@reneturcios/hookcheck 0.1.5 → 0.1.7

package/dist/core.js

@@ -4,18 +4,27 @@
  * No network, no LLM. Every classification comes from explicit pattern
  * rules so the same repo always produces the same report.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join, relative, resolve, sep } from "node:path";
-export const VERSION = "0.1.5";
+import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+export const VERSION = "0.1.7";
 export const RISKY_RULES = [
     { id: "DECODE-PIPE-SH", pattern: /\bbase64\s+(-d|--decode|-D)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "decodes a base64 payload and pipes it straight into an interpreter", severe: true, remote: true },
     { id: "CURL-PIPE-SH", pattern: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "pipes a network download straight into an interpreter", severe: true, remote: true },
     { id: "REMOTE-EVAL", pattern: /\beval\b[^;]{0,80}\b(curl|wget)\b|\beval\b[^;]{0,80}\$\(\s*(curl|wget)|\bFunction\s*\([^)]{0,80}(curl|wget|fetch)/, evidence: "evaluates content fetched from the network as code", severe: true, remote: true },
-    { id: "NET-FETCH", pattern: /\b(curl|wget)\b|\bfetch\s*\(|https?\s*\.get\s*\(|requests\.(get|post)\b|Invoke-WebRequest\b|Invoke-RestMethod\b/, evidence: "performs a network fetch", remote: true },
+    // NET-FETCH (P-062): the curl and wget alternatives are NOT in this
+    // pattern. A fetch binary counts only in command position (see
+    // fetchPositions below): the token curl naming a package in an install
+    // line (pacman -S curl, apt-get install curl) is a package name being
+    // installed, not a command being run, and matching it anywhere in the
+    // step manufactured a phantom fetch on evilmartians/lefthook.
+    { id: "NET-FETCH", pattern: /\bfetch\s*\(|https?\s*\.get\s*\(|requests\.(get|post)\b|Invoke-WebRequest\b|Invoke-RestMethod\b/, evidence: "performs a network fetch", remote: true },
     { id: "REMOTE-URL", pattern: /https?:\/\/[^\s"'`]+/, evidence: "references a remote URL", remote: true },
     { id: "OBFUSCATION", pattern: /base64\s+(-d|--decode)|atob\s*\(|Buffer\.from\s*\([^)]*base64|\\x[0-9a-fA-F]{2}|\beval\b\s*\(|\beval\b\s+["'$(]|Function\s*\(/, evidence: "uses decoding or dynamic evaluation often used to hide payloads" },
     { id: "WRITE-OUTSIDE", pattern: /(>>?|tee)\s+~\/|(>>?|tee)\s+\$HOME\/|chmod\s+\+x/, evidence: "writes outside the repo or changes executable bits" },
-    { id: "DOWNLOAD-EXEC", pattern: /\bnode\s+-e\b|\bpython3?\s+-c\b|\bdeno\s+eval\b|\bbun\s+-e\b/, evidence: "executes inline code supplied on the command line" },
+    // DOWNLOAD-EXEC is detected procedurally (see detectDownloadExec):
+    // inline code execution counts only when the evaluated content itself
+    // carries a download or remote reference (P-064). A constant
+    // node -e version comparison downloads nothing.
 ];
 /**
  * Rule metadata for procedurally detected rules (credential access and env
@@ -84,9 +93,12 @@ function inRanges(idx, ranges) {
  * disclosure next to the prose word "fetch" in a docstring.
  */
 function refOutsideData(seg, name, segStart, dataRanges) {
+    return refOutsideRanges(seg, name, segStart, dataRanges);
+}
+function refOutsideRanges(seg, name, segStart, ranges) {
     const re = new RegExp(`\\b${name.replace(/\$/g, "\\$")}\\b`, "g");
     for (const m of seg.matchAll(re)) {
-        if (!inRanges(segStart + (m.index ?? 0), dataRanges))
+        if (!inRanges(segStart + (m.index ?? 0), ranges))
             return true;
     }
     return false;
@@ -389,6 +401,159 @@ function firstShellWord(segment) {
     const w = s.match(/^[A-Za-z_][A-Za-z0-9_.-]*/);
     return w ? w[0] : "";
 }
+/**
+ * Command position for fetch binaries (P-062). The word curl inside a
+ * step is not necessarily a fetch: in `pacman -S --noconfirm openssh
+ * git curl` it is a package name in argument position, and counting it
+ * as NET-FETCH manufactured an exfil verdict on evilmartians/lefthook
+ * (the phantom fetch combined with a credential store write in the same
+ * step). A fetch counts only when curl or wget is the invoked command:
+ * the head of a statement or pipeline segment, after wrappers (sudo,
+ * env, command, xargs, shell keywords) and environment assignments, or
+ * the head of a command string literal (the string handed to
+ * bash -c, execSync, os.system, and friends IS a command). Positions
+ * are returned as indices of the fetch word in the input text.
+ */
+const FETCH_WRAPPERS = new Set(["sudo", "doas", "env", "command", "builtin", "exec", "time", "nice", "nohup", "xargs", "if", "then", "else", "elif", "while", "until", "do", "!"]);
+const WRAPPER_ARG_FLAGS = new Set(["-u", "-I", "-n", "-L", "-P", "-s", "-E", "-e", "-C", "-S"]);
+/** Head word of one pipeline segment, with the fetch word offset. */
+function segmentHead(seg) {
+    let i = 0;
+    let lastWrapper = "";
+    for (let iter = 0; iter < 16; iter++) {
+        while (i < seg.length && /[\s'"`([{\\]/.test(seg[i]))
+            i++;
+        if ((seg[i] === "$" && seg[i + 1] === "{") || (seg[i] === "$" && seg[i + 1] === "(")) {
+            i += 2;
+            continue;
+        }
+        if (i >= seg.length)
+            return null;
+        const m = seg.slice(i).match(/^[^\s|;&]+/);
+        if (!m)
+            return null;
+        const tok = m[0];
+        if (tok.startsWith("-") && lastWrapper) {
+            // A flag belonging to the wrapper (env -u NAME, xargs -n 1):
+            // skip the flag and, for flags that take a value, its argument.
+            i += tok.length;
+            if (WRAPPER_ARG_FLAGS.has(tok)) {
+                while (i < seg.length && /\s/.test(seg[i]))
+                    i++;
+                const arg = seg.slice(i).match(/^[^\s|;&]+/);
+                if (arg)
+                    i += arg[0].length;
+            }
+            continue;
+        }
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tok)) {
+            i += tok.length;
+            lastWrapper = "";
+            continue;
+        }
+        const base = (tok.split("/").pop() ?? tok).replace(/['"`)\]]+$/, "");
+        if (FETCH_WRAPPERS.has(base)) {
+            lastWrapper = base;
+            i += tok.length;
+            continue;
+        }
+        const slash = tok.lastIndexOf("/");
+        return { word: base, idx: i + (slash === -1 ? 0 : slash + 1) };
+    }
+    return null;
+}
+/** Quoted literal content ranges (simple scanner, escape aware). */
+function quotedContentRanges(text) {
+    const ranges = [];
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === "'" || c === '"' || c === "`") {
+            let j = i + 1;
+            let depth = 0;
+            while (j < text.length) {
+                if (text[j] === "\\") {
+                    j += 2;
+                    continue;
+                }
+                if (c === "`" && text[j] === "$" && text[j + 1] === "{") {
+                    depth++;
+                    j += 2;
+                    continue;
+                }
+                if (depth > 0 && text[j] === "}") {
+                    depth--;
+                    j++;
+                    continue;
+                }
+                if (text[j] === c && depth === 0)
+                    break;
+                j++;
+            }
+            ranges.push({ start: i + 1, end: j });
+            i = j + 1;
+            continue;
+        }
+        i++;
+    }
+    return ranges;
+}
+/**
+ * Indices of curl and wget words in command position in `text`.
+ * Command string literals are searched recursively (depth 2): a literal
+ * is a command string when code hands it to an interpreter, and the
+ * views this runs on have already blanked data literals in script
+ * files and echo arguments in shell text, so a quoted mention of the
+ * word in data does not produce a position.
