@reneturcios/hookcheck 0.1.6 → 0.1.8

package/dist/core.js

@@ -6,16 +6,25 @@
  */
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
-export const VERSION = "0.1.6";
+export const VERSION = "0.1.8";
 export const RISKY_RULES = [
     { id: "DECODE-PIPE-SH", pattern: /\bbase64\s+(-d|--decode|-D)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "decodes a base64 payload and pipes it straight into an interpreter", severe: true, remote: true },
     { id: "CURL-PIPE-SH", pattern: /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|node|python3?|perl|ruby)\b/, evidence: "pipes a network download straight into an interpreter", severe: true, remote: true },
     { id: "REMOTE-EVAL", pattern: /\beval\b[^;]{0,80}\b(curl|wget)\b|\beval\b[^;]{0,80}\$\(\s*(curl|wget)|\bFunction\s*\([^)]{0,80}(curl|wget|fetch)/, evidence: "evaluates content fetched from the network as code", severe: true, remote: true },
-    { id: "NET-FETCH", pattern: /\b(curl|wget)\b|\bfetch\s*\(|https?\s*\.get\s*\(|requests\.(get|post)\b|Invoke-WebRequest\b|Invoke-RestMethod\b/, evidence: "performs a network fetch", remote: true },
+    // NET-FETCH (P-062): the curl and wget alternatives are NOT in this
+    // pattern. A fetch binary counts only in command position (see
+    // fetchPositions below): the token curl naming a package in an install
+    // line (pacman -S curl, apt-get install curl) is a package name being
+    // installed, not a command being run, and matching it anywhere in the
+    // step manufactured a phantom fetch on evilmartians/lefthook.
+    { id: "NET-FETCH", pattern: /\bfetch\s*\(|https?\s*\.get\s*\(|requests\.(get|post)\b|Invoke-WebRequest\b|Invoke-RestMethod\b/, evidence: "performs a network fetch", remote: true },
     { id: "REMOTE-URL", pattern: /https?:\/\/[^\s"'`]+/, evidence: "references a remote URL", remote: true },
     { id: "OBFUSCATION", pattern: /base64\s+(-d|--decode)|atob\s*\(|Buffer\.from\s*\([^)]*base64|\\x[0-9a-fA-F]{2}|\beval\b\s*\(|\beval\b\s+["'$(]|Function\s*\(/, evidence: "uses decoding or dynamic evaluation often used to hide payloads" },
     { id: "WRITE-OUTSIDE", pattern: /(>>?|tee)\s+~\/|(>>?|tee)\s+\$HOME\/|chmod\s+\+x/, evidence: "writes outside the repo or changes executable bits" },
-    { id: "DOWNLOAD-EXEC", pattern: /\bnode\s+-e\b|\bpython3?\s+-c\b|\bdeno\s+eval\b|\bbun\s+-e\b/, evidence: "executes inline code supplied on the command line" },
+    // DOWNLOAD-EXEC is detected procedurally (see detectDownloadExec):
+    // inline code execution counts only when the evaluated content itself
+    // carries a download or remote reference (P-064). A constant
+    // node -e version comparison downloads nothing.
 ];
 /**
  * Rule metadata for procedurally detected rules (credential access and env
@@ -84,9 +93,12 @@ function inRanges(idx, ranges) {
  * disclosure next to the prose word "fetch" in a docstring.
  */
 function refOutsideData(seg, name, segStart, dataRanges) {
+    return refOutsideRanges(seg, name, segStart, dataRanges);
+}
+function refOutsideRanges(seg, name, segStart, ranges) {
     const re = new RegExp(`\\b${name.replace(/\$/g, "\\$")}\\b`, "g");
     for (const m of seg.matchAll(re)) {
-        if (!inRanges(segStart + (m.index ?? 0), dataRanges))
+        if (!inRanges(segStart + (m.index ?? 0), ranges))
             return true;
     }
     return false;
@@ -389,6 +401,159 @@ function firstShellWord(segment) {
     const w = s.match(/^[A-Za-z_][A-Za-z0-9_.-]*/);
     return w ? w[0] : "";
 }
+/**
+ * Command position for fetch binaries (P-062). The word curl inside a
+ * step is not necessarily a fetch: in `pacman -S --noconfirm openssh
+ * git curl` it is a package name in argument position, and counting it
+ * as NET-FETCH manufactured an exfil verdict on evilmartians/lefthook
+ * (the phantom fetch combined with a credential store write in the same
+ * step). A fetch counts only when curl or wget is the invoked command:
+ * the head of a statement or pipeline segment, after wrappers (sudo,
+ * env, command, xargs, shell keywords) and environment assignments, or
+ * the head of a command string literal (the string handed to
+ * bash -c, execSync, os.system, and friends IS a command). Positions
+ * are returned as indices of the fetch word in the input text.
+ */
+const FETCH_WRAPPERS = new Set(["sudo", "doas", "env", "command", "builtin", "exec", "time", "nice", "nohup", "xargs", "if", "then", "else", "elif", "while", "until", "do", "!"]);
+const WRAPPER_ARG_FLAGS = new Set(["-u", "-I", "-n", "-L", "-P", "-s", "-E", "-e", "-C", "-S"]);
+/** Head word of one pipeline segment, with the fetch word offset. */
+function segmentHead(seg) {
+    let i = 0;
+    let lastWrapper = "";
+    for (let iter = 0; iter < 16; iter++) {
+        while (i < seg.length && /[\s'"`([{\\]/.test(seg[i]))
+            i++;
+        if ((seg[i] === "$" && seg[i + 1] === "{") || (seg[i] === "$" && seg[i + 1] === "(")) {
+            i += 2;
+            continue;
+        }
+        if (i >= seg.length)
+            return null;
+        const m = seg.slice(i).match(/^[^\s|;&]+/);
+        if (!m)
+            return null;
+        const tok = m[0];
+        if (tok.startsWith("-") && lastWrapper) {
+            // A flag belonging to the wrapper (env -u NAME, xargs -n 1):
+            // skip the flag and, for flags that take a value, its argument.
+            i += tok.length;
+            if (WRAPPER_ARG_FLAGS.has(tok)) {
+                while (i < seg.length && /\s/.test(seg[i]))
+                    i++;
+                const arg = seg.slice(i).match(/^[^\s|;&]+/);
+                if (arg)
+                    i += arg[0].length;
+            }
+            continue;
+        }
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tok)) {
+            i += tok.length;
+            lastWrapper = "";
+            continue;
+        }
+        const base = (tok.split("/").pop() ?? tok).replace(/['"`)\]]+$/, "");
+        if (FETCH_WRAPPERS.has(base)) {
+            lastWrapper = base;
+            i += tok.length;
+            continue;
+        }
+        const slash = tok.lastIndexOf("/");
+        return { word: base, idx: i + (slash === -1 ? 0 : slash + 1) };
+    }
+    return null;
+}
+/** Quoted literal content ranges (simple scanner, escape aware). */
+function quotedContentRanges(text) {
+    const ranges = [];
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === "'" || c === '"' || c === "`") {
+            let j = i + 1;
+            let depth = 0;
+            while (j < text.length) {
+                if (text[j] === "\\") {
+                    j += 2;
+                    continue;
+                }
+                if (c === "`" && text[j] === "$" && text[j + 1] === "{") {
+                    depth++;
+                    j += 2;
+                    continue;
+                }
+                if (depth > 0 && text[j] === "}") {
+                    depth--;
+                    j++;
+                    continue;
+                }
+                if (text[j] === c && depth === 0)
+                    break;
+                j++;
+            }
+            ranges.push({ start: i + 1, end: j });
+            i = j + 1;
+            continue;
+        }
+        i++;
+    }
+    return ranges;
+}
+/**
+ * Indices of curl and wget words in command position in `text`.
+ * Command string literals are searched recursively (depth 2): a literal
+ * is a command string when code hands it to an interpreter, and the
+ * views this runs on have already blanked data literals in script
+ * files and echo arguments in shell text, so a quoted mention of the
+ * word in data does not produce a position.
+ */
+function fetchPositions(text, depth = 0) {
+    const out = new Set();
+    for (const stmt of splitShell(text, ["\n", ";", "&&", "||"])) {
+        const stmtText = text.slice(stmt.start, stmt.end);
+        for (const seg of splitShell(stmtText, ["|"])) {
+            const segText = stmtText.slice(seg.start, seg.end);
+            const head = segmentHead(segText);
+            if (head && (head.word === "curl" || head.word === "wget")) {
+                out.add(stmt.start + seg.start + head.idx);
+            }
+        }
+    }
+    if (depth < 2) {
+        for (const r of quotedContentRanges(text)) {
+            const inner = text.slice(r.start, r.end);
+            if (!/\b(?:curl|wget)\b/.test(inner))
+                continue;
+            for (const p of fetchPositions(inner, depth + 1))
+                out.add(r.start + p);
+        }
+        // Interpreter -c and -e tails are command strings too, even when
+        // the quotes are not visible in the text under analysis: an MCP
+        // config's command and args are joined with spaces, so a server
+        // configured as sh with args [-c, "curl ... | sh"] reaches the
+        // classifier as the unquoted text `sh -c curl ... | sh`, whose
+        // pipeline head is sh. The tail after the -c flag is the program.
