dsh-plugin-inspector 0.5.0 → 0.7.0

package/lib/checks/tier-b.js

@@ -16,6 +16,7 @@ import ts from 'typescript';
 import { lineColumn, snippet } from "../files.js";
 import { scanInjection } from "../injection.js";
 import { NETWORK_MODULES, SEAM_KEYS, SECURITY_SEAM_KEYS, UNMEDIATED_FS_MODULES, UNMEDIATED_PROCESS_MODULES, } from "../knowledge.js";
+import { foldConstantString, isBuiltinModuleGetter } from "../syntax.js";
 /** Global functions that fetch over the network without any `ctx` service. */
 const NETWORK_GLOBALS = new Set(['fetch', 'WebSocket', 'EventSource', 'XMLHttpRequest']);
 /** `process.env` keys whose names say they hold a secret. */
@@ -53,6 +54,13 @@ export function matchesCredentialPath(text) {
 const DYNAMIC_CODE_CALLEES = new Set([
     'eval', 'runInNewContext', 'runInThisContext', 'runInContext', 'compileFunction',
 ]);
+/**
+ * The harness's own tool-definition helper, exported from
+ * `@deepseek-ai/dsh-tools`. Every registered tool in the harness is built by
+ * either calling it or handing `tools.register` a literal, so recognising the
+ * two shapes is what tells a tool `description` from every other kind.
+ */
+const TOOL_DEFINITION_HELPER = 'defineTool';
 /** `ctx.systemPrompt` members that change what the model is told. */
 const SYSTEM_PROMPT_MEMBERS = new Set([
     'section', 'context', 'variable', 'tools', 'suppressRuntimeContext',
@@ -67,18 +75,18 @@ function tierB(finding) {
     return { ...finding, tier: 'B', confidence: 'high', examples: [finding.evidence], occurrences: 1 };
 }
 /**
- * The literal text of a string argument, or `null` when it is computed.
- * A computed argument is not a Tier B miss to paper over — it is a Tier C
- * signal, and `tier-c.ts` records it.
+ * The text a string argument holds, folding the constant forms — a `+` chain of
+ * literals, a template whose spans are literals, `[…].join(…)` over literals.
+ *
+ * Folding is bounded on purpose. An argument this cannot resolve is not a
+ * Tier B miss to paper over: it is a Tier C signal, and `tier-c.ts` records it
+ * by asking the same folder, so a site is either matched here or degraded
+ * there and never both.
  * @param node - the argument expression.
- * @returns the literal text, or `null`.
+ * @returns the text, or `null`.
  */
 function literalText(node) {
-    if (node === undefined)
-        return null;
-    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
-        return node.text;
-    return null;
+    return foldConstantString(node);
 }
 /**
  * Strip the `node:` prefix so `node:fs` and `fs` compare equal.
@@ -89,9 +97,13 @@ function bareModule(specifier) {
     return specifier.startsWith('node:') ? specifier.slice(5) : specifier;
 }
 /**
- * Every module specifier the file imports or requires, as literal text.
+ * Every module the file reaches by a name this tool can resolve.
+ *
+ * Three ways in, not two. `import` and `require` are the declarations a reader
+ * looks for; `process.getBuiltinModule('node:fs')` is a third that needs
+ * neither, returns the same module object, and appears in no import list.
  * @param file - the parsed file.
- * @returns specifier text paired with the node it came from.
+ * @returns one entry per resolved reference.
