@reneturcios/hookcheck 0.1.7 → 0.1.9

package/README.md

@@ -14,9 +14,9 @@ Reports in October 2026 described AI agents orchestrating attacks and a self-pro
 
 | surface | what it looks for |
 | --- | --- |
-| `package.json` | preinstall, install, postinstall, prepare scripts. The root package.json and nested workspace package.json files (for example `packages/*/package.json`, `apps/*/package.json`, any directory up to 4 levels below the root, node_modules excluded) are inventoried the same way |
+| `package.json` | preinstall, install, postinstall, prepare scripts. The root package.json and nested workspace package.json files (for example `packages/*/package.json`, `apps/*/package.json`, any directory up to 8 levels below the root, node_modules excluded) are inventoried the same way |
 | `.claude/settings.json` and `settings.local.json` | SessionStart, PreToolUse, and other hook commands. Also discovered: the GNU stow layout (`claude/settings.json`, no dot) and settings nested one level under a config dir (for example `config/.claude/settings.json`). A settings path that exists as a directory is reported as a warning, not silently skipped |
-| Claude Code plugin hooks | `hooks/hooks.json` in a plugin root: at the repo root, or nested under plugin directories (for example `plugins/<name>/hooks/hooks.json`), with the plugin root at most 4 levels below the scan root. The file carries the same events map as the hooks key of `.claude/settings.json` (SessionStart, PreToolUse, PostToolUse, Stop, UserPromptSubmit, and the rest of the Claude Code event set) and its commands are classified exactly the same way. The sibling `hooks/hooks-cursor.json` variant carries the same command object shape under Cursor event names and is inventoried the same way |
+| Claude Code plugin hooks | `hooks/hooks.json` in a plugin root: at the repo root, or nested under plugin directories (for example `plugins/<name>/hooks/hooks.json`), with the plugin root at most 8 levels below the scan root. The file carries the same events map as the hooks key of `.claude/settings.json` (SessionStart, PreToolUse, PostToolUse, Stop, UserPromptSubmit, and the rest of the Claude Code event set) and its commands are classified exactly the same way. The sibling `hooks/hooks-cursor.json` variant carries the same command object shape under Cursor event names and is inventoried the same way |
 | `.vscode/tasks.json` | tasks with runOn folderOpen, plus task inventory |
 | `.husky/` | every hook file and its full command content |
 | `lefthook.yml` | run commands |
@@ -26,10 +26,12 @@ Reports in October 2026 described AI agents orchestrating attacks and a self-pro
 | `.github/workflows/` | run steps, as inventory, including block scalar bodies (`run: |` and `run: >`, with chomping variants). Every workflow finding carries the line number of its `run:` key |
 | `.githooks/` | hook files |
 
+Every surface above is discovered by one bounded recursive walk, not only at the scan root: a surface that appears inside a subdirectory (for example `packages/foo/.claude/settings.json`, `sub/.vscode/tasks.json`, or `sub/.github/workflows/ci.yml`) is inventoried from a parent scan with its real relative path in the finding, within the discovery bound documented under Limits. A surface file is inventoried exactly once however many discovery paths reach it.
+
 Classification per hook:
 
