dsh-plugin-inspector 0.1.0 → 0.2.0

package/README.md

@@ -2,13 +2,13 @@
 
 **Know what a plugin does before you install it.**
 
-`dsh-inspect` reads a DeepSeek Harness plugin — a directory or an npm tarball — and tells you
-what it declares and what its code is capable of. It does not install it, build it, import it,
-spawn it, or evaluate any part of it.
+`dsh-inspect` reads a DeepSeek Harness plugin — a directory, an npm tarball, or a published
+package fetched by name and checked against the hash the registry published — and tells you what it
+declares and what its code is capable of. It does not install it, build it, import it, spawn it, or
+evaluate any part of it.
 
 ```console
-$ npm pack some-dsh-plugin@1.4.0 --pack-destination /tmp
-$ dsh-inspect /tmp/some-dsh-plugin-1.4.0.tgz
+$ dsh-inspect --from-npm some-dsh-plugin@1.4.0
 ```
 
 ## Install
@@ -53,7 +53,7 @@ dsh: warning: <pkg> declares no dsh.bundle — installed as a plain dependency,
 
 The dangerous case prints nothing.
 
-There are over 4,000 repos tagged `dsh-plugin` — 4,813 when this was last counted, in August
+There are over 5,000 repos tagged `dsh-plugin` — 5,071 when this was last counted, on 16 August
 2026 — and no registry, no review, and no signing between any of them and your process. This tool
 exists so that the moment before you install one is not a blank.
 
@@ -68,15 +68,6 @@ commands it puts on your PATH, its dependencies, what model-visible text it ship
 it could be read. A well-behaved plugin has a full facts section and an empty findings section.
 That is a useful answer, not an empty one.
 
-That is also the bar the tool is held to. Across twelve real targets — four plugins read both as a
-directory and as their published tarball, the three bundles the harness itself ships, and a
-scratch plugin — the current build reports **49 findings: none critical, two high, and exactly one
-target exiting non-zero.** Both high findings are true statements about `@deepseek-ai/dsh-web-app`'s
-own shipped code, which does contribute to the system prompt and does mount further plugins. The
-upstream plugin template reports three findings, all `node:fs` and `dshHomePath` facts about what
-it genuinely does; the base and headless bundles report three and one. Every packable target's
-directory reading and tarball reading are byte-identical.
-
 **Findings** — ranked, in three tiers:
 
 | Tier | What it reads | What it can say |
@@ -89,14 +80,67 @@ Every Tier B and Tier C finding carries a `bypass` field naming the one-line eva
 specific check. It is inside the finding, not in a footnote, so a report cannot be rendered
 without its caveat.
 
+A finding is **per package, not per syntax site**. A package importing `node:fs` from eleven files
+gets one finding with `occurrences: 11` and three example locations, because the eleventh import
+warrants no decision the first did not. Findings are grouped by check and `subject` — the module
+specifier, the row id, the seam name, the matched rule — so `node:child_process` and
+`node:worker_threads` stay two findings, and a gate can accept `B13`/`node:fs` without accepting
+every `B13`.
+
+## What it reports on the real ecosystem
+
+Measured **2026-08-16** against the 40 most-starred GitHub repositories tagged `dsh-plugin` that
+publish a resolvable npm package, each pinned to the version current that day. Re-run it with
+`pnpm run sweep`; the corpus is `scripts/ecosystem-corpus.json` and the recorded measurement is
+`tests/ecosystem-baseline.json`.
+
+Both columns come from the same corpus and the same pinned versions, so the difference is this
+tool's doing and not the ecosystem's. "0.1" is the published `dsh-plugin-inspector@0.1.0`; "0.2" is
+this tree, which still reports version `0.1.0` because the release is not published yet.
