, and the pair fed
+ * verdict path (b) to COMPROMISED-PATTERN. Content inside a search
+ * pattern is pattern text, not behavior, for both halves of a
+ * strong evidence combination, and a credential path string used
+ * as a search target is a reference, not credential access.
+ *
+ * Ranges are per pipeline segment: the pattern operand (the first
+ * bare token, or the value of -e, -f, --regexp, --file, or
+ * --pattern) and the file operands after it. A token containing a
+ * command substitution is left visible (its content can execute),
+ * parsing stops at a redirection (its target is a write, judged on
+ * its own text), and other statements in the same step are
+ * untouched: a grep followed by a cat of a credential file, or by
+ * a fetch of the grepped URL, still fires on those statements.
+ */
+function searchRanges(text) {
+    const pattern = [];
+    const operands = [];
+    for (const stmt of splitShell(text, ["\n", ";", "&&", "||"])) {
+        const stmtText = text.slice(stmt.start, stmt.end);
+        for (const seg of splitShell(stmtText, ["|"])) {
+            const segText = stmtText.slice(seg.start, seg.end);
+            const head = segmentHead(segText);
+            if (!head || !SEARCH_HEADS.has(head.word))
+                continue;
+            const afterHead = head.idx + head.word.length;
+            const base = stmt.start + seg.start + afterHead;
+            const toks = shellTokenSpans(segText.slice(afterHead));
+            let patternSeen = false;
+            let expect = null;
+            let afterDashDash = false;
+            for (const tok of toks) {
+                const g = { start: base + tok.start, end: base + tok.end };
+                const dynamic = tok.text.includes("$(") || tok.text.includes("`");
+                const t = unquoteToken(tok.text);
+                if (expect === "pattern") {
+                    if (!dynamic)
+                        pattern.push(g);
+                    patternSeen = true;
+                    expect = null;
+                    continue;
+                }
+                if (expect === "other") {
+                    expect = null;
+                    continue;
+                }
+                if (!afterDashDash && t === "--") {
+                    afterDashDash = true;
+                    continue;
+                }
+                if (!afterDashDash && /^(?:\d+)?[<>]/.test(t))
+                    break;
+                if (!afterDashDash && t.startsWith("--")) {
+                    const eq = t.indexOf("=");
+                    const name = eq === -1 ? t : t.slice(0, eq);
+                    if (name === "--regexp" || name === "--file" || name === "--pattern") {
+                        if (eq !== -1) {
+                            if (!dynamic)
+                                pattern.push(g);
+                            patternSeen = true;
+                        }
+                        else
+                            expect = "pattern";
+                    }
+                    else if (["--max-count", "--after-context", "--before-context", "--context", "--directory", "--devices", "--exclude", "--include", "--type", "--glob", "--max-filesize"].includes(name)) {
+                        if (eq === -1)
+                            expect = "other";
+                    }
+                    continue;
+                }
+                if (!afterDashDash && t.startsWith("-") && t.length > 1) {
+                    const cluster = t.slice(1);
+                    const ei = cluster.search(/[ef]/);
+                    if (ei !== -1 && !patternSeen) {
+                        if (ei < cluster.length - 1) {
+                            if (!dynamic)
+                                pattern.push(g);
+                            patternSeen = true;
+                        }
+                        else
+                            expect = "pattern";
+                        continue;
+                    }
+                    if (SEARCH_VALUE_FLAGS.has(cluster[cluster.length - 1])) {
+                        expect = "other";
+                        continue;
+                    }
+                    continue;
+                }
+                if (dynamic) {
+                    if (!patternSeen)
+                        patternSeen = true;
+                    continue;
+                }
+                if (!patternSeen) {
+                    pattern.push(g);
+                    patternSeen = true;
+                }
+                else
+                    operands.push(g);
+            }
+        }
+    }
+    return { pattern, operands };
+}
 const NETWORK_CALL_RES = [
     /\bfetch\s*\(/g,
     /\baxios(?:\s*\.\s*\w+)?\s*\(/g,
@@ -619,8 +958,19 @@ const NETWORK_CALL_RES = [
 ];
 function buildViews(text, lang) {
     if (lang === "shell") {
-        const dataRanges = shellEchoDataRanges(text);
-        return { codeText: blankRanges(text, dataRanges), credText: text, dataRanges, urlText: text };
+        const echoRanges = shellEchoDataRanges(text);
+        // Search text is data (P-108): pattern contents are blanked in
+        // the behavior and URL views, and pattern plus search input
+        // operands are blanked in the credential view, so a defensive
+        // grep supplies neither half of a strong evidence combination.
+        const search = searchRanges(text);
+        const dataRanges = [...echoRanges, ...search.pattern];
+        return {
+            codeText: blankRanges(text, dataRanges),
+            credText: blankRanges(text, [...search.pattern, ...search.operands]),
+            dataRanges,
+            urlText: blankRanges(text, search.pattern),
+        };
     }
     const literals = lang === "python" ? scanPyLiterals(text) : scanJsLiterals(text);
     const execSpans = callFirstArgSpans(text, EXEC_CALLS, literals);
@@ -1118,7 +1468,7 @@ function consumeValueExpr(text, start) {
     }
     return i;
 }
-const AUTH_HEADER_KEY = /^(authorization|proxy-authorization|api[-_]?key|apikey|x-api-key|x-auth[-_]?token|auth[-_]?token|x-access[-_]?token|access[-_]?token|x-session[-_]?token|session[-_]?token)$/i;
+const AUTH_HEADER_KEY = /^(authorization|proxy-authorization|auth|api[-_]?key|apikey|x-api-key|x-auth[-_]?token|auth[-_]?token|x-access[-_]?token|access[-_]?token|x-session[-_]?token|session[-_]?token)$/i;
 function isAuthHeaderKey(key) {
     const k = key.toLowerCase();
     return AUTH_HEADER_KEY.test(k) || k.endsWith("-api-key") || k.endsWith("-apikey") || k.endsWith("-auth-token") || k.endsWith("-access-token");
@@ -1150,9 +1500,19 @@ function isAuthHeaderKey(key) {
  *     or request options object;
  *   - header setter calls (set, append, setHeader) and Python
  *     requests-style auth= tuples.