 - **SAFE**: matches known safe dev patterns such as test, lint, build, typecheck, husky, or lint-staged, and matches no risky rule.
-- **RISKY**: matches at least one risky rule: network fetch, curl piped to an interpreter, base64 decode piped to an interpreter, credential store paths or credential files (matched on content and paths, never on a script filename that merely contains the word credentials), credential shaped environment names (token, secret, password, api key) or bulk environment access, base64 decoding or eval style obfuscation, inline code execution, or a remote URL. Ordinary single named environment reads (NODE_ENV, HOME, RUNNER_DEBUG) are not flagged. Neither are operations that are not reads: `env -u NAME` unsets a variable, `os.environ.setdefault(...)` writes one key with a default, and a `[ -n "$NAME" ]` test checks existence. A hook whose target is a shell script is classified by that script's contents, not by the fact that it is a shell script. Comments are stripped before classification, so a docs URL inside a comment is not a fetch, and a fetch whose every URL is loopback (a localhost health check) is not treated as network behavior. In script files (JavaScript, Python), the contents of string and regex literals are data, not behavior: a defensive guard whose pattern list quotes `eval(` or `curl | sh` performs neither, and hookcheck does not classify it as an attacker. Literals handed to exec style calls (`execSync("...")`, `os.system("...")`) are code by construction and are still matched. Two rules are about value flow, not co-occurrence: ENV-EXFIL fires only when a credential value demonstrably flows into an outbound send (a request payload, a query string, a pipe into a network tool, or printed output next to a send), and CRED-EXFIL when credential store contents are piped or posted straight into a network send. A token used as authentication (an Authorization header, the userinfo of a push URL to the repo's own host, a `--token` flag) is authentication, not exfiltration, and never fires either rule. Authentication positions are recognized by shape, not only by the Authorization spelling: any curl `-H` header argument whatever its name, any dict or object entry whose key is an authentication header name (Authorization, `x-api-key`, `*-api-key`, `*-auth-token`, and friends) in a one hop script file, and any header shaped entry inside a headers construction (a dict assigned to a headers variable, a `headers=` argument, a headers property of a request options object) all count as authentication positions, while the same credential in a body, a query string, or printed output still counts as exfiltration. Fetch detection requires command position: curl or wget counts as a network fetch only when it is the invoked command (the head of a statement or pipeline segment, after sudo or env wrappers, or the head of a command string handed to an interpreter), never when the word merely names a package in an install line (`pacman -S curl`, `apt-get install curl`). In script files the remote URL rule follows the same data view as the other behavior rules: a URL that appears only inside a string literal or a comment (an error message, a documentation link, an API base constant) is data, while a URL handed to a network call (fetch, requests, http.get, urlopen, axios, sendBeacon) is a fetch target and still fires. Inline code execution (DOWNLOAD-EXEC) fires only when the evaluated content itself carries a download or remote reference; constant inline code such as a `node -e` version comparison downloads nothing and is not flagged.
+- **RISKY**: matches at least one risky rule: network fetch, curl piped to an interpreter, base64 decode piped to an interpreter, credential store paths or credential files (matched on content and paths, never on a script filename that merely contains the word credentials), credential shaped environment names (token, secret, password, api key) or bulk environment access, base64 decoding or eval style obfuscation, inline code execution, or a remote URL. Ordinary single named environment reads (NODE_ENV, HOME, RUNNER_DEBUG) are not flagged. Neither are operations that are not reads: `env -u NAME` unsets a variable, `os.environ.setdefault(...)` writes one key with a default, and a `[ -n "$NAME" ]` test checks existence. A hook whose target is a shell script is classified by that script's contents, not by the fact that it is a shell script. Comments are stripped before classification, so a docs URL inside a comment is not a fetch, and a fetch whose every URL is loopback (a localhost health check) is not treated as network behavior. In script files (JavaScript, Python), the contents of string and regex literals are data, not behavior: a defensive guard whose pattern list quotes `eval(` or `curl | sh` performs neither, and hookcheck does not classify it as an attacker. Literals handed to exec style calls (`execSync("...")`, `os.system("...")`) are code by construction and are still matched. Two rules are about value flow, not co-occurrence: ENV-EXFIL fires only when a credential value demonstrably flows into an outbound send (a request payload, a query string, a pipe into a network tool, or printed output next to a send), and CRED-EXFIL when credential store contents are piped or posted straight into a network send. Environment inheritance is not a send: when the only environment movement is inheritance or bulk access passed as a subprocess environment (env=os.environ, a {**os.environ, ...} spread, dict(os.environ), os.environ.copy(), and their JavaScript forms), ENV-EXFIL additionally requires a non-loopback destination in the flow, so a test harness that starts its own server on 127.0.0.1 and hands it the inherited environment does not verdict as exfiltration; the same forms serialized into a payload, or paired with a remote destination, still fire. The ENV-BULK evidence names the form it saw: inheritance and copy forms are described as bulk access in inheritance or copy form, not as a serialization or dump. A token used as authentication (an Authorization header, the userinfo of a push URL to the repo's own host, a `--token` flag) is authentication, not exfiltration, and never fires either rule. Authentication positions are recognized by shape, not only by the Authorization spelling: any curl `-H` header argument whatever its name, any dict or object entry whose key is an authentication header name (Authorization, `x-api-key`, `*-api-key`, `*-auth-token`, and friends) in a one hop script file, and any header shaped entry inside a headers construction (a dict assigned to a headers variable, a `headers=` argument, a headers property of a request options object) all count as authentication positions, while the same credential in a body, a query string, or printed output still counts as exfiltration. Fetch detection requires command position: curl or wget counts as a network fetch only when it is the invoked command (the head of a statement or pipeline segment, after sudo or env wrappers, or the head of a command string handed to an interpreter), never when the word merely names a package in an install line (`pacman -S curl`, `apt-get install curl`). In script files the remote URL rule follows the same data view as the other behavior rules: a URL that appears only inside a string literal or a comment (an error message, a documentation link, an API base constant) is data, while a URL handed to a network call (fetch, requests, http.get, urlopen, axios, sendBeacon) is a fetch target and still fires. Inline code execution (DOWNLOAD-EXEC) fires only when the evaluated content itself carries a download or remote reference; constant inline code such as a `node -e` version comparison downloads nothing and is not flagged.
 - **UNKNOWN**: matches neither safe nor risky patterns. A local script name alone is UNKNOWN until a human reads it. When a hook runs a local file such as `node setup.mjs`, hookcheck reads that file and escalates the finding if the file itself matches risky rules. The same one hop following applies to direct script execution (`./setup.sh`), `node --require ./setup.mjs`, and package.json script chains (`postinstall: npm run other-script`). If the referenced file itself spawns a further local script, the chain runs past the one hop limit: the finding is floored at UNKNOWN, never SAFE, and the evidence names the second hop file, so the verdict lands at REVIEW for a hand read.
 