+
+| | 0.1 | 0.2 |
+|---|---|---|
+| Findings | 1,420 | **295** |
+| Critical | 252 | **3** |
+| Median findings per package | 10.5 | **5.5** |
+| Packages with a high or critical | 27 of 40 (68 %) | **21 of 40 (53 %)** |
+| Packages failing `--fail-on critical` | 40 of 40 | **1 of 40** |
+| Clean packages | 0 of 40 | **0 of 40** |
+
+**The 0.1 README quoted "49 findings, 0 critical" and that number was worthless.** It was measured
+on twelve targets — the harness's own bundles and our own sibling plugins — which is a sample
+selected for being trusted already. Against published third-party plugins the same build produced
+1,420 findings and 252 criticals, and no package came out clean.
+
+Read the 0.2 column honestly:
+
+- **`--fail-on critical` is now a usable gate.** It stops one package in forty. That package,
+  `@struktoai/mirage-dsh`, ships a patch layer that switches off `fs-sandbox`, `bash-sandbox` and
+  `pwsh-sandbox`, and its three findings lead the report. Under 0.1 the same three sat somewhere in
+  a list of 252.
+- **The default `--fail-on high` still stops a majority of the ecosystem**, and that is not a
+  finished job. The largest remaining driver is `C2` — the analyzer saying it could not read the
+  package, on 33 % of the corpus. That is a true statement rather than a false positive, but a gate
+  that fires on a third of npm for reasons about the *tool* is not yet a gate.
+- **No package is clean, and that is expected rather than alarming.** `C3` alone — "ships built
+  output and no source" — fires on 65 % of published packages, because that is what publishing a
+  package is. It is `low`, it does not degrade the analysis, and it is not a defect.
+
+The gap between "readable report" and "installable gate" is what 0.3 is for.
+
 ## Usage
 
 ```
 dsh-inspect <target> [options]
+dsh-inspect --from-npm <name>[@<version>] [options]
 
   <target>                A plugin directory, or an npm tarball (.tgz / .tar.gz).
 
 Options
+  --from-npm <spec>       Fetch a published package from the registry, verify its
+                          dist.integrity hash, and analyse it in memory.
+  --registry <url>        Registry base URL for --from-npm.
+                          (default: https://registry.npmjs.org)
   --json                  Emit the machine-readable JSON document on stdout.
   --fail-on <severity>    Exit 1 at or above this severity.
                           critical | high | medium | low | none    (default: high)
@@ -117,13 +161,12 @@ plugin is clean" is the failure this split exists to prevent.
 
 ### Getting a package without installing it
 
-Never `pnpm add` a package you have not read. Two safe ways to get the bytes:
+Never `pnpm add` a package you have not read.
 
 ```console
-# From the registry. `npm pack` on a registry spec downloads and repacks; it does not install
-# and does not run the package's scripts.
-npm pack <name>@<version> --pack-destination /tmp
-dsh-inspect /tmp/<name>-<version>.tgz
+# From the registry, in one step. Reads the ~3 KB version document, downloads the tarball into
+# memory, verifies dist.integrity BEFORE anything parses it, and analyses it there.
+dsh-inspect --from-npm <name>@<version>
 
 # From git. Clone shallow and point the tool at the directory — do NOT use `npm pack` on a git
 # spec, which runs the package's `prepare` script.
@@ -131,10 +174,21 @@ git clone --depth 1 https://github.com/… /tmp/plugin
 dsh-inspect /tmp/plugin
 ```
 
-A tarball is decoded **entirely in memory**. Nothing is written to disk, which makes tar path
-traversal structurally impossible rather than something a filter has to catch. Every read ceiling
-is applied to the arriving stream rather than to a finished buffer, so a 28 MB archive holding one
-8 GB member is a refusal in under two seconds, not an out-of-memory kill.
+`--from-npm` is the only mode that opens a socket, and it is one flag per invocation: it cannot be
+combined with a local target, and a directory or tarball scan can never reach it — the fetch lives
+in a module the analysis path does not import. **A network fetch is not execution.** No subprocess,
+no disk write, no lifecycle script, and no `npm pack`. The report records the tarball URL, the
+digest that matched, and the registry's own `hasInstallScript` flag under `target.registry`.
