dsh-plugin-inspector 0.2.1 → 0.4.0

package/lib/checks/tier-b.js

@@ -20,8 +20,35 @@ import { NETWORK_MODULES, SEAM_KEYS, SECURITY_SEAM_KEYS, UNMEDIATED_FS_MODULES,
 const NETWORK_GLOBALS = new Set(['fetch', 'WebSocket', 'EventSource', 'XMLHttpRequest']);
 /** `process.env` keys whose names say they hold a secret. */
 const SECRET_ENV_KEY = /(?:^|_)(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|APIKEY|SESSION)(?:_|$)|API_?KEY|ACCESS_?TOKEN/i;
-/** Filesystem locations that hold credentials. */
-const CREDENTIAL_PATH = /(?:\.npmrc|\.netrc|\.ssh\/|id_rsa|id_ed25519|\.aws\/|\.docker\/config\.json|\.git-credentials|credentials\.json|\.dsh\/credentials|\.env(?:\.[a-z]+)?$)/i;
+/**
+ * Filesystem locations that hold credentials.
+ *
+ * A table rather than one regular expression so each location can be pinned by
+ * name: `tests/unit/rule-tables.spec.ts` iterates this export, and a location
+ * added without a fixture fails there.
+ */
+export const CREDENTIAL_PATHS = [
+    { id: 'npmrc', pattern: String.raw `\.npmrc` },
+    { id: 'netrc', pattern: String.raw `\.netrc` },
+    { id: 'ssh-directory', pattern: String.raw `\.ssh\/` },
+    { id: 'ssh-key-rsa', pattern: 'id_rsa' },
+    { id: 'ssh-key-ed25519', pattern: 'id_ed25519' },
+    { id: 'aws-directory', pattern: String.raw `\.aws\/` },
+    { id: 'docker-config', pattern: String.raw `\.docker\/config\.json` },
+    { id: 'git-credentials', pattern: String.raw `\.git-credentials` },
+    { id: 'service-account-json', pattern: String.raw `credentials\.json` },
+    { id: 'dsh-credentials', pattern: String.raw `\.dsh\/credentials` },
+    { id: 'dotenv', pattern: String.raw `\.env(?:\.[a-z]+)?$` },
+];
+const CREDENTIAL_PATH = new RegExp(`(?:${CREDENTIAL_PATHS.map(path => path.pattern).join('|')})`, 'i');
+/**
+ * Whether a string names a location that holds credentials.
+ * @param text - the literal text of a string in shipped source.
+ * @returns true when it names one of {@link CREDENTIAL_PATHS}.
+ */
+export function matchesCredentialPath(text) {
+    return CREDENTIAL_PATH.test(text);
+}
 /** Members of `ctx` that construct or evaluate code, or mount further plugins. */
 const DYNAMIC_CODE_CALLEES = new Set([
     'eval', 'runInNewContext', 'runInThisContext', 'runInContext', 'compileFunction',
@@ -71,6 +98,7 @@ function moduleSpecifiers(file) {
     const visit = (node) => {
         if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier !== undefined) {
             const text = literalText(node.moduleSpecifier);
+            /* v8 ignore next -- an import declaration only parses with a string-literal specifier. */
             if (text !== null)
                 found.push({ specifier: text, node });
         }
@@ -298,7 +326,7 @@ function checkCredentialRead(file, node, accumulator) {
             subject = `env:${key}`;
         }
     }
-    if ((ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) && CREDENTIAL_PATH.test(node.text)) {
+    if ((ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) && matchesCredentialPath(node.text)) {
         title = `References the credential location \`${node.text}\``;
         subject = `path:${node.text}`;
     }
@@ -375,6 +403,7 @@ export function runTierB(input) {
     const accumulator = { findings: [], credentialRead: null, networkCall: null };
     for (const path of input.sourceFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `sourceFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
         const file = {
@@ -450,15 +479,18 @@ function pairFinding(accumulator) {
     // finding's own text says it is not a verdict. A severity that says "do not
     // treat this as a verdict" cannot be the top one.
     const severity = 'high';
+    /* v8 ignore start -- `at()` records a line and column for every finding these two come from. */
+    const credentialSite = `${credential.evidence.file}:${credential.evidence.path ?? '?'}`;
+    const networkSite = `${network.evidence.file}:${network.evidence.path ?? '?'}`;
+    /* v8 ignore stop */
     return tierB({
         checkId: 'B8',
         name: 'exfiltration-capability',
         subject: 'credential-and-egress',
         severity,
         title: 'This package can read a credential and can make a network call',
-        detail: 'This is a capability, not a dataflow. The tool found a credential read at '
-            + `${credential.evidence.file}:${credential.evidence.path ?? '?'} and a network call at `
-            + `${network.evidence.file}:${network.evidence.path ?? '?'}. It has NOT shown that the credential value `
+        detail: `This is a capability, not a dataflow. The tool found a credential read at ${credentialSite} `
+            + `and a network call at ${networkSite}. It has NOT shown that the credential value `
             + 'reaches the request, and it cannot: proving that needs value tracking this tool does not do. Many '
             + 'legitimate packages — any telemetry or authenticated API client — trip this pair for good reasons. Treat '
             + 'it as a prompt to read those two sites, not as a verdict.',