 Verdict rules:
@@ -38,7 +40,7 @@ Verdict rules:
 - **REVIEW**: at least one UNKNOWN finding, or a RISKY finding whose evidence is weak on its own (a remote URL alone, a download by itself, credential access with no network behavior). Exit code 1.
 - **COMPROMISED-PATTERN**: at least one RISKY finding with strong evidence: fetched or decoded content executed directly as code (curl piped to an interpreter, base64 decode piped to an interpreter, eval of fetched content), a verified exfil flow (a credential value flowing into an outbound send, or credential store contents piped into a network tool), or credential store access combined with network behavior in the same finding. This is the Shai-Hulud persistence shape. Treat the repo as untrusted until proven otherwise. Exit code 1. Canonical legitimate installers that download their own binary (esbuild, puppeteer) verdict REVIEW under this calibration, not COMPROMISED-PATTERN; the download is reported as a RISKY finding with its evidence, and the top verdict no longer over-claims it. The same applies to a repo's own release automation: a step that reads its token and pushes to its own repo, posts its own workflow dispatch, or updates its own homebrew tap uses the token as authentication and verdicts REVIEW, because the credential value never flows into a payload to a third party. One more calibration in the same family: a CI workflow step whose only severe evidence is a curl pipe to a named vendor's official installer over HTTPS (an installer shaped path such as /install or /uv/install.sh, or a known installer host such as astral.sh or sh.rustup.rs), with no credential, persistence, or second severe signal in the finding, verdicts REVIEW with the finding kept RISKY. The same pipe on an auto-exec hook surface (an install script, a Claude settings or plugin hook, a folderOpen task), a pipe to a non-installer source, or a pipe accompanied by any other signal still reaches COMPROMISED-PATTERN.
 