- * A credential that reaches a payload position (body, query, URL path,
- * printed output next to a send) still fires: only the value
- * expressions of these header positions are scrubbed.
+ * A credential that reaches a payload position (body, a data named
+ * query parameter, a partial URL path segment, printed output next
+ * to a send) still fires: only the value expressions of these
+ * positions are scrubbed.
+ *
+ * Mega-corpus (P-106, P-107): the scrub now also covers curl -u and
+ * --user basic auth pairs, the argument following a git
+ * http.extraheader key, and ::add-mask:: registrations; and
+ * destination positions inside the URL of a send (entire path
+ * segments, the whole URL, the URL origin, authentication named
+ * query parameters, the curl URL operand, and the destination first
+ * argument of a fetch style call) are computed separately in
+ * destAuthRanges, always subject to the body test.
  */
 function authRanges(text) {
     const ranges = [];
@@ -1191,6 +1551,68 @@ function authRanges(text) {
             ranges.push(valueAfter(i));
         }
     }
+    // curl -u and --user basic authentication pairs (P-107): the flag
+    // value (user:password, usually a variable pair) is the credential
+    // presented to the destination as authentication, in exactly the
+    // position the protocol reserves for it. nodejs/node uploads its
+    // own WPT report with -u "$USER:$PASSWORD" and n8n posts to its own
+    // internal webhook with -u "name:$WEBHOOK_PASSWORD"; both fired
+    // ENV-EXFIL on 0.1.10 because the scrubber knew --token style flags
+    // but not the basic auth pair.
+    const flagValue = (from) => {
+        let i = from;
+        while (i < text.length && /\s/.test(text[i]))
+            i++;
+        if (i >= text.length)
+            return;
+        if (text[i] === "'" || text[i] === '"' || text[i] === "`") {
+            const end = consumeLiteral(text, i);
+            ranges.push({ start: i + 1, end: Math.max(i + 1, end - 1) });
+        }
+        else {
+            ranges.push(valueAfter(i));
+        }
+    };
+    for (const m of text.matchAll(/(?:^|[\s;|&])(?:-u|--user|--http-user|--http-password)(?:\s+|=)/g)) {
+        flagValue(m.index + m[0].length);
+    }
+    // git http.extraheader indirection (P-107): the value configured
+    // for an extraheader key IS an Authorization header value, however
+    // it was built (microsoft/TypeScript base64-encodes its app token
+    // into a variable, registers it with add-mask, and configures it as
+    // http.https://github.com/.extraheader "AUTHORIZATION: basic ...").
+    // The argument following the extraheader key is scrubbed.
+    for (const m of text.matchAll(/extraheader\b/gi)) {
+        let i = m.index + m[0].length;
+        while (i < text.length && /[\s"']/.test(text[i]))
+            i++;
+        if (text[i] === "=" || text[i] === ":") {
+            i++;
+            while (i < text.length && /[\s"']/.test(text[i]))
+                i++;
+        }
+        if (i >= text.length)
+            continue;
+        if (text[i] === "'" || text[i] === '"' || text[i] === "`") {
+            const end = consumeLiteral(text, i);
+            ranges.push({ start: i + 1, end: Math.max(i + 1, end - 1) });
+        }
+        else {
+            ranges.push(valueAfter(i));
+        }
+    }
+    // add-mask registrations: an echo whose argument is the workflow
+    // command ::add-mask::<value> registers the value for masking in
+    // the log; printing it there is the masking idiom itself, not a
+    // disclosure of the value as data.
+    for (const m of text.matchAll(/::add-mask::/g)) {
+        const start = m.index + m[0].length;
+        let end = start;
+        while (end < text.length && text[end] !== "\n" && text[end] !== '"' && text[end] !== "'")
+            end++;
+        if (end > start)
+            ranges.push({ start, end });
+    }
     // Header setter calls and requests-style auth= tuples.
     for (const m of text.matchAll(/\b(?:set|append|setHeader|addHeader|header)\s*\(\s*["'][A-Za-z0-9-]+["']\s*,\s*/g)) {
         const end = consumeValueExpr(text, m.index + m[0].length);
@@ -1230,17 +1652,111 @@ function authRanges(text) {
     return ranges;
 }
 /**
- * Variables assigned (transitively) from a credential value expression,
- * mapped to their inheritance purity (P-091): a variable is pure when
- * every taint source in its assignment chain is an inheritance atom
- * or another pure variable (ENV = {**os.environ, ...} is pure; a
- * payload built by serializing that same environment is not, because
- * the serializing atom in its own right-hand side is impure).
- * References inside authentication positions do not propagate taint
- * (P-061): a headers dict whose only credential use is its
- * Authorization value is an authentication container, not a tainted
- * payload, and passing it to fetch does not become exfil.
+ * Functions defined in the same text (P-110). Python `def` bodies are
+ * line ranges bounded by indentation; JavaScript `function` bodies
+ * and arrow function bodies are the balanced brace span after the
+ * signature. Only plain (non-method) definitions are collected.
+ */
+function localFunctions(text) {
+    const fns = [];
+    const lines = text.split("\n");
+    const lineStart = [];
+    let off = 0;
+    for (const l of lines) {
+        lineStart.push(off);
+        off += l.length + 1;
+    }
+    for (let li = 0; li < lines.length; li++) {
+        const dm = lines[li].match(/^(\s*)def\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/);
+        if (!dm)
+            continue;
+        const indent = dm[1].length;
+        let endLine = lines.length - 1;
+        for (let lj = li + 1; lj < lines.length; lj++) {
+            const l = lines[lj];
+            if (l.trim() === "")
+                continue;
+            const ind = l.match(/^\s*/)?.[0].length ?? 0;
+            if (ind <= indent) {
+                endLine = lj - 1;
+                break;
+            }
+        }
+        fns.push({ name: dm[2], bodyStart: lineStart[li], bodyEnd: lineStart[endLine] + lines[endLine].length });
+    }
+    const jsRe = /\bfunction\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*\(|(?:^|[;\n])\s*(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][A-Za-z0-9_$]*)\s*=>/g;
+    let jm;
+    while ((jm = jsRe.exec(text)) !== null) {
+        const name = jm[1] ?? jm[2];
+        if (!name)
+            continue;
+        const brace = text.indexOf("{", jm.index + jm[0].length);
+        if (brace === -1)
+            continue;
+        fns.push({ name, bodyStart: jm.index, bodyEnd: consumeBalanced(text, brace) });
+    }
+    return fns;
+}
+/**
+ * True when a locally defined function returns tainted data: a return
+ * expression inside its body that references a credential atom or a
+ * tainted variable at a genuine reference position (outside data and
+ * authentication ranges), or returns the result of another local
+ * function that does (one level of recursion, depth capped).