+        for (const m of text.matchAll(/\b(?:sh|bash|zsh|dash)\s+-c\s+|\b(?:node|bun|python3?|perl|ruby)\s+-(?:e|c)\s+/g)) {
+            const start = m.index + m[0].length;
+            const tail = text.slice(start);
+            if (!/\b(?:curl|wget)\b/.test(tail))
+                continue;
+            for (const p of fetchPositions(tail, depth + 1))
+                out.add(start + p);
+        }
+    }
+    return out;
+}
+/** True when a CURL-PIPE-SH match in `codeJoined` starts a real fetch. */
+function curlPipeIsCommandFetch(codeJoined, positions) {
+    if (positions.size === 0)
+        return false;
+    for (const m of codeJoined.matchAll(/\b(curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|node|python3?|perl|ruby)\b/g)) {
+        const at = m.index + m[0].indexOf(m[1]);
+        if (positions.has(at))
+            return true;
+    }
+    return false;
+}
 /**
  * Content ranges of echo and printf string arguments in shell text:
  * output data, blanked in the code view, unless the pipeline ends in a
@@ -442,10 +607,20 @@ function shellEchoDataRanges(text) {
     }
     return ranges;
 }
+const NETWORK_CALL_RES = [
+    /\bfetch\s*\(/g,
+    /\baxios(?:\s*\.\s*\w+)?\s*\(/g,
+    /\brequests\s*\.\s*\w+\s*\(/g,
+    /\bhttpx\s*\.\s*\w+\s*\(/g,
+    /\bhttps?\s*\.\s*(?:request|get)\s*\(/g,
+    /\burlopen\s*\(/g,
+    /\bsendBeacon\s*\(/g,
+    /\bWebSocket\s*\(/g,
+];
 function buildViews(text, lang) {
     if (lang === "shell") {
         const dataRanges = shellEchoDataRanges(text);
-        return { codeText: blankRanges(text, dataRanges), credText: text, dataRanges };
+        return { codeText: blankRanges(text, dataRanges), credText: text, dataRanges, urlText: text };
     }
     const literals = lang === "python" ? scanPyLiterals(text) : scanJsLiterals(text);
     const execSpans = callFirstArgSpans(text, EXEC_CALLS, literals);
@@ -474,7 +649,24 @@ function buildViews(text, lang) {
         // "code" literals keep their contents in both views: the text is a
         // program handed to an interpreter, and behavior rules should see it.
     }
-    return { codeText: blankRanges(text, codeBlank), credText: blankRanges(text, credBlank), dataRanges };
+    const codeText = blankRanges(text, codeBlank);
+    // URL view (P-064): restore literal contents handed to network calls.
+    const netSpans = [];
+    for (const re of NETWORK_CALL_RES) {
+        let m;
+        while ((m = re.exec(text)) !== null)
+            netSpans.push(callSpan(text, m.index + m[0].length - 1));
+    }
+    const urlChars = codeText.split("");
+    for (const lit of literals) {
+        if (!netSpans.some((s) => lit.contentStart >= s.start && lit.contentEnd <= s.end))
+            continue;
+        for (const r of contentRanges(lit)) {
+            for (let i = r.start; i < r.end && i < urlChars.length; i++)
+                urlChars[i] = text[i];
+        }
+    }
+    return { codeText, credText: blankRanges(text, credBlank), dataRanges, urlText: urlChars.join("") };
 }
 const CRED_FILE_PATTERNS = [
     /~\/\.ssh(\/|\s|$|["'])/, /\$HOME\/\.ssh(\/|\s|$|["'])/, /(^|[\s"'(=])\.ssh\//,
@@ -650,6 +842,164 @@ function findAtoms(text, dataRanges) {
  * Round 2 showed it driving false exfil verdicts on langfuse, PostHog,
  * and cas release automation (P-018).
  */
+/** Consume a balanced bracket span starting at the opener index. */
+function consumeBalanced(text, openIdx) {
+    const open = text[openIdx];
+    const close = open === "(" ? ")" : open === "{" ? "}" : open === "[" ? "]" : "";
+    if (!close)
+        return openIdx + 1;
+    let depth = 0;
+    let quote = "";
+    for (let j = openIdx; j < text.length; j++) {
+        const c = text[j];
+        if (quote) {
+            if (c === "\\") {
+                j++;
+                continue;
+            }
+            if (c === quote)
+                quote = "";
+            continue;
+        }
+        if (c === "'" || c === '"' || c === "`") {
+            quote = c;
+            continue;
+        }
+        if (c === open)
+            depth++;
+        else if (c === close) {
+            depth--;
+            if (depth === 0)
+                return j + 1;
+        }
+    }
+    return text.length;
+}
+/** Consume one string literal starting at (or just before) index i. */
+function consumeLiteral(text, i) {
+    let j = i;
+    while (j < text.length && /[furbFURB]/.test(text[j]))
+        j++;
+    const q = text[j];
+    if (q !== "'" && q !== '"' && q !== "`")
+        return i;
+    const triple = text.startsWith(q + q + q, j);
+    const qLen = triple ? 3 : 1;
+    let k = j + qLen;
+    let depth = 0;
+    while (k < text.length) {
+        if (text[k] === "\\") {
+            k += 2;
+            continue;
+        }
+        if ((q === "`" && text[k] === "$" && text[k + 1] === "{") || (q !== "`" && depth >= 0 && text[k] === "{" && /[fF]/.test(text.slice(Math.max(0, j - 1), j + 1)))) {
+            depth++;
+            k += q === "`" ? 2 : 1;
+            continue;
+        }
+        if (depth > 0 && text[k] === "}") {
+            depth--;
+            k++;
+            continue;
+        }
+        if (depth > 0 && (text[k] === "'" || text[k] === '"' || text[k] === "`")) {
+            k = consumeLiteral(text, k);
+            continue;
+        }
+        if (triple ? text.startsWith(q + q + q, k) : text[k] === q)
+            return k + qLen;
+        if (!triple && text[k] === "\n" && q !== "`")
+            return k;
+        k++;
+    }
+    return k;
+}
+/**
+ * Consume a value expression starting at `start`: a string literal
+ * (including template and f-string forms), a bare variable or dotted
+ * chain, a call, a bracketed value, or a +-concatenation of those.
+ * Returns the end index. Capped so a malformed value cannot run away.
+ */
+function consumeValueExpr(text, start) {
+    let i = start;
+    const cap = Math.min(text.length, start + 400);
+    for (let part = 0; part < 6; part++) {
+        while (i < cap && /\s/.test(text[i]))
+            i++;
+        if (i >= cap)
+            break;
+        const c = text[i];
+        if (c === "'" || c === '"' || c === "`" || (/[furbFURB]/.test(c) && /["'`]/.test(text[i + 1] ?? ""))) {
+            i = consumeLiteral(text, i);
+        }
+        else if (c === "(" || c === "{" || c === "[") {
+            i = consumeBalanced(text, i);
+        }
+        else if (/[A-Za-z0-9_$]/.test(c)) {
+            while (i < cap && /[A-Za-z0-9_$.]/.test(text[i]))
+                i++;
+            if (text[i] === "[")
+                i = consumeBalanced(text, i);
+            while (i < cap && /\s/.test(text[i]))
+                i++;
+            if (text[i] === "(")
+                i = consumeBalanced(text, i);
+            // A template literal directly after a chain (tag or suffix).
+            while (i < cap && /\s/.test(text[i]))
+                i++;
+            if (text[i] === "`")
+                i = consumeLiteral(text, i);
+        }
+        else {
+            break;
+        }
+        let j = i;
+        while (j < cap && /\s/.test(text[j]))
+            j++;
+        if (text[j] === "+") {
+            i = j + 1;
+            continue;
+        }
+        break;
+    }
+    return i;
+}
+const AUTH_HEADER_KEY = /^(authorization|proxy-authorization|api[-_]?key|apikey|x-api-key|x-auth[-_]?token|auth[-_]?token|x-access[-_]?token|access[-_]?token|x-session[-_]?token|session[-_]?token)$/i;
+function isAuthHeaderKey(key) {
+    const k = key.toLowerCase();
+    return AUTH_HEADER_KEY.test(k) || k.endsWith("-api-key") || k.endsWith("-apikey") || k.endsWith("-auth-token") || k.endsWith("-access-token");
+}
+/**
+ * Spans where a credential is used as authentication for the destination
+ * it belongs to: the userinfo of a URL (x-access-token pushes and clones
+ * to the repo's own host), the value of an Authorization header, and the
+ * value of a CLI auth flag (--token, --auth, --api-key). A token in one
+ * of these positions authenticates the send; it is not the payload, and
+ * Round 2 showed it driving false exfil verdicts on langfuse, PostHog,
+ * and cas release automation (P-018).
+ *
+ * Wave B (P-061): the v0.1.4 scrubbing recognized only the literal
+ * Authorization spelling in shell text. Real estates also authenticate
+ * with custom header names (statsig-api-key, x-api-key, any name at
+ * all) and with headers dictionaries inside one hop Python and
+ * TypeScript files, and those shapes still fired ENV-EXFIL on
+ * anthropics/claude-code, hesreallyhim/awesome-claude-code, and
+ * Aider-AI/aider. Authentication positions now also include:
+ *   - any curl -H or --header argument, whatever the header name: the
+ *     whole header value is an authentication position;
+ *   - a dict or object entry whose key is an authentication header
+ *     name (Authorization, *-api-key, *-auth-token, and friends),
+ *     whatever the surrounding code;
+ *   - any header-shaped entry (a header name key) inside a headers
+ *     construction: a dict assigned to a variable named like headers,
+ *     a headers= keyword argument, or a headers property of a fetch
+ *     or request options object;
+ *   - header setter calls (set, append, setHeader) and Python
+ *     requests-style auth= tuples.
+ * A credential that reaches a payload position (body, query, URL path,
+ * printed output next to a send) still fires: only the value
+ * expressions of these header positions are scrubbed.