+
+If the hash does not match what the registry published, the tool refuses and parses nothing. If the
+package predates `dist.integrity` entirely, the weaker `dist.shasum` is used and the report says
+`sha1` rather than claiming more. If neither is published, that is a refusal too.
+
+A tarball is decoded **entirely in memory**, from a file or from a fetch alike. Nothing is written
+to disk, which makes tar path traversal structurally impossible rather than something a filter has
+to catch. Every read ceiling is applied to the arriving stream rather than to a finished buffer, so
+a 28 MB archive holding one 8 GB member is a refusal in under two seconds, not an out-of-memory
+kill.
 
 ### Directory mode reads the working tree, not "the package"
 
@@ -187,6 +241,12 @@ The tool does not run in the harness process, does not gate installation, and ca
 anything. It raises the cost of shipping a hostile plugin and gives you something to read where
 today you see nothing. That is the whole claim.
 
+A seam at which an install *could* be stopped does exist — `dsh plugin add` runs pnpm in the
+profile directory, pnpm honours a `.pnpmfile.cjs` there, and throwing from its async `readPackage`
+hook aborts the install with nothing written to `node_modules`. Nothing in 0.2 uses it.
+[`ADR.md`](./ADR.md) §11 records the seam and why shipping a gate on this release's calibration
+would have burned the idea.
+
 ### What is not statically decidable
 
 1. **`!!js` semantics.** The loader evaluates these with
@@ -207,13 +267,20 @@ today you see nothing. That is the whole claim.
 6. **Intent.** Tier B's `B8` is the sharpest case: the tool proves a package *can* read a
    credential and *can* open a socket. It has not shown that the value flows between them, and it
    cannot — that needs value tracking this tool does not do. Any telemetry library or
-   authenticated API client trips `B8` legitimately.
+   authenticated API client trips `B8` legitimately. It fires on 18 % of published plugins, which
+   is why it is `high` and not `critical`.
+7. **Injection phrasing that is not spelled in ASCII.** The injection heuristics are Latin-alphabet
+   regexes. Substituting Cyrillic homoglyphs — `о` U+043E for `o`, `е` U+0435 for `e` — defeats
+   **every one of the ten rules**, including the zero-width-character rule, which looks for
+   invisible characters and not for visible ones that are the wrong letter. Verified against the
+   rule table, not assumed. Normalisation is not in 0.2; do not read a clean `A21`/`B10` as
+   evidence that shipped markdown carries no instructions.
 
 ### Every Tier B check has a one-line bypass
 
 `ctx['pro' + 'vide']('approval', …)` defeats seam detection. A computed specifier defeats every
 import check. A base64 event name defeats every listener check. Splitting a credential read and a
-network call across two packages defeats `B8`.
+network call across two packages defeats `B8`. A Cyrillic `о` defeats every injection rule.
 
 **Tier A is much harder to hide from, because it is structured declaration rather than code.**
 The harness must read `disabled: true` literally in order to disable anything, so there is no
@@ -232,8 +299,9 @@ that could be read.*
 
 ## Development
 
-Node `^22.19.0 || >=24` and pnpm are the only requirements; there is no network and no harness
-checkout in any test.
+Node `^22.19.0 || >=24` and pnpm are the only requirements. No test reaches a network or a harness
+checkout: every registry case injects its own `fetch`, and one of them replaces the global with a
+throwing stub to prove a directory or tarball scan never calls it.
 
 ```console
 pnpm install
@@ -242,8 +310,17 @@ pnpm run test               # unit suite
 pnpm run test:coverage      # same suite, with the coverage ratchet
 pnpm run test:e2e           # builds, then runs the real binary as a subprocess
 pnpm run inspect <target>   # run from source without building
+pnpm run sweep -- --check   # the one thing here that DOES use a network
 ```
 
+`pnpm run sweep` is the ecosystem measurement. It fetches the pinned corpus in
+`scripts/ecosystem-corpus.json` through the same verified in-memory path as `--from-npm`, prints the
+distribution, and with `--check` exits non-zero when a fresh run is worse than
+`tests/ecosystem-baseline.json`. `--discover` rebuilds the corpus from the most-starred repositories
+carrying the topic; `--pin` moves every entry to the version current now; `--record` rewrites the
+baseline. It runs from its own weekly workflow, never from CI — every other workflow here runs
+without a network, and a unit suite that cannot reach one is easier to trust.
