dsh-plugin-inspector 0.3.0 → 0.5.0

package/lib/checks/tier-a.js

@@ -9,9 +9,9 @@
  * @module dsh-plugin-inspector/checks/tier-a
  */
 import { isJsExpr } from "../cordis-yaml.js";
-import { boundedJson, lineColumn, normalizePackagePath, snippet } from "../files.js";
+import { boundedJson, isNativeSource, lineColumn, normalizePackagePath, snippet } from "../files.js";
 import { scanInjection } from "../injection.js";
-import { CORE_ROWS, HARNESS_BUNDLE_PACKAGES, INSTALL_LIFECYCLE_SCRIPTS, LIFECYCLE_SIGNALS, MCP_CLIENT_PACKAGE, SECURITY_ROW_IDS, SECURITY_SEAM_KEYS, SEAM_KEYS, SKILL_FILESYSTEM_ROW, SKILL_ROOT_CONFIG_KEYS, } from "../knowledge.js";
+import { CORE_ROWS, GYP_COMMAND_KEYS, HARNESS_BUNDLE_PACKAGES, INSTALL_LIFECYCLE_SCRIPTS, MCP_CLIENT_PACKAGE, NATIVE_BUILD_FILE, SECURITY_ROW_IDS, SECURITY_SEAM_KEYS, SEAM_KEYS, SKILL_FILESYSTEM_ROW, SKILL_ROOT_CONFIG_KEYS, matchingLifecycleSignals, } from "../knowledge.js";
 import { declaredPackages } from "../manifest.js";
 /**
  * Checks that read a Cordis patch row. None of them may produce a finding
@@ -103,6 +103,7 @@ function coreRowSeverity(id) {
  */
 function coreRowOrigin(id) {
     const row = CORE_ROWS.get(id);
+    /* v8 ignore next -- only called once `coreRowSeverity` has found the id in the same map. */
     if (row === undefined)
         return 'a shipped bundle';
     return row.bundles.map(bundle => `@deepseek-ai/dsh-${bundle}`).join(' and ');
@@ -205,16 +206,16 @@ function checkOverriddenRows(input) {
             const rewritten = override.overriddenKeys.filter(key => key !== 'disabled');
             if (rewritten.length === 0)
                 continue;
-            const isSecurity = SECURITY_ROW_IDS.has(override.id);
+            const provides = SECURITY_ROW_IDS.get(override.id);
             findings.push(tierA({
                 checkId: 'A5',
                 name: 'core-row-overridden',
                 subject: `${override.id}:${rewritten.join(',')}`,
-                severity: isSecurity ? 'high' : 'medium',
+                severity: provides === undefined ? 'medium' : 'high',
                 title: `Patch layer rewrites ${rewritten.map(key => `\`${key}\``).join(', ')} on the core row "${override.id}"`,
                 detail: `The row is ${coreName}. Patch overrides are shallow whole-value replacements, not merges, so `
                     + `overriding \`config\` discards that row's entire shipped configuration rather than adding to it.`
-                    + (isSecurity ? ` This row provides ${SECURITY_ROW_IDS.get(override.id) ?? 'a core constraint'}.` : ''),
+                    + (provides === undefined ? '' : ` This row provides ${provides}.`),
                 evidence: { file: patch.file, path: override.path, snippet: snippet(rewritten.join(', ')) },
             }));
         }
@@ -421,8 +422,9 @@ function checkManifest(input) {
     const { manifest, source } = input;
     const lifecycle = INSTALL_LIFECYCLE_SCRIPTS.filter(name => name in manifest.scripts);
     for (const name of lifecycle) {
+        /* v8 ignore next -- `name` came from filtering the same object's own keys. */
         const command = manifest.scripts[name] ?? '';
-        const signals = LIFECYCLE_SIGNALS.filter(signal => signal.pattern.test(command));
+        const signals = matchingLifecycleSignals(command);
         findings.push(tierA({
             checkId: 'A1',
             name: 'install-lifecycle-script',
@@ -438,8 +440,8 @@ function checkManifest(input) {
                 + (signals.length === 0
                     ? ''
                     : ` The command ${signals.map(signal => signal.meaning).join(', and ')}. A build hook runs something `
-                        + 'this package shipped and this one does not, which is the shape 21.2 % of malicious npm packages '
-                        + 'take: the whole attack inside `package.json`, with no module to read.'),
+                        + 'this package shipped; this one does not. The whole of it is in `package.json`, with no module to '
+                        + 'read.'),
             evidence: { file: 'package.json', path: `scripts.${name}`, snippet: snippet(command) },
         }));
     }
@@ -546,6 +548,88 @@ function checkManifest(input) {
     }
     return findings;
 }
+/**
+ * Whether the package ships anything a native build would compile.