+ */
 function authRanges(text) {
     const ranges = [];
     for (const m of text.matchAll(/https?:\/\/[^\s"'`]+/g)) {
@@ -672,10 +1022,67 @@ function authRanges(text) {
     for (const m of text.matchAll(/--(?:token|auth|api[-_]?key|password|secret)(?:\s*=\s*|\s+)["']?/gi)) {
         ranges.push(valueAfter(m.index + m[0].length));
     }
+    // curl -H and --header arguments: any header name is authentication.
+    for (const m of text.matchAll(/(?:^|[\s;|&])(?:-H|--header)(?:\s+|=)/g)) {
+        let i = m.index + m[0].length;
+        while (i < text.length && /\s/.test(text[i]))
+            i++;
+        if (i >= text.length)
+            continue;
+        if (text[i] === "'" || text[i] === '"' || text[i] === "`") {
+            const end = consumeLiteral(text, i);
+            ranges.push({ start: i + 1, end: Math.max(i + 1, end - 1) });
+        }
+        else {
+            ranges.push(valueAfter(i));
+        }
+    }
+    // Header setter calls and requests-style auth= tuples.
+    for (const m of text.matchAll(/\b(?:set|append|setHeader|addHeader|header)\s*\(\s*["'][A-Za-z0-9-]+["']\s*,\s*/g)) {
+        const end = consumeValueExpr(text, m.index + m[0].length);
+        if (end > m.index + m[0].length)
+            ranges.push({ start: m.index + m[0].length, end });
+    }
+    for (const m of text.matchAll(/\bauth\s*=\s*\(/g)) {
+        ranges.push({ start: m.index, end: consumeBalanced(text, m.index + m[0].length - 1) });
+    }
+    // Dict and object entries: authentication header keys anywhere, and
+    // any header-shaped key inside a headers construction.
+    const entryRe = /(?:^|[{,;\n])\s*(?:(["'])([A-Za-z][A-Za-z0-9_-]*)\1|([A-Za-z][A-Za-z0-9_-]*))\s*:\s*/g;
+    let em;
+    while ((em = entryRe.exec(text)) !== null) {
+        const key = em[2] ?? em[3] ?? "";
+        if (!key)
+            continue;
+        const valueStart = em.index + em[0].length;
+        let auth = isAuthHeaderKey(key);
+        if (!auth) {
+            // Headers construction context: the nearest opening brace before
+            // this entry is introduced by a headers assignment, property, or
+            // keyword argument.
+            const brace = text.lastIndexOf("{", em.index);
+            if (brace !== -1 && em.index - brace < 2000) {
+                const before = text.slice(Math.max(0, brace - 90), brace);
+                auth = /(?:^|[\s{,;])(?:[A-Za-z_$][A-Za-z0-9_$]*headers[A-Za-z0-9_$]*|headers)\s*[:=]\s*$/i.test(before)
+                    || /[A-Za-z_$][A-Za-z0-9_$]*[Hh]eaders[A-Za-z0-9_$]*\s*=\s*$/.test(before);
+            }
+        }
+        if (!auth)
+            continue;
+        const end = consumeValueExpr(text, valueStart);
+        if (end > valueStart)
+            ranges.push({ start: valueStart, end });
+    }
     return ranges;
 }
-/** Variables assigned (transitively) from a credential value expression. */
-function taintedVars(text, atoms, dataRanges) {
+/**
+ * Variables assigned (transitively) from a credential value expression.
+ * References inside authentication positions do not propagate taint
+ * (P-061): a headers dict whose only credential use is its
+ * Authorization value is an authentication container, not a tainted
+ * payload, and passing it to fetch does not become exfil.
+ */
+function taintedVars(text, atoms, dataRanges, auth = []) {
     const tainted = new Set();
     const assignRe = /(?:^|[;\n,])\s*(?:export\s+|const\s+|let\s+|var\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*=(?![=<>])\s*/g;
     const assigns = [];
@@ -698,7 +1105,7 @@ function taintedVars(text, atoms, dataRanges) {
             }
             const rhs = text.slice(a.rhsStart, a.rhsEnd);
             for (const v of tainted) {
-                if (refOutsideData(rhs, v, a.rhsStart, dataRanges)) {
+                if (refOutsideRanges(rhs, v, a.rhsStart, [...dataRanges, ...auth])) {
                     tainted.add(a.name);
                     break;
                 }
@@ -736,14 +1143,14 @@ function callSpan(text, openIdx) {
     }
     return { start: openIdx, end: text.length };
 }
-function spanHasTaint(text, span, atoms, tainted, dataRanges) {
+function spanHasTaint(text, span, atoms, tainted, dataRanges, auth = []) {
     if (atoms.some((a) => !a.inData && a.start >= span.start && a.start < span.end))
         return true;
     if (tainted.size === 0)
         return false;
     const seg = text.slice(span.start, span.end);
     for (const v of tainted) {
-        if (refOutsideData(seg, v, span.start, dataRanges))
+        if (refOutsideRanges(seg, v, span.start, [...dataRanges, ...auth]))
             return true;
     }
     return false;
@@ -774,8 +1181,8 @@ function analyzeExfil(text, views, lang) {
     const dataRanges = views.dataRanges;
     const auth = authRanges(text);
     const atoms = findAtoms(text, dataRanges).filter((a) => !inRanges(a.start, auth));
-    const tainted = taintedVars(text, atoms, dataRanges);
-    const has = (span) => spanHasTaint(text, span, atoms, tainted, dataRanges);
+    const tainted = taintedVars(text, atoms, dataRanges, auth);
+    const has = (span) => spanHasTaint(text, span, atoms, tainted, dataRanges, auth);
     const callRes = [
         /\bfetch\s*\(/g,
         /\baxios(?:\s*\.\s*(?:post|put|patch|get|request|delete))?\s*\(/g,
@@ -792,9 +1199,21 @@ function analyzeExfil(text, views, lang) {
                 return true;
         }
     }
+    // Fetch positions run on the code view with data blanked (indices
+    // align with `text`: every view transform preserves length). A curl
+    // word in argument position (P-062) opens no exfil path.
+    const positionText = blankRanges(views.codeText, dataRanges);
+    const positions = fetchPositions(positionText);
     const statements = splitShell(text, ["\n", ";", "&&", "||"]);
     for (const stmt of statements) {
-        if (!/\b(?:curl|wget)\b/.test(text.slice(stmt.start, stmt.end)))
+        let isFetchStmt = false;
+        for (const p of positions) {
+            if (p >= stmt.start && p < stmt.end) {
+                isFetchStmt = true;
+                break;
+            }
+        }
+        if (!isFetchStmt)
             continue;
         if (has(stmt))
             return true;
@@ -825,8 +1244,8 @@ function analyzeExfil(text, views, lang) {
     // a code position (an f-string or template interpolation hole is code;
     // prose inside a plain string is not). In shell text, echo and printf
     // arguments ARE the printed values, so references inside them count.
-    const gateText = blankRanges(views.codeText, dataRanges);
-    const hasSendConstruct = /\b(?:fetch|axios|requests\s*\.|urlopen|https?\s*\.\s*(?:request|get)|curl|wget|nc|netcat)\b/.test(gateText);
+    const gateText = positionText;
+    const hasSendConstruct = /\b(?:fetch|axios|requests\s*\.|urlopen|https?\s*\.\s*(?:request|get)|nc|netcat)\b/.test(gateText) || positions.size > 0;
     if (hasSendConstruct) {
         for (const m of text.matchAll(/(?:^|[;\n|&]\s*)(?:echo|printf)\s+([^\n;|]*)/g)) {
             const span = { start: m.index, end: m.index + m[0].length };
@@ -835,7 +1254,7 @@ function analyzeExfil(text, views, lang) {
             const argText = m[1] ?? "";
             const argStart = m.index + m[0].length - argText.length;
             for (const v of tainted) {
-                if (lang === "shell" || refOutsideData(argText, v, argStart, dataRanges))
+                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
                     return true;
             }
         }
@@ -846,7 +1265,7 @@ function analyzeExfil(text, views, lang) {
             const argText = m[1] ?? "";
             const argStart = m.index + m[0].indexOf(argText);
             for (const v of tainted) {
-                if (lang === "shell" || refOutsideData(argText, v, argStart, dataRanges))
+                if (lang === "shell" || refOutsideRanges(argText, v, argStart, [...dataRanges, ...auth]))
                     return true;
             }
         }
@@ -866,6 +1285,39 @@ const SAFE_PATTERNS = [
     /^patch-package$/i,
     /^simple-git-hooks$/i,
 ];
+/**
+ * DOWNLOAD-EXEC (P-064). Inline code execution (node -e, python -c,
+ * deno eval, bun -e) is download-exec only when the evaluated content
+ * itself carries a download or remote reference: a URL, a fetch or
+ * request call, a network module. Constant inline code (a node -e
+ * version comparison in modelcontextprotocol/servers, uv run python -c
+ * file parsers in wshobson/agents) downloads nothing and is not
+ * download-exec; labeling it RISKY was pure noise.