  */
+function fnReturnsTaint(fn, text, live, tainted, dataRanges, auth, fns, depth) {
+    const body = text.slice(fn.bodyStart, fn.bodyEnd);
+    for (const m of body.matchAll(/\breturn\b/g)) {
+        const exprStart = fn.bodyStart + (m.index ?? 0) + m[0].length;
+        let exprEnd = text.indexOf("\n", exprStart);
+        if (exprEnd === -1)
+            exprEnd = fn.bodyEnd;
+        const semi = text.indexOf(";", exprStart);
+        if (semi !== -1 && semi < exprEnd)
+            exprEnd = semi;
+        exprEnd = Math.min(exprEnd, fn.bodyEnd);
+        const expr = text.slice(exprStart, exprEnd);
+        for (const x of live) {
+            if (x.start >= exprStart && x.start < exprEnd)
+                return true;
+        }
+        for (const [v] of tainted) {
+            if (refOutsideRanges(expr, v, exprStart, [...dataRanges, ...auth]))
+                return true;
+        }
+        if (depth < 2) {
+            for (const cm of expr.matchAll(/\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g)) {
+                const inner = fns.find((f) => f.name === cm[1] && f !== fn);
+                if (inner && fnReturnsTaint(inner, text, live, tainted, dataRanges, auth, fns, depth + 1))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * The innermost plain call whose argument list contains `pos`
+ * within the assignment right-hand side, when that call is to a
+ * function defined in the same text. Returns the function, or null
+ * when the position is not inside a local call's arguments.
+ */
+function localCallAt(text, rhsStart, rhsEnd, pos, fns) {
+    const rhs = text.slice(rhsStart, rhsEnd);
+    let best = null;
+    for (const m of rhs.matchAll(/\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g)) {
+        const nameStart = rhsStart + (m.index ?? 0);
+        if (nameStart > 0 && text[nameStart - 1] === ".")
+            continue;
+        const fn = fns.find((f) => f.name === m[1]);
+        if (!fn)
+            continue;
+        const open = nameStart + m[0].length - 1;
+        const span = callSpan(text, open);
+        if (pos > open && pos < span.end && (!best || open > best.open))
+            best = { fn, open };
+    }
+    return best?.fn ?? null;
+}
 function taintedVars(text, atoms, dataRanges, auth = []) {
     const tainted = new Map();
     const assignRe = /(?:^|[;\n,])\s*(?:export\s+|const\s+|let\s+|var\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*=(?![=<>])\s*/g;
@@ -1254,18 +1770,59 @@ function taintedVars(text, atoms, dataRanges, auth = []) {
         assigns.push({ name: m[1], rhsStart, rhsEnd });
     }
     const live = atoms.filter((a) => !a.inData);
+    const fns = localFunctions(text);
+    // Local helper taint (P-110). Passing a credential as an ARGUMENT
+    // to a function defined in the same text does not taint that call's
+    // result, unless the helper itself returns tainted data: the
+    // helper's own body is part of the analyzed text, so a credential
+    // it posts from inside is caught there directly, and a credential
+    // it only presents as authentication (the davila7 and ticker
+    // shapes: fetch_stargazers(token) and fetch_repos(token), whose
+    // results are star dates and repo metadata) never becomes the
+    // result's value. Calls to functions NOT defined in the text
+    // (JSON.stringify, encodeURIComponent, library helpers) keep the
+    // conservative rule: their result carries their arguments' taint.
+    const consumedByLocalCall = (a, pos) => {
+        if (fns.length === 0)
+            return false;
+        const fn = localCallAt(text, a.rhsStart, a.rhsEnd, pos, fns);
+        if (!fn)
+            return false;
+        return !fnReturnsTaint(fn, text, live, tainted, dataRanges, auth, fns, 0);
+    };
     for (let pass = 0; pass < 4; pass++) {
         for (const a of assigns) {
             if (tainted.has(a.name))
                 continue;
             const sources = [];
+            // Destination positions inside the right-hand side do not
+            // taint the RESULT of a call or command substitution either
+            // (P-106): a variable assigned a send's result (a status code,
+            // a response) does not carry the credential that was presented
+            // in the send's URL. The skip applies only inside a call or
+            // substitution span: a plain string or expression that
+            // CONTAINS a destination atom (a capability URL built into a
+            // variable) keeps its taint, because printing or posting that
+            // variable would disclose the credential.
+            const dest = destAuthRanges(text, { start: a.rhsStart, end: a.rhsEnd }, true)
+                .filter((r) => {
+                const rhs = text.slice(a.rhsStart, a.rhsEnd);
+                for (const cm of rhs.matchAll(/\$\(|[A-Za-z_$][A-Za-z0-9_$]*\s*\(/g)) {
+                    const open = a.rhsStart + (cm.index ?? 0) + cm[0].length - 1;
+                    const span = callSpan(text, open);
+                    if (r.start >= span.start && r.start < span.end)
+                        return true;
+                }
+                return false;
+            });
             for (const x of live) {
-                if (x.start >= a.rhsStart && x.start < a.rhsEnd)
+                if (x.start >= a.rhsStart && x.start < a.rhsEnd && !consumedByLocalCall(a, x.start) && !inRanges(x.start, dest))
                     sources.push(x.pure === true);
             }
             const rhs = text.slice(a.rhsStart, a.rhsEnd);
             for (const [v, vPure] of tainted) {
-                if (refOutsideRanges(rhs, v, a.rhsStart, [...dataRanges, ...auth]))
+                const positions = refPositions(rhs, v, a.rhsStart, [...dataRanges, ...auth]);
+                if (positions.some((p) => !consumedByLocalCall(a, p) && !inRanges(p, dest)))
                     sources.push(vPure);
             }
             if (sources.length > 0)
@@ -1309,11 +1866,11 @@ function callSpan(text, openIdx) {
  * A span carrying even one impure hit (a credential shaped read, a
  * serialization of the whole environment) is an impure flow.