-Every finding reports file, hook id, command text, classification, rule ids, and evidence. Malformed JSON is reported as a warning, never silently ignored. Scanning a path that does not exist, or that is a file instead of a directory, is a clean error with exit code 2.
+Every finding reports file, hook id, command text, classification, rule ids, and evidence. Malformed JSON is reported as a warning, never silently ignored. Scanning a path that does not exist, or that is a file instead of a directory, is a clean error with exit code 2. Reports are written through a flush-aware emit: if the reader of a piped report closes the pipe early, the process exits 141 (the shell-visible equivalent of death by SIGPIPE) rather than reporting the verdict code for a report that was never delivered.
 
 ## Limits
 
@@ -53,8 +55,7 @@ Honest boundaries, pinned by tests in test/hardening.test.ts:
 - Non-string package.json script values are skipped: npm only executes string script values, so an array or number in scripts cannot auto-run.
 - Classification reads up to 200,000 characters of a hook file or a referenced local file. Beyond that depth a payload can hide; the cap exists so a hostile file cannot make the scan unbounded.
 - GitHub workflow run steps in block scalars (`run: |`, `run: >`, and chomping variants) are parsed and classified like one line commands. Plain multi-line scalars without a block header are not joined, and reusable workflow internals are not resolved. YAML anchors, aliases, and merge keys on run steps are resolved when the anchor is defined in the same file; anchors applied to other step fields, and anchors defined in other files, are not resolved. Workflow files with CRLF line endings are parsed exactly like their LF equivalents.
-- Nested package.json inventory is bounded: the root package.json plus nested package.json files whose directory sits at most 4 levels below the root, visited in sorted order, capped at 200 nested files (the cap is reported as a warning when hit). node_modules, .git, dot directories, and symlinked directories are never entered, so package.json files deeper than the depth bound, or anywhere under node_modules, are not scanned.
-- Plugin hooks inventory is bounded the same way: `hooks/hooks.json` and `hooks/hooks-cursor.json` files whose plugin root sits at most 4 levels below the scan root, visited in sorted order, capped at 200 files (the cap is reported as a warning when hit), with node_modules, .git, dot directories, and symlinked directories never entered. Plugin hook files deeper than the bound are not scanned. Only the object command form of the plugin schema is inventoried; a hook entry written as a bare string instead of a command object is outside the documented schema and is not inventoried.
+- Nested discovery is one bounded walk covering every inventoried surface: package.json files, `.claude/settings.json` and `settings.local.json` (including the stow layout `claude/settings.json`), plugin `hooks/hooks.json` and `hooks/hooks-cursor.json` files, `.vscode/tasks.json`, `.github/workflows/*.yml` and `*.yaml`, `.husky/` and `.githooks/` hook files, lefthook configs (`lefthook.yml`, `lefthook.yaml`, `.lefthook.yml`), `.pre-commit-config.yaml`, `.cursor/` and `.codex/` config files, and MCP configs (`.mcp.json`, `mcp.json`, `.cursor/mcp.json`, `.windsurf/mcp.json`, `.codex/mcp.json`, and `.vscode/mcp.json`). A surface is in scope when its project directory sits at most 8 levels below the scan root (the plugin hooks directory itself sits one level below its plugin root), visited in sorted order. Each surface family inventories at most 200 nested files; the scan root files always count. node_modules, .git, dot directories, and symlinked directories are never entered, so surfaces deeper than the depth bound, or anywhere under node_modules, are not scanned. Non-regular files (FIFOs, sockets, device files) are never opened: every file the scanner reads is checked by stat type first and a non-regular file is skipped with a warning naming it, because opening a FIFO blocks until a writer appears and would hang the scan. The bound is never silent: when the walk hits the depth bound with more tree remaining, the report carries a warning naming the depth bound and counts the directories just below the bound that contain hook surface files or config directories; when a family hits the file cap, a warning names the cap and the count found. A scan cut short by either bound, by the cap, or by unreadable files is partial, says so in its warnings, and never verdicts a bare CLEAN when surfaces are known to have been missed. Only the object command form of the plugin schema is inventoried; a hook entry written as a bare string instead of a command object is outside the documented schema and is not inventoried.
 - A file or directory the scanner sets out to inventory but cannot read (for example a workflow file at mode 000) is never skipped silently: the report carries a warning naming it, and the verdict is floored at REVIEW while any part of the estate is unread, so a partial scan never presents as a complete all-clear.
 - Custom git hook directories set through core.hooksPath are not scanned: hookcheck inventories the standard `.githooks/` directory and `.husky/`, but it does not parse git config or a committed `.gitconfig` to discover a custom core.hooksPath directory. Hooks kept only in a custom hooksPath directory are outside the inventory; audit them by scanning a tree where they sit in a standard location.
 - Agent config coverage boundaries: `.gemini/settings.json` is not scanned yet. Template configs (for example `templates/settings.json.template`) are not scanned: they are inert until copied into place, at which point the copied file is scanned under its real name.