package/lib/checks/tier-c.js

@@ -40,6 +40,7 @@ function checkMinification(input) {
     const findings = [];
     for (const path of input.sourceFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `sourceFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
         const lines = text.split('\n');
@@ -64,6 +65,7 @@ function checkMinification(input) {
                 + `that long are ${Math.round(longBytes * 100 / Math.max(text.length, 1))}% of the file. Capability `
                 + 'detection reads syntax, and it reads minified syntax no better than a person does. Every Tier B '
                 + 'negative for this package is unreliable while a file like this is in it.',
+            /* v8 ignore next -- `split` returns at least one element for any string, so the fallback is unreachable. */
             evidence: { file: path, path: '1:1', snippet: snippet(lines[0] ?? '') },
             bypass: 'none — this finding is about the analysis, not about the plugin',
         }));
@@ -75,6 +77,7 @@ function checkDynamicDispatch(input) {
     const findings = [];
     for (const path of input.sourceFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `sourceFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
         const source = ts.createSourceFile(path, text, ts.ScriptTarget.ESNext, true, ts.ScriptKind.TS);
@@ -156,9 +159,11 @@ function isDispatchReceiver(node) {
 function receiverName(node) {
     if (ts.isIdentifier(node))
         return node.text;
+    /* v8 ignore start -- only called after `isDispatchReceiver`, which accepts these two forms and no other. */
     if (ts.isPropertyAccessExpression(node))
         return node.name.text;
     return '?';
+    /* v8 ignore stop */
 }
 /**
  * Whether a node builds a string at runtime rather than naming one. A plain
@@ -217,6 +222,7 @@ function checkSourcelessBuild(input) {
             detail: 'What runs is the built output, so that is what this tool analysed — but there is nothing in the '
                 + 'package to check the build against. Whether the source that produced it matches the repository is not '
                 + 'decidable from here.',
+            /* v8 ignore next -- guarded by `built.length > 0` two lines above. */
             evidence: { file: built[0] ?? '', snippet: snippet(built.slice(0, 5).join(', ')) },
             bypass: 'none — this finding is about the analysis, not about the plugin',
         }));
@@ -255,6 +261,7 @@ function checkUnreadableFiles(input) {
             ? 'Binary payloads — native addons, WebAssembly, archives — are shipped code this tool cannot read at all. '
                 + 'A mounted layer can load a `.node` addon with no restriction whatsoever.'
             : 'These files exceeded a size or count cap and were not read. Nothing is claimed about their contents.',
+        /* v8 ignore next -- a reason only appears in the map once a path was pushed under it. */
         evidence: { file: paths[0] ?? '', snippet: snippet(paths.slice(0, 8).join(', ')) },
         bypass: 'none — this finding is about the analysis, not about the plugin',
     }));
@@ -278,6 +285,23 @@ function checkPatchWalkLimit(input) {
         bypass: 'none — this finding is about the analysis, not about the plugin',
     }));
 }
+/** C7 — a patch layer whose rows are assembled out of YAML anchors and aliases. */
+function checkPatchAliases(input) {
+    return input.patches.filter(patch => patch.aliased).map(patch => tierC({
+        checkId: 'C7',
+        name: 'patch-uses-aliases',
+        subject: patch.file,
+        severity: 'medium',
+        title: `\`${patch.file}\` builds rows out of YAML anchors and aliases`,
+        detail: 'An alias is not a copy: `*a` hands the loader the same node again, so one row in the file can be two '
+            + 'rows in the composed profile, and the row a reader sees under an inert key can be the row that lands in a '
+            + 'live one. This tool expands every alias to its own node before reading the layer, which is what makes the '
+            + 'reading match the loader — but the layer a person reviews and the layer that mounts are no longer the same '
+            + 'document, and no Tier B negative about this package is claimed while that is true.',
+        evidence: { file: patch.file },
+        bypass: 'none — this finding is about the analysis, not about the plugin',
+    }));
+}
 /**
  * Run every Tier C check.
  * @param input - the decoded package.
@@ -290,5 +314,6 @@ export function runTierC(input) {
         ...checkSourcelessBuild(input),
         ...checkUnreadableFiles(input),
         ...checkPatchWalkLimit(input),
+        ...checkPatchAliases(input),
     ];
 }

