dsh-standards 1.6.0 → 1.6.2

package/40-checker/src/security.mjs

@@ -45,6 +45,18 @@ const READ_APIS = new Set([
   'open', 'openSync', 'createReadStream', 'readdir', 'readdirSync',
 ])
 const CHILD_PROCESS = /^(?:node:)?child_process$/
+const COMMAND_EXEC_APIS = new Set(['exec', 'execSync', 'spawn', 'spawnSync', 'execFile', 'execFileSync'])
+// A subprocess call is only a FAIL when its statically-known command is
+// unambiguously a download-and-run / obfuscated payload, never for a plain
+// `git status` or an import that is never called.
+const DANGEROUS_COMMAND = [
+  { pattern: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|fish)\b/, label: 'remote script piped to a shell' },
+  { pattern: /\b(?:curl|wget)\b[^\n]{0,200}(?:&&|;|\|\|)\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|fish|node)\b/, label: 'downloaded file executed by a shell' },
+  { pattern: /\bbase64\s+(?:-d|--decode|-D)\b/, label: 'base64 decode command' },
+  { pattern: /\bnode\s+(?:-e|--eval)\b/, label: 'inline node code' },
+  { pattern: /\bpowershell(?:\.exe)?\b[^\n]*(?:-enc|-encodedcommand)\b/i, label: 'powershell encoded command' },
+  { pattern: /\b(?:bash|sh|zsh|dash|ksh)\s+-[a-z]*c\b[^\n]{0,200}\b(?:curl|wget|base64|nc|eval)\b/, label: 'shell -c with a download/decode payload' },
+]
 const INSTRUCTION_PATTERN = /\b(?:ignore|disregard|forget)\b[^\n]{0,60}\b(?:previous|prior|above|earlier|system)\b|\byou are now\b|\bdo not (?:tell|reveal|mention|disclose)\b|\bsystem prompt\b|\bact as\b/i
 const SUSPICIOUS_HOST = /(?:^|\.)(?:webhook|pastebin|paste|ngrok\.io|ngrok-free\.app|requestbin|pipedream|interact\.sh|burpcollaborator|canarytokens)\./i
 const TEXT_EXTENSIONS = /\.(?:[cm]?[jt]sx?|json|md|txt|ya?ml|html|css)$/i
@@ -122,6 +134,91 @@ function collectBindings(ast) {
   return bindings
 }
 
+const BASE64_TEXT = /^[A-Za-z0-9+/]+={0,2}$/
+
+/** Decode a base64 literal only when the result is printable text. */
+function decodeBase64Literal(text) {
+  if (typeof text !== 'string' || text.length < 8 || text.length % 4 !== 0) return null
+  if (!BASE64_TEXT.test(text)) return null
+  let decoded
+  try {
+    decoded = Buffer.from(text, 'base64').toString('utf8')
+  } catch {
+    return null
+  }
+  if (decoded === '' || decoded.includes('\uFFFD')) return null
+  if (!/^[\t\n\r\x20-\x7e]*$/.test(decoded)) return null
+  return decoded
+}
+
+/**
+ * `Buffer.from(<string>, 'base64').toString()` / `atob(<string>)` when the
+ * payload is a static literal (also reachable through a local binding).
+ * Returns null for runtime-joined or non-base64 encodings.