  */
-function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
+function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = [], extra = []) {
     let found = false;
     let pure = true;
     for (const a of atoms) {
-        if (!a.inData && a.start >= span.start && a.start < span.end) {
+        if (!a.inData && a.start >= span.start && a.start < span.end && !inRanges(a.start, extra)) {
             found = true;
             if (a.pure !== true)
                 pure = false;
@@ -1322,7 +1879,7 @@ function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
     if (tainted.size > 0) {
         const seg = text.slice(span.start, span.end);
         for (const [v, vPure] of tainted) {
-            if (refOutsideRanges(seg, v, span.start, [...dataRanges, ...auth])) {
+            if (refOutsideRanges(seg, v, span.start, [...dataRanges, ...auth, ...extra])) {
                 found = true;
                 if (!vPure)
                     pure = false;
@@ -1331,6 +1888,222 @@ function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
     }
     return { found, pure };
 }
+/**
+ * Body ranges inside one send span or statement: the values handed
+ * to curl data flags (-d, --data*, -F, --form, --json) and to body,
+ * data, json, or payload properties and keyword arguments. A
+ * credential inside a body range is payload by construction; the
+ * destination rules below never scrub inside a body range, which is
+ * what makes the body test decisive (P-106): a capability URL shape
+ * PLUS credential data in the body still fires.
+ */
+function bodyRanges(text, span) {
+    const ranges = [];
+    const seg = text.slice(span.start, span.end);
+    for (const m of seg.matchAll(/(?:^|\s)(?:-d|--data(?:-raw|-binary|-urlencode|-ascii)?|--form(?:-string)?|-F|--json)(?:\s+|=)/g)) {
+        let i = span.start + (m.index ?? 0) + m[0].length;
+        while (i < span.end && /\s/.test(text[i]))
+            i++;
+        if (i >= span.end)
+            continue;
+        if (text[i] === "'" || text[i] === '"' || text[i] === "`") {
+            ranges.push({ start: i, end: Math.min(span.end, consumeLiteral(text, i)) });
+        }
+        else {
+            let end = i;
+            while (end < span.end && !/[\s,;]/.test(text[end]))
+                end++;
+            ranges.push({ start: i, end });
+        }
+    }
+    for (const m of seg.matchAll(/\b(?:body|data|json|payload)\s*[:=]\s*/g)) {
+        const start = span.start + (m.index ?? 0) + m[0].length;
+        const end = consumeValueExpr(text, start);
+        if (end > start)
+            ranges.push({ start, end: Math.min(end, span.end) });
+    }
+    return ranges;
+}
+const AUTH_PARAM_NAME = /^(?:.*[-_])?(?:token|api[-_]?key|access[-_]?token|auth|secret|signature|sig|key|session[-_]?id)$/i;
+/** True when a URL path segment is exactly one reference (a variable, an Actions expression, a template or f-string hole). */
+function segmentRefRange(seg, segGlobalStart) {
+    const t = seg.replace(/^["'`(]+/, "").replace(/["'`),;]+$/, "");
+    const lead = seg.length - seg.replace(/^["'`(]+/, "").length;
+    const base = segGlobalStart + lead;
+    if (/^\$\{\{[^}]*\}\}$/.test(t) || /^\$\{[^}]*\}$/.test(t) || /^\$[A-Za-z_][A-Za-z0-9_]*$/.test(t) || /^\{[A-Za-z_][A-Za-z0-9_.]*\}$/.test(t)) {
+        return { start: base, end: base + t.length };
+    }
+    return null;
+}
+/**
+ * Destination authentication ranges inside one send span or
+ * statement (P-106, P-107). A credential PRESENTED in the URL of a
+ * send authenticates that send to the destination: capability URLs
+ * are credentials by design (a Netlify build hook URL, a preview
+ * token as a path segment, a token query parameter), and the URL a
+ * configuration expression expands to is the destination itself.
+ * Recognized presentations:
+ *   - a reference that is an entire URL path segment;
+ *   - the value of an authentication named query parameter (token,
+ *     api_key, access_token, auth, secret, signature, key, and their
+ *     prefixed forms); a data named parameter (?t=, ?q=, ?payload=)
+ *     is NOT a presentation and keeps firing;
+ *   - a reference at the start of a URL token, in the origin position
+ *     (an expression or variable the rest of the URL is built on);
+ *   - the whole URL token when it is exactly one reference;
+ *   - in a curl or wget statement, a bare reference token in the URL
+ *     operand position (not a flag value): the Actions OIDC request
+ *     URL variable shape.
+ * Nothing inside a body range is scrubbed here, and a reference in
+ * any other URL position (a partial path segment, a data parameter)
+ * is payload and keeps full exfil weight.
+ */
+function destAuthRanges(text, span, isStatement) {
+    const ranges = [];
+    const bodies = bodyRanges(text, span);
+    const inBody = (r) => bodies.some((b) => r.start >= b.start && r.start < b.end);
+    const seg = text.slice(span.start, span.end);
+    const tokenRe = /[^\s]+/g;
+    let tm;
+    while ((tm = tokenRe.exec(seg)) !== null) {
+        const tokStart = span.start + (tm.index ?? 0);
+        const tok = tm[0];
+        const tokEnd = tokStart + tok.length;
+        if (inBody({ start: tokStart, end: tokEnd }))
+            continue;
+        const schemeAt = tok.indexOf("://");
+        if (schemeAt !== -1) {
+            // Authority ends at the first path, query, or fragment char.
+            let authEnd = tok.length;
+            for (let i = schemeAt + 3; i < tok.length; i++) {
+                if (tok[i] === "/" || tok[i] === "?" || tok[i] === "#") {
+                    authEnd = i;
+                    break;
+                }
+            }
+            // Path segments that are exactly one reference.