+ */
+function fetchPositions(text, depth = 0) {
+    const out = new Set();
+    for (const stmt of splitShell(text, ["\n", ";", "&&", "||"])) {
+        const stmtText = text.slice(stmt.start, stmt.end);
+        for (const seg of splitShell(stmtText, ["|"])) {
+            const segText = stmtText.slice(seg.start, seg.end);
+            const head = segmentHead(segText);
+            if (head && (head.word === "curl" || head.word === "wget")) {
+                out.add(stmt.start + seg.start + head.idx);
+            }
+        }
+    }
+    if (depth < 2) {
+        for (const r of quotedContentRanges(text)) {
+            const inner = text.slice(r.start, r.end);
+            if (!/\b(?:curl|wget)\b/.test(inner))
+                continue;
+            for (const p of fetchPositions(inner, depth + 1))
+                out.add(r.start + p);
+        }
+        // Interpreter -c and -e tails are command strings too, even when
+        // the quotes are not visible in the text under analysis: an MCP
+        // config's command and args are joined with spaces, so a server
+        // configured as sh with args [-c, "curl ... | sh"] reaches the
+        // classifier as the unquoted text `sh -c curl ... | sh`, whose
+        // pipeline head is sh. The tail after the -c flag is the program.
+        for (const m of text.matchAll(/\b(?:sh|bash|zsh|dash)\s+-c\s+|\b(?:node|bun|python3?|perl|ruby)\s+-(?:e|c)\s+/g)) {
+            const start = m.index + m[0].length;
+            const tail = text.slice(start);
+            if (!/\b(?:curl|wget)\b/.test(tail))
+                continue;
+            for (const p of fetchPositions(tail, depth + 1))
+                out.add(start + p);
+        }
+    }
+    return out;
+}
+/** True when a CURL-PIPE-SH match in `codeJoined` starts a real fetch. */
+function curlPipeIsCommandFetch(codeJoined, positions) {
+    if (positions.size === 0)
+        return false;
+    for (const m of codeJoined.matchAll(/\b(curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|node|python3?|perl|ruby)\b/g)) {
+        const at = m.index + m[0].indexOf(m[1]);
+        if (positions.has(at))
+            return true;
+    }
+    return false;
+}
 /**
  * Content ranges of echo and printf string arguments in shell text:
  * output data, blanked in the code view, unless the pipeline ends in a
@@ -442,10 +607,20 @@ function shellEchoDataRanges(text) {
     }
     return ranges;
 }
+const NETWORK_CALL_RES = [
+    /\bfetch\s*\(/g,
+    /\baxios(?:\s*\.\s*\w+)?\s*\(/g,
+    /\brequests\s*\.\s*\w+\s*\(/g,
+    /\bhttpx\s*\.\s*\w+\s*\(/g,
+    /\bhttps?\s*\.\s*(?:request|get)\s*\(/g,
+    /\burlopen\s*\(/g,
+    /\bsendBeacon\s*\(/g,
+    /\bWebSocket\s*\(/g,
+];
 function buildViews(text, lang) {
     if (lang === "shell") {
         const dataRanges = shellEchoDataRanges(text);
-        return { codeText: blankRanges(text, dataRanges), credText: text, dataRanges };
+        return { codeText: blankRanges(text, dataRanges), credText: text, dataRanges, urlText: text };
     }
     const literals = lang === "python" ? scanPyLiterals(text) : scanJsLiterals(text);
     const execSpans = callFirstArgSpans(text, EXEC_CALLS, literals);
@@ -474,7 +649,24 @@ function buildViews(text, lang) {
         // "code" literals keep their contents in both views: the text is a
         // program handed to an interpreter, and behavior rules should see it.
     }
-    return { codeText: blankRanges(text, codeBlank), credText: blankRanges(text, credBlank), dataRanges };
+    const codeText = blankRanges(text, codeBlank);
+    // URL view (P-064): restore literal contents handed to network calls.
+    const netSpans = [];
+    for (const re of NETWORK_CALL_RES) {
+        let m;
+        while ((m = re.exec(text)) !== null)
+            netSpans.push(callSpan(text, m.index + m[0].length - 1));
+    }
+    const urlChars = codeText.split("");
+    for (const lit of literals) {
+        if (!netSpans.some((s) => lit.contentStart >= s.start && lit.contentEnd <= s.end))
+            continue;
+        for (const r of contentRanges(lit)) {
+            for (let i = r.start; i < r.end && i < urlChars.length; i++)
+                urlChars[i] = text[i];
+        }
+    }
+    return { codeText, credText: blankRanges(text, credBlank), dataRanges, urlText: urlChars.join("") };
 }
 const CRED_FILE_PATTERNS = [
     /~\/\.ssh(\/|\s|$|["'])/, /\$HOME\/\.ssh(\/|\s|$|["'])/, /(^|[\s"'(=])\.ssh\//,
@@ -650,6 +842,164 @@ function findAtoms(text, dataRanges) {
  * Round 2 showed it driving false exfil verdicts on langfuse, PostHog,
  * and cas release automation (P-018).
  */
+/** Consume a balanced bracket span starting at the opener index. */
+function consumeBalanced(text, openIdx) {
+    const open = text[openIdx];
+    const close = open === "(" ? ")" : open === "{" ? "}" : open === "[" ? "]" : "";
+    if (!close)
+        return openIdx + 1;
+    let depth = 0;
+    let quote = "";
+    for (let j = openIdx; j < text.length; j++) {
+        const c = text[j];
+        if (quote) {
+            if (c === "\\") {
+                j++;
+                continue;
+            }
+            if (c === quote)
+                quote = "";
+            continue;
+        }
+        if (c === "'" || c === '"' || c === "`") {
+            quote = c;
+            continue;
+        }
+        if (c === open)
+            depth++;
+        else if (c === close) {
+            depth--;
+            if (depth === 0)
+                return j + 1;
+        }
+    }
+    return text.length;
+}
+/** Consume one string literal starting at (or just before) index i. */
+function consumeLiteral(text, i) {
+    let j = i;
+    while (j < text.length && /[furbFURB]/.test(text[j]))
+        j++;
+    const q = text[j];
+    if (q !== "'" && q !== '"' && q !== "`")
+        return i;
+    const triple = text.startsWith(q + q + q, j);
+    const qLen = triple ? 3 : 1;
+    let k = j + qLen;
+    let depth = 0;
+    while (k < text.length) {
+        if (text[k] === "\\") {
+            k += 2;
+            continue;
+        }
+        if ((q === "`" && text[k] === "$" && text[k + 1] === "{") || (q !== "`" && depth >= 0 && text[k] === "{" && /[fF]/.test(text.slice(Math.max(0, j - 1), j + 1)))) {
+            depth++;
+            k += q === "`" ? 2 : 1;
+            continue;
+        }
+        if (depth > 0 && text[k] === "}") {
+            depth--;
+            k++;
+            continue;
+        }
+        if (depth > 0 && (text[k] === "'" || text[k] === '"' || text[k] === "`")) {
+            k = consumeLiteral(text, k);
+            continue;
+        }
+        if (triple ? text.startsWith(q + q + q, k) : text[k] === q)
+            return k + qLen;
+        if (!triple && text[k] === "\n" && q !== "`")
+            return k;
+        k++;
+    }
+    return k;
+}
+/**
+ * Consume a value expression starting at `start`: a string literal
+ * (including template and f-string forms), a bare variable or dotted
+ * chain, a call, a bracketed value, or a +-concatenation of those.
+ * Returns the end index. Capped so a malformed value cannot run away.
+ */
+function consumeValueExpr(text, start) {
+    let i = start;
+    const cap = Math.min(text.length, start + 400);
+    for (let part = 0; part < 6; part++) {
+        while (i < cap && /\s/.test(text[i]))
+            i++;
+        if (i >= cap)
+            break;
+        const c = text[i];
+        if (c === "'" || c === '"' || c === "`" || (/[furbFURB]/.test(c) && /["'`]/.test(text[i + 1] ?? ""))) {
+            i = consumeLiteral(text, i);
+        }
+        else if (c === "(" || c === "{" || c === "[") {
+            i = consumeBalanced(text, i);
+        }
+        else if (/[A-Za-z0-9_$]/.test(c)) {
+            while (i < cap && /[A-Za-z0-9_$.]/.test(text[i]))
+                i++;
+            if (text[i] === "[")
+                i = consumeBalanced(text, i);
+            while (i < cap && /\s/.test(text[i]))
+                i++;
+            if (text[i] === "(")
+                i = consumeBalanced(text, i);
+            // A template literal directly after a chain (tag or suffix).
+            while (i < cap && /\s/.test(text[i]))
+                i++;
+            if (text[i] === "`")
+                i = consumeLiteral(text, i);
+        }
+        else {
+            break;
+        }
+        let j = i;
+        while (j < cap && /\s/.test(text[j]))
+            j++;
+        if (text[j] === "+") {
+            i = j + 1;
+            continue;
+        }
+        break;
+    }
+    return i;
+}
+const AUTH_HEADER_KEY = /^(authorization|proxy-authorization|api[-_]?key|apikey|x-api-key|x-auth[-_]?token|auth[-_]?token|x-access[-_]?token|access[-_]?token|x-session[-_]?token|session[-_]?token)$/i;
+function isAuthHeaderKey(key) {
+    const k = key.toLowerCase();
+    return AUTH_HEADER_KEY.test(k) || k.endsWith("-api-key") || k.endsWith("-apikey") || k.endsWith("-auth-token") || k.endsWith("-access-token");
+}
+/**
+ * Spans where a credential is used as authentication for the destination
+ * it belongs to: the userinfo of a URL (x-access-token pushes and clones
+ * to the repo's own host), the value of an Authorization header, and the
+ * value of a CLI auth flag (--token, --auth, --api-key). A token in one
+ * of these positions authenticates the send; it is not the payload, and
+ * Round 2 showed it driving false exfil verdicts on langfuse, PostHog,
+ * and cas release automation (P-018).