+ */
+function base64DecodedFrom(node, bindings, depth = 0, seen = new Set()) {
+  if (!node || node.type !== 'CallExpression' || depth > 4 || seen.has(node)) return null
+  const names = chainNames(node.callee)
+  const last = names[names.length - 1]
+  if (last === 'atob') {
+    const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+    return payload === null ? null : decodeBase64Literal(payload)
+  }
+  if (last !== 'from' || names[names.length - 2] !== 'Buffer') return null
+  const encodingNode = node.arguments[1]
+  const encoding = encodingNode === undefined ? 'utf8' : (encodingNode.type === 'Literal' ? encodingNode.value : null)
+  if (encoding !== 'base64' && encoding !== 'base64url') return null
+  const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+  return payload === null ? null : decodeBase64Literal(payload)
+}
+
+function isBase64DecodeCall(node, bindings) {
+  if (!node || node.type !== 'CallExpression') return false
+  const names = chainNames(node.callee)
+  const last = names[names.length - 1]
+  if (last === 'from' && names[names.length - 2] === 'Buffer') {
+    const encoding = node.arguments[1]
+    if (encoding?.type !== 'Literal' || (encoding.value !== 'base64' && encoding.value !== 'base64url')) return false
+    return stringFromNode(node.arguments[0], bindings) !== null
+  }
+  if (last === 'toString' && node.callee.type === 'MemberExpression') {
+    const encoding = node.arguments[0]
+    if (encoding?.type === 'Literal' && (encoding.value === 'base64' || encoding.value === 'base64url')) return false
+    return base64DecodedFrom(node.callee.object, bindings) !== null
+  }
+  if (last === 'atob' && names[0] === 'atob') return base64DecodedFrom(node, bindings) !== null
+  return false
+}
+
+function isProcessLike(node) {
+  if (identifierName(node) === 'process') return true
+  return node?.type === 'MemberExpression'
+    && memberPropertyName(node) === 'process'
+    && ['globalThis', 'global', 'window', 'self'].includes(identifierName(node.object))
+}
+
+/**
+ * `process.env.HOME` / `process.env['DSH_HOME']` / `globalThis.process.env.HOME`.
+ * The old check compared identifierName(node.object) with 'process', but
+ * node.object is the `process.env` MemberExpression, so it never matched.
+ */
+function envPropertyOf(member) {
+  if (!member || member.type !== 'MemberExpression') return null
+  const env = member.object
+  if (env?.type !== 'MemberExpression' || memberPropertyName(env) !== 'env') return null
+  if (!isProcessLike(env.object)) return null
+  return memberPropertyName(member)
+}
+
+/** Property name with static computed keys folded: globalThis['fe' + 'tch']. */
+function foldedPropertyName(member, bindings) {
+  if (!member || member.type !== 'MemberExpression') return null
+  const direct = memberPropertyName(member)
+  if (direct !== null) return direct
+  if (!member.computed) return null
+  return stringFromNode(member.property, bindings)
+}
+
 function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
   if (!node || depth > 5 || seen.has(node)) return null
   if (node.type === 'Literal' && typeof node.value === 'string') return node.value
@@ -161,12 +258,9 @@ function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
     const property = memberPropertyName(node)
     const objectName = identifierName(node.object)
     if (objectName === 'process' && property === 'cwd') return '/work/package'
-    if (objectName === 'process' && node.object.type === 'MemberExpression'
-      && memberPropertyName(node.object) === 'env'
-      && ['HOME', 'USERPROFILE'].includes(property)) return '/home/dsh-user'
-    if (objectName === 'process' && node.object.type === 'MemberExpression'
-      && memberPropertyName(node.object) === 'env'