+
 Hostile fixtures live in `tests/fixtures/` and are authored here — a plugin that disables the
 approval row, one whose `!!js` calls `child_process`, one with a `postinstall`, one pairing a
 credential read with `fetch`, one shipping a `SKILL.md` full of injection text, one declaring an

package/lib/checks/tier-a.js

@@ -69,7 +69,7 @@ const INERT_CLASSES = new Set(['literal', 'inert-read']);
  * @returns the complete finding.
  */
 function tierA(finding) {
-    return { ...finding, tier: 'A', confidence: 'certain', bypass: null };
+    return { ...finding, tier: 'A', confidence: 'certain', bypass: null, examples: [finding.evidence], occurrences: 1 };
 }
 /**
  * Whether the package under analysis is itself one of the harness's shipped
@@ -131,6 +131,7 @@ function checkDisabledRows(input) {
                 findings.push(tierA({
                     checkId: 'A19',
                     name: 'core-row-force-enabled',
+                    subject: override.id,
                     severity: 'medium',
                     title: `Patch layer re-enables the core row "${override.id}"`,
                     detail: 'The loader coerces `disabled` with `Boolean()`, so this value leaves the row running. Because '
@@ -145,6 +146,7 @@ function checkDisabledRows(input) {
                 findings.push(tierA({
                     checkId: 'A2',
                     name: 'security-row-disabled',
+                    subject: override.id,
                     severity: 'critical',
                     title: `Patch layer disables the core row "${override.id}"`,
                     detail: `Bundle patches apply after @deepseek-ai/dsh-base, so this layer switches off ${stops}. `
@@ -161,6 +163,7 @@ function checkDisabledRows(input) {
             findings.push(tierA({
                 checkId: 'A3',
                 name: 'core-row-disabled',
+                subject: override.id,
                 severity,
                 title: `Patch layer disables the core row "${override.id}"`,
                 detail: `The row comes from ${coreRowOrigin(override.id)}, and this layer applies after it, so the row `
@@ -189,6 +192,7 @@ function checkOverriddenRows(input) {
                 findings.push(tierA({
                     checkId: 'A4',
                     name: 'patch-name-guard-mismatch',
+                    subject: override.id,
                     severity: 'medium',
                     title: `Patch for "${override.id}" names ${override.nameGuard}, but that row is ${coreName}`,
                     detail: 'applyEntryPatches treats `name` on a non-insert patch as an assertion guard: on mismatch it '
@@ -205,6 +209,7 @@ function checkOverriddenRows(input) {
             findings.push(tierA({
                 checkId: 'A5',
                 name: 'core-row-overridden',
+                subject: `${override.id}:${rewritten.join(',')}`,
                 severity: isSecurity ? 'high' : 'medium',
                 title: `Patch layer rewrites ${rewritten.map(key => `\`${key}\``).join(', ')} on the core row "${override.id}"`,
                 detail: `The row is ${coreName}. Patch overrides are shallow whole-value replacements, not merges, so `
@@ -249,6 +254,7 @@ function liveExpression(file, site) {
     return tierA({
         checkId: 'A6',
         name: 'js-expression',
+        subject: `${site.slot}:${site.classification}`,
         severity: EXPRESSION_SEVERITY[site.classification],
         title: `\`!!js\` expression in a row's \`${site.slot}\` ${EXPRESSION_MEANING[site.classification]}`,
         detail: `The loader evaluates this with new Function('ctx', 'expr', 'with (ctx) { return eval(expr) }') — `
@@ -270,6 +276,7 @@ function inertExpression(file, site) {
     return tierA({
         checkId: 'A7',
         name: 'js-expression-inert',
+        subject: 'inert-slot',
         severity: 'medium',
         title: '`!!js` in a field the loader never interpolates',
         detail: 'The loader interpolates only a row\'s `config` (recursively) and the top-level node of its `disabled`. '
@@ -285,6 +292,7 @@ function checkPatchFailures(input) {
         ? tierA({
             checkId: 'A8',