+            let p = authEnd;
+            while (p < tok.length && tok[p] === "/") {
+                let q = p + 1;
+                while (q < tok.length && tok[q] !== "/" && tok[q] !== "?" && tok[q] !== "#")
+                    q++;
+                const r = segmentRefRange(tok.slice(p + 1, q), tokStart + p + 1);
+                if (r)
+                    ranges.push(r);
+                p = q;
+                if (tok[p] === "?" || tok[p] === "#")
+                    break;
+            }
+            // Authentication named query parameters.
+            const qAt = tok.indexOf("?");
+            if (qAt !== -1) {
+                let qs = tok.slice(qAt + 1);
+                const hash = qs.indexOf("#");
+                if (hash !== -1)
+                    qs = qs.slice(0, hash);
+                let off = qAt + 1;
+                for (const part of qs.split("&")) {
+                    const eq = part.indexOf("=");
+                    if (eq > 0 && AUTH_PARAM_NAME.test(part.slice(0, eq))) {
+                        ranges.push({ start: tokStart + off + eq + 1, end: tokStart + off + part.length });
+                    }
+                    off += part.length + 1;
+                }
+            }
+            continue;
+        }
+        // Expression or variable led token: the leading reference in the
+        // origin position, or the whole token as one reference.
+        const lead = tok.replace(/^["'`(]+/, "");
+        const leadOff = tok.length - lead.length;
+        const ref = lead.match(/^\$\{\{[^}]*\}\}|^\$\{[^}]*\}|^\$[A-Za-z_][A-Za-z0-9_]*/);
+        if (ref) {
+            const after = lead[ref[0].length] ?? "";
+            if (after === "" || after === "/" || after === "?" || after === "#") {
+                ranges.push({ start: tokStart + leadOff, end: tokStart + leadOff + ref[0].length });
+            }
+            continue;
+        }
+        // A bare reference token in a curl statement's operand position.
+        if (isStatement) {
+            const bare = tok.replace(/^["'`(]+/, "").replace(/["'`),;]+$/, "");
+            if (/^\{[A-Za-z_][A-Za-z0-9_.]*\}$/.test(bare)) {
+                ranges.push({ start: tokStart, end: tokEnd });
+            }
+        }
+    }
+    if (isStatement) {
+        // Bare operand variables: tokenize with flag value awareness.
+        const VALUE_FLAGS = new Set(["-d", "--data", "--data-raw", "--data-binary", "--data-urlencode", "--data-ascii", "-F", "--form", "--form-string", "-H", "--header", "-u", "--user", "-o", "--output", "-X", "--request", "-e", "--referer", "-A", "--user-agent", "-b", "--cookie", "-c", "--cookie-jar", "--cert", "--key", "--cacert", "--connect-timeout", "--max-time", "--retry", "--url", "-T", "--upload-file", "--json", "--oauth2-bearer", "-m", "-E"]);
+        const toks = Array.from(seg.matchAll(/[^\s]+/g));
+        let prevWasValueFlag = false;
+        for (const t of toks) {
+            const raw = t[0];
+            const start = span.start + (t.index ?? 0);
+            const clean = raw.replace(/^["'`(]+/, "").replace(/["'`),;]+$/, "");
+            if (!prevWasValueFlag && /^(?:\$[A-Za-z_][A-Za-z0-9_]*|\$\{[^}]*\}|\$\{\{[^}]*\}\})$/.test(clean) && !inBody({ start, end: start + raw.length })) {
+                ranges.push({ start, end: start + raw.length });
+            }
+            if (raw.includes("=") && raw.startsWith("--"))
+                prevWasValueFlag = false;
+            else if (VALUE_FLAGS.has(raw))
+                prevWasValueFlag = true;
+            else
+                prevWasValueFlag = false;
+        }
+    }
+    return ranges;
+}
+/** The first argument span of a call whose "(" is at openIdx. */
+function firstArgSpan(text, openIdx) {
+    let depth = 0;
+    let quote = "";
+    for (let j = openIdx; j < text.length; j++) {
+        const c = text[j];
+        if (quote) {
+            if (c === "\\") {
+                j++;
+                continue;
+            }
+            if (c === quote)
+                quote = "";
+            continue;
+        }
+        if (c === "'" || c === '"' || c === "`") {
+            quote = c;
+            continue;
+        }
+        if (c === "(" || c === "[" || c === "{")
+            depth++;
+        else if (c === ")" || c === "]" || c === "}") {
+            depth--;
+            if (depth === 0)
+                return { start: openIdx + 1, end: j };
+        }
+        else if (c === "," && depth === 1)
+            return { start: openIdx + 1, end: j };
+    }
+    return { start: openIdx + 1, end: text.length };
+}
+/**
+ * Aggregate ranges inside a printed argument (P-110): a length or
+ * count of a value is metadata about the value, not the value (the
+ * P-020 principle: ${#NAME} is a length, not a read). References
+ * inside len(...), count(...), or size(...) calls, and the object of
+ * a .length or .size property, do not count as print disclosure.
+ */
+function aggregateRanges(argText, argStart) {
+    const ranges = [];
+    for (const m of argText.matchAll(/\b(?:len|count|size)\s*\(/g)) {
+        const openLocal = (m.index ?? 0) + m[0].length - 1;
+        const local = callSpan(argText, openLocal);
+        ranges.push({ start: argStart + (m.index ?? 0), end: argStart + local.end });
+    }
+    for (const m of argText.matchAll(/\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:length|size)\b/g)) {
+        ranges.push({ start: argStart + (m.index ?? 0), end: argStart + (m.index ?? 0) + m[1].length });
+    }
+    return ranges.filter((r) => r.end > r.start);
+}
 /**
  * Exfil value flow (Round 2, P-018). ENV-EXFIL used to fire on mere
  * co-occurrence: a credential shaped name and any URL inside one finding.