-      && ['DSH_HOME', 'XDG_CONFIG_HOME'].includes(property)) return '/home/dsh-user/.dsh'
+    const envProperty = envPropertyOf(node)
+    if (envProperty === 'HOME' || envProperty === 'USERPROFILE') return '/home/dsh-user'
+    if (envProperty === 'DSH_HOME' || envProperty === 'XDG_CONFIG_HOME') return '/home/dsh-user/.dsh'
     return null
   }
   if (node.type === 'CallExpression') {
@@ -194,7 +288,22 @@ function stringFromNode(node, bindings, depth = 0, seen = new Set()) {
     }
     if (last === 'toString') {
       const object = node.callee.type === 'MemberExpression' ? node.callee.object : null
+      const encoding = node.arguments[0]
+      const reEncoding = encoding?.type === 'Literal' && (encoding.value === 'base64' || encoding.value === 'base64url')
+      if (!reEncoding) {
+        const decoded = base64DecodedFrom(object, bindings, depth + 1, new Set(seen).add(node))
+        if (decoded !== null) return decoded
+      }
       if (object?.type === 'Literal') return String(object.value)
+      return null
+    }
+    if (last === 'atob' && names[0] === 'atob') {
+      const payload = stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
+      if (payload !== null) {
+        const decoded = decodeBase64Literal(payload)
+        if (decoded !== null) return decoded
+      }
+      return null
     }
     if (names[0] === 'String') return stringFromNode(node.arguments[0], bindings, depth + 1, new Set(seen).add(node))
     return null
@@ -258,21 +367,95 @@ function analyseClosure(sources, entryRelative) {
 // DSC-15: install lifecycle scripts
 // ---------------------------------------------------------------------------
 
-function scriptReferenceProblems(name, command, dir, scripts) {
-  const problems = []
-  const missing = []
-  const checkRef = (reference) => {
-    if (!reference || reference.startsWith('-')) return
-    if (!/^(?:\.{0,2}\/|[\w@.-]+\/)/.test(reference) && !/\.(?:[cm]?[jt]s|sh|ps1)$/.test(reference)) return
-    const absolute = path.resolve(dir, reference)
-    if (!fs.existsSync(absolute)) missing.push(reference)
+const SCRIPT_FILE_EXTENSION = /\.(?:[cm]?[jt]s|sh|bash|zsh|ps1)$/i
+const SCRIPT_INSPECT_MAX_BYTES = 512 * 1024
+const SCRIPT_DANGER_RULES = [
+  { pattern: /\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh|dash|ksh|fish)\b/, label: 'remote script piped to a shell' },
+  { pattern: /\bbase64\s+(?:-d|--decode)\b|\bbase64\s+-D\b/, label: 'base64 decode' },
+  { pattern: /\beval\b\s*\)?\s*\(|\bnew\s+Function\s*\(|\bvm\.(?:runIn\w+|compileFunction)\s*\(/, label: 'eval/Function of a string' },
+  { pattern: /\bnode\s+(?:-e|--eval)\b|\b(?:sh|bash|zsh|dash|ksh)\s+-[a-z]*c\b/, label: 'inline code passed to an interpreter' },
+  { pattern: /\bpowershell(?:\.exe)?\b[^\n]*(?:-enc|-encodedcommand)\b/i, label: 'powershell encoded command' },
+  { pattern: /(?:readFile(?:Sync)?|createReadStream|open(?:Sync)?)\s*\([^\n]{0,200}(?:\.ssh|\.dsh|credential|id_rsa|id_ed25519|\.aws|\.npmrc|\.netrc|tokens?)/i, label: 'reads a credential-like path' },
+  { pattern: /\b(?:cat|cp|scp|tar|zip)\b[^\n]{0,160}(?:\.ssh\/|\.dsh\/|credentials|id_rsa|\.aws\/|\.npmrc|\.netrc)/i, label: 'collects credential-like files' },
+  { pattern: /(?:os\.homedir\(\)|process\.env\.(?:HOME|USERPROFILE|DSH_HOME))[^\n]{0,160}(?:\.dsh|\.ssh|credential|tokens?|id_rsa)/i, label: 'combines the home directory with a secret path' },
+]
+const SCRIPT_NETWORK = /\b(?:fetch|axios\.(?:get|post)|https?\.(?:get|request))\s*\(|\bcurl\b|\bwget\b/
+const SCRIPT_EXECUTE = /\beval\b|\bnew\s+Function\b|\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(|\bvm\.(?:runIn\w+|compileFunction)/
+// require(<variable>) / import(<variable>): loading code that is not a static
+// literal. Only dangerous when the same script also downloads or pipes code.