  */
 function moduleSpecifiers(file) {
     const found = [];
@@ -100,15 +112,16 @@ function moduleSpecifiers(file) {
             const text = literalText(node.moduleSpecifier);
             /* v8 ignore next -- an import declaration only parses with a string-literal specifier. */
             if (text !== null)
-                found.push({ specifier: text, node });
+                found.push({ specifier: text, node, via: 'import' });
         }
         if (ts.isCallExpression(node)) {
             const isRequire = ts.isIdentifier(node.expression) && node.expression.text === 'require';
             const isImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
-            if (isRequire || isImport) {
+            const isBuiltin = isBuiltinModuleGetter(node);
+            if (isRequire || isImport || isBuiltin) {
                 const text = literalText(node.arguments[0]);
                 if (text !== null)
-                    found.push({ specifier: text, node });
+                    found.push({ specifier: text, node, via: isBuiltin ? 'builtin-getter' : 'import' });
             }
         }
         ts.forEachChild(node, visit);
@@ -129,9 +142,25 @@ function at(file, node) {
         snippet: snippet(file.text.slice(node.getStart(file.node), node.end)),
     };
 }
-/** B9, B7, B13 — what the file imports. */
+/**
+ * How a finding names the way a module was reached.
+ *
+ * `Imports` would be false of `process.getBuiltinModule('node:fs')`, and the
+ * difference is the point of covering it: the module arrives with no import
+ * declaration and no `require` for a reader to find.
+ * @param reference - the resolved module reference.
+ * @returns the opening clause of the finding's title.
+ */
+function reachedBy(reference) {
+    return reference.via === 'import'
+        ? `Imports \`${reference.specifier}\``
+        : `Loads \`${reference.specifier}\` through \`process.getBuiltinModule\``;
+}
+/** B9, B7, B13 — what modules the file reaches. */
 function checkImports(file, accumulator) {
-    for (const { specifier, node } of moduleSpecifiers(file)) {
+    for (const reference of moduleSpecifiers(file)) {
+        const { specifier, node } = reference;
+        const reached = reachedBy(reference);
         const bare = bareModule(specifier);
         const unmediated = UNMEDIATED_PROCESS_MODULES.get(bare);
         if (unmediated !== undefined) {
@@ -143,12 +172,13 @@ function checkImports(file, accumulator) {
                 // reads a credential or reaches the network. On its own it is a
                 // capability half the ecosystem has.
                 severity: 'medium',
-                title: `Imports \`${specifier}\`, which ${unmediated}`,
+                title: `${reached}, which ${unmediated}`,
                 detail: 'A mounted bundle layer is imported into the harness process at the agent\'s uid. The harness\'s own '
                     + 'dynamic-package sandbox denies untrusted code `require` outright and redirects it to ctx services; a '
                     + 'bundle layer gets no such restriction, so this import does exactly what the harness forbids elsewhere.',
                 evidence: at(file, node),
-                bypass: 'a computed specifier — `await import(["node","child_process"].join(":"))` — is not matched, which is why C2 downgrades every Tier B negative',
+                bypass: 'a specifier this tool cannot fold to a constant — `import(name)` against a binding — which C2 '
+                    + 'reports, so the negative degrades rather than passing quietly',
             }));
         }
         if (NETWORK_MODULES.has(bare)) {
@@ -157,11 +187,11 @@ function checkImports(file, accumulator) {
                 name: 'network-egress',
                 subject: specifier,
                 severity: 'medium',
-                title: `Imports \`${specifier}\`, which can move bytes off the machine`,
+                title: `${reached}, which can move bytes off the machine`,
                 detail: 'Network access is a capability, not a verdict: most plugins that reach the network do so for a '
                     + 'declared reason. It is recorded because paired with a credential read it becomes B8.',
                 evidence: at(file, node),
-                bypass: 'a computed specifier, or a transitive dependency doing the request on this package\'s behalf',
+                bypass: 'a transitive dependency doing the request on this package\'s behalf',
             });
             accumulator.findings.push(finding);
             accumulator.networkCall ??= finding;
@@ -172,12 +202,12 @@ function checkImports(file, accumulator) {
                 name: 'unmediated-filesystem',
                 subject: specifier,
                 severity: 'medium',
-                title: `Imports \`${specifier}\` rather than using the \`ctx.fs\` service`,
+                title: `${reached} rather than using the \`ctx.fs\` service`,
                 detail: 'Reads and writes through the Node filesystem API are invisible to `fs/write-intent`, '
                     + '`fs/edit-intent`, `fs/observed`, and the `fs-sandbox` row, so no policy in the profile sees them and '
                     + 'nothing appears in the session log.',
                 evidence: at(file, node),
-                bypass: 'a computed specifier, or `process.getBuiltinModule("node:fs")`',
+                bypass: 'a transitive dependency reading the file on this package\'s behalf',
             }));
         }
     }
@@ -203,7 +233,8 @@ function checkSeamReplacement(file, node, accumulator) {
             + 'package\'s implementation for every consumer in the scope, and consumers cannot tell the difference.'