+ *
+ * Skipped files count: a `.cc` the reader passed over for its size is still a
+ * source in the tarball, and claiming a package has none because the analyzer
+ * declined to read one would be wrong in the direction that raises a finding.
+ * @param input - the decoded package.
+ * @returns true when C-family source is present.
+ */
+function shipsNativeSource(input) {
+    const paths = [...input.source.files.keys(), ...input.source.skipped.map(entry => entry.path)];
+    return paths.some(isNativeSource);
+}
+/**
+ * A24 — a native build declaration, which is an install-time execution point
+ * that appears in no entry the manifest declares.
+ *
+ * Tier A because the decidable half is the whole finding: the file is at the
+ * package root or it is not, and npm's default install command for a package
+ * that ships one and declares no `install` or `preinstall` script is
+ * `node-gyp rebuild`. Nothing has to be inferred about the code to know that a
+ * build runs, which is the same standard A1 and A22 are read at — a field npm
+ * itself must read literally in order to act on it.
+ *
+ * **The file is not parsed and never evaluated.** GYP is Python-ish, not JSON:
+ * single-quoted strings, `#` comments, trailing commas, and `conditions` whose
+ * first element is a Python expression written as a string. There is no
+ * maintained JavaScript parser for it — `node-gyp` shells out to Python — so
+ * parsing it here would mean hand-rolling one for an attacker-controlled file,
+ * and evaluating a condition is the one thing this tool may never do. It also
+ * would not change the verdict: what distinguishes a build declaration from a
+ * build step is the presence of an `actions`, `rules` or `postbuilds` key and
+ * the shape of the command line under it, and both are literal text in the file
+ * either way. The severity is therefore keyed on a key match plus the same
+ * command signals A1 grades a lifecycle script by.
+ * @param input - the decoded package.
+ * @returns the finding, or none when the package ships no `binding.gyp`.
+ */
+function checkNativeBuild(input) {
+    const text = input.source.files.get(NATIVE_BUILD_FILE);
+    if (text === undefined)
+        return [];
+    const runsCommands = GYP_COMMAND_KEYS.test(text);
+    const signals = runsCommands ? matchingLifecycleSignals(text) : [];
+    const empty = shipsNativeSource(input) ? '' : ' The package ships no C or C++ source, so there is nothing here for '
+        + 'a compiler to build and the build step is the only effect the file has.';
+    const first = signals[0];
+    let at = 0;
+    if (first !== undefined) {
+        /* v8 ignore next -- `first` is in the list because it matched this same text, so `exec` finds it again. */
+        at = first.pattern.exec(text)?.index ?? 0;
+    }
+    return [tierA({
+            checkId: 'A24',
+            name: 'native-build-declaration',
+            subject: NATIVE_BUILD_FILE,
+            severity: signals.length === 0 ? 'medium' : 'high',
+            title: signals.length === 0
+                ? 'Ships `binding.gyp`, which npm turns into an install-time build'
+                : 'Ships a `binding.gyp` whose build steps run commands rather than a compiler',
+            detail: 'A package that ships this file and declares no `install` or `preinstall` script gets `node-gyp rebuild` '
+                + 'as its install command by default, and `node-gyp` evaluates the file to decide what that build does. The '
+                + 'declaration is in none of the entry points a reader checks: not `main`, not `bin`, not `exports`, and not '
+                + '`scripts`. It runs under the same gate as A1 — pnpm and npm block a dependency\'s build until the package is '
+                + 'named in `allowBuilds` — but reaching that gate takes no key in `package.json` at all, which is why an '
+                + 'ecosystem where install hooks are off by default is one where this path is worth reading.'