+const SCRIPT_DYNAMIC_LOAD = /\brequire\s*\(\s*(?!['"`])[A-Za-z_$]|\bimport\s*\(\s*(?!['"`])[A-Za-z_$]/
+const SCRIPT_CHILD_DYNAMIC = [
+  /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*`[^`]*\$\{/,
+  /\b(?:exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(\s*[A-Za-z_$][\w$]*\s*[,)]/,
+]
+
+function scriptDangerLabels(text) {
+  const labels = []
+  const add = (label) => { if (!labels.includes(label)) labels.push(label) }
+  for (const rule of SCRIPT_DANGER_RULES) if (rule.pattern.test(text)) add(rule.label)
+  if (SCRIPT_NETWORK.test(text) && SCRIPT_EXECUTE.test(text)) add('downloads remote content and executes it')
+  if (SCRIPT_NETWORK.test(text) && SCRIPT_DYNAMIC_LOAD.test(text)) add('downloads remote content and dynamically loads it')
+  if (/\bchild_process\b/.test(text) && SCRIPT_CHILD_DYNAMIC.some(pattern => pattern.test(text))) {
+    add('child_process with a dynamic command')
+  }
+  return labels
+}
+
+/** Local script paths referenced by one lifecycle command (node/sh/tsx/direct). */
+function commandScriptReferences(command) {
+  const references = []
+  const add = (value) => {
+    if (!value || value.startsWith('-')) return
+    if (value.includes('://')) return
+    if (!SCRIPT_FILE_EXTENSION.test(value)) return
+    if (!references.includes(value)) references.push(value)
+  }
+  for (const match of command.matchAll(/\bnode\s+(?!-e\b|--eval\b)(?:(?:--?[\w-]+(?:=[^\s]+)?)\s+)*([^\s;&|()]+)/g)) add(match[1])
+  for (const match of command.matchAll(/\b(?:sh|bash|zsh|dash|ksh|fish)\s+(?!-[a-z]*c\b)([^\s;&|()]+)/g)) add(match[1])
+  for (const match of command.matchAll(/(?:^|[;&|]\s*|\b(?:then|do|else)\s+)((?:\.{1,2}\/)?[\w@./-]+\.(?:[cm]?[jt]s|sh|ps1))/g)) add(match[1])
+  return references
+}
+
+/** Follow `npm run x` one level so `postinstall: npm run setup` is inspectable. */
+function collectScriptFacts(command, dir, scripts, depth = 0, seen = new Set(), acc = null) {
+  const facts = acc ?? { references: [], missing: [] }
+  for (const reference of commandScriptReferences(command)) {
+    if (!facts.references.includes(reference)) facts.references.push(reference)
   }
-  for (const match of command.matchAll(/\bnode\s+(?!-e\b|--eval\b)([^\s;&|]+)/g)) checkRef(match[1])
   for (const match of command.matchAll(/\b(?:npm|pnpm|yarn)\s+run\s+([\w:.@-]+)/g)) {
-    if (!Object.hasOwn(scripts, match[1])) missing.push(`npm run ${match[1]}`)
+    const name = match[1]
+    if (!Object.hasOwn(scripts, name)) {
+      if (!facts.missing.includes(`npm run ${name}`)) facts.missing.push(`npm run ${name}`)
+      continue
+    }
+    if (depth >= 2 || seen.has(name)) continue
+    seen.add(name)
+    collectScriptFacts(String(scripts[name] ?? ''), dir, scripts, depth + 1, seen, facts)
   }
-  if (missing.length > 0) problems.push(`scripts.${name} references missing script(s): ${[...new Set(missing)].join(', ')}`)
-  return problems
+  return facts
+}
+
+/**
+ * Read a referenced local script and look for install-time danger. The file is
+ * never executed; only text is inspected and the walk is bounded to the
+ * package directory so a lifecycle command cannot make the checker read an
+ * arbitrary host file.