+ *
+ * Wave B (P-061): the v0.1.4 scrubbing recognized only the literal
+ * Authorization spelling in shell text. Real estates also authenticate
+ * with custom header names (statsig-api-key, x-api-key, any name at
+ * all) and with headers dictionaries inside one hop Python and
+ * TypeScript files, and those shapes still fired ENV-EXFIL on
+ * anthropics/claude-code, hesreallyhim/awesome-claude-code, and
+ * Aider-AI/aider. Authentication positions now also include:
+ *   - any curl -H or --header argument, whatever the header name: the
+ *     whole header value is an authentication position;
+ *   - a dict or object entry whose key is an authentication header
+ *     name (Authorization, *-api-key, *-auth-token, and friends),
+ *     whatever the surrounding code;
+ *   - any header-shaped entry (a header name key) inside a headers
+ *     construction: a dict assigned to a variable named like headers,
+ *     a headers= keyword argument, or a headers property of a fetch
+ *     or request options object;
+ *   - header setter calls (set, append, setHeader) and Python
+ *     requests-style auth= tuples.
+ * A credential that reaches a payload position (body, query, URL path,
+ * printed output next to a send) still fires: only the value
+ * expressions of these header positions are scrubbed.
+ */
 function authRanges(text) {
     const ranges = [];
     for (const m of text.matchAll(/https?:\/\/[^\s"'`]+/g)) {
@@ -672,10 +1022,67 @@ function authRanges(text) {
     for (const m of text.matchAll(/--(?:token|auth|api[-_]?key|password|secret)(?:\s*=\s*|\s+)["']?/gi)) {
         ranges.push(valueAfter(m.index + m[0].length));
     }
+    // curl -H and --header arguments: any header name is authentication.
+    for (const m of text.matchAll(/(?:^|[\s;|&])(?:-H|--header)(?:\s+|=)/g)) {
+        let i = m.index + m[0].length;
+        while (i < text.length && /\s/.test(text[i]))
+            i++;
+        if (i >= text.length)
+            continue;
+        if (text[i] === "'" || text[i] === '"' || text[i] === "`") {
+            const end = consumeLiteral(text, i);
+            ranges.push({ start: i + 1, end: Math.max(i + 1, end - 1) });
+        }
+        else {
+            ranges.push(valueAfter(i));
+        }
+    }
+    // Header setter calls and requests-style auth= tuples.
+    for (const m of text.matchAll(/\b(?:set|append|setHeader|addHeader|header)\s*\(\s*["'][A-Za-z0-9-]+["']\s*,\s*/g)) {
+        const end = consumeValueExpr(text, m.index + m[0].length);
+        if (end > m.index + m[0].length)
+            ranges.push({ start: m.index + m[0].length, end });
+    }
+    for (const m of text.matchAll(/\bauth\s*=\s*\(/g)) {
+        ranges.push({ start: m.index, end: consumeBalanced(text, m.index + m[0].length - 1) });
+    }
+    // Dict and object entries: authentication header keys anywhere, and
+    // any header-shaped key inside a headers construction.
+    const entryRe = /(?:^|[{,;\n])\s*(?:(["'])([A-Za-z][A-Za-z0-9_-]*)\1|([A-Za-z][A-Za-z0-9_-]*))\s*:\s*/g;
+    let em;
+    while ((em = entryRe.exec(text)) !== null) {
+        const key = em[2] ?? em[3] ?? "";
+        if (!key)
+            continue;
+        const valueStart = em.index + em[0].length;
+        let auth = isAuthHeaderKey(key);
+        if (!auth) {
+            // Headers construction context: the nearest opening brace before
+            // this entry is introduced by a headers assignment, property, or
+            // keyword argument.
+            const brace = text.lastIndexOf("{", em.index);
+            if (brace !== -1 && em.index - brace < 2000) {
+                const before = text.slice(Math.max(0, brace - 90), brace);
+                auth = /(?:^|[\s{,;])(?:[A-Za-z_$][A-Za-z0-9_$]*headers[A-Za-z0-9_$]*|headers)\s*[:=]\s*$/i.test(before)
+                    || /[A-Za-z_$][A-Za-z0-9_$]*[Hh]eaders[A-Za-z0-9_$]*\s*=\s*$/.test(before);
+            }
+        }
+        if (!auth)
+            continue;
+        const end = consumeValueExpr(text, valueStart);
+        if (end > valueStart)
+            ranges.push({ start: valueStart, end });
+    }
     return ranges;
 }
-/** Variables assigned (transitively) from a credential value expression. */
-function taintedVars(text, atoms, dataRanges) {
+/**
+ * Variables assigned (transitively) from a credential value expression.
+ * References inside authentication positions do not propagate taint
+ * (P-061): a headers dict whose only credential use is its
+ * Authorization value is an authentication container, not a tainted
+ * payload, and passing it to fetch does not become exfil.
+ */
+function taintedVars(text, atoms, dataRanges, auth = []) {
     const tainted = new Set();
     const assignRe = /(?:^|[;\n,])\s*(?:export\s+|const\s+|let\s+|var\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*=(?![=<>])\s*/g;
     const assigns = [];
@@ -698,7 +1105,7 @@ function taintedVars(text, atoms, dataRanges) {
             }
             const rhs = text.slice(a.rhsStart, a.rhsEnd);
             for (const v of tainted) {
-                if (refOutsideData(rhs, v, a.rhsStart, dataRanges)) {
+                if (refOutsideRanges(rhs, v, a.rhsStart, [...dataRanges, ...auth])) {
                     tainted.add(a.name);
                     break;
                 }
@@ -736,14 +1143,14 @@ function callSpan(text, openIdx) {
     }
     return { start: openIdx, end: text.length };
 }
-function spanHasTaint(text, span, atoms, tainted, dataRanges) {
+function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
     if (atoms.some((a) => !a.inData && a.start >= span.start && a.start < span.end))
         return true;
     if (tainted.size === 0)
         return false;
     const seg = text.slice(span.start, span.end);
     for (const v of tainted) {
-        if (refOutsideData(seg, v, span.start, dataRanges))
+        if (refOutsideRanges(seg, v, span.start, [...dataRanges, ...auth]))
             return true;
     }
     return false;
@@ -774,8 +1181,8 @@ function analyzeExfil(text, views, lang) {
     const dataRanges = views.dataRanges;
     const auth = authRanges(text);
     const atoms = findAtoms(text, dataRanges).filter((a) => !inRanges(a.start, auth));
-    const tainted = taintedVars(text, atoms, dataRanges);
-    const has = (span) => spanHasTaint(text, span, atoms, tainted, dataRanges);
+    const tainted = taintedVars(text, atoms, dataRanges, auth);
+    const has = (span) => spanHasTaint(text, span, atoms, tainted, dataRanges, auth);
     const callRes = [
         /\bfetch\s*\(/g,
         /\baxios(?:\s*\.\s*(?:post|put|patch|get|request|delete))?\s*\(/g,
@@ -792,9 +1199,21 @@ function analyzeExfil(text, views, lang) {
                 return true;
         }
     }
+    // Fetch positions run on the code view with data blanked (indices
+    // align with `text`: every view transform preserves length). A curl
+    // word in argument position (P-062) opens no exfil path.
+    const positionText = blankRanges(views.codeText, dataRanges);
+    const positions = fetchPositions(positionText);
     const statements = splitShell(text, ["\n", ";", "&&", "||"]);
     for (const stmt of statements) {
-        if (!/\b(?:curl|wget)\b/.test(text.slice(stmt.start, stmt.end)))
+        let isFetchStmt = false;
+        for (const p of positions) {
+            if (p >= stmt.start && p < stmt.end) {
+                isFetchStmt = true;
+                break;
+            }
+        }
+        if (!isFetchStmt)
             continue;
         if (has(stmt))
             return true;
@@ -825,8 +1244,8 @@ function analyzeExfil(text, views, lang) {
     // a code position (an f-string or template interpolation hole is code;
     // prose inside a plain string is not). In shell text, echo and printf
     // arguments ARE the printed values, so references inside them count.