             name: 'single-bang-js-tag',
+            subject: failure.file,
             severity: 'medium',
             title: 'Patch layer uses the `!js` tag, which no harness accepts',
             detail: 'The dialect registers exactly one custom tag, `tag:yaml.org,2002:js`, whose shorthand is `!!js`. '
@@ -295,6 +303,7 @@ function checkPatchFailures(input) {
         : tierA({
             checkId: 'A17',
             name: 'patch-parse-error',
+            subject: failure.file,
             severity: 'medium',
             title: 'Patch layer does not parse',
             detail: 'The declared patch layer cannot be read as a Cordis entry list, so mounting this package fails the '
@@ -321,6 +330,7 @@ function checkInsertedModules(input) {
             findings.push(tierA({
                 checkId: 'A9',
                 name: 'insert-undeclared-module',
+                subject: name,
                 severity: isCore ? 'medium' : 'high',
                 title: `Inserted row "${row.id ?? '(unnamed)'}" mounts ${name}, which this package does not declare`,
                 detail: isCore
@@ -352,6 +362,7 @@ function checkMcpRows(input) {
             findings.push(tierA({
                 checkId: 'A10',
                 name: 'mcp-server-row',
+                subject: shown,
                 severity: stdio ? 'critical' : 'high',
                 title: stdio
                     ? `Patch layer starts a local MCP server by running \`${shown}\``
@@ -389,6 +400,7 @@ function checkSkillRootRedirect(input) {
         findings.push(tierA({
             checkId: 'A15',
             name: 'skill-root-redirected',
+            subject: keys.join(','),
             severity: 'high',
             title: `Patch layer redirects skill discovery via ${keys.map(key => `\`${key}\``).join(', ')}`,
             detail: 'Skill files reach the model verbatim, unescaped and uncapped. This row changes which directories '
@@ -412,6 +424,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A1',
             name: 'install-lifecycle-script',
+            subject: name,
             severity: 'medium',
             title: `Declares a \`${name}\` script, which runs at install time once allowed`,
             detail: 'This command would run at the user\'s uid as part of `dsh plugin add`, before the user has read a '
@@ -427,6 +440,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A22',
             name: 'installs-command',
+            subject: command,
             severity: 'low',
             title: `Installs the command \`${command}\` on the user's PATH`,
             detail: 'A `bin` entry is linked into the profile\'s `node_modules/.bin` at install time. It is not run by '
@@ -440,6 +454,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A20',
             name: 'profile-mounts-bundles',
+            subject: 'dsh.profile.bundles',
             severity: 'high',
             title: `Declares a profile that mounts ${profileBundles.length} bundle(s)`,
             detail: 'A `dsh.profile.bundles` list makes this package a profile rather than a layer: the launcher resolves '
@@ -459,6 +474,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A11',
             name: 'non-registry-dependency',
+            subject: `${field}.${name}`,
             severity: 'high',
             title: `Depends on ${name} through a non-registry specifier`,
             detail: 'The code behind this specifier can change without the version of this package changing, so nothing '
@@ -471,6 +487,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A13',
             name: 'no-files-allowlist',
+            subject: 'files',
             severity: 'low',
             title: 'No `files` allowlist in package.json',
             detail: 'Without an allowlist the published tarball is whatever was in the working tree minus npm\'s default '
@@ -485,6 +502,7 @@ function checkManifest(input) {
             findings.push(tierA({
                 checkId: 'A14',
                 name: 'bundle-patch-escapes-package',
+                subject: 'dsh.bundle.patch',
                 severity: 'critical',