@@ -1356,7 +2129,61 @@ function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
 function analyzeExfil(text, views, lang) {
     const dataRanges = views.dataRanges;
     const auth = authRanges(text);
-    const atoms = findAtoms(text, dataRanges).filter((a) => !inRanges(a.start, auth));
+    const rawAtoms = findAtoms(text, dataRanges).filter((a) => !inRanges(a.start, auth));
+    // Bound-clean shell variables (P-107, the n8n OIDC probe shape):
+    // a $NAME occurrence is a credential atom by NAME, but when the
+    // same text assigns that name from a value that contains no
+    // credential atom at all, the name is bound to a known
+    // non-credential value in this scope: ID_TOKEN_RESPONSE bound to
+    // "$RUNNER_TEMP/npm-oidc-id-token.json" is a response FILE PATH
+    // (used as a curl --output sink), not a token. A name bound from a
+    // credential (TOKEN2="$API_TOKEN") keeps its atom, and a name never
+    // assigned in the text (a runner or environment provided value)
+    // keeps it too.
+    const boundClean = new Set();
+    {
+        const assignRe = /(?:^|[;\n,])\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(?![=<>])\s*/g;
+        let am;
+        while ((am = assignRe.exec(text)) !== null) {
+            const rhsStart = am.index + am[0].length;
+            let rhsEnd = rhsStart;
+            while (rhsEnd < text.length && text[rhsEnd] !== ";" && text[rhsEnd] !== "\n")
+                rhsEnd++;
+            // Atoms of names already proven bound-clean (a literal path
+            // variable used as an output sink) are not credential atoms
+            // for this test either: cleanliness is transitive.
+            const inRhs = rawAtoms.filter((x) => {
+                if (x.start < rhsStart || x.start >= rhsEnd)
+                    return false;
+                const nm = text.slice(x.start, x.end).match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/);
+                return !(nm && boundClean.has(nm[1]));
+            });
+            if (inRhs.length === 0) {
+                boundClean.add(am[1]);
+                continue;
+            }
+            // A name bound to the RESULT of a command substitution whose
+            // only credential atoms sit in destination positions of the
+            // substituted send is bound to that result (the OIDC probe's
+            // id_token_status is an HTTP status code), not to the
+            // credential presented in the URL. A name bound to a plain
+            // string or expression that CONTAINS a destination atom (a
+            // capability URL held in a variable) is not clean: printing
+            // that variable would print the credential.
+            const rhsText = text.slice(rhsStart, rhsEnd);
+            if (rhsText.includes("$(")) {
+                const dest = destAuthRanges(text, { start: rhsStart, end: rhsEnd }, true);
+                if (inRhs.every((x) => inRanges(x.start, dest)))
+                    boundClean.add(am[1]);
+            }
+        }
+    }
+    const atoms = rawAtoms.filter((a) => {
+        if (a.kind !== "cred")
+            return true;
+        const m = text.slice(a.start, a.end).match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/);
+        return !(m && boundClean.has(m[1]));
+    });
     // Inheritance purity (P-091): a bulk atom inside an inheritance
     // expression passed as a subprocess env= is marked pure. Flows are
     // accumulated with their purity instead of returning at the first
@@ -1385,6 +2212,26 @@ function analyzeExfil(text, views, lang) {
             sawImpureFlow = true;
     };
     const has = (span) => note(spanHasTaint(text, span, atoms, tainted, dataRanges, auth));
+    // Destination aware variant (P-106): taint that sits only in a
+    // destination position (a capability URL presentation, the URL
+    // operand, or the destination first argument of a fetch style
+    // call) is authentication, not a flow into a send. Taint anywhere
+    // else in the span - above all in a body range - fires as before.
+    const hasDest = (span, isStatement, firstArg) => {
+        const extra = destAuthRanges(text, span, isStatement);
+        if (firstArg) {
+            const open = text.indexOf("(", span.start);
+            if (open !== -1 && open < span.end) {
+                const fa = firstArgSpan(text, open);
+                const faText = text.slice(fa.start, fa.end).trim();
+                const bodies = bodyRanges(text, span);
+                const faHasBody = bodies.some((b) => b.start >= fa.start && b.start < fa.end);
+                if (!faText.startsWith("{") && !faHasBody)
+                    extra.push(fa);
+            }
+        }
+        note(spanHasTaint(text, span, atoms, tainted, dataRanges, auth, extra));
+    };
     const callRes = [
         /\bfetch\s*\(/g,
         /\baxios(?:\s*\.\s*(?:post|put|patch|get|request|delete))?\s*\(/g,
@@ -1397,7 +2244,14 @@ function analyzeExfil(text, views, lang) {
     for (const re of callRes) {
         let m;
         while ((m = re.exec(text)) !== null) {
-            has(callSpan(text, m.index + m[0].length - 1));
+            const span = callSpan(text, m.index + m[0].length - 1);
+            // XHR .send( takes the BODY as its argument, so it keeps the
+            // plain rule; every other send call takes its destination
+            // first, so its first argument is a destination position.
+            if (re.source.includes("send"))
+                has(span);
+            else
+                hasDest(span, false, true);
         }
     }
     // Fetch positions run on the code view with data blanked (indices
@@ -1416,7 +2270,7 @@ function analyzeExfil(text, views, lang) {
         }
         if (!isFetchStmt)
             continue;
-        has(stmt);
+        hasDest(stmt, true, false);
     }
     for (const stmt of statements) {
         const stmtText = text.slice(stmt.start, stmt.end);
@@ -1448,27 +2302,36 @@ function analyzeExfil(text, views, lang) {
     if (hasSendConstruct) {
         for (const m of text.matchAll(/(?:^|[;\n|&]\s*)(?:echo|printf)\s+([^\n;|]*)/g)) {
             const span = { start: m.index, end: m.index + m[0].length };
+            const argText = m[1] ?? "";
+            const argStart = m.index + m[0].length - argText.length;
+            const agg = aggregateRanges(argText, argStart);
             for (const a of atoms) {
-                if (a.start >= span.start && a.start < span.end)
+                if (a.start >= span.start && a.start < span.end && !inRanges(a.start, agg))
                     note({ found: true, pure: a.pure === true });
             }
-            const argText = m[1] ?? "";
-            const argStart = m.index + m[0].length - argText.length;
             for (const [v, vPure] of tainted) {
-                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
+                // Shell echo arguments are the printed values themselves, so
+                // a reference inside a quoted argument still counts; what
+                // does not count is a reference inside an authentication or
+                // masking position (the add-mask registration) or inside an
+                // aggregate (a printed length or count).