-    const gateText = blankRanges(views.codeText, dataRanges);
-    const hasSendConstruct = /\b(?:fetch|axios|requests\s*\.|urlopen|https?\s*\.\s*(?:request|get)|curl|wget|nc|netcat)\b/.test(gateText);
+    const gateText = positionText;
+    const hasSendConstruct = /\b(?:fetch|axios|requests\s*\.|urlopen|https?\s*\.\s*(?:request|get)|nc|netcat)\b/.test(gateText) || positions.size > 0;
     if (hasSendConstruct) {
         for (const m of text.matchAll(/(?:^|[;\n|&]\s*)(?:echo|printf)\s+([^\n;|]*)/g)) {
             const span = { start: m.index, end: m.index + m[0].length };
@@ -835,7 +1254,7 @@ function analyzeExfil(text, views, lang) {
             const argText = m[1] ?? "";
             const argStart = m.index + m[0].length - argText.length;
             for (const v of tainted) {
-                if (lang === "shell" || refOutsideData(argText, v, argStart, dataRanges))
+                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
                     return true;
             }
         }
@@ -846,7 +1265,7 @@ function analyzeExfil(text, views, lang) {
             const argText = m[1] ?? "";
             const argStart = m.index + m[0].indexOf(argText);
             for (const v of tainted) {
-                if (lang === "shell" || refOutsideData(argText, v, argStart, dataRanges))
+                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
                     return true;
             }
         }
@@ -866,6 +1285,39 @@ const SAFE_PATTERNS = [
     /^patch-package$/i,
     /^simple-git-hooks$/i,
 ];
+/**
+ * DOWNLOAD-EXEC (P-064). Inline code execution (node -e, python -c,
+ * deno eval, bun -e) is download-exec only when the evaluated content
+ * itself carries a download or remote reference: a URL, a fetch or
+ * request call, a network module. Constant inline code (a node -e
+ * version comparison in modelcontextprotocol/servers, uv run python -c
+ * file parsers in wshobson/agents) downloads nothing and is not
+ * download-exec; labeling it RISKY was pure noise.
+ */
+function detectDownloadExec(codeText) {
+    const re = /\b(?:node|bun)\s+-(?:e|-eval)\b|\bdeno\s+eval\b|\bpython3?\s+-c\b/g;
+    const netRef = /https?:\/\/|\bfetch\s*\(|\bcurl\b|\bwget\b|\brequests\b|urllib|urlopen|\baxios\b|https?\s*\.\s*(?:get|request)|XMLHttpRequest|\bnet\s*\.\s*connect|\bsocket\b/i;
+    let m;
+    while ((m = re.exec(codeText)) !== null) {
+        let i = m.index + m[0].length;
+        while (i < codeText.length && /\s/.test(codeText[i]))
+            i++;
+        let content = "";
+        if (codeText[i] === "'" || codeText[i] === '"' || codeText[i] === "`") {
+            const end = consumeLiteral(codeText, i);
+            content = codeText.slice(i, end);
+        }
+        else {
+            let j = i;
+            while (j < codeText.length && codeText[j] !== "\n" && codeText[j] !== ";" && codeText[j] !== "|")
+                j++;
+            content = codeText.slice(i, j);
+        }
+        if (netRef.test(content))
+            return true;
+    }
+    return false;
+}
 export function classifyCommand(command, lang = "shell") {
     // Strip comments first (a docs URL in a comment is not a fetch), then
     // normalize shell line continuations and stray carriage returns, so a
@@ -884,12 +1336,34 @@ export function classifyCommand(command, lang = "shell") {
     const views = buildViews(cmd, lang);
     const joined = cmd.replace(/\n/g, " ");
     const codeJoined = views.codeText.replace(/\n/g, " ");
+    const urlJoined = views.urlText.replace(/\n/g, " ");
+    // Fetch positions are computed on the newline preserving code view:
+    // newlines are statement separators, and flattening them first would
+    // glue an install line and the curl command after it into one
+    // statement whose head is the package manager. Indices align with
+    // the joined views because joining only swaps newline for space.
+    const positions = fetchPositions(views.codeText);
     const fired = [];
     for (const rule of RISKY_RULES) {
-        const hay = rule.id === "REMOTE-URL" ? joined : codeJoined;
+        if (rule.id === "NET-FETCH") {
+            // P-062: the pattern covers the non-curl fetch forms; curl and
+            // wget count only in command position.
+            if (rule.pattern.test(codeJoined) || positions.size > 0)
+                fired.push({ id: rule.id, evidence: rule.evidence });
+            continue;
+        }
+        if (rule.id === "CURL-PIPE-SH") {
+            if (curlPipeIsCommandFetch(codeJoined, positions))
+                fired.push({ id: rule.id, evidence: rule.evidence });
+            continue;
+        }
+        const hay = rule.id === "REMOTE-URL" ? urlJoined : codeJoined;
         if (rule.pattern.test(hay))
             fired.push({ id: rule.id, evidence: rule.evidence });
     }
+    if (detectDownloadExec(views.codeText)) {
+        fired.push({ id: "DOWNLOAD-EXEC", evidence: "executes inline code that itself downloads or references remote content" });
+    }
     // Loopback downgrade (P-004): a fetch whose every URL is loopback is a
     // local health check shape, not a network exfil shape. Downgrade only
     // when no severe rule fired.
@@ -943,25 +1417,98 @@ export function classifyCommand(command, lang = "shell") {
     // referenced local file itself contains risky patterns we escalate below.
     return { classification: "UNKNOWN", rules: [], evidence: "no known safe pattern and no risky pattern matched; manual review needed" };
 }
+const SCRIPT_TOKEN_RE = /[A-Za-z0-9_.\/-]+\.(?:mjs|cjs|js|ts|sh|py)\b/g;
+/**
+ * Second hop detection (P-031). The one hop limit means a payload two
+ * files deep is never read, and that limit is documented. What was not
+ * acceptable was the chain head classifying SAFE on the strength of its
+ * own command text (`node scripts/a.js` matches a safe dev pattern)
+ * while its target's whole job is spawning a further local script the
+ * scanner cannot see: SAFE is an affirmative statement, and the README
+ * floor for chains beyond the follower is UNKNOWN or REVIEW. This
+ * detector returns the local script tokens that `content` EXECUTES:
+ * script tokens inside exec style call spans (execSync, spawn, Popen,
+ * os.system, and friends), and interpreter invocations (`node x.js`,
+ * `bash x.sh`) appearing as command text. Spawning a plain binary
+ * (spawn('esbuild', ...)) executes no local script and does not count,
+ * and a mere require or mention of a file is not a spawn.
+ */
+function secondHopScripts(scanRootAbs, baseAbs, content, selfAbs) {
+    const text = stripComments(content);
+    const found = new Set();
+    const collectFrom = (segText) => {
+        for (const tok of segText.match(SCRIPT_TOKEN_RE) ?? [])
+            found.add(tok);
+    };
+    // Exec style call spans: everything up to the matching close paren.
+    const callRe = /\b(?:execSync|execFileSync|execSync|execFile|spawnSync|spawn|exec|system|popen|Popen|runInThisContext|runInNewContext)\s*\(/g;
+    let cm;
+    while ((cm = callRe.exec(text)) !== null) {
+        const span = callSpan(text, cm.index + cm[0].length - 1);
+        collectFrom(text.slice(span.start, span.end));
+    }
+    // Interpreter invocations written as command text anywhere (shell
+    // lines, command strings outside the calls above).
+    const interpRe = /(?:^|[\s'"`(;|&])(?:node|bash|sh|zsh|python3?|perl|ruby)\s+(?:\.\/)?([A-Za-z0-9_.\/-]+\.(?:mjs|cjs|js|ts|sh|py))\b/gm;
+    let im;
+    while ((im = interpRe.exec(text)) !== null)
+        found.add(im[1]);
+    const out = [];
+    for (const tok of found) {
+        const rel = tok.replace(/^\.\//, "");
+        if (rel.includes("://"))
+            continue;
+        for (const base of [baseAbs, scanRootAbs]) {
+            const abs = resolve(base, rel);
+            if (abs === selfAbs)
+                continue;
+            if (abs !== scanRootAbs && !abs.startsWith(scanRootAbs + sep))
+                continue;
+            let st;
+            try {
+                st = statSync(abs);
+            }
+            catch {
+                continue;
+            }
+            if (st.isFile()) {
+                out.push(rel);
+                break;
+            }
+        }
+    }
+    return out;
+}
 /**
  * If a command references local script files, inspect those files for risky
  * patterns too (one hop). References are found by token, not only after an
  * interpreter name, so `node setup.mjs`, `./setup.sh`, `node --require
  * ./setup.mjs`, and `bash setup.sh` all resolve. References that escape the
- * scanned root are never followed.