package/dist/cli.js

@@ -4,10 +4,51 @@
  *   hookcheck scan [path] [--json]
  *   hookcheck mcp
  *   hookcheck --version
- * Exit codes: 0 CLEAN, 1 REVIEW or COMPROMISED-PATTERN, 2 usage error.
+ * Exit codes: 0 CLEAN, 1 REVIEW or COMPROMISED-PATTERN, 2 usage error,
+ * 141 when the reader closed the output pipe before the report was
+ * delivered (the shell-visible equivalent of death by SIGPIPE).
+ *
+ * Every report goes through emit(), which waits for stdout to flush
+ * before the exit code takes effect. This is the factory emit
+ * contract (~/workspace/security-wave/FACTORY-NOTES.md). The P-017 fix
+ * in v0.1.3 replaced process.exit() with process.exitCode, which made
+ * delivery reliable for cooperative readers, but the CLI still printed
+ * with console.log and had no EPIPE handling at all: on a very large
+ * report (35 MB on the chaos big-workflow target), a reader that
+ * closed the pipe early still received the verdict exit code,
+ * reporting silent truncation as success (P-071). Sibling tools
+ * actionpin (P-001) and injectcheck (P-021) exit 141 in that case;
+ * hookcheck now does the same.
  */
 import { existsSync, statSync } from "node:fs";
 import { explainHook, renderReport, scanHooks, VERSION } from "./core.js";
+function exitBrokenPipe() {
+    // The reader closed the pipe before the report was delivered. A Unix
+    // writer in this position dies from SIGPIPE; exit 141 (128 + 13) is
+    // the equivalent a shell reports, and it guarantees an undelivered
+    // report is never mistaken for a successful run.
+    process.exit(141);
+}
+process.stdout.on("error", (err) => {
+    if (err.code === "EPIPE")
+        exitBrokenPipe();
+    throw err;
+});
+/** Write one full report and resolve only after stdout has flushed it. */
+async function emit(text, code) {
+    process.exitCode = code;
+    await new Promise((resolve, reject) => {
+        process.stdout.write(`${text}\n`, (err) => {
+            if (!err) {
+                resolve();
+                return;
+            }
+            if (err.code === "EPIPE")
+                exitBrokenPipe();
+            reject(err);
+        });
+    });
+}
 /** A scan target must be an existing directory; anything else is a usage error (exit 2). */
 function requireDirectory(target) {
     if (!existsSync(target)) {
@@ -52,16 +93,7 @@ async function main() {
             const target = rest.find((a) => !a.startsWith("--")) ?? ".";
             requireDirectory(target);
             const report = scanHooks(target);
-            if (asJson)
-                console.log(JSON.stringify(report, null, 2));
-            else
-                console.log(renderReport(report));
-            // exitCode, not process.exit: stdout to a pipe is async in Node, and
-            // process.exit right after console.log truncates large reports at
-            // exactly 65,536 characters (measured during v0.1.2 re-validation
-            // on a sparse cli/cli checkout). Letting main return lets the
-            // runtime flush stdout in full before exiting with this code.
-            process.exitCode = report.verdict === "CLEAN" ? 0 : 1;
+            await emit(asJson ? JSON.stringify(report, null, 2) : renderReport(report), report.verdict === "CLEAN" ? 0 : 1);
         }
         else if (cmd === "explain") {
             const args = rest.filter((a) => !a.startsWith("--"));
@@ -78,11 +110,7 @@ async function main() {
                 usage();
             requireDirectory(target);
             const result = explainHook(target, id);
-            if (asJson)
-                console.log(JSON.stringify(result, null, 2));
-            else
-                console.log(result.explanation);
-            process.exitCode = result.finding ? 0 : 1;
+            await emit(asJson ? JSON.stringify(result, null, 2) : result.explanation, result.finding ? 0 : 1);
         }
         else {
             usage();