package/lib/cli.js

@@ -80,6 +80,7 @@ export function parseArgs(argv) {
         return next;
     };
     for (let index = 0; index < argv.length; index += 1) {
+        /* v8 ignore next -- `index` is bounded by the loop condition. */
         const argument = argv[index] ?? '';
         if (argument === '--help' || argument === '-h') {
             process.stdout.write(USAGE);
@@ -152,6 +153,7 @@ export async function main(argv) {
         options = parseArgs(argv);
     }
     catch (error) {
+        /* v8 ignore next -- `parseArgs` refuses a command line only with a UsageError. */
         process.stderr.write(`dsh-inspect: ${error instanceof Error ? error.message : String(error)}\n\n${USAGE}`);
         return EXIT.unanalysable;
     }
@@ -165,6 +167,7 @@ export async function main(argv) {
         return exceedsThreshold(report, options.failOn) ? EXIT.findings : EXIT.clean;
     }
     catch (error) {
+        /* v8 ignore next -- every refusal on the read path is a SourceError, ManifestError or RegistryError. */
         process.stderr.write(`dsh-inspect: ${error instanceof Error ? error.message : String(error)}\n`);
         return EXIT.unanalysable;
     }
@@ -187,6 +190,7 @@ export function reportFatal(error) {
     process.stderr.write(`dsh-inspect: the analysis could not be completed: ${message}\n`);
     return EXIT.unanalysable;
 }
+/* v8 ignore start -- the process entry, exercised by tests/e2e/cli.e2e.ts against the built CLI rather than by the instrumented unit run. */
 if (import.meta.main) {
     process.on('uncaughtException', (error) => {
         process.exit(reportFatal(error));
@@ -196,3 +200,4 @@ if (import.meta.main) {
     });
     process.exitCode = await main(process.argv.slice(2));
 }
+/* v8 ignore stop */