+ */
+function detectDownloadExec(codeText) {
+    const re = /\b(?:node|bun)\s+-(?:e|-eval)\b|\bdeno\s+eval\b|\bpython3?\s+-c\b/g;
+    const netRef = /https?:\/\/|\bfetch\s*\(|\bcurl\b|\bwget\b|\brequests\b|urllib|urlopen|\baxios\b|https?\s*\.\s*(?:get|request)|XMLHttpRequest|\bnet\s*\.\s*connect|\bsocket\b/i;
+    let m;
+    while ((m = re.exec(codeText)) !== null) {
+        let i = m.index + m[0].length;
+        while (i < codeText.length && /\s/.test(codeText[i]))
+            i++;
+        let content = "";
+        if (codeText[i] === "'" || codeText[i] === '"' || codeText[i] === "`") {
+            const end = consumeLiteral(codeText, i);
+            content = codeText.slice(i, end);
+        }
+        else {
+            let j = i;
+            while (j < codeText.length && codeText[j] !== "\n" && codeText[j] !== ";" && codeText[j] !== "|")
+                j++;
+            content = codeText.slice(i, j);
+        }
+        if (netRef.test(content))
+            return true;
+    }
+    return false;
+}
 export function classifyCommand(command, lang = "shell") {
     // Strip comments first (a docs URL in a comment is not a fetch), then
     // normalize shell line continuations and stray carriage returns, so a
@@ -884,12 +1336,34 @@ export function classifyCommand(command, lang = "shell") {
     const views = buildViews(cmd, lang);
     const joined = cmd.replace(/\n/g, " ");
     const codeJoined = views.codeText.replace(/\n/g, " ");
+    const urlJoined = views.urlText.replace(/\n/g, " ");
+    // Fetch positions are computed on the newline preserving code view:
+    // newlines are statement separators, and flattening them first would
+    // glue an install line and the curl command after it into one
+    // statement whose head is the package manager. Indices align with
+    // the joined views because joining only swaps newline for space.
+    const positions = fetchPositions(views.codeText);
     const fired = [];
     for (const rule of RISKY_RULES) {
-        const hay = rule.id === "REMOTE-URL" ? joined : codeJoined;
+        if (rule.id === "NET-FETCH") {
+            // P-062: the pattern covers the non-curl fetch forms; curl and
+            // wget count only in command position.
+            if (rule.pattern.test(codeJoined) || positions.size > 0)
+                fired.push({ id: rule.id, evidence: rule.evidence });
+            continue;
+        }
+        if (rule.id === "CURL-PIPE-SH") {
+            if (curlPipeIsCommandFetch(codeJoined, positions))
+                fired.push({ id: rule.id, evidence: rule.evidence });
+            continue;
+        }
+        const hay = rule.id === "REMOTE-URL" ? urlJoined : codeJoined;
         if (rule.pattern.test(hay))
             fired.push({ id: rule.id, evidence: rule.evidence });
     }
+    if (detectDownloadExec(views.codeText)) {
+        fired.push({ id: "DOWNLOAD-EXEC", evidence: "executes inline code that itself downloads or references remote content" });
+    }
     // Loopback downgrade (P-004): a fetch whose every URL is loopback is a
     // local health check shape, not a network exfil shape. Downgrade only
     // when no severe rule fired.
@@ -1136,6 +1610,48 @@ function escalateWithScriptChain(root, scripts, currentName, finding, baseAbs =
  * read, a download by itself) classify RISKY at most, and a RISKY-only
  * estate verdicts REVIEW, never COMPROMISED-PATTERN.
  */
+/**
+ * Vendor installer pipe calibration (P-063, Wave B). A CI workflow step
+ * whose ONLY severe evidence is a curl pipe to a named vendor's
+ * official installer over HTTPS (the uv installer at astral.sh, the
+ * opencode installer) is the same family as the esbuild and puppeteer
+ * download-own-binary installers the v0.1.2 calibration already holds
+ * at REVIEW: the pattern match is literal and the finding stays RISKY,
+ * but nothing about the step exfils, persists, or touches a credential.
+ * The narrowing is deliberately tight; ALL of these must hold:
+ *   - the finding is a GitHub workflow run step (CI context). The same
+ *     pipe on an auto-exec hook surface (package.json script, Claude
+ *     settings or plugin hook, folderOpen task) keeps the top verdict:
+ *     a hook runs on a developer machine at open or install time,
+ *     which is exactly the Shai-Hulud persistence shape;
+ *   - CURL-PIPE-SH is the only severe rule, and every rule present is
+ *     part of the pipe shape itself (CURL-PIPE-SH, NET-FETCH,
+ *     REMOTE-URL). Any credential rule, persistence rule, or second
+ *     severe signal disqualifies the finding;
+ *   - the piped URL is HTTPS and installer shaped: a path segment
+ *     named install, installer, or setup (optionally with a script
+ *     extension), or a host on the short known-installer list below.
+ * A curl pipe to an unversioned or non-vendor source (payload.sh on an
+ * arbitrary host) never qualifies.
+ */
+const KNOWN_INSTALLER_HOSTS = new Set(["sh.rustup.rs", "get.docker.com", "install.python-poetry.org", "astral.sh", "opencode.ai"]);
+function isVendorInstallerPipeOnly(f) {
+    if (f.source !== "github-workflow")
+        return false;
+    if (!f.rules.includes("CURL-PIPE-SH"))
+        return false;
+    const allowed = new Set(["CURL-PIPE-SH", "NET-FETCH", "REMOTE-URL"]);
+    if (!f.rules.every((r) => allowed.has(r)))
+        return false;
+    const m = f.command.match(/https:\/\/([^\s"'`/:?#]+)([^\s"'`]*)/i);
+    if (!m)
+        return false;
+    const host = m[1].toLowerCase();
+    const path = (m[2] ?? "").toLowerCase();
+    if (/(^|\/)(install|installer|setup)(\.(sh|bash|ps1|py))?($|[/?#])/.test(path))
+        return true;
+    return KNOWN_INSTALLER_HOSTS.has(host);
+}
 export function computeVerdict(findings) {
     let review = false;
     for (const f of findings) {
@@ -1144,7 +1660,10 @@ export function computeVerdict(findings) {
             const hasSevere = metas.some((x) => x.severe);
             const hasCredStore = f.rules.includes("CRED-ACCESS");
             const hasNet = metas.some((x) => x.remote);
-            if (hasSevere || (hasCredStore && hasNet))
+            // P-063: a lone vendor installer pipe in CI is strong pattern
+            // evidence but not, on its own, a compromise pattern.
+            const vendorPipeOnly = isVendorInstallerPipeOnly(f);
+            if ((hasSevere && !vendorPipeOnly) || (hasCredStore && hasNet))
                 return "COMPROMISED-PATTERN";
             review = true;
         }
@@ -1244,21 +1763,54 @@ function scanOnePackageJson(root, rel, findings, warnings) {
     }
 }
 /**
- * Nested package.json discovery (P-032). Install scripts in workspace
- * subpackages (packages/foo, apps/web) run on a root install, so a
- * root-only scan misses exactly the surface a worm would persist in.
- * The walk is bounded so a hostile or giant tree cannot explode the
- * report: directories are visited in sorted order to depth
- * PACKAGE_MAX_DEPTH (the package.json directory depth below the root),
- * node_modules, .git, and dot directories are never entered, symlinked
- * directories are never followed (a symlink loop cannot hang the scan),
- * and at most PACKAGE_MAX_NESTED nested files are inventoried, with the
- * cap reported as a warning when it is hit.
+ * Unified nested discovery (P-032, P-060, P-065). Every surface the
+ * tool inventories at the scan root is also inventoried when it
+ * appears inside a subdirectory: before v0.1.8 only nested package.json
+ * files (P-032) and plugin hooks files (P-060) were recursed, so a
+ * parent scan of a monorepo or workspace silently missed nested
+ * .claude/settings.json, .vscode/tasks.json, workflows, husky and
+ * githooks directories, lefthook and pre-commit configs, and MCP
+ * configs, and a tree holding only nested surfaces scanned CLEAN with
+ * the empty estate note attached (P-065).
+ *
+ * One bounded walk enumerates every project root (each directory at
+ * most NESTED_MAX_DEPTH levels below the scan root, the scan root
+ * itself included) plus the nested package.json and plugin hooks file
+ * lists. Per surface scanners then run once per project root with the
+ * root prefix carried into every finding file path, so findings carry
+ * their real relative paths. The walk is bounded so a hostile or
+ * giant tree cannot explode the report: directories are visited in
+ * sorted order, node_modules, .git, and dot directories are never
+ * entered, symlinked directories are never followed (a symlink loop
+ * cannot hang the scan), and each surface family inventories at most
+ * NESTED_MAX_FILES_PER_SURFACE nested files, with the cap reported as
+ * a warning when it is hit. When directories remain below the depth
+ * bound the walk says so in a warning naming the bound, and it probes
+ * the directories just below the bound (names only, no file reads) so
+ * surfaces sitting there are counted in the warning instead of being
+ * silently dropped.