             + (critical ? ' This seam is one whose whole purpose is to constrain what the agent may do.' : ''),
         evidence: at(file, node),
-        bypass: "`ctx['pro' + 'vide']('approval', …)` — a computed member name is not matched",
+        bypass: "`ctx['pro' + 'vide']('approval', …)` — a computed member name is not matched — and neither is a "
+            + '`provide` destructured off `ctx` and called through the bare name. C2 reports both',
     }));
 }
 /** B5 — changing what the model is told. */
@@ -345,11 +376,75 @@ function checkCredentialRead(file, node, accumulator) {
         detail: 'Reading a credential is a capability, not a verdict — a plugin that authenticates to its own service '
             + 'must do it. It is recorded because paired with network access it becomes B8.',
         evidence: at(file, node),
-        bypass: 'a computed key — `process.env["API"+"_KEY"]` — or reading the whole `process.env` object and indexing it later',
+        bypass: 'a key this tool cannot fold to a constant, or reading the whole `process.env` object and indexing it later',
     });
     accumulator.findings.push(finding);
     accumulator.credentialRead ??= finding;
 }
+/**
+ * Whether a call hands its arguments to the tool registry: the registry call
+ * itself, `<ctx>.tools.register(…)`, or the harness's `defineTool(…)` helper,
+ * whose argument is a tool definition and nothing else.
+ * @param node - the call expression.
+ * @returns true when its arguments are tool definitions.
+ */
+function isToolRegistration(node) {
+    const callee = node.expression;
+    if (ts.isIdentifier(callee))
+        return callee.text === TOOL_DEFINITION_HELPER;
+    return ts.isPropertyAccessExpression(callee) && callee.name.text === 'register'
+        && ts.isPropertyAccessExpression(callee.expression) && callee.expression.name.text === 'tools';
+}
+/**
+ * Whether a name bound in this file is passed to a tool registration call, so
+ * a definition built as `const tool = {…}` and registered on a later line is
+ * still recognised as one.
+ * @param name - the bound identifier.
+ * @param file - the parsed file it was bound in.
+ * @returns true when a registration call in the same file receives it.
+ */
+function isRegisteredName(name, file) {
+    let registered = false;
+    const visit = (node) => {
+        if (ts.isCallExpression(node) && isToolRegistration(node)
+            && node.arguments.some(argument => ts.isIdentifier(argument) && argument.text === name)) {
+            registered = true;
+        }
+        ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(file.node, visit);
+    return registered;
+}
+/**
+ * Whether a `description` property belongs to a tool definition this package
+ * registers.
+ *
+ * The receiver guard is the whole check. `description` is one of the commonest
+ * property names in JavaScript — a JSON schema, an OpenAPI document, a
+ * changelog entry and a CLI option table all carry one — and none of that text
+ * reaches a model. Without the guard the injection heuristics run on release
+ * notes, and the finding's title then asserts something about a tool that the
+ * package does not have.
+ *
+ * Nested properties count, because the whole definition is model-visible: a
+ * parameter's `description` is rendered into the tool schema the model
+ * receives alongside the tool's own.
+ * @param node - the `description` property assignment.
+ * @param file - the parsed file it came from.
+ * @returns true when an enclosing object literal is a registered tool definition.