+ */
+function inspectInstallScript(reference, dir) {
+  const root = path.resolve(dir)
+  const absolute = path.resolve(root, reference)
+  if (absolute !== root && !absolute.startsWith(root + path.sep)) {
+    return { reference, skipped: 'outside the package tree' }
+  }
+  let stats
+  try { stats = fs.lstatSync(absolute) } catch { return { reference, missing: true } }
+  if (stats.isSymbolicLink()) return { reference, skipped: 'symlink not followed' }
+  if (!stats.isFile()) return { reference, missing: true }
+  if (stats.size > SCRIPT_INSPECT_MAX_BYTES) return { reference, skipped: `larger than ${SCRIPT_INSPECT_MAX_BYTES} bytes` }
+  let text
+  try { text = fs.readFileSync(absolute, 'utf8') } catch { return { reference, skipped: 'unreadable' } }
+  if (text.includes('\0')) return { reference, skipped: 'binary content' }
+  return { reference, labels: scriptDangerLabels(text) }
 }
 
 export function checkLifecycleScripts(manifest, dir) {
@@ -286,7 +469,16 @@ export function checkLifecycleScripts(manifest, dir) {
     present += 1
     const evidence = [`package.json#scripts.${name}`]
     const dangerous = DANGEROUS_SCRIPT.filter(rule => rule.pattern.test(command)).map(rule => rule.label)
-    const missing = scriptReferenceProblems(name, command, dir, scripts)
+    const facts = dir ? collectScriptFacts(command, dir, scripts) : { references: [], missing: [] }
+    const missing = [...new Set(facts.missing)]
+    const contentFindings = []
+    const skipped = []
+    for (const reference of facts.references) {
+      const inspected = inspectInstallScript(reference, dir)
+      if (inspected.missing) missing.push(reference)
+      else if (inspected.skipped) skipped.push(`${reference}: ${inspected.skipped}`)
+      else if (inspected.labels.length > 0) contentFindings.push(`${reference}: ${inspected.labels.join(', ')}`)
+    }
     if (name === 'prepare' && dangerous.length > 0) {
       details.push(detail('C-15.1', 'WARN', `scripts.prepare uses a dangerous form (${dangerous.join('; ')}); prepare is allowBuilds-gated, so this is WARN not FAIL`, evidence))
       findings.push('warn')
@@ -297,10 +489,20 @@ export function checkLifecycleScripts(manifest, dir) {
       // `prepare` also runs for git/source installs, which pnpm gates behind
       // allowBuilds; a missing prepare target is therefore WARN, not FAIL.
       const level = name === 'prepare' ? 'WARN' : 'FAIL'
-      details.push(detail('C-15.3', level, `${missing.join('; ')}${name === 'prepare' ? ' (prepare is allowBuilds-gated)' : ''}`, evidence))
+      details.push(detail('C-15.3', level, `scripts.${name} references missing script(s): ${missing.join(', ')}${name === 'prepare' ? ' (prepare is allowBuilds-gated)' : ''}`, evidence))
       findings.push(level === 'WARN' ? 'warn' : 'fail')
+    } else if (contentFindings.length > 0) {
+      const level = name === 'prepare' ? 'WARN' : 'FAIL'
+      details.push(detail('C-15.1', level, `referenced install script is dangerous: ${contentFindings.join('; ')}${name === 'prepare' ? ' (prepare is allowBuilds-gated)' : ''}`, evidence))
+      findings.push(level === 'WARN' ? 'warn' : 'fail')
+    } else if (skipped.length > 0) {
+      details.push(detail('C-15.2', 'WARN', `referenced install script was not inspected: ${skipped.join('; ')}`, evidence))
+      findings.push('warn')
     } else {
       details.push(detail('C-15.2', 'WARN', `lifecycle script scripts.${name} is present; install-time commands are not executed by the checker`, evidence))
+      if (facts.references.length > 0) {
+        details.push(detail('C-15.2', 'PASS', `inspected referenced script(s): ${facts.references.join(', ')}; no dangerous pattern found`))
+      }
       findings.push('warn')
     }
   }
@@ -346,6 +548,50 @@ function functionConstructorExempt(node, ancestors) {
   return allowsEvalContext(ancestors)
 }
 