package/lib/cordis-yaml.js

@@ -28,6 +28,7 @@ const jsExprType = new yaml.Type('tag:yaml.org,2002:js', {
     kind: 'scalar',
     resolve: data => typeof data === 'string',
     construct: (data) => {
+        /* v8 ignore next -- js-yaml calls `construct` only for data its `resolve` accepted, which is a string. */
         if (typeof data !== 'string')
             throw new TypeError('!!js requires a scalar string');
         return { __jsExpr: data };
@@ -44,35 +45,77 @@ export const patchSchema = yaml.JSON_SCHEMA.extend(jsExprType);
 export const EXPRESSION_CLASSES = [
     'literal', 'inert-read', 'harness-call', 'call', 'mutation', 'module-access', 'unparseable',
 ];
-/** Nodes one patch layer may be walked through before the walk gives up. */
+/**
+ * The two ceilings that make reading a patch layer terminate.
+ *
+ * They apply to {@link expandAliases}, and through it to everything downstream:
+ * the walk runs over the tree the expansion produced, which holds at most
+ * `MAX_WALK_NODES` nodes nested at most `MAX_WALK_DEPTH` deep, so the walk needs
+ * no ceiling of its own.
+ */
 export const MAX_WALK_NODES = 200_000;
-/** Nesting one patch layer may reach before the walk gives up. */
+/** Nesting one patch layer may reach before the reader gives up. */
 export const MAX_WALK_DEPTH = 200;
 /**
- * Charge one node against the budget, and refuse a node already walked.
- * @param budget - the shared budget.
- * @param value - the node about to be walked.
- * @param depth - the current nesting depth.
- * @returns true when the walk may descend into this node.
+ * Materialise a parsed patch layer's alias graph as a tree, so that every
+ * occurrence of an anchored node is a distinct node at its own path.
+ *
+ * js-yaml resolves `*a` to the *same JavaScript object* as `&a`, not to a copy.
+ * A reader that walks the result as a graph and skips an object it has already
+ * seen therefore attributes an anchored node to whichever position it reached
+ * first and drops every other one — which is how a row anchored in an inert
+ * `inject:` slot and aliased into a real patch slot came to be read as inert
+ * and analysed no further. The loader has no such notion: `interpolate` in
+ * `vendor/loader/src/config/utils.ts` maps over arrays and objects as a tree
+ * and evaluates each occurrence it reaches, and `applyEntryPatches` reads each
+ * element of the patch list on its own. Expanding first makes this module agree
+ * with both.
+ *
+ * The expansion is bounded, which is what keeps an alias bomb from becoming a
+ * hang: a 475-byte file can describe 100 nodes with 31 billion paths through
+ * them, and materialising those paths is exactly the non-terminating walk the
+ * ceilings exist to stop. Past either ceiling the subtree becomes `null` and
+ * the limit is recorded, so a truncated read is reported rather than presented
+ * as a complete one.
+ * @param entries - the entry list js-yaml returned.
+ * @returns the expanded entries, whether an alias was used, and the ceiling hit.
  */
-function admit(budget, value, depth) {
-    if (budget.limit !== null)
-        return false;
-    if (depth > MAX_WALK_DEPTH) {
-        budget.limit = 'depth';
-        return false;
-    }
-    budget.nodes += 1;
-    if (budget.nodes > MAX_WALK_NODES) {
-        budget.limit = 'nodes';
-        return false;
-    }
-    if (typeof value !== 'object' || value === null)
-        return true;
-    if (budget.visited.has(value))
-        return false;
-    budget.visited.add(value);
-    return true;
+function expandAliases(entries) {
+    const state = { aliased: false, nodes: 1, limit: null };
+    const seen = new WeakSet([entries]);
+    const expand = (value, depth) => {
+        if (typeof value !== 'object' || value === null)
+            return value;
+        if (state.limit !== null)
+            return null;
+        if (depth > MAX_WALK_DEPTH) {
+            state.limit = 'depth';
+            return null;
+        }
+        state.nodes += 1;
+        if (state.nodes > MAX_WALK_NODES) {