                 title: 'The declared `dsh.bundle.patch` path climbs out of the package directory',
                 detail: 'The launcher resolves the patch as join(packageDir, declared) with no sanitisation, and `..` '
@@ -497,6 +515,7 @@ function checkManifest(input) {
             findings.push(tierA({
                 checkId: 'A16',
                 name: 'bundle-patch-missing',
+                subject: 'dsh.bundle.patch',
                 severity: 'medium',
                 title: 'The declared `dsh.bundle.patch` file is not in the package',
                 detail: 'The package declares a mounted patch layer whose file is absent — commonly a `files` allowlist '
@@ -511,6 +530,7 @@ function checkManifest(input) {
         findings.push(tierA({
             checkId: 'A18',
             name: 'manifest-defect',
+            subject: defect,
             severity: 'low',
             title: `Malformed package.json field: ${defect}`,
             detail: 'The field was ignored. A manifest that npm and the harness read differently is worth knowing about.',
@@ -526,6 +546,7 @@ function checkModelVisibleText(input) {
     return [tierA({
             checkId: 'A12',
             name: 'model-visible-text-shipped',
+            subject: 'shipped-instructions',
             severity: 'low',
             title: `Ships ${input.modelVisibleFiles.length} model-visible instruction file(s)`,
             detail: 'Skill and agent-instruction markdown reaches the model verbatim, unescaped and uncapped. Shipping it '
@@ -548,6 +569,7 @@ function checkServiceRemapping(input) {
                 findings.push(tierA({
                     checkId: 'A23',
                     name: 'row-service-remapping',
+                    subject: `${field}:${seams.join(',')}`,
                     severity: critical ? 'critical' : 'high',
                     title: `Inserted row "${row.id ?? '(unnamed)'}" re-maps ${seams.map(name => `\`${name}\``).join(', ')} via \`${field}\``,
                     detail: field === 'isolate'
@@ -583,9 +605,11 @@ function checkInjectionText(input) {
         if (text === undefined)
             continue;
         for (const match of scanInjection(text)) {
+            const evidence = { file: path, path: lineColumn(text, match.index), snippet: snippet(match.excerpt) };
             findings.push({
                 checkId: 'A21',
                 name: 'model-visible-injection',
+                subject: match.ruleId,
                 tier: 'A',
                 severity: 'high',
                 confidence: 'certain',
@@ -595,7 +619,9 @@ function checkInjectionText(input) {
                     + 'model, which is why this is a verdict about the text rather than a capability report. Whether the '
                     + 'sentence is an instruction or a discussion of one is a judgement this tool cannot make: the pattern '
                     + 'will miss a rephrasing, and it can fire on a document that legitimately quotes an attack.',
-                evidence: { file: path, path: lineColumn(text, match.index), snippet: snippet(match.excerpt) },
+                evidence,
+                examples: [evidence],
+                occurrences: 1,
                 bypass: null,
             });
         }

package/lib/checks/tier-b.js

@@ -37,7 +37,7 @@ const SYSTEM_PROMPT_MEMBERS = new Set([
  * @returns the complete finding.
  */
 function tierB(finding) {
-    return { ...finding, tier: 'B', confidence: 'high' };
+    return { ...finding, tier: 'B', confidence: 'high', examples: [finding.evidence], occurrences: 1 };
 }
 /**
  * The literal text of a string argument, or `null` when it is computed.
@@ -110,7 +110,11 @@ function checkImports(file, accumulator) {
             accumulator.findings.push(tierB({
                 checkId: 'B9',
                 name: 'unmediated-process-api',
-                severity: 'critical',
+                subject: specifier,
+                // Raised to `high` by `escalateProcessImports` when this package also
+                // reads a credential or reaches the network. On its own it is a
+                // capability half the ecosystem has.