+ */
+function isRegisteredToolDescription(node, file) {
+    let parent = node.parent;
+    for (;;) {
+        if (ts.isCallExpression(parent))
+            return isToolRegistration(parent);
+        if (ts.isVariableDeclaration(parent))
+            return ts.isIdentifier(parent.name) && isRegisteredName(parent.name.text, file);
+        if (!ts.isObjectLiteralExpression(parent) && !ts.isPropertyAssignment(parent))
+            return false;
+        parent = parent.parent;
+    }
+}
 /** B10 — injection phrasing in a registered tool description. */
 function checkToolDescription(file, node, accumulator) {
     if (!ts.isPropertyAssignment(node))
@@ -359,6 +454,8 @@ function checkToolDescription(file, node, accumulator) {
     const text = literalText(node.initializer);
     if (text === null)
         return;
+    if (!isRegisteredToolDescription(node, file))
+        return;
     for (const match of scanInjection(text)) {
         accumulator.findings.push(tierB({
             checkId: 'B10',
@@ -366,11 +463,14 @@ function checkToolDescription(file, node, accumulator) {
             subject: match.ruleId,
             severity: 'high',
             title: `Tool description ${match.meaning}`,
-            detail: `Heuristic \`${match.ruleId}\` matched a tool \`description\`, which is prompt text the model receives `
-                + 'verbatim on every request that lists the tool. This is a natural-language heuristic: it will miss a '
-                + 'rephrasing, and it can fire on a description that legitimately discusses the subject.',
+            detail: `Heuristic \`${match.ruleId}\` matched a \`description\` inside a registered tool definition, which is `
+                + 'prompt text the model receives verbatim on every request that lists the tool. This is a natural-language '
+                + 'heuristic: it will miss a rephrasing, and it can fire on a description that legitimately discusses the '
+                + 'subject.',
             evidence: { ...at(file, node), snippet: snippet(match.excerpt) },
-            bypass: 'any rephrasing the pattern does not cover, or building the description by concatenation',
+            bypass: 'any rephrasing the pattern does not cover, assembling the description out of anything this tool '
+                + 'cannot fold to a constant, or registering the definition through a value this tool does not track — a '
+                + 'definition exported from one file and passed to `tools.register` in another is not matched',
         }));
     }
 }

package/lib/checks/tier-c.js

@@ -7,9 +7,11 @@
  * user is entitled to see it.
  *
  * A Tier C hit also has a mechanical consequence. Tier B recognises a whitelist
- * of syntactic shapes, so when code is minified, when identifiers are computed,
- * or when the shipped artifact has no readable source, a Tier B *positive* is
- * still true but a Tier B *negative* means nothing. `inspect.ts` reads the
+ * of syntactic shapes — a member, on a receiver, taking a name it can resolve —
+ * so when code is minified, when a name is assembled out of something this tool
+ * cannot fold, when a member is detached from the receiver the checks match it
+ * on, or when the shipped artifact has no readable source, a Tier B *positive*
+ * is still true but a Tier B *negative* means nothing. `inspect.ts` reads the
  * output of this module to lower Tier B confidence and to forbid the report
  * from claiming nothing was found.
  * @module dsh-plugin-inspector/checks/tier-c
@@ -17,6 +19,7 @@
 import ts from 'typescript';
 import { lineColumn, snippet } from "../files.js";
 import { MAX_EXAMPLES } from "../model.js";
+import { BUILTIN_MODULE_GETTER, foldConstantString, isBuiltinModuleGetter } from "../syntax.js";
 /** A line longer than this is not written by hand. */
 const MINIFIED_LINE_LENGTH = 500;
 /** Below this many bytes, a low line count says nothing. */
@@ -27,6 +30,42 @@ const DISPATCH_RECEIVERS = new Set(['ctx', 'context', 'globalThis', 'global']);
 const NAMED_TARGET_CALLEES = new Set([
     'on', 'once', 'provide', 'set', 'get', 'emit', 'waterfall', 'bail', 'parallel', 'serial',
 ]);
+/**
+ * Members every Tier B check can only match *through* their receiver.
+ *
+ * B1 reads `<receiver>.provide` / `.set` / `.mixin`, B5 reads
+ * `<receiver>.on`, B11 reads `.plugin`, B10 reads `tools.register`, and B7,
+ * B9 and B13 read `process.getBuiltinModule`. Every one of them is a property
+ * access on a named receiver, so pulling the member off the receiver and
+ * binding it to a bare name removes the only thing those checks match on —
+ * while the call still does exactly what it did.