+ * scanned root are never followed. Local references resolve against
+ * baseAbs first (the directory of the file that carries the hook, which
+ * matters for nested package.json files) and then against the scan root.
+ *
+ * P-031 floor: when a referenced file is not itself RISKY but spawns a
+ * further local script, the chain continues past the one hop limit, so a
+ * SAFE classification is floored to UNKNOWN with the second hop named in
+ * the evidence. The payload at hop two stays unclassified (the limit),
+ * but the head can no longer be affirmatively cleared.
  */
-function escalateWithLocalFile(root, finding) {
-    const tokenRe = /[A-Za-z0-9_.\/-]+\.(?:mjs|cjs|js|ts|sh|py)\b/g;
-    const tokens = Array.from(new Set(finding.command.match(tokenRe) ?? [])).slice(0, 5);
+function escalateWithLocalFile(root, finding, baseAbs = root) {
+    const tokens = Array.from(new Set(finding.command.match(SCRIPT_TOKEN_RE) ?? [])).slice(0, 5);
     if (tokens.length === 0)
         return finding;
     const rootAbs = resolve(root);
+    const baseResolved = resolve(baseAbs);
     let out = finding;
     for (const token of tokens) {
         const rel = token.replace(/^\.\//, "");
         if (rel.includes("://"))
             continue;
-        const abs = resolve(rootAbs, rel);
+        let abs = resolve(baseResolved, rel);
+        if ((abs !== rootAbs && !abs.startsWith(rootAbs + sep)) || !existsSync(abs)) {
+            abs = resolve(rootAbs, rel);
+        }
         if (abs !== rootAbs && !abs.startsWith(rootAbs + sep))
             continue;
         if (!existsSync(abs))
@@ -991,15 +1538,25 @@ function escalateWithLocalFile(root, finding) {
                 rules,
                 evidence: `${out.evidence === "" ? "" : out.evidence + "; "}referenced local file ${rel} is RISKY: ${inner.evidence}`,
             };
+            continue;
+        }
+        const hops = secondHopScripts(rootAbs, dirname(abs), content, abs);
+        if (hops.length > 0) {
+            const note = `referenced local file ${rel} spawns further local script(s) ${hops.join(", ")} beyond the one hop limit; the chain head cannot be verified past hop one`;
+            out = {
+                ...out,
+                classification: out.classification === "SAFE" ? "UNKNOWN" : out.classification,
+                evidence: `${out.evidence === "" ? "" : out.evidence + "; "}${note}; classification floored at UNKNOWN`,
+            };
         }
     }
     return out;
 }
 /** Classify a command string, including one hop into local files it runs. */
-function classifyWithLocalFile(root, source, command) {
+function classifyWithLocalFile(root, source, command, baseAbs = root) {
     const c = classifyCommand(command);
     const temp = { id: "", file: "", source, hook: "", command, classification: c.classification, rules: c.rules, evidence: c.evidence };
-    const escalated = escalateWithLocalFile(root, temp);
+    const escalated = escalateWithLocalFile(root, temp, baseAbs);
     return { classification: escalated.classification, rules: escalated.rules, evidence: escalated.evidence };
 }
 /**
@@ -1008,7 +1565,7 @@ function classifyWithLocalFile(root, source, command) {
  * script is RISKY (directly or through a local file it runs), the install
  * hook inherits the classification.
  */
-function escalateWithScriptChain(root, scripts, currentName, finding) {
+function escalateWithScriptChain(root, scripts, currentName, finding, baseAbs = root) {
     const chainRe = /\b(?:npm|yarn|pnpm|bun)\s+(?:run\s+)?([A-Za-z0-9:_-]+)/g;
     let out = finding;
     let m;
@@ -1019,7 +1576,7 @@ function escalateWithScriptChain(root, scripts, currentName, finding) {
         const chained = scripts[name];
         if (typeof chained !== "string" || !chained.trim())
             continue;
-        const inner = classifyWithLocalFile(root, "package.json", chained);
+        const inner = classifyWithLocalFile(root, "package.json", chained, baseAbs);
         if (inner.classification === "RISKY") {
             const rules = Array.from(new Set([...out.rules, ...inner.rules]));
             out = {
@@ -1053,6 +1610,48 @@ function escalateWithScriptChain(root, scripts, currentName, finding) {
  * read, a download by itself) classify RISKY at most, and a RISKY-only
  * estate verdicts REVIEW, never COMPROMISED-PATTERN.
  */
+/**
+ * Vendor installer pipe calibration (P-063, Wave B). A CI workflow step
+ * whose ONLY severe evidence is a curl pipe to a named vendor's
+ * official installer over HTTPS (the uv installer at astral.sh, the
+ * opencode installer) is the same family as the esbuild and puppeteer
+ * download-own-binary installers the v0.1.2 calibration already holds
+ * at REVIEW: the pattern match is literal and the finding stays RISKY,
+ * but nothing about the step exfils, persists, or touches a credential.
+ * The narrowing is deliberately tight; ALL of these must hold:
+ *   - the finding is a GitHub workflow run step (CI context). The same
+ *     pipe on an auto-exec hook surface (package.json script, Claude
+ *     settings or plugin hook, folderOpen task) keeps the top verdict:
+ *     a hook runs on a developer machine at open or install time,
+ *     which is exactly the Shai-Hulud persistence shape;
+ *   - CURL-PIPE-SH is the only severe rule, and every rule present is
+ *     part of the pipe shape itself (CURL-PIPE-SH, NET-FETCH,
+ *     REMOTE-URL). Any credential rule, persistence rule, or second
+ *     severe signal disqualifies the finding;
+ *   - the piped URL is HTTPS and installer shaped: a path segment
+ *     named install, installer, or setup (optionally with a script
+ *     extension), or a host on the short known-installer list below.
+ * A curl pipe to an unversioned or non-vendor source (payload.sh on an
+ * arbitrary host) never qualifies.
+ */
+const KNOWN_INSTALLER_HOSTS = new Set(["sh.rustup.rs", "get.docker.com", "install.python-poetry.org", "astral.sh", "opencode.ai"]);
+function isVendorInstallerPipeOnly(f) {
+    if (f.source !== "github-workflow")
+        return false;
+    if (!f.rules.includes("CURL-PIPE-SH"))
+        return false;
+    const allowed = new Set(["CURL-PIPE-SH", "NET-FETCH", "REMOTE-URL"]);
+    if (!f.rules.every((r) => allowed.has(r)))
+        return false;
+    const m = f.command.match(/https:\/\/([^\s"'`/:?#]+)([^\s"'`]*)/i);
+    if (!m)
+        return false;
+    const host = m[1].toLowerCase();
+    const path = (m[2] ?? "").toLowerCase();
+    if (/(^|\/)(install|installer|setup)(\.(sh|bash|ps1|py))?($|[/?#])/.test(path))
+        return true;
+    return KNOWN_INSTALLER_HOSTS.has(host);
+}
 export function computeVerdict(findings) {
     let review = false;
     for (const f of findings) {
@@ -1061,7 +1660,10 @@ export function computeVerdict(findings) {
             const hasSevere = metas.some((x) => x.severe);
             const hasCredStore = f.rules.includes("CRED-ACCESS");
             const hasNet = metas.some((x) => x.remote);
-            if (hasSevere || (hasCredStore && hasNet))
+            // P-063: a lone vendor installer pipe in CI is strong pattern
+            // evidence but not, on its own, a compromise pattern.
+            const vendorPipeOnly = isVendorInstallerPipeOnly(f);
+            if ((hasSevere && !vendorPipeOnly) || (hasCredStore && hasNet))
                 return "COMPROMISED-PATTERN";
             review = true;
         }
@@ -1071,7 +1673,7 @@ export function computeVerdict(findings) {
     }
     return review ? "REVIEW" : "CLEAN";
 }
-function makeFinding(root, file, source, hook, command, idSuffix, line) {
+function makeFinding(root, file, source, hook, command, idSuffix, line, baseAbs = root) {
     const c = classifyCommand(command);
     const id = `${file}:${hook}${idSuffix !== undefined ? `:${idSuffix}` : ""}`;
     const base = {
@@ -1080,7 +1682,7 @@ function makeFinding(root, file, source, hook, command, idSuffix, line) {
         classification: c.classification, rules: c.rules,
         evidence: c.evidence,
     };
-    return escalateWithLocalFile(root, base);
+    return escalateWithLocalFile(root, base, baseAbs);
 }
 function readText(abs) {
     try {
@@ -1090,8 +1692,26 @@ function readText(abs) {
         return null;
     }
 }
+/**
+ * Read a file the scanner has decided to inventory, warning loudly when
+ * it cannot be read (P-049). A file that exists but cannot be read (the
+ * classic case is mode 000) must never vanish silently: the warning
+ * names the file, and scanHooks floors the verdict at REVIEW whenever
+ * any warning carries the Unreadable prefix, so a partial scan never
+ * presents as a complete all-clear.