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1E,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,KAAK,CAAC;IAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CAAC;;;;sBAIM,CAAC,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC1E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,KAAK,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAC5D,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,qEAAqE;YACrE,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,8DAA8D;YAC9D,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,MAAM,GAAG,GAAG,CAAC;YAAC,IAAI,EAAE,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;;gBACzD,KAAK,EAAE,CAAC;YACb,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACrC,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1E,SAAS,cAAc;IACrB,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,iDAAiD;IACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,cAAc,EAAE,CAAC;IAC3C,MAAM,GAAG,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,cAAc,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,KAAK,CAAC;IAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CAAC;;;;sBAIM,CAAC,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC1E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,KAAK,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;YAC5D,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,MAAM,GAAG,GAAG,CAAC;YAAC,IAAI,EAAE,GAAG,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;;gBACzD,KAAK,EAAE,CAAC;YACb,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/core.d.ts

@@ -1,6 +1,6 @@
 import { relative } from "node:path";
 import type { Classification, HookFinding, ScanReport, Verdict } from "./types.js";
-export declare const VERSION = "0.1.7";
+export declare const VERSION = "0.1.9";
 interface RuleDef {
     id: string;
     pattern: RegExp;
@@ -60,46 +60,64 @@ export declare function classifyCommand(command: string, lang?: Lang): {
 };
 export declare function computeVerdict(findings: HookFinding[]): Verdict;
 /**
- * Nested package.json discovery (P-032). Install scripts in workspace
- * subpackages (packages/foo, apps/web) run on a root install, so a
- * root-only scan misses exactly the surface a worm would persist in.
- * The walk is bounded so a hostile or giant tree cannot explode the
- * report: directories are visited in sorted order to depth
- * PACKAGE_MAX_DEPTH (the package.json directory depth below the root),
- * node_modules, .git, and dot directories are never entered, symlinked
- * directories are never followed (a symlink loop cannot hang the scan),
- * and at most PACKAGE_MAX_NESTED nested files are inventoried, with the
- * cap reported as a warning when it is hit.
- */
-export declare const PACKAGE_MAX_DEPTH = 4;
-export declare const PACKAGE_MAX_NESTED = 200;
-/**
- * Claude Code plugin hook files (P-060, BLOCKER). Plugins distribute
- * hooks in a hooks/ directory at the plugin root: hooks/hooks.json at
- * the repo root for a single plugin repo (obra/superpowers), or
- * plugins/<name>/hooks/hooks.json inside a marketplace or monorepo
- * (anthropics/claude-code carries 9 such files, wshobson/agents 2 among
- * 92 plugin directories). Before v0.1.7 none of these files was scanned
- * at any depth: a SessionStart curl pipe in hooks/hooks.json scanned
- * CLEAN with total 0 while the identical payload in .claude/settings.json
- * verdicts COMPROMISED-PATTERN. The file carries the same schema as the
- * hooks key of .claude/settings.json (an events map of command hooks:
- * SessionStart, PreToolUse, PostToolUse, Stop, UserPromptSubmit, and
- * the rest of the Claude Code event set), so commands are classified
- * exactly as settings hooks are. The sibling hooks/hooks-cursor.json
- * variant shipped by the same plugins (superpowers) carries the same
- * command object shape under Cursor event names, so it is inventoried
- * the same way.