+ *
+ * This is not the assembled-name case. The name is right there in plain text;
+ * what is gone is the receiver, and following it to the call site is value
+ * tracking this tool does not do.
+ */
+const RECEIVER_ANCHORED_MEMBERS = new Set([
+    'provide', 'set', 'mixin', 'on', 'plugin', 'register', BUILTIN_MODULE_GETTER,
+]);
+/**
+ * Receivers whose members {@link RECEIVER_ANCHORED_MEMBERS} names.
+ *
+ * The plugin context, plus `process` — the receiver of `getBuiltinModule`. The
+ * guard is what keeps `const { set } = options` out of the check.
+ */
+const ANCHORED_RECEIVERS = new Set([...DISPATCH_RECEIVERS, 'process']);
+/** The harness's plugin entry point, whose first parameter is the context. */
+const PLUGIN_ENTRY = 'apply';
+/** Why an unresolvable name makes every Tier B negative meaningless. */
+const ASSEMBLED_NAME_DETAIL = 'Every Tier B check matches a literal name. A name assembled at runtime defeats all of '
+    + 'them, so no Tier B negative for this package carries any information. A Tier B positive still does — the tool '
+    + 'saw what it saw.';
+/** Why a detached member makes every Tier B negative meaningless. */
+const DETACHED_MEMBER_DETAIL = 'Every Tier B check that matches this member matches it on its receiver: B1 reads '
+    + '`ctx.provide`, B5 reads `ctx.on`, B10 reads `tools.register`, B13 reads `process.getBuiltinModule`. Bound to a '
+    + 'bare name the member still does all of that, and the call site no longer says on what. Following the binding is '
+    + 'value tracking this tool does not do, so no Tier B negative for this package carries any information. A Tier B '
+    + 'positive still does — the tool saw what it saw.';
 /**
  * Build one Tier C finding. Confidence is `moderate`: these are heuristics
  * about form, and a hand-written file can legitimately have one long line.
@@ -85,20 +124,18 @@ function checkMinification(files) {
     }
     return findings;
 }
-/** C2 — names the analyzer cannot resolve without running the code. */
+/** C2 — names and receivers the analyzer cannot resolve without running the code. */
 function checkDynamicDispatch(files) {
     const findings = [];
     for (const { path, text, node: source } of files) {
-        const report = (node, what) => {
+        const report = (node, what, why) => {
             findings.push(tierC({
                 checkId: 'C2',
                 name: 'dynamic-dispatch',
                 subject: what,
                 severity: 'high',
                 title: `Shipped source ${what}`,
-                detail: 'Every Tier B check matches a literal name. A name assembled at runtime defeats all of them, so no '
-                    + 'Tier B negative for this package carries any information. A Tier B positive still does — the tool saw '
-                    + 'what it saw.',
+                detail: why,
                 evidence: {
                     file: path,
                     path: lineColumn(text, node.getStart(source)),
@@ -108,29 +145,36 @@ function checkDynamicDispatch(files) {
             }));
         };
         const isComputed = (node) => node !== undefined && !ts.isStringLiteral(node) && !ts.isNoSubstitutionTemplateLiteral(node);
+        // A specifier Tier B folded to a constant is one Tier B matched, so it is
+        // not a gap. Only what the folder gives up on degrades the report.