+            state.limit = 'nodes';
+            return null;
+        }
+        if (seen.has(value))
+            state.aliased = true;
+        else
+            seen.add(value);
+        if (Array.isArray(value))
+            return value.map(item => expand(item, depth + 1));
+        const clone = {};
+        for (const [key, child] of Object.entries(value)) {
+            // Assignment would invoke the `__proto__` setter, and js-yaml keeps a
+            // `__proto__` key from the document as an own property precisely so that
+            // it stays data. Defining the property keeps it data here too.
+            Object.defineProperty(clone, key, {
+                value: expand(child, depth + 1), enumerable: true, writable: true, configurable: true,
+            });
+        }
+        return clone;
+    };
+    const expanded = entries.map(entry => expand(entry, 1));
+    return { entries: expanded, aliased: state.aliased, limit: state.limit };
 }
 /** Thrown when the patch file cannot be parsed as an entry list. */
 export class PatchParseError extends Error {
@@ -126,6 +169,7 @@ export function classifyExpression(expression) {
         new Function(`return (${expression})`);
     }
     catch (error) {
+        /* v8 ignore next -- the Function constructor rejects a body only with a SyntaxError. */
         return { class: 'unparseable', parseError: error instanceof Error ? error.message : String(error) };
     }
     const source = ts.createSourceFile('expr.ts', `(${expression})`, ts.ScriptTarget.ESNext, false, ts.ScriptKind.TS);
@@ -218,8 +262,6 @@ function isInertCall(node) {
  * @param depth - the current nesting depth.
  */
 function collect(value, path, slot, sink, depth) {
-    if (!admit(sink.budget, value, depth))
-        return;
     if (isJsExpr(value)) {
         const classified = classifyExpression(value.__jsExpr);
         sink.expressions.push({
@@ -294,8 +336,6 @@ function isTreeCarrier(entry) {
 function walkRow(value, path, intoGroupId, sink, depth) {
     if (!isRecord(value))
         return;
-    if (!admit(sink.budget, value, depth))
-        return;
     const carrier = isTreeCarrier(value);
     sink.inserts.push({
         path,
@@ -334,8 +374,6 @@ function walkPatchList(list, prefix, sink, depth) {
         const path = `${prefix}[${index}]`;
         if (!isRecord(patch))
             continue;
-        if (!admit(sink.budget, patch, depth))
-            continue;
         const id = typeof patch.id === 'string' ? patch.id : null;
         if (Array.isArray(patch.insert)) {
             for (const [rowIndex, row] of patch.insert.entries()) {
@@ -365,29 +403,27 @@ function walkPatchList(list, prefix, sink, depth) {
  * @throws PatchParseError when the text is not a loadable entry list.
  */
 export function parsePatchDocument(file, text) {
-    let document;
+    let loaded;
     try {
-        document = yaml.load(text, { schema: patchSchema });
+        loaded = yaml.load(text, { schema: patchSchema });
     }
     catch (error) {
+        /* v8 ignore next -- js-yaml rejects a document only with a YAMLException. */
         const message = error instanceof Error ? error.message : String(error);
         throw new PatchParseError(message, /(?<!!)!js(?![a-zA-Z0-9_-])/.test(text));
     }
-    if (!Array.isArray(document)) {
+    if (!Array.isArray(loaded)) {
         throw new PatchParseError('a patch layer must be a top-level array of entries', false);
     }
-    const sink = {
-        overrides: [],
-        inserts: [],
-        expressions: [],
-        budget: { visited: new WeakSet(), nodes: 0, limit: null },
-    };
-    walkPatchList(document, '', sink, 0);
+    const expansion = expandAliases(loaded);
+    const sink = { overrides: [], inserts: [], expressions: [] };
+    walkPatchList(expansion.entries, '', sink, 0);
     return {
         file,
         overrides: sink.overrides,
         inserts: sink.inserts,
         expressions: sink.expressions,
-        limit: sink.budget.limit,
+        limit: expansion.limit,
+        aliased: expansion.aliased,
     };
 }