+ */
+function readTextWarn(abs, rel, warnings) {
+    try {
+        return readFileSync(abs, "utf8");
+    }
+    catch (err) {
+        const code = err?.code ?? "error";
+        warnings.push(`Unreadable file skipped: ${rel} could not be read (${code}); the scan is partial and this file was not inventoried`);
+        return null;
+    }
+}
 function readJson(root, rel, warnings) {
-    const raw = readText(join(root, rel));
+    const raw = readTextWarn(join(root, rel), rel, warnings);
     if (raw === null)
         return null;
     // Strip a UTF-8 BOM first: Windows editors add one, JSON.parse rejects it,
@@ -1109,14 +1729,13 @@ function readJson(root, rel, warnings) {
         return null;
     }
 }
-function scanPackageJson(root, findings, warnings) {
-    const rel = "package.json";
+function scanOnePackageJson(root, rel, findings, warnings) {
     if (!existsSync(join(root, rel)))
         return;
     const data = readJson(root, rel, warnings);
     if (!data) {
-        // readJson already warned when the file exists but is malformed. If it
-        // parsed to a non object, note it as well.
+        // readJson already warned when the file exists but is malformed or
+        // unreadable. If it parsed to a non object, note it as well.
         if (readText(join(root, rel)) !== null && !warnings.some((w) => w.includes(rel))) {
             warnings.push(`Could not parse ${rel} as an object`);
         }
@@ -1132,28 +1751,97 @@ function scanPackageJson(root, findings, warnings) {
     }
     const scripts = (data.scripts ?? {});
     const watched = ["preinstall", "install", "postinstall", "prepare", "prepublish", "prepublishOnly"];
+    // Referenced local files resolve against this package's own directory:
+    // a nested workspace package runs its scripts from its own folder.
+    const baseAbs = dirname(join(root, rel));
     for (const name of watched) {
         const cmd = scripts[name];
         if (typeof cmd === "string" && cmd.trim()) {
-            const finding = makeFinding(root, rel, "package.json", name, cmd);
-            findings.push(escalateWithScriptChain(root, scripts, name, finding));
+            const finding = makeFinding(root, rel, "package.json", name, cmd, undefined, undefined, baseAbs);
+            findings.push(escalateWithScriptChain(root, scripts, name, finding, baseAbs));
         }
     }
 }
-function collectClaudeHooks(node, file, root, findings, prefix) {
+/**
+ * Nested package.json discovery (P-032). Install scripts in workspace
+ * subpackages (packages/foo, apps/web) run on a root install, so a
+ * root-only scan misses exactly the surface a worm would persist in.
+ * The walk is bounded so a hostile or giant tree cannot explode the
+ * report: directories are visited in sorted order to depth
+ * PACKAGE_MAX_DEPTH (the package.json directory depth below the root),
+ * node_modules, .git, and dot directories are never entered, symlinked
+ * directories are never followed (a symlink loop cannot hang the scan),
+ * and at most PACKAGE_MAX_NESTED nested files are inventoried, with the
+ * cap reported as a warning when it is hit.
+ */
+export const PACKAGE_MAX_DEPTH = 4;
+export const PACKAGE_MAX_NESTED = 200;
+function discoverNestedPackageJson(root, warnings) {
+    const found = [];
+    const skipDirs = new Set(["node_modules", ".git"]);
+    const stack = [{ abs: root, rel: "", depth: 0 }];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        let entries = [];
+        try {
+            entries = readdirSync(cur.abs);
+        }
+        catch {
+            if (cur.rel)
+                warnings.push(`Unreadable directory skipped: ${cur.rel} could not be listed; the scan is partial`);
+            continue;
+        }
+        entries.sort();
+        if (cur.depth >= 1 && entries.includes("package.json")) {
+            found.push(cur.rel === "" ? "package.json" : `${cur.rel}/package.json`);
+        }
+        if (cur.depth >= PACKAGE_MAX_DEPTH)
+            continue;
+        // Push in reverse so the stack pops in sorted order.
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const name = entries[i];
+            if (skipDirs.has(name) || name.startsWith("."))
+                continue;
+            const childAbs = join(cur.abs, name);
+            let lst;
+            try {
+                lst = lstatSync(childAbs);
+            }
+            catch {
+                continue;
+            }
+            if (lst.isSymbolicLink() || !lst.isDirectory())
+                continue;
+            stack.push({ abs: childAbs, rel: cur.rel === "" ? name : `${cur.rel}/${name}`, depth: cur.depth + 1 });
+        }
+    }
+    found.sort();
+    if (found.length > PACKAGE_MAX_NESTED) {
+        warnings.push(`Nested package.json inventory capped at ${PACKAGE_MAX_NESTED} files (${found.length} found); the remaining nested package.json files were not inventoried and the scan is partial`);
+        return found.slice(0, PACKAGE_MAX_NESTED);
+    }
+    return found;
+}
+function scanPackageJson(root, findings, warnings) {
+    scanOnePackageJson(root, "package.json", findings, warnings);
+    for (const rel of discoverNestedPackageJson(root, warnings)) {
+        scanOnePackageJson(root, rel, findings, warnings);
+    }
+}
+function collectClaudeHooks(node, file, root, findings, prefix, source = "claude-settings", baseAbs = root) {
     if (!node || typeof node !== "object")
         return;
     const obj = node;
     if (typeof obj.command === "string" && obj.command.trim()) {
-        findings.push(makeFinding(root, file, "claude-settings", prefix || "hook", obj.command, String(findings.length)));
+        findings.push(makeFinding(root, file, source, prefix || "hook", obj.command, String(findings.length), undefined, baseAbs));
         return;
     }
     for (const [key, value] of Object.entries(obj)) {
         if (Array.isArray(value)) {
-            value.forEach((item, i) => collectClaudeHooks(item, file, root, findings, prefix ? `${prefix}:${key}` : key));
+            value.forEach((item, i) => collectClaudeHooks(item, file, root, findings, prefix ? `${prefix}:${key}` : key, source, baseAbs));
         }
         else if (value && typeof value === "object") {
-            collectClaudeHooks(value, file, root, findings, prefix ? `${prefix}:${key}` : key);
+            collectClaudeHooks(value, file, root, findings, prefix ? `${prefix}:${key}` : key, source, baseAbs);
         }
     }
 }
@@ -1227,6 +1915,100 @@ function scanClaude(root, findings, warnings) {
         collectClaudeHooks(hooks, rel, root, findings, "");
     }
 }
+/**
+ * Claude Code plugin hook files (P-060, BLOCKER). Plugins distribute
+ * hooks in a hooks/ directory at the plugin root: hooks/hooks.json at
+ * the repo root for a single plugin repo (obra/superpowers), or
+ * plugins/<name>/hooks/hooks.json inside a marketplace or monorepo
+ * (anthropics/claude-code carries 9 such files, wshobson/agents 2 among
+ * 92 plugin directories). Before v0.1.7 none of these files was scanned
+ * at any depth: a SessionStart curl pipe in hooks/hooks.json scanned
+ * CLEAN with total 0 while the identical payload in .claude/settings.json
+ * verdicts COMPROMISED-PATTERN. The file carries the same schema as the
+ * hooks key of .claude/settings.json (an events map of command hooks:
+ * SessionStart, PreToolUse, PostToolUse, Stop, UserPromptSubmit, and
+ * the rest of the Claude Code event set), so commands are classified
+ * exactly as settings hooks are. The sibling hooks/hooks-cursor.json
+ * variant shipped by the same plugins (superpowers) carries the same
+ * command object shape under Cursor event names, so it is inventoried
+ * the same way.
+ *
+ * The walk mirrors the nested package.json discipline (P-032): sorted
+ * order, node_modules, .git, and dot directories never entered,
+ * symlinked directories never followed, and a cap with a warning. The
+ * depth bound applies to the plugin root (at most PLUGIN_HOOKS_MAX_DEPTH
+ * directories below the scan root); the hooks directory itself sits one
+ * level below its plugin root.