+                const ranges = lang === "shell" ? [...auth, ...agg] : [...dataRanges, ...auth, ...agg];
+                if (refOutsideRanges(argText, v, argStart, ranges))
                     note({ found: true, pure: vPure });
             }
         }
         for (const m of text.matchAll(/\b(?:console\.(?:log|info|debug)|print)\s*\(([^)]*)\)/g)) {
             const span = { start: m.index, end: m.index + m[0].length };
+            const argText = m[1] ?? "";
+            const argStart = m.index + m[0].indexOf(argText);
+            const agg = aggregateRanges(argText, argStart);
             for (const a of atoms) {
-                if (a.start >= span.start && a.start < span.end && (lang === "shell" || !a.inData))
+                if (a.start >= span.start && a.start < span.end && (lang === "shell" || !a.inData) && !inRanges(a.start, agg))
                     note({ found: true, pure: a.pure === true });
             }
-            const argText = m[1] ?? "";
-            const argStart = m.index + m[0].indexOf(argText);
             for (const [v, vPure] of tainted) {
-                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
+                const ranges = lang === "shell" ? [...auth, ...agg] : [...dataRanges, ...auth, ...agg];
+                if (refOutsideRanges(argText, v, argStart, ranges))
                     note({ found: true, pure: vPure });
             }
         }
@@ -1560,7 +2423,15 @@ export function classifyCommand(command, lang = "shell") {
             continue;
         }
         if (rule.id === "CURL-PIPE-SH") {
-            if (curlPipeIsCommandFetch(codeJoined, positions))
+            if (curlPipeIsCommandFetch(views.codeText, positions))
+                fired.push({ id: rule.id, evidence: rule.evidence });
+            continue;
+        }
+        if (rule.id === "DECODE-PIPE-SH") {
+            // Same pipe target analysis as CURL-PIPE-SH (P-109d): decoded
+            // content piped into an interpreter that is given its program
+            // is data for that program, not executed code.
+            if (decodePipeExecutesStdin(views.codeText))
                 fired.push({ id: rule.id, evidence: rule.evidence });
             continue;
         }
@@ -1823,46 +2694,121 @@ function escalateWithScriptChain(root, scripts, currentName, finding, baseAbs =
  * estate verdicts REVIEW, never COMPROMISED-PATTERN.
  */
 /**
- * Vendor installer pipe calibration (P-063, Wave B). A CI workflow step
- * whose ONLY severe evidence is a curl pipe to a named vendor's
- * official installer over HTTPS (the uv installer at astral.sh, the
- * opencode installer) is the same family as the esbuild and puppeteer
- * download-own-binary installers the v0.1.2 calibration already holds
- * at REVIEW: the pattern match is literal and the finding stays RISKY,
- * but nothing about the step exfils, persists, or touches a credential.
- * The narrowing is deliberately tight; ALL of these must hold:
+ * Vendor installer pipe calibration (P-063, Wave B; composition
+ * completed in P-109). A CI workflow step whose ONLY severe evidence
+ * is a curl pipe to a named vendor's official installer over HTTPS
+ * (the uv installer at astral.sh, the opencode installer) is the same
+ * family as the esbuild and puppeteer download-own-binary installers
+ * the v0.1.2 calibration already holds at REVIEW: the pattern match
+ * is literal and the finding stays RISKY, but nothing about the step
+ * exfils, persists, or touches a credential. The narrowing is
+ * deliberately tight; ALL of these must hold:
  *   - the finding is a GitHub workflow run step (CI context). The same
  *     pipe on an auto-exec hook surface (package.json script, Claude
  *     settings or plugin hook, folderOpen task) keeps the top verdict:
  *     a hook runs on a developer machine at open or install time,
  *     which is exactly the Shai-Hulud persistence shape;
  *   - CURL-PIPE-SH is the only severe rule, and every rule present is
- *     part of the pipe shape itself (CURL-PIPE-SH, NET-FETCH,
- *     REMOTE-URL). Any credential rule, persistence rule, or second
- *     severe signal disqualifies the finding;
- *   - the piped URL is HTTPS and installer shaped: a path segment
- *     named install, installer, or setup (optionally with a script
- *     extension), or a host on the short known-installer list below.
+ *     part of the pipe shape itself or of the install's own footprint
+ *     in the same step: CURL-PIPE-SH, NET-FETCH, and REMOTE-URL are
+ *     the pipe; WRITE-OUTSIDE is the footprint (P-109c: the rollup
+ *     nvm step that sources the profile it just installed and
+ *     chmods the binary it just built; an installer writing under
+ *     $HOME is its shape, not a second signal). Any credential rule
+ *     (CRED-ACCESS, ENV-ACCESS, ENV-BULK, either exfil rule), any
+ *     obfuscation, or a second severe signal disqualifies the
+ *     finding on its own merits;
+ *   - the piped URL is HTTPS and installer shaped or same-repo
+ *     shaped (see installerUrlShape).
  * A curl pipe to an unversioned or non-vendor source (payload.sh on an
  * arbitrary host) never qualifies.
+ *
+ * Composition (P-109d): the calibration is a property of the single
+ * finding, evaluated at the verdict layer per finding. A calibrated
+ * pipe never drives the top verdict, and no other finding can
+ * re-arm it; every other finding in the estate stands or falls on
+ * its own merits (an unrelated ENV-EXFIL finding verdicts the repo
+ * COMPROMISED-PATTERN by itself, a DOWNLOAD-EXEC only finding does
+ * not, and neither outcome changes what the pipes contribute).