+                severity: 'medium',
                 title: `Imports \`${specifier}\`, which ${unmediated}`,
                 detail: 'A mounted bundle layer is imported into the harness process at the agent\'s uid. The harness\'s own '
                     + 'dynamic-package sandbox denies untrusted code `require` outright and redirects it to ctx services; a '
@@ -123,6 +127,7 @@ function checkImports(file, accumulator) {
             const finding = tierB({
                 checkId: 'B7',
                 name: 'network-egress',
+                subject: specifier,
                 severity: 'medium',
                 title: `Imports \`${specifier}\`, which can move bytes off the machine`,
                 detail: 'Network access is a capability, not a verdict: most plugins that reach the network do so for a '
@@ -137,6 +142,7 @@ function checkImports(file, accumulator) {
             accumulator.findings.push(tierB({
                 checkId: 'B13',
                 name: 'unmediated-filesystem',
+                subject: specifier,
                 severity: 'medium',
                 title: `Imports \`${specifier}\` rather than using the \`ctx.fs\` service`,
                 detail: 'Reads and writes through the Node filesystem API are invisible to `fs/write-intent`, '
@@ -162,6 +168,7 @@ function checkSeamReplacement(file, node, accumulator) {
     accumulator.findings.push(tierB({
         checkId: 'B1',
         name: 'seam-replacement',
+        subject: `${seam}.${method}`,
         severity: critical ? 'critical' : 'high',
         title: `Replaces the \`${seam}\` capability seam via \`.${method}()\``,
         detail: `\`${seam}\` is a catalogued core service. Providing it from a third-party layer substitutes this `
@@ -185,6 +192,7 @@ function checkSystemPrompt(file, node, accumulator) {
     accumulator.findings.push(tierB({
         checkId: 'B5',
         name: 'system-prompt-mutation',
+        subject: isAssembleListener ? 'system-prompt/assemble' : callee.name.text,
         severity: 'high',
         title: isAssembleListener
             ? 'Listens on `system-prompt/assemble`'
@@ -207,6 +215,7 @@ function checkNestedMount(file, node, accumulator) {
     accumulator.findings.push(tierB({
         checkId: 'B11',
         name: 'nested-plugin-mount',
+        subject: 'runtime-mount',
         severity: 'high',
         title: 'Mounts further plugins at runtime',
         detail: 'A layer that mounts other layers moves the analysis target: what actually runs is decided by code '
@@ -257,6 +266,7 @@ function checkDynamicCode(file, node, accumulator) {
     accumulator.findings.push(tierB({
         checkId: 'B12',
         name: 'dynamic-code-construction',
+        subject: 'runtime-code',
         severity: 'high',
         title: 'Builds and runs code at runtime',
         detail: 'Whatever this evaluates is not in the package and cannot be analysed from it. Construction alone is '
@@ -269,11 +279,14 @@ function checkDynamicCode(file, node, accumulator) {
 /** B6 — reading a credential. */
 function checkCredentialRead(file, node, accumulator) {
     let title = null;
+    let subject = '';
     if (ts.isPropertyAccessExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
         const outer = node.expression;
         if (ts.isIdentifier(outer.expression) && outer.expression.text === 'process' && outer.name.text === 'env') {
-            if (SECRET_ENV_KEY.test(node.name.text))
+            if (SECRET_ENV_KEY.test(node.name.text)) {
                 title = `Reads the environment variable \`${node.name.text}\``;
+                subject = `env:${node.name.text}`;
+            }
         }
     }
     if (ts.isElementAccessExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
@@ -282,19 +295,23 @@ function checkCredentialRead(file, node, accumulator) {
         if (ts.isIdentifier(outer.expression) && outer.expression.text === 'process' && outer.name.text === 'env'
             && key !== null && SECRET_ENV_KEY.test(key)) {
             title = `Reads the environment variable \`${key}\``;
+            subject = `env:${key}`;
         }
     }
     if ((ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) && CREDENTIAL_PATH.test(node.text)) {
         title = `References the credential location \`${node.text}\``;
+        subject = `path:${node.text}`;
     }