+ */
+export const PLUGIN_HOOKS_MAX_DEPTH = 4;
+export const PLUGIN_HOOKS_MAX_FILES = 200;
+function discoverPluginHookFiles(root, warnings) {
+    const found = [];
+    const skipDirs = new Set(["node_modules", ".git"]);
+    const maxHooksDirDepth = PLUGIN_HOOKS_MAX_DEPTH + 1;
+    const stack = [{ abs: root, rel: "", depth: 0 }];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        let entries = [];
+        try {
+            entries = readdirSync(cur.abs);
+        }
+        catch {
+            if (cur.rel)
+                warnings.push(`Unreadable directory skipped: ${cur.rel} could not be listed; the scan is partial`);
+            continue;
+        }
+        entries.sort();
+        const base = cur.rel === "" ? "" : (cur.rel.split("/").pop() ?? "");
+        if (cur.depth >= 1 && base === "hooks") {
+            for (const name of ["hooks.json", "hooks-cursor.json"]) {
+                if (entries.includes(name))
+                    found.push(cur.rel === "" ? name : `${cur.rel}/${name}`);
+            }
+        }
+        if (cur.depth >= maxHooksDirDepth)
+            continue;
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const name = entries[i];
+            if (skipDirs.has(name) || name.startsWith("."))
+                continue;
+            const childAbs = join(cur.abs, name);
+            let lst;
+            try {
+                lst = lstatSync(childAbs);
+            }
+            catch {
+                continue;
+            }
+            if (lst.isSymbolicLink() || !lst.isDirectory())
+                continue;
+            stack.push({ abs: childAbs, rel: cur.rel === "" ? name : `${cur.rel}/${name}`, depth: cur.depth + 1 });
+        }
+    }
+    found.sort();
+    if (found.length > PLUGIN_HOOKS_MAX_FILES) {
+        warnings.push(`Plugin hooks inventory capped at ${PLUGIN_HOOKS_MAX_FILES} files (${found.length} found); the remaining plugin hook files were not inventoried and the scan is partial`);
+        return found.slice(0, PLUGIN_HOOKS_MAX_FILES);
+    }
+    return found;
+}
+function scanPluginHooks(root, findings, warnings) {
+    for (const rel of discoverPluginHookFiles(root, warnings)) {
+        const data = readJson(root, rel, warnings);
+        if (!data || typeof data !== "object" || Array.isArray(data))
+            continue;
+        // The events map lives under the hooks key when one is present;
+        // some plugin files put the events map at the top level.
+        const eventsNode = ("hooks" in data && data.hooks && typeof data.hooks === "object" && !Array.isArray(data.hooks))
+            ? data.hooks
+            : data;
+        // Referenced local files resolve against the plugin root (the
+        // directory holding the hooks folder), which is where
+        // ${CLAUDE_PLUGIN_ROOT} points at runtime.
+        const pluginRootAbs = dirname(dirname(join(root, rel)));
+        collectClaudeHooks(eventsNode, rel, root, findings, "", "claude-plugin", pluginRootAbs);
+    }
+}
 function scanVscode(root, findings, warnings) {
     const rel = ".vscode/tasks.json";
     if (existsSync(join(root, rel))) {
@@ -1268,7 +2050,7 @@ function scanVscode(root, findings, warnings) {
     // MCP config inside .vscode
     scanMcpFile(root, ".vscode/mcp.json", findings, warnings);
 }
-function scanDirFiles(root, dirRel, source, findings) {
+function scanDirFiles(root, dirRel, source, findings, warnings) {
     const abs = join(root, dirRel);
     if (!existsSync(abs))
         return;
@@ -1277,6 +2059,7 @@ function scanDirFiles(root, dirRel, source, findings) {
         entries = readdirSync(abs);
     }
     catch {
+        warnings.push(`Unreadable directory skipped: ${dirRel} could not be listed; the scan is partial`);
         return;
     }
     for (const name of entries.sort()) {
@@ -1292,7 +2075,7 @@ function scanDirFiles(root, dirRel, source, findings) {
             continue;
         if (name === "_" || name.startsWith("."))
             continue;
-        const content = readText(fileAbs);
+        const content = readTextWarn(fileAbs, `${dirRel}/${name}`, warnings);
         if (content === null)
             continue;
         const firstMeaningful = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith("set -")).join(" ");
@@ -1304,11 +2087,11 @@ function scanDirFiles(root, dirRel, source, findings) {
         void firstMeaningful;
     }
 }
-function scanLefthook(root, findings) {
+function scanLefthook(root, findings, warnings) {
     for (const rel of ["lefthook.yml", "lefthook.yaml", ".lefthook.yml"]) {
         if (!existsSync(join(root, rel)))
             continue;
-        const raw = readText(join(root, rel)) ?? "";
+        const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
         const runRe = /^\s*run:\s*(.+)$/gm;
         let m;
         let i = 0;
@@ -1317,11 +2100,11 @@ function scanLefthook(root, findings) {
         }
     }
 }
-function scanPreCommit(root, findings) {
+function scanPreCommit(root, findings, warnings) {
     const rel = ".pre-commit-config.yaml";
     if (!existsSync(join(root, rel)))
         return;
-    const raw = readText(join(root, rel)) ?? "";
+    const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
     const entryRe = /^\s*entry:\s*(.+)$/gm;
     let m;
     let i = 0;
@@ -1370,19 +2153,23 @@ function scanAgentDirs(root, findings, warnings) {
             if (!st.isFile())
                 continue;
             const rel = `${dir}/${name}`;
+            // mcp.json is an MCP config surface, inventoried exactly once by
+            // the central scanMcpFile pass in scanHooks (P-035). Running it
+            // through the generic command walk here as well counted every
+            // .cursor/mcp.json server twice.
+            if (name === "mcp.json")
+                continue;
             if (name.endsWith(".json")) {
                 const data = readJson(root, rel, warnings);
                 if (data)
                     collectGenericCommands(data, rel, root, findings, source);
             }
             else {
-                const content = readText(fileAbs);
+                const content = readTextWarn(fileAbs, rel, warnings);
                 if (content && content.trim()) {
                     findings.push(makeFinding(root, rel, source, name, content.trim().slice(0, 200000)));
                 }
             }
-            if (name === "mcp.json")
-                scanMcpFile(root, rel, findings, warnings);
         }
     }
 }
@@ -1429,8 +2216,24 @@ function scanMcpFile(root, rel, findings, warnings) {
  * multi-line steps; their bodies are collected by indentation, dedented,
  * and classified exactly like the same commands on one line. Every
  * finding carries the 1-based line number of its run: key.
+ *
+ * Line endings are normalized before parsing (P-048): CRLF is a
+ * semantics preserving encoding for YAML and GitHub Actions, but the
+ * line parser keyed on patterns that a trailing carriage return broke,
+ * so a Windows authored workflow inventoried as total 0. A CRLF file
+ * now produces exactly the findings of its LF twin.
+ *
+ * YAML anchors defined in the same file are resolved (P-033): a scalar
+ * alias used as a run value (run: *name) resolves to the anchored
+ * scalar, a step that is only an alias (- *name) resolves to the
+ * anchored mapping's run value, and a merge key step (<<: *name) is
+ * inventoried by its resolved content. The anchored definition itself
+ * (an x- style key outside any step) is not double counted: it is
+ * inventoried at each use site instead. An alias that cannot be
+ * resolved is still inventoried, as the literal alias text at UNKNOWN,
+ * so no executable step ever yields zero findings.
  */
-function scanWorkflows(root, findings) {
+function scanWorkflows(root, findings, warnings) {
     const dir = ".github/workflows";
     const abs = join(root, dir);
     if (!existsSync(abs))
@@ -1440,58 +2243,150 @@ function scanWorkflows(root, findings) {
         entries = readdirSync(abs);
     }
     catch {
+        warnings.push(`Unreadable directory skipped: ${dir} could not be listed; the scan is partial`);
         return;
     }
     for (const name of entries.sort()) {
         if (!/\.(yml|yaml)$/.test(name))
             continue;
         const rel = `${dir}/${name}`;
-        const raw = readText(join(root, rel)) ?? "";
+        const rawFile = readTextWarn(join(root, rel), rel, warnings);
+        if (rawFile === null)
+            continue;
+        const raw = rawFile.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
         const lines = raw.split("\n");
+        const indentOf = (l) => l.length - l.trimStart().length;
+        const unquote = (s) => {
+            const t = s.trim();
+            if (t.length >= 2 && ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))))
+                return t.slice(1, -1);
+            return t;
+        };
+        // Anchor tables, filled by a first pass over the whole file so a
+        // use site resolves regardless of definition order.
+        const scalarAnchors = new Map();
+        const mapAnchors = new Map();
+        const definitionRunLines = new Set();
+        const resolveAlias = (value, depth = 0) => {
+            const t = value.trim();
+            const am = t.match(/^\*([A-Za-z0-9_-]+)$/);
+            if (am && depth < 5) {
+                if (scalarAnchors.has(am[1]))
+                    return resolveAlias(scalarAnchors.get(am[1]), depth + 1);
+                if (mapAnchors.has(am[1]))
+                    return mapAnchors.get(am[1]);
+            }
+            return unquote(t);
+        };
+        // Collect the dedented body of a block scalar whose header sits at
+        // line hdrIdx with run indent runIndent. Returns body and end index.