  */
-const KNOWN_INSTALLER_HOSTS = new Set(["sh.rustup.rs", "get.docker.com", "install.python-poetry.org", "astral.sh", "opencode.ai"]);
+const KNOWN_INSTALLER_HOSTS = new Set(["sh.rustup.rs", "get.docker.com", "install.python-poetry.org", "astral.sh", "opencode.ai", "pyenv.run"]);
+/**
+ * Installer endpoints are conventionally served from a dedicated
+ * subdomain of the vendor domain whose first label names the
+ * installer role: get.docker.com, install.python-poetry.org,
+ * sh.rustup.rs, and (P-109a) get.maestro.mobile.dev, the Maestro
+ * installer host that verdicts meteor/meteor on 0.1.11. pyenv.run
+ * sits in the known list above instead: it is the documented pyenv
+ * installer endpoint (the pyenv README install command is
+ * `curl https://pyenv.run | bash`) with no subdomain to generalize.
+ */
+const INSTALLER_SUBDOMAINS = new Set(["get", "install", "installer", "setup", "sh"]);
+const OWN_REPO_REF = /(?:\$\{\{\s*github\.repository\s*\}\}|\$\{\s*GITHUB_REPOSITORY\s*\}|\$GITHUB_REPOSITORY\b)/;
+const OWN_SHA_REF = /(?:\$\{\{\s*github\.sha\s*\}\}|\$\{\s*GITHUB_SHA\s*\}|\$GITHUB_SHA\b)/;
+/**
+ * True when one piped URL is a calibrated download source:
+ *   - installer shaped (P-063, generalized in P-109a): any path
+ *     segment carries install, installer, or setup as a whole
+ *     hyphen, underscore, or dot delimited token (install.sh,
+ *     setup_lts.x, and astral's cargo-hawk-installer.sh, whose
+ *     segment is not exactly an installer word), or the host is a
+ *     documented installer host (the known list, or the installer
+ *     subdomain convention). A segment that merely CONTAINS an
+ *     installer word inside a larger token (uninstall.sh) is not an
+ *     installer shape;
+ *   - or the repo's own script at the immutable commit under test
+ *     (P-109b): the URL is on github.com or
+ *     raw.githubusercontent.com, names the repo through the
+ *     repository variable or expression, and pins the ref through
+ *     the SHA variable or expression (${GITHUB_SHA} or
+ *     ${{ github.sha }}). nodejs/node pipes its own start-ci and
+ *     release-proposal scripts this way; content at the commit
+ *     already being tested adds no trust surface beyond the code
+ *     already running. A literal other repo, or the same repo at a
+ *     mutable ref, is not verified same-repo content and does not
+ *     qualify.
+ */
+function installerUrlShape(url) {
+    const m = url.match(/^https:\/\/([^\s"'`/:?#]+)([^\s"'`]*)/i);
+    if (!m)
+        return false;
+    const host = m[1].toLowerCase();
+    const path = (m[2] ?? "").toLowerCase();
+    if ((host === "github.com" || host === "raw.githubusercontent.com") && OWN_REPO_REF.test(url) && OWN_SHA_REF.test(url))
+        return true;
+    for (const seg of path.split("/")) {
+        if (!seg)
+            continue;
+        const tokens = seg.split(/[-_.]+/).filter(Boolean);
+        if (tokens.some((t) => t === "install" || t === "installer" || t === "setup"))
+            return true;
+    }
+    if (KNOWN_INSTALLER_HOSTS.has(host))
+        return true;
+    return INSTALLER_SUBDOMAINS.has(host.split(".")[0]);
+}
 function isVendorInstallerPipeOnly(f) {
     if (f.source !== "github-workflow")
         return false;
     if (!f.rules.includes("CURL-PIPE-SH"))
         return false;
-    const allowed = new Set(["CURL-PIPE-SH", "NET-FETCH", "REMOTE-URL"]);
+    const allowed = new Set(["CURL-PIPE-SH", "NET-FETCH", "REMOTE-URL", "WRITE-OUTSIDE"]);
     if (!f.rules.every((r) => allowed.has(r)))
         return false;
-    const m = f.command.match(/https:\/\/([^\s"'`/:?#]+)([^\s"'`]*)/i);
-    if (!m)
-        return false;
-    const host = m[1].toLowerCase();
-    const path = (m[2] ?? "").toLowerCase();
-    if (/(^|\/)(install|installer|setup)(\.(sh|bash|ps1|py))?($|[/?#])/.test(path))
-        return true;
-    return KNOWN_INSTALLER_HOSTS.has(host);
+    // The piped URL is the URL inside a curl pipe segment of the
+    // command. When the pipe segment holds no literal URL (the URL is
+    // in a variable assigned earlier in the step), fall back to the
+    // URLs elsewhere in the command, as before P-109. Actions
+    // expressions are whitespace collapsed first, the same
+    // normalization classification applies, so a URL spelled with
+    // ${{ github.repository }} and ${{ github.sha }} parses whole.
+    const cmd = f.command.replace(/\$\{\{([\s\S]*?)\}\}/g, (_m, inner) => "${{" + inner.replace(/\s+/g, "") + "}}");
+    const pipedUrls = [];
+    for (const m of cmd.matchAll(/\b(?:curl|wget)\b[^|]*\|/g)) {
+        pipedUrls.push(...(m[0].match(/https:\/\/[^\s"'`]+/gi) ?? []));
+    }
+    const candidates = pipedUrls.length > 0 ? pipedUrls : (cmd.match(/https:\/\/[^\s"'`]+/gi) ?? []);
+    return candidates.some((u) => installerUrlShape(u));
 }
 export function computeVerdict(findings) {
     let review = false;
@@ -1872,8 +2818,10 @@ export function computeVerdict(findings) {
             const hasSevere = metas.some((x) => x.severe);
             const hasCredStore = f.rules.includes("CRED-ACCESS");
             const hasNet = metas.some((x) => x.remote);
-            // P-063: a lone vendor installer pipe in CI is strong pattern
-            // evidence but not, on its own, a compromise pattern.
+            // P-063 and P-109: the installer pipe calibration is per
+            // finding. A calibrated pipe is strong pattern evidence but
+            // not, on its own, a compromise pattern; it neither drives
+            // the top verdict nor is re-armed by any other finding.
             const vendorPipeOnly = isVendorInstallerPipeOnly(f);
             if ((hasSevere && !vendorPipeOnly) || (hasCredStore && hasNet))
                 return "COMPROMISED-PATTERN";