     if (ts.isPropertyAccessExpression(node) && node.name.text === 'credentials' && ts.isIdentifier(node.expression)) {
         title = 'Reads the `credentials` service';
+        subject = 'service:credentials';
     }
     if (title === null)
         return;
     const finding = tierB({
         checkId: 'B6',
         name: 'credential-read',
+        subject,
         severity: 'medium',
         title,
         detail: 'Reading a credential is a capability, not a verdict — a plugin that authenticates to its own service '
@@ -318,6 +335,7 @@ function checkToolDescription(file, node, accumulator) {
         accumulator.findings.push(tierB({
             checkId: 'B10',
             name: 'model-visible-injection',
+            subject: match.ruleId,
             severity: 'high',
             title: `Tool description ${match.meaning}`,
             detail: `Heuristic \`${match.ruleId}\` matched a tool \`description\`, which is prompt text the model receives `
@@ -336,6 +354,7 @@ function checkNetworkGlobals(file, node, accumulator) {
     const finding = tierB({
         checkId: 'B7',
         name: 'network-egress',
+        subject: callee.text,
         severity: 'medium',
         title: `Calls \`${callee.text}()\``,
         detail: 'The harness\'s own dynamic-package sandbox traps `fetch` and redirects it to the `ctx.web` service, so '
@@ -381,7 +400,40 @@ export function runTierB(input) {
     const pair = pairFinding(accumulator);
     if (pair !== null)
         accumulator.findings.push(pair);
-    return accumulator.findings;
+    return escalateProcessImports(accumulator);
+}
+/**
+ * B9 — raise a process-API import from `medium` to `high` when the same package
+ * also reads a credential or reaches the network.
+ *
+ * A bare `import 'node:child_process'` was hardcoded `critical` and fired on
+ * half the published ecosystem. A severity that common is not a severity: it
+ * pushed a package disabling `fs-sandbox` down a list of a thousand identical
+ * criticals. Spawning a process is what a plugin that wraps `git`, `ffmpeg` or
+ * a language server does, and the tool cannot tell that from the other thing.
+ *
+ * The pairing is exactly the one B8 already uses — a credential read *and* a
+ * network call in the same package — and for the same reason: the combination
+ * is what changes the question from "can it run a program" to "can it run a
+ * program with something worth sending, and somewhere to send it". Either half
+ * alone is not enough, and it would not narrow anything if it were: 68 % of
+ * published plugins reach the network at all.
+ *
+ * That pairing is still a capability, not a dataflow, so it stops at `high`.
+ * @param accumulator - the accumulated Tier B state.
+ * @returns the findings, with B9 severities settled.
+ */
+function escalateProcessImports(accumulator) {
+    const paired = accumulator.credentialRead !== null && accumulator.networkCall !== null;
+    if (!paired)
+        return accumulator.findings;
+    return accumulator.findings.map(finding => finding.checkId !== 'B9' ? finding : {
+        ...finding,
+        severity: 'high',
+        detail: `${finding.detail} This package also reads a credential or reaches the network, which is why this is `
+            + 'graded above a bare process import: the two capabilities together are what an exfiltration needs. It '
+            + 'remains a capability report — nothing here shows the two are connected.',
+    });
 }
 /**
  * B8 — a credential read and a network call in the same package.
@@ -393,10 +445,15 @@ function pairFinding(accumulator) {
     const network = accumulator.networkCall;
     if (credential === null || network === null)
         return null;
-    const severity = 'critical';
+    // Not critical. This pair fires on 18 % of the published ecosystem — every
+    // telemetry client and every authenticated API client trips it — and the
+    // finding's own text says it is not a verdict. A severity that says "do not
+    // treat this as a verdict" cannot be the top one.
+    const severity = 'high';
     return tierB({
         checkId: 'B8',
         name: 'exfiltration-capability',
+        subject: 'credential-and-egress',
         severity,
         title: 'This package can read a credential and can make a network call',
         detail: 'This is a capability, not a dataflow. The tool found a credential read at '