+        const collectBlock = (hdrIdx, runIndent) => {
+            const body = [];
+            let j = hdrIdx + 1;
+            for (; j < lines.length; j++) {
+                const l = lines[j];
+                if (l.trim() === "") {
+                    body.push("");
+                    continue;
+                }
+                if (indentOf(l) <= runIndent)
+                    break;
+                body.push(l);
+            }
+            const nonBlank = body.filter((l) => l.trim() !== "");
+            if (nonBlank.length === 0)
+                return { body: "", end: j };
+            const minIndent = Math.min(...nonBlank.map((l) => l.length - l.trimStart().length));
+            const dedented = body.map((l) => (l.trim() === "" ? "" : l.slice(minIndent))).join("\n").trim();
+            return { body: dedented, end: j };
+        };
+        for (let idx = 0; idx < lines.length; idx++) {
+            const line = lines[idx];
+            const scalarM = line.match(/^(\s*)(?:-\s*)?([A-Za-z0-9_-]+):\s*&([A-Za-z0-9_-]+)\s+(.+?)\s*$/);
+            if (scalarM && scalarM[2] !== "run") {
+                scalarAnchors.set(scalarM[3], unquote(scalarM[4]));
+                continue;
+            }
+            const mapM = line.match(/^(\s*)(-\s*)?([A-Za-z0-9_-]+):\s*&([A-Za-z0-9_-]+)\s*(#.*)?$/);
+            if (mapM) {
+                const isListItem = mapM[2] !== undefined;
+                const baseIndent = indentOf(line) + (isListItem ? 2 : 0);
+                for (let j = idx + 1; j < lines.length; j++) {
+                    const l = lines[j];
+                    if (l.trim() === "")
+                        continue;
+                    if (indentOf(l) <= baseIndent)
+                        break;
+                    const rm = l.match(/^(\s*)-?\s*run:\s*(.*)$/);
+                    if (rm) {
+                        const rest = rm[2].trim();
+                        const bh = rest.match(/^([|>])([+-]?)\s*(#.*)?$/);
+                        const value = bh ? collectBlock(j, rm[1].length).body : resolveAlias(rest);
+                        if (value)
+                            mapAnchors.set(mapM[4], value);
+                        // A definition outside a step (an x- key) never runs on its
+                        // own; its run line is inventoried at the use sites, not
+                        // here. A list item anchor is a real step and stays live.
+                        if (!isListItem)
+                            definitionRunLines.add(j);
+                        break;
+                    }
+                }
+            }
+        }
         let i = 0;
         for (let idx = 0; idx < lines.length; idx++) {
-            const m = lines[idx].match(/^(\s*)-?\s*run:\s*(.*)$/);
+            if (definitionRunLines.has(idx))
+                continue;
+            const line = lines[idx];
+            const lineNo = idx + 1;
+            const aliasStep = line.match(/^\s*-\s*\*([A-Za-z0-9_-]+)\s*(#.*)?$/);
+            if (aliasStep) {
+                const name = aliasStep[1];
+                const resolved = scalarAnchors.has(name) || mapAnchors.has(name) ? resolveAlias(`*${name}`) : `*${name}`;
+                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo));
+                continue;
+            }
+            const mergeKey = line.match(/^\s*<<:\s*\*([A-Za-z0-9_-]+)\s*(#.*)?$/);
+            if (mergeKey) {
+                const name = mergeKey[1];
+                const resolved = scalarAnchors.has(name) || mapAnchors.has(name) ? resolveAlias(`*${name}`) : `*${name}`;
+                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo));
+                continue;
+            }
+            const m = line.match(/^(\s*)-?\s*run:\s*(.*)$/);
             if (!m)
                 continue;
             const runIndent = m[1].length;
-            const rest = m[2].trim();
-            const lineNo = idx + 1;
+            let rest = m[2].trim();
+            const lineNoRun = idx + 1;
+            // A run value that defines an anchor (run: &name cmd) is itself
+            // executable; register the anchor and inventory the value.
+            const anchorDef = rest.match(/^&([A-Za-z0-9_-]+)\s+(.+)$/);
+            if (anchorDef) {
+                scalarAnchors.set(anchorDef[1], unquote(anchorDef[2]));
+                rest = anchorDef[2].trim();
+            }
+            else if (/^\*[A-Za-z0-9_-]+$/.test(rest)) {
+                rest = resolveAlias(rest);
+            }
             const blockHeader = rest.match(/^([|>])([+-]?)\s*(#.*)?$/);
             if (blockHeader) {
-                // Collect body lines: blank lines belong to the block; the block
-                // ends at the first non-blank line indented at or below run:.
-                const body = [];
-                let j = idx + 1;
-                for (; j < lines.length; j++) {
-                    const l = lines[j];
-                    if (l.trim() === "") {
-                        body.push("");
-                        continue;
-                    }
-                    const indent = l.length - l.trimStart().length;
-                    if (indent <= runIndent)
-                        break;
-                    body.push(l);
-                }
-                const nonBlank = body.filter((l) => l.trim() !== "");
-                if (nonBlank.length > 0) {
-                    const minIndent = Math.min(...nonBlank.map((l) => l.length - l.trimStart().length));
-                    const dedented = body.map((l) => (l.trim() === "" ? "" : l.slice(minIndent))).join("\n").trim();
-                    if (dedented) {
-                        findings.push(makeFinding(root, rel, "github-workflow", "run", dedented, String(i++), lineNo));
-                    }
+                const { body, end } = collectBlock(idx, runIndent);
+                if (body) {
+                    findings.push(makeFinding(root, rel, "github-workflow", "run", body, String(i++), lineNoRun));
                 }
-                idx = j - 1;
+                idx = end - 1;
                 continue;
             }
             if (rest === "")
                 continue;
-            findings.push(makeFinding(root, rel, "github-workflow", "run", rest, String(i++), lineNo));
+            findings.push(makeFinding(root, rel, "github-workflow", "run", rest, String(i++), lineNoRun));
         }
     }
 }
-function scanGitHooks(root, findings) {
-    scanDirFiles(root, ".githooks", "githooks", findings);
+function scanGitHooks(root, findings, warnings) {
+    scanDirFiles(root, ".githooks", "githooks", findings, warnings);
 }
 /**
  * Empty estate note (P-014, hookcheck half). A scan that inventories
@@ -1530,15 +2425,19 @@ export function scanHooks(root) {
     }
     scanPackageJson(root, findings, warnings);
     scanClaude(root, findings, warnings);
+    scanPluginHooks(root, findings, warnings);
     scanVscode(root, findings, warnings);
-    scanDirFiles(root, ".husky", "husky", findings);
-    scanLefthook(root, findings);
-    scanPreCommit(root, findings);
+    scanDirFiles(root, ".husky", "husky", findings, warnings);
+    scanLefthook(root, findings, warnings);
+    scanPreCommit(root, findings, warnings);
     scanAgentDirs(root, findings, warnings);
-    for (const rel of [".mcp.json", "mcp.json", ".cursor/mcp.json"])
+    // MCP config surfaces, each inventoried exactly once (P-035).
+    // .windsurf/mcp.json joined the covered surfaces in v0.1.6 (P-034);
+    // .vscode/mcp.json is handled inside scanVscode.
+    for (const rel of [".mcp.json", "mcp.json", ".cursor/mcp.json", ".windsurf/mcp.json", ".codex/mcp.json"])
         scanMcpFile(root, rel, findings, warnings);
-    scanWorkflows(root, findings);
-    scanGitHooks(root, findings);
+    scanWorkflows(root, findings, warnings);
+    scanGitHooks(root, findings, warnings);
     // Dedupe identical ids (agent dir scan may double count mcp.json).
     const seen = new Set();
     const deduped = findings.filter((f) => {
@@ -1554,9 +2453,17 @@ export function scanHooks(root) {
         risky: deduped.filter((f) => f.classification === "RISKY").length,
         unknown: deduped.filter((f) => f.classification === "UNKNOWN").length,
     };
+    // Partial scan floor (P-049): when any inventoried file or directory
+    // could not be read, the scan did not see the whole estate, so a bare
+    // CLEAN is not an honest verdict. Floor at REVIEW; the warnings name
+    // exactly what was missed.
+    let verdict = computeVerdict(deduped);
+    if (verdict === "CLEAN" && warnings.some((w) => w.startsWith("Unreadable"))) {
+        verdict = "REVIEW";
+    }
     return {
         path: root,
-        verdict: computeVerdict(deduped),
+        verdict,
         findings: deduped,
         counts,
         warnings,