package/lib/files.js

@@ -34,6 +34,7 @@ export function isSourceFile(path) {
  */
 export function isModelVisibleText(path) {
     const segments = path.split('/');
+    /* v8 ignore next -- `split` returns at least one element for any string. */
     const base = segments.at(-1) ?? '';
     if (base === 'SKILL.md' || base === 'AGENTS.md' || base === 'CLAUDE.md')
         return true;
@@ -49,6 +50,7 @@ export function isModelVisibleText(path) {
  * @returns true for a cordis YAML file.
  */
 export function isCordisConfigFile(path) {
+    /* v8 ignore next -- `split` returns at least one element for any string. */
     const base = path.split('/').at(-1) ?? '';
     return /cordis/.test(base) && (base.endsWith('.yml') || base.endsWith('.yaml'));
 }

package/lib/injection.js

@@ -62,6 +62,22 @@ export const INJECTION_RULES = [
         pattern: /[\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff]|[\u{E0000}-\u{E007F}]/u,
         meaning: 'contains zero-width or bidirectional-control characters, which change what a human reader sees but not what the model reads',
     },
+    {
+        // Keyed on a run of four, not on a single selector. One selector is
+        // ordinary: U+FE0F and U+FE0E pick the emoji or text presentation of the
+        // character before them, and the U+E01xx plane carries the Ideographic
+        // Variation Sequences that CJK text uses, so firing on one would fire on
+        // every document with an emoji in it. Nothing standardised puts four in a
+        // row: a variation selector modifies the single character it follows, so a
+        // second one has nothing to modify. GlassWorm's five waves encoded
+        // executable JavaScript one byte per selector, which makes any real payload
+        // an unbroken run of tens to thousands. Four is far below that and above
+        // the doubled selectors that copy-paste through an editor produces.
+        id: 'variation-selector-payload',
+        pattern: /[\uFE00-\uFE0F\u{E0100}-\u{E01EF}]{4,}/u,
+        meaning: 'contains a run of variation selectors, which occupy no width in any editor, terminal or diff '
+            + 'view and can carry an arbitrary encoded payload one byte per selector',
+    },
     {
         id: 'hidden-html-instruction',
         pattern: /<!--[^]{0,400}?\b(?:you (?:must|should|are)|instruction|assistant|ignore)\b[^]{0,400}?-->/i,

package/lib/inspect.js

@@ -9,6 +9,7 @@
  * `cordis-yaml.ts`, and its result is discarded without being called.
  * @module dsh-plugin-inspector/inspect
  */
+import { readFileSync } from 'node:fs';
 import { EXPRESSION_CLASSES, PatchParseError, parsePatchDocument, } from "./cordis-yaml.js";
 import { isCordisConfigFile, isModelVisibleText, isSourceFile, normalizePackagePath } from "./files.js";
 import { HARNESS_REFERENCE } from "./knowledge.js";
@@ -18,8 +19,18 @@ import { loadSource } from "./source.js";
 import { runTierA } from "./checks/tier-a.js";
 import { runTierB } from "./checks/tier-b.js";
 import { NON_DEGRADING_CHECKS, runTierC } from "./checks/tier-c.js";
-/** This tool's own version, reported in the JSON document. */
-export const TOOL_VERSION = '0.1.0';
+/**
+ * This tool's own version, reported in the JSON document, by `--version`, and
+ * in the recorded ecosystem measurement.
+ *
+ * Read from this package's own `package.json` rather than written down a second
+ * time. A constant is a copy that only a release checklist keeps honest, and it
+ * stopped being honest for two releases: every report claimed `0.1.0` while the
+ * published package was `0.2.1`. The manifest sits one directory above this
+ * module in the source tree, in `lib/` after a build, and in the published
+ * tarball, so the same relative path resolves in all three.
+ */
+export const TOOL_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 /** This tool's package name, reported in the JSON document. */
 export const TOOL_NAME = 'dsh-plugin-inspector';
 /**
@@ -97,11 +108,13 @@ export function analyze(source, registry) {
     const patches = [];
     const patchFailures = [];
     if (mounted !== null) {
+        /* v8 ignore next -- `mounted` is non-null only when `source.files` holds that key. */
         const text = source.files.get(mounted) ?? '';
         try {
             patches.push(parsePatchDocument(mounted, text));
         }
         catch (error) {
+            /* v8 ignore next -- `parsePatchDocument` reports every refusal as a PatchParseError. */
             if (!(error instanceof PatchParseError))
                 throw error;
             patchFailures.push({ file: mounted, error });