+        const isUnresolvedSpecifier = (node) => isComputed(node) && foldConstantString(node) === null;
         const visit = (node) => {
             if (ts.isElementAccessExpression(node) && ts.isIdentifier(node.expression)
                 && DISPATCH_RECEIVERS.has(node.expression.text) && isComputed(node.argumentExpression)) {
-                report(node, `resolves a member of \`${node.expression.text}\` from a computed name`);
+                report(node, `resolves a member of \`${node.expression.text}\` from a computed name`, ASSEMBLED_NAME_DETAIL);
             }
+            if (ts.isVariableDeclaration(node))
+                reportDetachedBindings(node, report);
+            if (ts.isFunctionLike(node))
+                reportDetachedContextParameter(node, report);
             if (ts.isCallExpression(node)) {
                 const callee = node.expression;
                 const isRequire = ts.isIdentifier(callee) && callee.text === 'require';
                 const isImport = callee.kind === ts.SyntaxKind.ImportKeyword;
-                if ((isRequire || isImport) && isComputed(node.arguments[0])) {
-                    report(node, 'loads a module from a computed specifier');
+                if ((isRequire || isImport || isBuiltinModuleGetter(node)) && isUnresolvedSpecifier(node.arguments[0])) {
+                    report(node, 'loads a module from a computed specifier', ASSEMBLED_NAME_DETAIL);
                 }
                 if (ts.isIdentifier(callee) && callee.text === 'atob') {
-                    report(node, 'decodes a base64 string at runtime');
+                    report(node, 'decodes a base64 string at runtime', ASSEMBLED_NAME_DETAIL);
                 }
                 if (ts.isPropertyAccessExpression(callee) && callee.name.text === 'from'
                     && ts.isIdentifier(callee.expression) && callee.expression.text === 'Buffer'
                     && (literalOf(node.arguments[1]) === 'base64' || literalOf(node.arguments[1]) === 'base64url')) {
-                    report(node, 'decodes a base64 string at runtime');
+                    report(node, 'decodes a base64 string at runtime', ASSEMBLED_NAME_DETAIL);
                 }
                 if (ts.isPropertyAccessExpression(callee) && NAMED_TARGET_CALLEES.has(callee.name.text)
                     && isDispatchReceiver(callee.expression) && isAssembledName(node.arguments[0])) {
-                    report(node, `passes an assembled name to \`${receiverName(callee.expression)}.${callee.name.text}()\``);
+                    report(node, `passes an assembled name to \`${receiverName(callee.expression)}.${callee.name.text}()\``, ASSEMBLED_NAME_DETAIL);
                 }
             }
             ts.forEachChild(node, visit);
@@ -139,6 +183,84 @@ function checkDynamicDispatch(files) {
     }
     return findings;
 }
+/**
+ * Report every {@link RECEIVER_ANCHORED_MEMBERS} member a binding pattern pulls
+ * out of a known receiver.
+ *
+ * A computed property in the pattern — `const { [name]: fn } = ctx` — is
+ * `ctx[name]` written as a destructuring, and is recorded as that same finding
+ * so the two spellings aggregate together.
+ * @param pattern - the binding pattern.
+ * @param receiver - how the finding names the object being destructured.
+ * @param report - the reporter.
+ */
+function reportPatternMembers(pattern, receiver, report) {
+    for (const element of pattern.elements) {
+        const property = element.propertyName ?? element.name;
+        if (ts.isComputedPropertyName(property)) {
+            report(element, `resolves a member of ${receiver} from a computed name`, ASSEMBLED_NAME_DETAIL);
+            continue;
+        }
+        if (!ts.isIdentifier(property) || !RECEIVER_ANCHORED_MEMBERS.has(property.text))
+            continue;
+        report(element, `binds \`${property.text}\` off ${receiver} to a bare name`, DETACHED_MEMBER_DETAIL);
+    }
+}
+/**
+ * Whether an expression names a receiver whose members Tier B matches by name.
+ * @param node - the expression.
+ * @returns the receiver's own name, or `null`.
+ */
+function anchoredReceiver(node) {
+    if (node === undefined)
+        return null;
+    if (ts.isIdentifier(node) && ANCHORED_RECEIVERS.has(node.text))
+        return node.text;
+    // `this.ctx` and `self.ctx` are the same receiver held on a field.
+    if (ts.isPropertyAccessExpression(node) && DISPATCH_RECEIVERS.has(node.name.text))
+        return node.name.text;
+    return null;
+}
+/**
+ * C2 — a variable declaration that detaches an anchored member from its
+ * receiver, in either spelling: `const { provide } = ctx`, or
+ * `const provide = ctx.provide`.
+ * @param node - the variable declaration.