  */
-export const PACKAGE_MAX_DEPTH = 4;
-export const PACKAGE_MAX_NESTED = 200;
-function discoverNestedPackageJson(root, warnings) {
-    const found = [];
+export const NESTED_MAX_DEPTH = 4;
+export const NESTED_MAX_FILES_PER_SURFACE = 200;
+export const PACKAGE_MAX_DEPTH = NESTED_MAX_DEPTH;
+export const PACKAGE_MAX_NESTED = NESTED_MAX_FILES_PER_SURFACE;
+export const PLUGIN_HOOKS_MAX_DEPTH = NESTED_MAX_DEPTH;
+export const PLUGIN_HOOKS_MAX_FILES = NESTED_MAX_FILES_PER_SURFACE;
+const SURFACE_FILE_INDICATORS = new Set([
+    "package.json", "lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml",
+    ".pre-commit-config.yaml", ".pre-commit-config.yml", ".mcp.json", "mcp.json",
+]);
+const SURFACE_DIR_INDICATORS = new Set([
+    ".claude", "claude", ".vscode", ".github", ".husky", ".githooks",
+    "hooks", ".cursor", ".windsurf", ".codex",
+]);
+function discoverSurfaces(root, warnings) {
+    const projectRoots = [];
+    const packageFiles = [];
+    const pluginSet = new Set();
+    let frontierDirs = 0;
+    let surfacesBelowBound = 0;
+    let probes = 0;
     const skipDirs = new Set(["node_modules", ".git"]);
     const stack = [{ abs: root, rel: "", depth: 0 }];
     while (stack.length > 0) {
@@ -1273,14 +1825,38 @@ function discoverNestedPackageJson(root, warnings) {
             continue;
         }
         entries.sort();
+        projectRoots.push(cur.rel);
         if (cur.depth >= 1 && entries.includes("package.json")) {
-            found.push(cur.rel === "" ? "package.json" : `${cur.rel}/package.json`);
+            packageFiles.push(`${cur.rel}/package.json`);
+        }
+        // Plugin hooks files sit in a hooks directory one level below the
+        // plugin root, so they are spotted from the plugin root listing
+        // (the hooks directory itself can sit at depth bound plus one).
+        if (entries.includes("hooks")) {
+            const hooksAbs = join(cur.abs, "hooks");
+            let lst = null;
+            try {
+                lst = lstatSync(hooksAbs);
+            }
+            catch {
+                lst = null;
+            }
+            if (lst && lst.isDirectory() && !lst.isSymbolicLink()) {
+                let hookEntries = [];
+                try {
+                    hookEntries = readdirSync(hooksAbs);
+                }
+                catch {
+                    hookEntries = [];
+                }
+                for (const name of ["hooks.json", "hooks-cursor.json"]) {
+                    if (hookEntries.includes(name))
+                        pluginSet.add(cur.rel === "" ? `hooks/${name}` : `${cur.rel}/hooks/${name}`);
+                }
+            }
         }
-        if (cur.depth >= PACKAGE_MAX_DEPTH)
-            continue;
-        // Push in reverse so the stack pops in sorted order.
-        for (let i = entries.length - 1; i >= 0; i--) {
-            const name = entries[i];
+        const children = [];
+        for (const name of entries) {
             if (skipDirs.has(name) || name.startsWith("."))
                 continue;
             const childAbs = join(cur.abs, name);
@@ -1293,36 +1869,101 @@ function discoverNestedPackageJson(root, warnings) {
             }
             if (lst.isSymbolicLink() || !lst.isDirectory())
                 continue;
-            stack.push({ abs: childAbs, rel: cur.rel === "" ? name : `${cur.rel}/${name}`, depth: cur.depth + 1 });
+            children.push({ abs: childAbs, rel: cur.rel === "" ? name : `${cur.rel}/${name}`, depth: cur.depth + 1 });
+        }
+        if (cur.depth >= NESTED_MAX_DEPTH) {
+            frontierDirs += children.length;
+            for (const child of children) {
+                if (probes >= 1000)
+                    break;
+                probes++;
+                let sub = [];
+                try {
+                    sub = readdirSync(child.abs);
+                }
+                catch {
+                    continue;
+                }
+                if (sub.some((n) => SURFACE_FILE_INDICATORS.has(n) || SURFACE_DIR_INDICATORS.has(n)))
+                    surfacesBelowBound++;
+            }
+            continue;
         }
+        // Push in reverse so the stack pops in sorted order.
+        for (let i = children.length - 1; i >= 0; i--)
+            stack.push(children[i]);
     }
-    found.sort();
-    if (found.length > PACKAGE_MAX_NESTED) {
-        warnings.push(`Nested package.json inventory capped at ${PACKAGE_MAX_NESTED} files (${found.length} found); the remaining nested package.json files were not inventoried and the scan is partial`);
-        return found.slice(0, PACKAGE_MAX_NESTED);
+    projectRoots.sort((a, b) => (a === b ? 0 : a === "" ? -1 : b === "" ? 1 : a < b ? -1 : 1));
+    packageFiles.sort();
+    return {
+        projectRoots,
+        packageFiles,
+        pluginHookFiles: Array.from(pluginSet).sort(),
+        frontierDirs,
+        surfacesBelowBound,
+        depthBoundHit: frontierDirs > 0,
+    };
+}
+const FAMILY_LABELS = {
+    settings: "Claude settings",
+    tasks: "VS Code tasks",
+    workflows: "workflow",
+    husky: "husky hook",
+    githooks: "githooks hook",
+    lefthook: "lefthook config",
+    "pre-commit": "pre-commit config",
+    mcp: "MCP config",
+    agent: "agent config",
+};
+/**
+ * Claim one surface file for inventory. Returns false when the file
+ * was already inventoried through another discovery path, or when the
+ * nested file cap for its family is already spent (the skip is
+ * counted, and scanHooks warns once per capped family).
+ */
+function claimFile(state, family, rel, isNested) {
+    if (state.inventoried.has(rel))
+        return false;
+    if (isNested) {
+        const found = (state.familyFound.get(family) ?? 0) + 1;
+        state.familyFound.set(family, found);
+        if (found > NESTED_MAX_FILES_PER_SURFACE) {
+            state.familyCapped.set(family, (state.familyCapped.get(family) ?? 0) + 1);
+            state.partial = true;
+            return false;
+        }
     }
-    return found;
+    state.inventoried.add(rel);
+    return true;
 }
-function scanPackageJson(root, findings, warnings) {
+function scanPackageJson(root, findings, warnings, state) {
     scanOnePackageJson(root, "package.json", findings, warnings);
-    for (const rel of discoverNestedPackageJson(root, warnings)) {
+    state.inventoried.add("package.json");
+    let nested = state.disc.packageFiles;
+    if (nested.length > PACKAGE_MAX_NESTED) {
+        warnings.push(`Nested package.json inventory capped at ${PACKAGE_MAX_NESTED} files (${nested.length} found); the remaining nested package.json files were not inventoried and the scan is partial`);
+        state.partial = true;
+        nested = nested.slice(0, PACKAGE_MAX_NESTED);
+    }
+    for (const rel of nested) {
+        state.inventoried.add(rel);
         scanOnePackageJson(root, rel, findings, warnings);
     }
 }
-function collectClaudeHooks(node, file, root, findings, prefix) {
+function collectClaudeHooks(node, file, root, findings, prefix, source = "claude-settings", baseAbs = root) {
     if (!node || typeof node !== "object")
         return;
     const obj = node;
     if (typeof obj.command === "string" && obj.command.trim()) {
-        findings.push(makeFinding(root, file, "claude-settings", prefix || "hook", obj.command, String(findings.length)));
+        findings.push(makeFinding(root, file, source, prefix || "hook", obj.command, String(findings.length), undefined, baseAbs));
         return;
     }
     for (const [key, value] of Object.entries(obj)) {
         if (Array.isArray(value)) {
-            value.forEach((item, i) => collectClaudeHooks(item, file, root, findings, prefix ? `${prefix}:${key}` : key));
+            value.forEach((item, i) => collectClaudeHooks(item, file, root, findings, prefix ? `${prefix}:${key}` : key, source, baseAbs));
         }
         else if (value && typeof value === "object") {
-            collectClaudeHooks(value, file, root, findings, prefix ? `${prefix}:${key}` : key);
+            collectClaudeHooks(value, file, root, findings, prefix ? `${prefix}:${key}` : key, source, baseAbs);
         }
     }
 }
@@ -1331,16 +1972,22 @@ function collectClaudeHooks(node, file, root, findings, prefix) {
  * the GNU stow layout used by real dotfiles repos (claude/settings.json,
  * no dot), and a settings file nested one level under a config dir
  * (config/.claude/settings.json). A settings path that exists as a
- * directory is reported as a warning, never silently skipped.
+ * directory is reported as a warning, never silently skipped. Since
+ * v0.1.8 (P-065) the candidates are computed per project root, so the
+ * same locations are inventoried in every subdirectory within the
+ * discovery bound; the inventoried set in ScanState keeps a file
+ * reachable by two paths (a parent root one level candidate and its
+ * own project root) counted exactly once.
  */
-function claudeSettingsCandidates(root) {
+function claudeSettingsCandidates(root, prefix) {
+    const base = prefix === "" ? "" : `${prefix}/`;
     const rels = [
-        ".claude/settings.json", ".claude/settings.local.json",
-        "claude/settings.json", "claude/settings.local.json",
+        `${base}.claude/settings.json`, `${base}.claude/settings.local.json`,
+        `${base}claude/settings.json`, `${base}claude/settings.local.json`,
     ];
     let entries = [];
     try {
-        entries = readdirSync(root);
+        entries = readdirSync(join(root, prefix));
     }
     catch {
         entries = [];
@@ -1350,7 +1997,7 @@ function claudeSettingsCandidates(root) {
             continue;
         let st;
         try {
-            st = statSync(join(root, name));
+            st = statSync(join(root, prefix, name));
         }
         catch {
             continue;
@@ -1358,167 +2005,142 @@ function claudeSettingsCandidates(root) {
         if (!st.isDirectory())
             continue;
         for (const f of ["settings.json", "settings.local.json"]) {
-            rels.push(`${name}/.claude/${f}`);
+            rels.push(`${base}${name}/.claude/${f}`);
         }
     }
     return Array.from(new Set(rels));
 }
-function scanClaude(root, findings, warnings) {
-    for (const rel of claudeSettingsCandidates(root)) {
-        const abs = join(root, rel);
-        if (!existsSync(abs))
-            continue;
-        let st;
-        try {
-            st = statSync(abs);
-        }
-        catch {
-            continue;
-        }
-        if (st.isDirectory()) {
-            warnings.push(`${rel} is a directory, not a settings file: any hooks inside it cannot be parsed as Claude settings`);
-            continue;
-        }
-        if (!st.isFile())
-            continue;
-        const data = readJson(root, rel, warnings);
-        if (!data || typeof data !== "object")
-            continue;
-        if (!("hooks" in data)) {
-            warnings.push(`No hooks key in ${rel}`);
-            continue;
-        }
-        const hooks = data.hooks;
-        if (!hooks || typeof hooks !== "object") {
-            warnings.push(`hooks key in ${rel} is not an object: hooks skipped`);
-            continue;
-        }
-        collectClaudeHooks(hooks, rel, root, findings, "");
-    }
-}
-function scanVscode(root, findings, warnings) {
-    const rel = ".vscode/tasks.json";
-    if (existsSync(join(root, rel))) {
-        const data = readJson(root, rel, warnings);
-        if (data && data.tasks !== undefined && !Array.isArray(data.tasks)) {
-            warnings.push(`tasks key in ${rel} is not an array: tasks skipped`);
-        }
-        const tasks = Array.isArray(data?.tasks) ? data.tasks : [];
-        tasks.forEach((rawTask, idx) => {
-            // Malformed entries (null, strings, numbers) are skipped, never fatal:
-            // one bad task must not hide every other surface in the repo.