package/lib/knowledge.js

@@ -291,6 +291,44 @@ export const SKILL_ROOT_CONFIG_KEYS = ['customSkillDirs', 'bundledSkillDir'];
 export const INSTALL_LIFECYCLE_SCRIPTS = [
     'preinstall', 'install', 'postinstall', 'prepare', 'prepublish', 'preprepare', 'postprepare',
 ];
+/**
+ * Command shapes that make an install lifecycle script the attack rather than
+ * the build.
+ *
+ * The case this table is for is the one where the command line itself fetches,
+ * decodes, or evaluates: the whole attack sits in `package.json` and there is
+ * no shipped module to read. A lifecycle hook alone does not distinguish that
+ * from a build, which is why the hook is a category at `medium` and only the
+ * command raises it.
+ *
+ * Each pattern is chosen against the measured false-positive side rather than
+ * against the idea of a build script. The five packages in the pinned corpus
+ * that declare a hook run `tsdown`, `npm run build`, `husky`, and
+ * `node scripts/prepare.mjs`; running a shipped file is what a build hook is, so
+ * that shape is deliberately not a signal here.
+ */
+export const LIFECYCLE_SIGNALS = [
+    {
+        id: 'fetches-remote',
+        pattern: /\b(?:curl|wget|Invoke-WebRequest|iwr)\b/i,
+        meaning: 'fetches a remote resource at install time, so what runs is not what was published',
+    },
+    {
+        id: 'pipes-to-shell',
+        pattern: /\|\s*(?:sudo\s+)?(?:ba|z|k)?sh\b/,
+        meaning: 'pipes its input straight into a shell',
+    },
+    {
+        id: 'evaluates-inline-code',
+        pattern: /\b(?:node|deno|bun|ruby|perl)\s+(?:-\S+\s+)*--?e(?:val)?\b|\bpython3?\s+(?:-\S+\s+)*-c\b/,
+        meaning: 'evaluates code written on the command line, which no published file records',
+    },
+    {
+        id: 'decodes-payload',
+        pattern: /\bbase64\s+(?:-d|-D|--decode)\b|\batob\s*\(|\bBuffer\.from\([^)]*base64/,
+        meaning: 'decodes an encoded payload, which is how a command hides what it runs',
+    },
+];
 /** Entry fields the loader never interpolates: a `!!js` node here is inert data. */
 export const STATIC_ENTRY_FIELDS = [
     'id', 'name', 'group', 'inject', 'intercept', 'isolate',

package/lib/manifest.js

@@ -103,6 +103,7 @@ export function parseManifest(text) {
         parsed = JSON.parse(text);
     }
     catch (error) {
+        /* v8 ignore next -- JSON.parse rejects text only with a SyntaxError. */
         throw new ManifestError(`package.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
     if (!isRecord(parsed))

package/lib/publish.js

@@ -54,6 +54,7 @@ function matchSegments(pattern, path) {
         }
         if (s === path.length)
             return false;
+        /* v8 ignore next -- both indices are checked against their lengths above. */
         if (!matchSegment(pattern[p] ?? '', path[s] ?? ''))
             return false;
         return step(p + 1, s + 1);
@@ -152,6 +153,7 @@ function ignoreMatches(rule, path) {
                 return true;
             continue;
         }
+        /* v8 ignore next -- `end` runs from 1 to `segments.length`, so the index is in range. */
         if (globMatch(rule.pattern, segments[end - 1] ?? ''))
             return true;
     }

package/lib/registry.js

@@ -127,6 +127,7 @@ export async function resolvePackage(spec, options = {}) {
         document = JSON.parse(body.toString('utf8'));
     }
     catch (error) {
+        /* v8 ignore next -- JSON.parse rejects text only with a SyntaxError. */
         throw new RegistryError(`${url} did not return JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
     const record = asRecord(document);