+                + (signals.length === 0
+                    ? ' This file declares no `actions`, `rules` or `postbuilds` step whose command line does anything a compile '
+                        + 'does not, so what it describes is a build.'
+                    : ` It declares a build step whose command ${signals.map(signal => signal.meaning).join(', and ')}.`)
+                + empty
+                + ' The file was read as text, never parsed and never evaluated — GYP is Python-ish syntax whose conditions are '
+                + 'Python expressions. Reading it that way is enough to decide that a build runs, which is this finding. It is '
+                + 'not enough to decide what the build does, so the grade above reads the command line the way A1 reads a '
+                + 'lifecycle script\'s.',
+            evidence: {
+                file: NATIVE_BUILD_FILE,
+                path: lineColumn(text, at),
+                snippet: snippet(text.slice(at, at + 400)),
+            },
+        })];
+}
 /** A12 — shipped markdown that reaches the model when it is discovered. */
 function checkModelVisibleText(input) {
     if (input.modelVisibleFiles.length === 0)
@@ -560,6 +644,7 @@ function checkModelVisibleText(input) {
                 + 'in an npm package does not by itself put it in front of the model: it is discovered only when the plugin '
                 + 'registers it through ctx.skills, when a patch row redirects a skill root into this package (A15), or when '
                 + 'something copies it into the user\'s workspace. The text itself is scored separately by B10.',
+            /* v8 ignore next -- the caller returns early on an empty list. */
             evidence: { file: input.modelVisibleFiles[0] ?? '', snippet: snippet(input.modelVisibleFiles.join(', ')) },
         })];
 }
@@ -609,6 +694,7 @@ function checkInjectionText(input) {
     const findings = [];
     for (const path of input.modelVisibleFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `modelVisibleFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
         for (const match of scanInjection(text)) {
@@ -648,6 +734,7 @@ function checkInjectionText(input) {
 export function runTierA(input) {
     const findings = [
         ...checkManifest(input),
+        ...checkNativeBuild(input),
         ...checkDisabledRows(input),
         ...checkOverriddenRows(input),
         ...checkExpressions(input),

package/lib/checks/tier-b.js

@@ -20,8 +20,35 @@ import { NETWORK_MODULES, SEAM_KEYS, SECURITY_SEAM_KEYS, UNMEDIATED_FS_MODULES,
 const NETWORK_GLOBALS = new Set(['fetch', 'WebSocket', 'EventSource', 'XMLHttpRequest']);
 /** `process.env` keys whose names say they hold a secret. */
 const SECRET_ENV_KEY = /(?:^|_)(?:TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|APIKEY|SESSION)(?:_|$)|API_?KEY|ACCESS_?TOKEN/i;
-/** Filesystem locations that hold credentials. */
-const CREDENTIAL_PATH = /(?:\.npmrc|\.netrc|\.ssh\/|id_rsa|id_ed25519|\.aws\/|\.docker\/config\.json|\.git-credentials|credentials\.json|\.dsh\/credentials|\.env(?:\.[a-z]+)?$)/i;
+/**
+ * Filesystem locations that hold credentials.
+ *
+ * A table rather than one regular expression so each location can be pinned by
+ * name: `tests/unit/rule-tables.spec.ts` iterates this export, and a location
+ * added without a fixture fails there.