-            if (!rawTask || typeof rawTask !== "object")
-                return;
-            const task = rawTask;
-            const runOptions = (task.runOptions ?? {});
-            const options = (task.options ?? {});
-            const optionsRunOptions = (options.runOptions ?? {});
-            // folderOpen lives in runOptions in the standard schema, but real
-            // world files also nest it under options or put runOn on the task.
-            const runOn = runOptions.runOn ?? optionsRunOptions.runOn ?? task.runOn;
-            const isFolderOpen = runOn === "folderOpen" || (Array.isArray(runOn) && runOn.includes("folderOpen"));
-            const command = typeof task.command === "string" ? task.command : "";
-            const args = Array.isArray(task.args) ? task.args.filter((a) => typeof a === "string").join(" ") : "";
-            const full = [command, args].filter(Boolean).join(" ").trim();
-            if (!full)
-                return;
-            const label = typeof task.label === "string" ? task.label : `task-${idx}`;
-            if (isFolderOpen) {
-                findings.push(makeFinding(root, rel, "vscode-tasks", `folderOpen:${label}`, full, String(idx)));
+function scanClaude(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        for (const rel of claudeSettingsCandidates(root, prefix)) {
+            const abs = join(root, rel);
+            if (!existsSync(abs))
+                continue;
+            let st;
+            try {
+                st = statSync(abs);
+            }
+            catch {
+                continue;
             }
-            else {
-                // Inventory non auto-run tasks at lower weight: still record them so
-                // explain can find them, classified by their command.
-                const f = makeFinding(root, rel, "vscode-tasks", label, full, String(idx));
-                findings.push(f);
+            if (st.isDirectory()) {
+                if (!state.inventoried.has(rel)) {
+                    state.inventoried.add(rel);
+                    warnings.push(`${rel} is a directory, not a settings file: any hooks inside it cannot be parsed as Claude settings`);
+                }
+                continue;
             }
-        });
+            if (!st.isFile())
+                continue;
+            if (!claimFile(state, "settings", rel, prefix !== ""))
+                continue;
+            const data = readJson(root, rel, warnings);
+            if (!data || typeof data !== "object")
+                continue;
+            if (!("hooks" in data)) {
+                warnings.push(`No hooks key in ${rel}`);
+                continue;
+            }
+            const hooks = data.hooks;
+            if (!hooks || typeof hooks !== "object") {
+                warnings.push(`hooks key in ${rel} is not an object: hooks skipped`);
+                continue;
+            }
+            collectClaudeHooks(hooks, rel, root, findings, "", "claude-settings", baseAbs);
+        }
     }
-    // MCP config inside .vscode
-    scanMcpFile(root, ".vscode/mcp.json", findings, warnings);
 }
-function scanDirFiles(root, dirRel, source, findings, warnings) {
-    const abs = join(root, dirRel);
-    if (!existsSync(abs))
-        return;
-    let entries = [];
-    try {
-        entries = readdirSync(abs);
-    }
-    catch {
-        warnings.push(`Unreadable directory skipped: ${dirRel} could not be listed; the scan is partial`);
-        return;
-    }
-    for (const name of entries.sort()) {
-        const fileAbs = join(abs, name);
-        let st;
-        try {
-            st = statSync(fileAbs);
-        }
-        catch {
-            continue;
-        }
-        if (!st.isFile())
-            continue;
-        if (name === "_" || name.startsWith("."))
-            continue;
-        const content = readTextWarn(fileAbs, `${dirRel}/${name}`, warnings);
-        if (content === null)
+/**
+ * Claude Code plugin hook files (P-060, BLOCKER). Plugins distribute
+ * hooks in a hooks/ directory at the plugin root: hooks/hooks.json at
+ * the repo root for a single plugin repo (obra/superpowers), or
+ * plugins/<name>/hooks/hooks.json inside a marketplace or monorepo
+ * (anthropics/claude-code carries 9 such files, wshobson/agents 2 among
+ * 92 plugin directories). Before v0.1.7 none of these files was scanned
+ * at any depth: a SessionStart curl pipe in hooks/hooks.json scanned
+ * CLEAN with total 0 while the identical payload in .claude/settings.json
+ * verdicts COMPROMISED-PATTERN. The file carries the same schema as the
+ * hooks key of .claude/settings.json (an events map of command hooks:
+ * SessionStart, PreToolUse, PostToolUse, Stop, UserPromptSubmit, and
+ * the rest of the Claude Code event set), so commands are classified
+ * exactly as settings hooks are. The sibling hooks/hooks-cursor.json
+ * variant shipped by the same plugins (superpowers) carries the same
+ * command object shape under Cursor event names, so it is inventoried
+ * the same way.
+ *
+ * Discovery is part of the unified bounded walk (P-065): the file
+ * list comes from discoverSurfaces, with the plugin root at most
+ * PLUGIN_HOOKS_MAX_DEPTH directories below the scan root (the hooks
+ * directory itself sits one level below its plugin root), and the
+ * same cap with a warning applies.
+ */
+function scanPluginHooks(root, findings, warnings, state) {
+    let files = state.disc.pluginHookFiles;
+    if (files.length > PLUGIN_HOOKS_MAX_FILES) {
+        warnings.push(`Plugin hooks inventory capped at ${PLUGIN_HOOKS_MAX_FILES} files (${files.length} found); the remaining plugin hook files were not inventoried and the scan is partial`);
+        state.partial = true;
+        files = files.slice(0, PLUGIN_HOOKS_MAX_FILES);
+    }
+    for (const rel of files) {
+        state.inventoried.add(rel);
+        const data = readJson(root, rel, warnings);
+        if (!data || typeof data !== "object" || Array.isArray(data))
             continue;
-        const firstMeaningful = content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith("set -")).join(" ");
-        const fileRel = `${dirRel}/${name}`;
-        // Entire file content is the command surface for husky style hooks.
-        // Classify generously deep into the file: a payload hidden behind
-        // padding must still be seen. Display code truncates separately.
-        findings.push(makeFinding(root, fileRel, source, name, content.trim().slice(0, 200000)));
-        void firstMeaningful;
+        // The events map lives under the hooks key when one is present;
+        // some plugin files put the events map at the top level.
+        const eventsNode = ("hooks" in data && data.hooks && typeof data.hooks === "object" && !Array.isArray(data.hooks))
+            ? data.hooks
+            : data;
+        // Referenced local files resolve against the plugin root (the
+        // directory holding the hooks folder), which is where
+        // ${CLAUDE_PLUGIN_ROOT} points at runtime.
+        const pluginRootAbs = dirname(dirname(join(root, rel)));
+        collectClaudeHooks(eventsNode, rel, root, findings, "", "claude-plugin", pluginRootAbs);
     }
 }
-function scanLefthook(root, findings, warnings) {
-    for (const rel of ["lefthook.yml", "lefthook.yaml", ".lefthook.yml"]) {
-        if (!existsSync(join(root, rel)))
-            continue;
-        const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-        const runRe = /^\s*run:\s*(.+)$/gm;
-        let m;
-        let i = 0;
-        while ((m = runRe.exec(raw)) !== null) {
-            findings.push(makeFinding(root, rel, "lefthook", "run", m[1].trim().replace(/^["']|["']$/g, ""), String(i++)));
-        }
+function scanVscode(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        const rel = `${base}.vscode/tasks.json`;
+        if (existsSync(join(root, rel)) && claimFile(state, "tasks", rel, prefix !== "")) {
+            const data = readJson(root, rel, warnings);
+            if (data && data.tasks !== undefined && !Array.isArray(data.tasks)) {
+                warnings.push(`tasks key in ${rel} is not an array: tasks skipped`);
+            }
+            const tasks = Array.isArray(data?.tasks) ? data.tasks : [];
+            tasks.forEach((rawTask, idx) => {
+                // Malformed entries (null, strings, numbers) are skipped, never fatal:
+                // one bad task must not hide every other surface in the repo.
+                if (!rawTask || typeof rawTask !== "object")
+                    return;
+                const task = rawTask;
+                const runOptions = (task.runOptions ?? {});
+                const options = (task.options ?? {});
+                const optionsRunOptions = (options.runOptions ?? {});
+                // folderOpen lives in runOptions in the standard schema, but real
+                // world files also nest it under options or put runOn on the task.