package/lib/report.js

@@ -91,6 +91,7 @@ function wrap(text, width) {
             current = word;
         }
     }
+    /* v8 ignore next -- every wrapped string is a finding's detail, and none is empty. */
     if (current !== '')
         lines.push(current);
     return lines;
@@ -144,9 +145,11 @@ function renderFacts(report, paint) {
                         ? 'yes — the registry marks this package as running one at install time'
                         : 'no — the registry does not mark this package as running one'],
             ],
+        /* v8 ignore start -- `mountsAsBundle` is true exactly when the manifest declared a path. */
         ['mounted layer', facts.mountsAsBundle
                 ? `yes — dsh.bundle.patch = ${facts.bundlePatchPath ?? '?'} (imported into the harness process at the agent's uid)`
                 : 'no — installs as a plain library, and dsh plugin add prints a warning saying so'],
+        /* v8 ignore stop */
         ['browser bundle', facts.shipsClientBundle ? 'yes — dsh.client with an ./client export, executed in the user\'s browser' : 'no'],
         ['rows inserted', facts.insertedRows.length === 0
                 ? 'none'
@@ -176,7 +179,9 @@ function renderFacts(report, paint) {
  * @returns the rendered text, ending in a newline.
  */
 export function renderHuman(report, color) {
+    /* v8 ignore start -- every call site passes a literal key of COLOR. */
     const paint = (code, text) => color ? `${COLOR[code] ?? ''}${text}${COLOR.reset}` : text;
+    /* v8 ignore stop */
     const lines = ['', ...renderFacts(report, paint)];
     if (report.findings.length > 0) {
         const counts = SEVERITIES

package/lib/source.js

@@ -31,11 +31,19 @@ export const MAX_FILE_BYTES = 4 * 1024 * 1024;
 export const MAX_TOTAL_BYTES = 64 * 1024 * 1024;
 /** Largest number of files the analyzer will consider. */
 export const MAX_ENTRIES = 10_000;
+/**
+ * Decompressed tar bytes one tarball may produce before the read is abandoned.
+ *
+ * Eight times the in-memory ceiling. A plugin tarball is never this large, and
+ * one that is has already answered the only question worth asking about it.
+ */
+export const MAX_STREAM_BYTES = 8 * MAX_TOTAL_BYTES;
 /** The shipping ceilings. Tests substitute smaller ones to exercise each cap. */
 export const DEFAULT_LIMITS = {
     maxFileBytes: MAX_FILE_BYTES,
     maxTotalBytes: MAX_TOTAL_BYTES,
     maxEntries: MAX_ENTRIES,
+    maxStreamBytes: MAX_STREAM_BYTES,
 };
 /** Directories never descended into: not shipped, and not the package's own code. */
 const SKIPPED_DIRECTORIES = new Set([
@@ -76,6 +84,7 @@ function countEntry(collector, path) {
  * @param buffer - the file content.
  */
 function store(collector, path, buffer) {
+    /* v8 ignore next 4 -- both callers check the size before reading; this is the same ceiling held at the last point that could still allocate. */
     if (buffer.byteLength > collector.limits.maxFileBytes) {
         collector.skipped.push({ path, reason: 'size-cap' });
         return;
@@ -170,6 +179,7 @@ function stripRoot(entryPath) {
     if (slash < 0)
         return undefined;
     const remainder = normalized.slice(slash + 1);
+    /* v8 ignore next -- an entry name ending in `/` is a directory entry, which the parser never hands to this. */
     if (remainder === '')
         return undefined;
     const segments = [];
@@ -186,13 +196,6 @@ function stripRoot(entryPath) {
     }
     return segments.length === 0 ? undefined : segments.join('/');
 }
-/**
- * Decompressed tar bytes one tarball may produce before the read is abandoned.
- *
- * Eight times the in-memory ceiling. A plugin tarball is never this large, and
- * one that is has already answered the only question worth asking about it.
- */
-export const MAX_STREAM_BYTES = 8 * MAX_TOTAL_BYTES;
 /**
  * A stage that fails the pipeline once the decompressed stream passes a
  * ceiling. Nothing downstream keeps the bytes, but *producing* eight gigabytes
@@ -308,7 +311,7 @@ async function readTarStream(bytes, gzipped, collector) {
         },
     });
     const inflate = gzipped ? createGunzip() : new PassThrough();
-    await pipeline(bytes, inflate, byteCeiling(MAX_STREAM_BYTES), parser);
+    await pipeline(bytes, inflate, byteCeiling(collector.limits.maxStreamBytes), parser);
     await Promise.all(pending);
     if (failure !== null)
         throw failure;