+ */
+export const CREDENTIAL_PATHS = [
+    { id: 'npmrc', pattern: String.raw `\.npmrc` },
+    { id: 'netrc', pattern: String.raw `\.netrc` },
+    { id: 'ssh-directory', pattern: String.raw `\.ssh\/` },
+    { id: 'ssh-key-rsa', pattern: 'id_rsa' },
+    { id: 'ssh-key-ed25519', pattern: 'id_ed25519' },
+    { id: 'aws-directory', pattern: String.raw `\.aws\/` },
+    { id: 'docker-config', pattern: String.raw `\.docker\/config\.json` },
+    { id: 'git-credentials', pattern: String.raw `\.git-credentials` },
+    { id: 'service-account-json', pattern: String.raw `credentials\.json` },
+    { id: 'dsh-credentials', pattern: String.raw `\.dsh\/credentials` },
+    { id: 'dotenv', pattern: String.raw `\.env(?:\.[a-z]+)?$` },
+];
+const CREDENTIAL_PATH = new RegExp(`(?:${CREDENTIAL_PATHS.map(path => path.pattern).join('|')})`, 'i');
+/**
+ * Whether a string names a location that holds credentials.
+ * @param text - the literal text of a string in shipped source.
+ * @returns true when it names one of {@link CREDENTIAL_PATHS}.
+ */
+export function matchesCredentialPath(text) {
+    return CREDENTIAL_PATH.test(text);
+}
 /** Members of `ctx` that construct or evaluate code, or mount further plugins. */
 const DYNAMIC_CODE_CALLEES = new Set([
     'eval', 'runInNewContext', 'runInThisContext', 'runInContext', 'compileFunction',
@@ -71,6 +98,7 @@ function moduleSpecifiers(file) {
     const visit = (node) => {
         if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier !== undefined) {
             const text = literalText(node.moduleSpecifier);
+            /* v8 ignore next -- an import declaration only parses with a string-literal specifier. */
             if (text !== null)
                 found.push({ specifier: text, node });
         }
@@ -298,7 +326,7 @@ function checkCredentialRead(file, node, accumulator) {
             subject = `env:${key}`;
         }
     }
-    if ((ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) && CREDENTIAL_PATH.test(node.text)) {
+    if ((ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) && matchesCredentialPath(node.text)) {
         title = `References the credential location \`${node.text}\``;
         subject = `path:${node.text}`;
     }
@@ -375,6 +403,7 @@ export function runTierB(input) {
     const accumulator = { findings: [], credentialRead: null, networkCall: null };
     for (const path of input.sourceFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `sourceFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
         const file = {
@@ -450,15 +479,18 @@ function pairFinding(accumulator) {
     // finding's own text says it is not a verdict. A severity that says "do not
     // treat this as a verdict" cannot be the top one.
     const severity = 'high';
+    /* v8 ignore start -- `at()` records a line and column for every finding these two come from. */
+    const credentialSite = `${credential.evidence.file}:${credential.evidence.path ?? '?'}`;
+    const networkSite = `${network.evidence.file}:${network.evidence.path ?? '?'}`;
+    /* v8 ignore stop */
     return tierB({
         checkId: 'B8',
         name: 'exfiltration-capability',
         subject: 'credential-and-egress',
         severity,
         title: 'This package can read a credential and can make a network call',
-        detail: 'This is a capability, not a dataflow. The tool found a credential read at '
-            + `${credential.evidence.file}:${credential.evidence.path ?? '?'} and a network call at `
-            + `${network.evidence.file}:${network.evidence.path ?? '?'}. It has NOT shown that the credential value `
+        detail: `This is a capability, not a dataflow. The tool found a credential read at ${credentialSite} `
+            + `and a network call at ${networkSite}. It has NOT shown that the credential value `
             + 'reaches the request, and it cannot: proving that needs value tracking this tool does not do. Many '
             + 'legitimate packages — any telemetry or authenticated API client — trip this pair for good reasons. Treat '
             + 'it as a prompt to read those two sites, not as a verdict.',

package/lib/checks/tier-c.js

@@ -16,6 +16,7 @@
  */
 import ts from 'typescript';
 import { lineColumn, snippet } from "../files.js";
+import { MAX_EXAMPLES } from "../model.js";
 /** A line longer than this is not written by hand. */
 const MINIFIED_LINE_LENGTH = 500;
 /** Below this many bytes, a low line count says nothing. */
@@ -35,13 +36,26 @@ const NAMED_TARGET_CALLEES = new Set([
 function tierC(finding) {
     return { ...finding, tier: 'C', confidence: 'moderate', examples: [finding.evidence], occurrences: 1 };
 }
-/** C1 — source that is not written to be read. */
-function checkMinification(input) {
-    const findings = [];
+/**
+ * Parse every shipped source file once.