+                const runOn = runOptions.runOn ?? optionsRunOptions.runOn ?? task.runOn;
+                const isFolderOpen = runOn === "folderOpen" || (Array.isArray(runOn) && runOn.includes("folderOpen"));
+                const command = typeof task.command === "string" ? task.command : "";
+                const args = Array.isArray(task.args) ? task.args.filter((a) => typeof a === "string").join(" ") : "";
+                const full = [command, args].filter(Boolean).join(" ").trim();
+                if (!full)
+                    return;
+                const label = typeof task.label === "string" ? task.label : `task-${idx}`;
+                findings.push(makeFinding(root, rel, "vscode-tasks", isFolderOpen ? `folderOpen:${label}` : label, full, String(idx), undefined, baseAbs));
+            });
+        }
+        // MCP config inside .vscode
+        scanMcpFile(root, `${base}.vscode/mcp.json`, findings, warnings, state, baseAbs, prefix !== "");
     }
 }
-function scanPreCommit(root, findings, warnings) {
-    const rel = ".pre-commit-config.yaml";
-    if (!existsSync(join(root, rel)))
-        return;
-    const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-    const entryRe = /^\s*entry:\s*(.+)$/gm;
-    let m;
-    let i = 0;
-    while ((m = entryRe.exec(raw)) !== null) {
-        findings.push(makeFinding(root, rel, "pre-commit", "entry", m[1].trim().replace(/^["']|["']$/g, ""), String(i++)));
-    }
-    const repoRe = /^\s*-\s*repo:\s*(https?:\/\/\S+)$/gm;
-    while ((m = repoRe.exec(raw)) !== null) {
-        // A remote hook repo is the standard pre-commit pattern, not a finding
-        // of compromise: the URL alone is inventoried as UNKNOWN so a human can
-        // review the pinned rev. Classifying the bare URL with the command
-        // rules would verdict every normal pre-commit config COMPROMISED.
-        findings.push({
-            id: `${rel}:remote-repo:${i++}`,
-            file: rel,
-            source: "pre-commit",
-            hook: "remote-repo",
-            command: m[1].trim(),
-            classification: "UNKNOWN",
-            rules: [],
-            evidence: "remote pre-commit hook repo (standard pattern): its hooks run locally at commit time; hookcheck cannot verify remote contents, review the pinned rev",
-        });
-    }
-}
-function scanAgentDirs(root, findings, warnings) {
-    for (const [dir, source] of [[".cursor", "cursor"], [".codex", "codex"]]) {
-        const abs = join(root, dir);
+function scanDirFiles(root, dirName, source, family, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const dirRel = prefix === "" ? dirName : `${prefix}/${dirName}`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        const abs = join(root, dirRel);
         if (!existsSync(abs))
             continue;
         let entries = [];
@@ -1526,6 +2148,7 @@ function scanAgentDirs(root, findings, warnings) {
             entries = readdirSync(abs);
         }
         catch {
+            warnings.push(`Unreadable directory skipped: ${dirRel} could not be listed; the scan is partial`);
             continue;
         }
         for (const name of entries.sort()) {
@@ -1539,43 +2162,144 @@ function scanAgentDirs(root, findings, warnings) {
             }
             if (!st.isFile())
                 continue;
-            const rel = `${dir}/${name}`;
-            // mcp.json is an MCP config surface, inventoried exactly once by
-            // the central scanMcpFile pass in scanHooks (P-035). Running it
-            // through the generic command walk here as well counted every
-            // .cursor/mcp.json server twice.
-            if (name === "mcp.json")
+            if (name === "_" || name.startsWith("."))
+                continue;
+            const fileRel = `${dirRel}/${name}`;
+            if (!claimFile(state, family, fileRel, prefix !== ""))
+                continue;
+            const content = readTextWarn(fileAbs, fileRel, warnings);
+            if (content === null)
+                continue;
+            // Entire file content is the command surface for husky style hooks.
+            // Classify generously deep into the file: a payload hidden behind
+            // padding must still be seen. Display code truncates separately.
+            findings.push(makeFinding(root, fileRel, source, name, content.trim().slice(0, 200000), undefined, undefined, baseAbs));
+        }
+    }
+}
+function scanLefthook(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        for (const name of ["lefthook.yml", "lefthook.yaml", ".lefthook.yml"]) {
+            const rel = `${base}${name}`;
+            if (!existsSync(join(root, rel)))
+                continue;
+            if (!claimFile(state, "lefthook", rel, prefix !== ""))
+                continue;
+            const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+            const runRe = /^\s*run:\s*(.+)$/gm;
+            let m;
+            let i = 0;
+            while ((m = runRe.exec(raw)) !== null) {
+                findings.push(makeFinding(root, rel, "lefthook", "run", m[1].trim().replace(/^["']|["']$/g, ""), String(i++), undefined, baseAbs));
+            }
+        }
+    }
+}
+function scanPreCommit(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        const rel = `${base}.pre-commit-config.yaml`;
+        if (!existsSync(join(root, rel)))
+            continue;
+        if (!claimFile(state, "pre-commit", rel, prefix !== ""))
+            continue;
+        const raw = (readTextWarn(join(root, rel), rel, warnings) ?? "").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+        const entryRe = /^\s*entry:\s*(.+)$/gm;
+        let m;
+        let i = 0;
+        while ((m = entryRe.exec(raw)) !== null) {
+            findings.push(makeFinding(root, rel, "pre-commit", "entry", m[1].trim().replace(/^["']|["']$/g, ""), String(i++), undefined, baseAbs));
+        }
+        const repoRe = /^\s*-\s*repo:\s*(https?:\/\/\S+)$/gm;
+        while ((m = repoRe.exec(raw)) !== null) {
+            // A remote hook repo is the standard pre-commit pattern, not a finding
+            // of compromise: the URL alone is inventoried as UNKNOWN so a human can
+            // review the pinned rev. Classifying the bare URL with the command
+            // rules would verdict every normal pre-commit config COMPROMISED.
+            findings.push({
+                id: `${rel}:remote-repo:${i++}`,
+                file: rel,
+                source: "pre-commit",
+                hook: "remote-repo",
+                command: m[1].trim(),
+                classification: "UNKNOWN",
+                rules: [],
+                evidence: "remote pre-commit hook repo (standard pattern): its hooks run locally at commit time; hookcheck cannot verify remote contents, review the pinned rev",
+            });
+        }
+    }
+}
+function scanAgentDirs(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        for (const [dir, source] of [[".cursor", "cursor"], [".codex", "codex"]]) {
+            const abs = join(root, base, dir);
+            if (!existsSync(abs))
+                continue;
+            let entries = [];
+            try {
+                entries = readdirSync(abs);
+            }
+            catch {
                 continue;
-            if (name.endsWith(".json")) {
-                const data = readJson(root, rel, warnings);
-                if (data)
-                    collectGenericCommands(data, rel, root, findings, source);
             }
-            else {
-                const content = readTextWarn(fileAbs, rel, warnings);
-                if (content && content.trim()) {
-                    findings.push(makeFinding(root, rel, source, name, content.trim().slice(0, 200000)));
+            for (const name of entries.sort()) {
+                const fileAbs = join(abs, name);
+                let st;
+                try {
+                    st = statSync(fileAbs);
+                }
+                catch {
+                    continue;
+                }
+                if (!st.isFile())
+                    continue;
+                const rel = `${base}${dir}/${name}`;
+                // mcp.json is an MCP config surface, inventoried exactly once by
+                // the central scanMcpFile pass in scanHooks (P-035). Running it
+                // through the generic command walk here as well counted every
+                // .cursor/mcp.json server twice.
+                if (name === "mcp.json")
+                    continue;
+                if (!claimFile(state, "agent", rel, prefix !== ""))
+                    continue;
+                if (name.endsWith(".json")) {
+                    const data = readJson(root, rel, warnings);
+                    if (data)
+                        collectGenericCommands(data, rel, root, findings, source, "", baseAbs);
+                }
+                else {
+                    const content = readTextWarn(fileAbs, rel, warnings);
+                    if (content && content.trim()) {
+                        findings.push(makeFinding(root, rel, source, name, content.trim().slice(0, 200000), undefined, undefined, baseAbs));
+                    }
                 }
             }
         }
     }
 }
-function collectGenericCommands(node, file, root, findings, source, prefix = "") {
+function collectGenericCommands(node, file, root, findings, source, prefix = "", baseAbs = root) {
     if (!node || typeof node !== "object")
         return;
     const obj = node;
     if (typeof obj.command === "string" && obj.command.trim()) {
         const args = Array.isArray(obj.args) ? obj.args.filter((a) => typeof a === "string").join(" ") : "";
-        findings.push(makeFinding(root, file, source, prefix || "command", [obj.command, args].filter(Boolean).join(" "), String(findings.length)));
+        findings.push(makeFinding(root, file, source, prefix || "command", [obj.command, args].filter(Boolean).join(" "), String(findings.length), undefined, baseAbs));
     }
     for (const [key, value] of Object.entries(obj)) {
         if (value && typeof value === "object")
-            collectGenericCommands(value, file, root, findings, source, prefix ? `${prefix}:${key}` : key);
+            collectGenericCommands(value, file, root, findings, source, prefix ? `${prefix}:${key}` : key, baseAbs);
     }
 }
-function scanMcpFile(root, rel, findings, warnings) {
+function scanMcpFile(root, rel, findings, warnings, state, baseAbs, isNested) {
     if (!existsSync(join(root, rel)))
         return;
+    if (!claimFile(state, "mcp", rel, isNested))
+        return;
     const data = readJson(root, rel, warnings);
     if (!data)
         return;
@@ -1590,9 +2314,9 @@ function scanMcpFile(root, rel, findings, warnings) {
         const args = Array.isArray(c.args) ? c.args.filter((a) => typeof a === "string").join(" ") : "";
         const full = [command, args].filter(Boolean).join(" ").trim();
         if (full)
-            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}`, full));
+            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}`, full, undefined, undefined, baseAbs));
         if (typeof c.url === "string" && c.url) {
-            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}:url`, c.url));
+            findings.push(makeFinding(root, rel, "mcp-config", `mcp:${name}:url`, c.url, undefined, undefined, baseAbs));
         }
     }
 }
@@ -1620,26 +2344,37 @@ function scanMcpFile(root, rel, findings, warnings) {
  * resolved is still inventoried, as the literal alias text at UNKNOWN,
  * so no executable step ever yields zero findings.