+ * Unified nested discovery (P-032, P-060, P-065). Every surface the
+ * tool inventories at the scan root is also inventoried when it
+ * appears inside a subdirectory: before v0.1.8 only nested package.json
+ * files (P-032) and plugin hooks files (P-060) were recursed, so a
+ * parent scan of a monorepo or workspace silently missed nested
+ * .claude/settings.json, .vscode/tasks.json, workflows, husky and
+ * githooks directories, lefthook and pre-commit configs, and MCP
+ * configs, and a tree holding only nested surfaces scanned CLEAN with
+ * the empty estate note attached (P-065).
  *
- * The walk mirrors the nested package.json discipline (P-032): sorted
- * order, node_modules, .git, and dot directories never entered,
- * symlinked directories never followed, and a cap with a warning. The
- * depth bound applies to the plugin root (at most PLUGIN_HOOKS_MAX_DEPTH
- * directories below the scan root); the hooks directory itself sits one
- * level below its plugin root.
+ * One bounded walk enumerates every project root (each directory at
+ * most NESTED_MAX_DEPTH levels below the scan root, the scan root
+ * itself included) plus the nested package.json and plugin hooks file
+ * lists. Per surface scanners then run once per project root with the
+ * root prefix carried into every finding file path, so findings carry
+ * their real relative paths. The walk is bounded so a hostile or
+ * giant tree cannot explode the report: directories are visited in
+ * sorted order, node_modules, .git, and dot directories are never
+ * entered, symlinked directories are never followed (a symlink loop
+ * cannot hang the scan), and each surface family inventories at most
+ * NESTED_MAX_FILES_PER_SURFACE nested files, with the cap reported as
+ * a warning when it is hit. When directories remain below the depth
+ * bound the walk says so in a warning naming the bound, and it probes
+ * the directories just below the bound (names only, no file reads) so
+ * surfaces sitting there are counted in the warning instead of being
+ * silently dropped.
+ *
+ * The bound itself was raised from 4 to 8 in v0.1.9 (P-072): at depth
+ * 4, realistic monorepo nesting (apps/<team>/<app>, packages grouped
+ * by area, fixture trees) sat below the bound, so a package.json
+ * dropper at depth 5 floored at REVIEW via the probe and a depth 8
+ * chain verdicted CLEAN with only the warning. Depth 8 covers those
+ * layouts; the walk cost stays linear in the number of directories
+ * actually present, and the 2,000 file tree and 5 MB workflow perf
+ * spot checks for v0.1.9 showed no material regression against
+ * v0.1.8. Whatever bound remains keeps the warning and the
+ * never-bare-CLEAN rule when the probe detects surface below it.
  */
-export declare const PLUGIN_HOOKS_MAX_DEPTH = 4;
+export declare const NESTED_MAX_DEPTH = 8;
+export declare const NESTED_MAX_FILES_PER_SURFACE = 200;
+export declare const PACKAGE_MAX_DEPTH = 8;
+export declare const PACKAGE_MAX_NESTED = 200;
+export declare const PLUGIN_HOOKS_MAX_DEPTH = 8;
 export declare const PLUGIN_HOOKS_MAX_FILES = 200;
+export interface Discovery {
+    /** Project root prefixes, scan root ("") first, then sorted. */
+    projectRoots: string[];
+    /** Nested package.json relative paths (scan root excluded), sorted, uncapped. */
+    packageFiles: string[];
+    /** Plugin hooks file relative paths, sorted, uncapped. */
+    pluginHookFiles: string[];
+    /** Directories just below the depth bound that were not entered. */
+    frontierDirs: number;
+    /** Frontier directories whose listing shows a hook surface file or config directory. */
+    surfacesBelowBound: number;
+    /** True when the depth bound left directories unentered. */
+    depthBoundHit: boolean;
+}
 /**
  * Empty estate note (P-014, hookcheck half). A scan that inventories
  * nothing must say so next to the verdict, in JSON as well as in the