+ * @param input - the decoded package.
+ * @returns one entry per source file, in `sourceFiles` order.
+ */
+function parseSources(input) {
+    const files = [];
     for (const path of input.sourceFiles) {
         const text = input.source.files.get(path);
+        /* v8 ignore next -- `sourceFiles` is filtered from `source.files`'s own keys, so the lookup always hits. */
         if (text === undefined)
             continue;
+        files.push({ path, text, node: ts.createSourceFile(path, text, ts.ScriptTarget.ESNext, true, ts.ScriptKind.TS) });
+    }
+    return files;
+}
+/** C1 — source that is not written to be read. */
+function checkMinification(files) {
+    const findings = [];
+    for (const { path, text } of files) {
         const lines = text.split('\n');
         const longest = lines.reduce((max, line) => Math.max(max, line.length), 0);
         const dense = text.length >= MINIFICATION_SIZE_FLOOR && lines.length < 5;
@@ -64,6 +78,7 @@ function checkMinification(input) {
                 + `that long are ${Math.round(longBytes * 100 / Math.max(text.length, 1))}% of the file. Capability `
                 + 'detection reads syntax, and it reads minified syntax no better than a person does. Every Tier B '
                 + 'negative for this package is unreliable while a file like this is in it.',
+            /* v8 ignore next -- `split` returns at least one element for any string, so the fallback is unreachable. */
             evidence: { file: path, path: '1:1', snippet: snippet(lines[0] ?? '') },
             bypass: 'none — this finding is about the analysis, not about the plugin',
         }));
@@ -71,13 +86,9 @@ function checkMinification(input) {
     return findings;
 }
 /** C2 — names the analyzer cannot resolve without running the code. */
-function checkDynamicDispatch(input) {
+function checkDynamicDispatch(files) {
     const findings = [];
-    for (const path of input.sourceFiles) {
-        const text = input.source.files.get(path);
-        if (text === undefined)
-            continue;
-        const source = ts.createSourceFile(path, text, ts.ScriptTarget.ESNext, true, ts.ScriptKind.TS);
+    for (const { path, text, node: source } of files) {
         const report = (node, what) => {
             findings.push(tierC({
                 checkId: 'C2',
@@ -156,9 +167,11 @@ function isDispatchReceiver(node) {
 function receiverName(node) {
     if (ts.isIdentifier(node))
         return node.text;
+    /* v8 ignore start -- only called after `isDispatchReceiver`, which accepts these two forms and no other. */
     if (ts.isPropertyAccessExpression(node))
         return node.name.text;
     return '?';
+    /* v8 ignore stop */
 }
 /**
  * Whether a node builds a string at runtime rather than naming one. A plain
@@ -189,18 +202,80 @@ function literalOf(node) {
         return node.text;
     return null;
 }
+/**
+ * C8 — identifiers spelled with Unicode escapes.
+ *
+ * An escaped spelling and a plain one are the same identifier: the escape is
+ * resolved in the scanner, before any binding, so the two are the same program
+ * and only a reader sees a difference. That is the whole technique — the file
+ * says one thing to a person and another to the engine.
+ *
+ * It says the same thing to this tool as to the engine. `ts.createSourceFile`
+ * hands back `node.text === 'fetch'` for the escaped form, so every Tier B
+ * check that matches a name matches the escaped spelling too. That is measured
+ * rather than assumed — `tests/unit/detection.spec.ts` runs escaped spellings
+ * through B6, B7, B9 and B12 — which is why this finding sits with C3 in
+ * {@link NON_DEGRADING_CHECKS} rather than making every Tier B negative
+ * unreliable.
+ * @param files - the parsed source files.
+ * @returns one finding for the package, or none.