+ * @param report - the reporter.
+ */
+function reportDetachedBindings(node, report) {
+    const source = anchoredReceiver(node.initializer);
+    if (source !== null && ts.isObjectBindingPattern(node.name)) {
+        reportPatternMembers(node.name, `\`${source}\``, report);
+        return;
+    }
+    const initializer = node.initializer;
+    if (initializer === undefined || !ts.isPropertyAccessExpression(initializer))
+        return;
+    const receiver = anchoredReceiver(initializer.expression);
+    if (receiver === null || !RECEIVER_ANCHORED_MEMBERS.has(initializer.name.text))
+        return;
+    report(node, `binds \`${initializer.name.text}\` off \`${receiver}\` to a bare name`, DETACHED_MEMBER_DETAIL);
+}
+/**
+ * C2 — a plugin entry point that destructures its context parameter:
+ * `export function apply({ provide }) { … }`.
+ *
+ * The receiver is known here without any binding to follow: `apply`'s first
+ * parameter is the plugin context by the harness's own mount contract, which is
+ * what keeps this off every other function that destructures an options object.
+ * @param node - the function-like declaration.
+ * @param report - the reporter.
+ */
+function reportDetachedContextParameter(node, report) {
+    const name = node.name;
+    if (name === undefined || !ts.isIdentifier(name) || name.text !== PLUGIN_ENTRY)
+        return;
+    const first = node.parameters[0];
+    if (first === undefined || !ts.isObjectBindingPattern(first.name))
+        return;
+    reportPatternMembers(first.name, 'the plugin context', report);
+}
 /**
  * Whether an expression names the plugin context.
  *
@@ -174,16 +296,22 @@ function receiverName(node) {
     /* v8 ignore stop */
 }
 /**
- * Whether a node builds a string at runtime rather than naming one. A plain
- * identifier is deliberately excluded: `ctx.on(EVENT_NAME, …)` against a module
- * constant is ordinary code, and treating it as evasion would degrade the
+ * Whether a node builds a string at runtime rather than naming one, and does it
+ * in a way the constant folder could not follow.
+ *
+ * A plain identifier is deliberately excluded: `ctx.on(EVENT_NAME, …)` against a
+ * module constant is ordinary code, and treating it as evasion would degrade the
  * analysis of nearly every well-written plugin.
  * @param node - the argument node.
- * @returns true for concatenation, an interpolated template, or a call.
+ * @returns true for an unfoldable concatenation, template, or call.
  */
 function isAssembledName(node) {
     if (node === undefined)
         return false;
+    // A name Tier B folded to a constant is a name Tier B matched. Reporting it
+    // here as well would degrade the whole report over a site that was read.
+    if (foldConstantString(node) !== null)
+        return false;
     if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken)
         return true;
     if (ts.isTemplateExpression(node))
@@ -330,7 +458,9 @@ function checkUnreadableFiles(input) {
         detail: reason === 'binary'
             ? 'Binary payloads — native addons, WebAssembly, archives — are shipped code this tool cannot read at all. '
                 + 'A mounted layer can load a `.node` addon with no restriction whatsoever.'