  */
-function scanWorkflows(root, findings, warnings) {
-    const dir = ".github/workflows";
-    const abs = join(root, dir);
-    if (!existsSync(abs))
-        return;
-    let entries = [];
-    try {
-        entries = readdirSync(abs);
-    }
-    catch {
-        warnings.push(`Unreadable directory skipped: ${dir} could not be listed; the scan is partial`);
-        return;
-    }
-    for (const name of entries.sort()) {
-        if (!/\.(yml|yaml)$/.test(name))
+function scanWorkflows(root, findings, warnings, state) {
+    for (const prefix of state.disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        const dir = `${base}.github/workflows`;
+        const abs = join(root, dir);
+        if (!existsSync(abs))
+            continue;
+        let entries = [];
+        try {
+            entries = readdirSync(abs);
+        }
+        catch {
+            warnings.push(`Unreadable directory skipped: ${dir} could not be listed; the scan is partial`);
             continue;
-        const rel = `${dir}/${name}`;
+        }
+        for (const name of entries.sort()) {
+            if (!/\.(yml|yaml)$/.test(name))
+                continue;
+            const rel = `${dir}/${name}`;
+            if (!claimFile(state, "workflows", rel, prefix !== ""))
+                continue;
+            scanOneWorkflow(root, rel, baseAbs, findings, warnings);
+        }
+    }
+}
+function scanOneWorkflow(root, rel, baseAbs, findings, warnings) {
+    {
         const rawFile = readTextWarn(join(root, rel), rel, warnings);
         if (rawFile === null)
-            continue;
+            return;
         const raw = rawFile.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
         const lines = raw.split("\n");
         const indentOf = (l) => l.length - l.trimStart().length;
@@ -1731,14 +2466,14 @@ function scanWorkflows(root, findings, warnings) {
             if (aliasStep) {
                 const name = aliasStep[1];
                 const resolved = scalarAnchors.has(name) || mapAnchors.has(name) ? resolveAlias(`*${name}`) : `*${name}`;
-                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo));
+                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo, baseAbs));
                 continue;
             }
             const mergeKey = line.match(/^\s*<<:\s*\*([A-Za-z0-9_-]+)\s*(#.*)?$/);
             if (mergeKey) {
                 const name = mergeKey[1];
                 const resolved = scalarAnchors.has(name) || mapAnchors.has(name) ? resolveAlias(`*${name}`) : `*${name}`;
-                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo));
+                findings.push(makeFinding(root, rel, "github-workflow", "run", resolved, String(i++), lineNo, baseAbs));
                 continue;
             }
             const m = line.match(/^(\s*)-?\s*run:\s*(.*)$/);
@@ -1761,19 +2496,19 @@ function scanWorkflows(root, findings, warnings) {
             if (blockHeader) {
                 const { body, end } = collectBlock(idx, runIndent);
                 if (body) {
-                    findings.push(makeFinding(root, rel, "github-workflow", "run", body, String(i++), lineNoRun));
+                    findings.push(makeFinding(root, rel, "github-workflow", "run", body, String(i++), lineNoRun, baseAbs));
                 }
                 idx = end - 1;
                 continue;
             }
             if (rest === "")
                 continue;
-            findings.push(makeFinding(root, rel, "github-workflow", "run", rest, String(i++), lineNoRun));
+            findings.push(makeFinding(root, rel, "github-workflow", "run", rest, String(i++), lineNoRun, baseAbs));
         }
     }
 }
-function scanGitHooks(root, findings, warnings) {
-    scanDirFiles(root, ".githooks", "githooks", findings, warnings);
+function scanGitHooks(root, findings, warnings, state) {
+    scanDirFiles(root, ".githooks", "githooks", "githooks", findings, warnings, state);
 }
 /**
  * Empty estate note (P-014, hookcheck half). A scan that inventories
@@ -1810,20 +2545,44 @@ export function scanHooks(root) {
             note: EMPTY_ESTATE_NOTE,
         };
     }
-    scanPackageJson(root, findings, warnings);
-    scanClaude(root, findings, warnings);
-    scanVscode(root, findings, warnings);
-    scanDirFiles(root, ".husky", "husky", findings, warnings);
-    scanLefthook(root, findings, warnings);
-    scanPreCommit(root, findings, warnings);
-    scanAgentDirs(root, findings, warnings);
-    // MCP config surfaces, each inventoried exactly once (P-035).
+    const disc = discoverSurfaces(root, warnings);
+    const state = { disc, inventoried: new Set(), familyFound: new Map(), familyCapped: new Map(), partial: false };
+    scanPackageJson(root, findings, warnings, state);
+    scanClaude(root, findings, warnings, state);
+    scanPluginHooks(root, findings, warnings, state);
+    scanVscode(root, findings, warnings, state);
+    scanDirFiles(root, ".husky", "husky", "husky", findings, warnings, state);
+    scanLefthook(root, findings, warnings, state);
+    scanPreCommit(root, findings, warnings, state);
+    scanAgentDirs(root, findings, warnings, state);
+    // MCP config surfaces, each inventoried exactly once (P-035), at the
+    // scan root and at every nested project root (P-065).
     // .windsurf/mcp.json joined the covered surfaces in v0.1.6 (P-034);
     // .vscode/mcp.json is handled inside scanVscode.
-    for (const rel of [".mcp.json", "mcp.json", ".cursor/mcp.json", ".windsurf/mcp.json", ".codex/mcp.json"])
-        scanMcpFile(root, rel, findings, warnings);
-    scanWorkflows(root, findings, warnings);
-    scanGitHooks(root, findings, warnings);
+    for (const prefix of disc.projectRoots) {
+        const base = prefix === "" ? "" : `${prefix}/`;
+        const baseAbs = prefix === "" ? root : join(root, prefix);
+        for (const name of [".mcp.json", "mcp.json", ".cursor/mcp.json", ".windsurf/mcp.json", ".codex/mcp.json"]) {
+            scanMcpFile(root, `${base}${name}`, findings, warnings, state, baseAbs, prefix !== "");
+        }
+    }
+    scanWorkflows(root, findings, warnings, state);
+    scanGitHooks(root, findings, warnings, state);
+    // Bounded scan honesty (P-065): a scan cut short by the discovery
+    // bounds must say so, naming the bound, instead of presenting as
+    // complete. Surfaces spotted just below the depth bound are counted
+    // in the warning, never silently dropped.
+    if (disc.depthBoundHit) {
+        const below = disc.surfacesBelowBound > 0
+            ? `; at least ${disc.surfacesBelowBound} of the directories just below the bound contain hook surface files or config directories that were not inventoried`
+            : "";
+        warnings.push(`Nested discovery bounded at depth ${NESTED_MAX_DEPTH}: project directories more than ${NESTED_MAX_DEPTH} levels below the scan root were not scanned (${disc.frontierDirs} ${disc.frontierDirs === 1 ? "directory" : "directories"} below the bound not entered${below}); the scan is partial (bounded)`);
+    }
+    for (const [family, capped] of state.familyCapped) {
+        const label = FAMILY_LABELS[family] ?? family;
+        warnings.push(`Nested ${label} inventory capped at ${NESTED_MAX_FILES_PER_SURFACE} files (${state.familyFound.get(family) ?? 0} found); the remaining nested ${label} files were not inventoried and the scan is partial`);
+        void capped;
+    }
     // Dedupe identical ids (agent dir scan may double count mcp.json).
     const seen = new Set();
     const deduped = findings.filter((f) => {
@@ -1839,12 +2598,14 @@ export function scanHooks(root) {
         risky: deduped.filter((f) => f.classification === "RISKY").length,
         unknown: deduped.filter((f) => f.classification === "UNKNOWN").length,
     };
-    // Partial scan floor (P-049): when any inventoried file or directory
-    // could not be read, the scan did not see the whole estate, so a bare
-    // CLEAN is not an honest verdict. Floor at REVIEW; the warnings name
-    // exactly what was missed.
+    // Partial scan floor (P-049, extended by P-065): when any inventoried
+    // file or directory could not be read, when a file cap left surface
+    // files uninventoried, or when hook surfaces were spotted just below
+    // the discovery depth bound, the scan did not see the whole estate,
+    // so a bare CLEAN is not an honest verdict. Floor at REVIEW; the
+    // warnings name exactly what was missed.
     let verdict = computeVerdict(deduped);
-    if (verdict === "CLEAN" && warnings.some((w) => w.startsWith("Unreadable"))) {
+    if (verdict === "CLEAN" && (warnings.some((w) => w.startsWith("Unreadable")) || state.partial || disc.surfacesBelowBound > 0)) {
         verdict = "REVIEW";
     }
     return {