+ */
+function checkEscapedIdentifiers(files) {
+    const sites = [];
+    for (const { path, text, node: source } of files) {
+        const visit = (node) => {
+            if (ts.isIdentifier(node)) {
+                const start = node.getStart(source);
+                const raw = text.slice(start, node.end);
+                // An identifier token holds a backslash only as part of a `\uXXXX` or
+                // `\u{X}` escape; nothing else in the grammar puts one there.
+                if (raw.includes('\\')) {
+                    sites.push({ name: node.text, evidence: { file: path, path: lineColumn(text, start), snippet: snippet(raw) } });
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(source, visit);
+    }
+    const first = sites[0];
+    if (first === undefined)
+        return [];
+    const names = [...new Set(sites.map(site => site.name))].sort();
+    return [{
+            ...tierC({
+                checkId: 'C8',
+                name: 'escaped-identifier',
+                subject: 'escaped-identifier',
+                severity: 'medium',
+                title: 'Writes identifier names as Unicode escapes',
+                detail: `The escapes resolve to ${names.map(name => `\`${name}\``).join(', ')}. JavaScript resolves an `
+                    + 'identifier escape in the scanner, so the escaped and the plain spelling are the same program and no '
+                    + 'behavior distinguishes them — the difference is only visible to whoever reads the file. Nothing writes a '
+                    + 'name this way by accident, and a published package has no build reason to.'
+                    + ' This does not weaken the rest of the report: the parser resolves the escape before any check sees the '
+                    + 'name, so a `\\u`-escaped `fetch` is still reported as network egress and an escaped `process.env` read is '
+                    + 'still reported as a credential read. What the escape defeats is the reading, not the detection.',
+                evidence: first.evidence,
+                bypass: 'concealing the name a way this check is not about — a computed member or a string assembled at '
+                    + 'runtime, which is C2',
+            }),
+            examples: sites.slice(0, MAX_EXAMPLES).map(site => site.evidence),
+            occurrences: sites.length,
+        }];
+}
 /**
  * Tier C checks that do **not** make a Tier B negative unreliable.
  *
- * Every other check here says the analyzer could not read something. C3 says
- * the opposite: the bytes were read exactly as written and exactly as they will
- * run — what cannot be checked is whether they match the repository that
- * claims to have produced them. That is worth reporting and it is not a reason
- * to distrust the parse, and treating it as one marks every ordinary published
- * tarball `degraded`, because shipping built output and no source is what
- * publishing a package *is*.
+ * Every other check here says the analyzer could not read something. C3 and C8
+ * say the opposite. C3: the bytes were read exactly as written and exactly as
+ * they will run — what cannot be checked is whether they match the repository
+ * that claims to have produced them. Treating that as an unreadable package
+ * marks every ordinary published tarball `degraded`, because shipping built
+ * output and no source is what publishing a package *is*. C8: the escape is
+ * resolved by the parser before any check reads the name, so the analysis of an
+ * escaped identifier is exactly as good as the analysis of a plain one.
  */
-export const NON_DEGRADING_CHECKS = new Set(['C3']);
+export const NON_DEGRADING_CHECKS = new Set(['C3', 'C8']);
 /** C3, C6 — shipped build output with nothing to compare it against. */
 function checkSourcelessBuild(input) {
     const built = input.sourceFiles.filter(path => /^(?:lib|dist|build|out)\//.test(path));
@@ -217,6 +292,7 @@ function checkSourcelessBuild(input) {
             detail: 'What runs is the built output, so that is what this tool analysed — but there is nothing in the '
                 + 'package to check the build against. Whether the source that produced it matches the repository is not '
                 + 'decidable from here.',
+            /* v8 ignore next -- guarded by `built.length > 0` two lines above. */
             evidence: { file: built[0] ?? '', snippet: snippet(built.slice(0, 5).join(', ')) },
             bypass: 'none — this finding is about the analysis, not about the plugin',
         }));
@@ -255,6 +331,7 @@ function checkUnreadableFiles(input) {
             ? 'Binary payloads — native addons, WebAssembly, archives — are shipped code this tool cannot read at all. '
                 + 'A mounted layer can load a `.node` addon with no restriction whatsoever.'