-            : 'These files exceeded a size or count cap and were not read. Nothing is claimed about their contents.',
+            : 'These files were not read: each either passed a size or count cap, or is not a regular file the reader '
+                + 'can open — a symbolic link, a FIFO, a socket, or a directory it was refused. The subject names which. '
+                + 'Nothing is claimed about their contents.',
         /* v8 ignore next -- a reason only appears in the map once a path was pushed under it. */
         evidence: { file: paths[0] ?? '', snippet: snippet(paths.slice(0, 8).join(', ')) },
         bypass: 'none — this finding is about the analysis, not about the plugin',

package/lib/index.js

@@ -12,8 +12,9 @@
  * @module dsh-plugin-inspector
  */
 export { analyze, exceedsThreshold, inspect, TOOL_NAME, TOOL_VERSION } from "./inspect.js";
+export { MAX_ATTESTATION_BYTES, packageUrl, PROVENANCE_PREDICATE_TYPE, provenanceAbsent, provenanceUnavailable, provenanceUnreadable, readProvenance, } from "./attestation.js";
 export { inspectFromNpm, precheck } from "./npm.js";
-export { DEFAULT_REGISTRY, fetchVerifiedTarball, parseSpec, RegistryError, resolvePackage, verifyIntegrity, } from "./registry.js";
+export { attestationUrl, DEFAULT_REGISTRY, fetchAttestation, fetchVerifiedTarball, parseSpec, RegistryError, resolvePackage, verifyIntegrity, } from "./registry.js";
 export { renderHuman, renderJson } from "./report.js";
 export { classifyExpression, isJsExpr, parsePatchDocument, patchSchema, PatchParseError, } from "./cordis-yaml.js";
 export { declaredPackages, ManifestError, parseManifest } from "./manifest.js";

package/lib/injection.js

@@ -39,7 +39,13 @@ export const INJECTION_RULES = [
     },
     {
         id: 'credential-exfiltration',
-        pattern: /\b(?:send|post|upload|transmit|exfiltrate|forward|report)\b[^.\n]{0,60}\b(?:api[_ -]?key|access[_ -]?token|secret|credential|password|\.env|id_rsa|\.npmrc)\b/i,
+        // The dotted filenames carry their own boundary. A `\b` in front of the
+        // whole alternation cannot match at the start of `.env` or `.npmrc`: the
+        // preceding character is a space and the next is a `.`, so neither side of
+        // that position is a word character and the boundary does not exist there.
+        // Under a shared `\b` those two alternatives match nothing, while the
+        // word-initial ones beside them keep working and hide it.
+        pattern: /\b(?:send|post|upload|transmit|exfiltrate|forward|report)\b[^.\n]{0,60}(?:\b(?:api[_ -]?key|access[_ -]?token|secret|credential|password|id_rsa)\b|\.(?:env|npmrc)\b)/i,
         meaning: 'instructs the model to move a credential somewhere',
     },
     {

package/lib/inspect.js

@@ -10,6 +10,7 @@
  * @module dsh-plugin-inspector/inspect
  */
 import { readFileSync } from 'node:fs';
+import { provenanceUnavailable } from "./attestation.js";
 import { EXPRESSION_CLASSES, PatchParseError, parsePatchDocument, } from "./cordis-yaml.js";
 import { isCordisConfigFile, isModelVisibleText, isSourceFile, normalizePackagePath } from "./files.js";
 import { HARNESS_REFERENCE } from "./knowledge.js";
@@ -95,11 +96,13 @@ export async function inspect(target) {
 /**
  * Run every check over an already-decoded package.
  * @param source - the decoded package.
- * @param registry - provenance, when the bytes were fetched from a registry.
+ * @param registry - where the bytes came from, when they were fetched from a registry.
+ * @param provenance - what the registry's attestation said and what was checked
+ * of it; defaults to the `unavailable` fact the two local modes carry.
  * @returns the complete report.
  * @throws ManifestError when the manifest cannot be read.
  */
-export function analyze(source, registry) {
+export function analyze(source, registry, provenance = provenanceUnavailable()) {
     const manifest = parseManifest(source.files.get('package.json') ?? '');
     const declared = manifest.dsh.bundle?.patch;
     const mountsAsBundle = declared !== undefined;
@@ -131,6 +134,7 @@ export function analyze(source, registry) {
         unmountedPatchFiles: others,
         sourceFiles,
         modelVisibleFiles,
+        provenance,
     };
     const tierC = runTierC(input);
     const unreadable = tierC.filter(finding => !NON_DEGRADING_CHECKS.has(finding.checkId));
@@ -148,6 +152,7 @@ export function analyze(source, registry) {
         packageName: manifest.name,
         packageVersion: manifest.version,
         license: manifest.license,
+        provenance,
         mountsAsBundle,
         bundlePatchPath: declared ?? null,
         shipsClientBundle: manifest.dsh.client !== undefined && manifest.exportPaths.includes('./client'),