             : 'These files exceeded a size or count cap and were not read. Nothing is claimed about their contents.',
+        /* v8 ignore next -- a reason only appears in the map once a path was pushed under it. */
         evidence: { file: paths[0] ?? '', snippet: snippet(paths.slice(0, 8).join(', ')) },
         bypass: 'none — this finding is about the analysis, not about the plugin',
     }));
@@ -278,17 +355,37 @@ function checkPatchWalkLimit(input) {
         bypass: 'none — this finding is about the analysis, not about the plugin',
     }));
 }
+/** C7 — a patch layer whose rows are assembled out of YAML anchors and aliases. */
+function checkPatchAliases(input) {
+    return input.patches.filter(patch => patch.aliased).map(patch => tierC({
+        checkId: 'C7',
+        name: 'patch-uses-aliases',
+        subject: patch.file,
+        severity: 'medium',
+        title: `\`${patch.file}\` builds rows out of YAML anchors and aliases`,
+        detail: 'An alias is not a copy: `*a` hands the loader the same node again, so one row in the file can be two '
+            + 'rows in the composed profile, and the row a reader sees under an inert key can be the row that lands in a '
+            + 'live one. This tool expands every alias to its own node before reading the layer, which is what makes the '
+            + 'reading match the loader — but the layer a person reviews and the layer that mounts are no longer the same '
+            + 'document, and no Tier B negative about this package is claimed while that is true.',
+        evidence: { file: patch.file },
+        bypass: 'none — this finding is about the analysis, not about the plugin',
+    }));
+}
 /**
  * Run every Tier C check.
  * @param input - the decoded package.
  * @returns findings, unordered.
  */
 export function runTierC(input) {
+    const files = parseSources(input);
     return [
-        ...checkMinification(input),
-        ...checkDynamicDispatch(input),
+        ...checkMinification(files),
+        ...checkDynamicDispatch(files),
+        ...checkEscapedIdentifiers(files),
         ...checkSourcelessBuild(input),
         ...checkUnreadableFiles(input),
         ...checkPatchWalkLimit(input),
+        ...checkPatchAliases(input),
     ];
 }

package/lib/cli.js

@@ -80,6 +80,7 @@ export function parseArgs(argv) {
         return next;
     };
     for (let index = 0; index < argv.length; index += 1) {
+        /* v8 ignore next -- `index` is bounded by the loop condition. */
         const argument = argv[index] ?? '';
         if (argument === '--help' || argument === '-h') {
             process.stdout.write(USAGE);
@@ -152,6 +153,7 @@ export async function main(argv) {
         options = parseArgs(argv);
     }
     catch (error) {
+        /* v8 ignore next -- `parseArgs` refuses a command line only with a UsageError. */
         process.stderr.write(`dsh-inspect: ${error instanceof Error ? error.message : String(error)}\n\n${USAGE}`);
         return EXIT.unanalysable;
     }
@@ -165,6 +167,7 @@ export async function main(argv) {
         return exceedsThreshold(report, options.failOn) ? EXIT.findings : EXIT.clean;
     }
     catch (error) {
+        /* v8 ignore next -- every refusal on the read path is a SourceError, ManifestError or RegistryError. */
         process.stderr.write(`dsh-inspect: ${error instanceof Error ? error.message : String(error)}\n`);
         return EXIT.unanalysable;
     }
@@ -187,6 +190,7 @@ export function reportFatal(error) {
     process.stderr.write(`dsh-inspect: the analysis could not be completed: ${message}\n`);
     return EXIT.unanalysable;
 }
+/* v8 ignore start -- the process entry, exercised by tests/e2e/cli.e2e.ts against the built CLI rather than by the instrumented unit run. */
 if (import.meta.main) {
     process.on('uncaughtException', (error) => {
         process.exit(reportFatal(error));
@@ -196,3 +200,4 @@ if (import.meta.main) {
     });
     process.exitCode = await main(process.argv.slice(2));
 }
+/* v8 ignore stop */