+/** exec/execSync/spawn/... called directly or through a one-level alias. */
+function commandExecApiOf(callee, bindings) {
+  if (!callee) return null
+  if (callee.type === 'Identifier') {
+    if (COMMAND_EXEC_APIS.has(callee.name)) return callee.name
+    const init = bindings.get(callee.name)
+    if (init?.type === 'MemberExpression') {
+      const property = memberPropertyName(init)
+      if (property && COMMAND_EXEC_APIS.has(property)) return property
+    }
+    return null
+  }
+  if (callee.type === 'MemberExpression') {
+    const property = memberPropertyName(callee)
+    if (property && COMMAND_EXEC_APIS.has(property)) return property
+  }
+  return null
+}
+
+/** Join the statically resolvable command/argv parts; options objects are skipped. */
+function commandTextOf(node, bindings) {
+  const parts = []
+  for (const argument of node.arguments ?? []) {
+    if (!argument || argument.type === 'ObjectExpression') continue
+    if (argument.type === 'ArrayExpression') {
+      for (const element of argument.elements) {
+        if (!element) continue
+        const value = stringFromNode(element, bindings)
+        if (value !== null) parts.push(value)
+      }
+      continue
+    }
+    const value = stringFromNode(argument, bindings)
+    if (value !== null) parts.push(value)
+  }
+  return parts.length > 0 ? parts.join(' ') : null
+}
+
+function dangerousCommandLabels(text) {
+  const labels = []
+  for (const rule of DANGEROUS_COMMAND) if (rule.pattern.test(text)) labels.push(rule.label)
+  return labels
+}
+
 export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   if (kind === 'client') {
     return check({
@@ -375,10 +621,19 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   const details = [...closure.notes]
   const dynamic = []
   const subprocess = []
+  const fileFacts = new Map()
   for (const relative of closure.visited) {
     const parsed = parseModule(closure.byRelative.get(relative))
     if (parsed.error) continue
+    let facts = fileFacts.get(relative)
+    if (!facts) {
+      facts = { base64Line: null, evalLike: false }
+      fileFacts.set(relative, facts)
+    }
     walkAst(parsed.ast, (node, ancestors) => {
+      if (isBase64DecodeCall(node, parsed.bindings)) {
+        if (facts.base64Line === null) facts.base64Line = lineOf(node)
+      }
       if (node.type === 'ImportDeclaration' && typeof node.source?.value === 'string' && CHILD_PROCESS.test(node.source.value)) {
         subprocess.push({ file: relative, line: lineOf(node), what: `import ${node.source.value}` })
         return
@@ -393,13 +648,26 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
         subprocess.push({ file: relative, line: lineOf(node), what: `import('${node.source.value}')` })
       }
       if (node.type === 'CallExpression' && node.callee.type === 'Identifier' && node.callee.name === 'eval') {
+        facts.evalLike = true
         dynamic.push({ file: relative, line: lineOf(node), what: 'eval()', item: 'C-16.1' })
         return
       }
       if (isFunctionConstructor(node)) {
+        facts.evalLike = true
         if (!functionConstructorExempt(node, ancestors)) dynamic.push({ file: relative, line: lineOf(node), what: 'new Function()', item: 'C-16.1' })
         return
       }
+      if (node.type === 'CallExpression') {
+        const execApi = commandExecApiOf(node.callee, parsed.bindings)
+        if (execApi) {
+          const command = commandTextOf(node, parsed.bindings)
+          const labels = command === null ? [] : dangerousCommandLabels(command)
+          if (labels.length > 0) {
+            dynamic.push({ file: relative, line: lineOf(node), what: `child_process.${execApi} executes a dangerous command (${labels.join('; ')})`, item: 'C-16.1' })
+            return
+          }
+        }
+      }
       if (node.type === 'CallExpression' || node.type === 'NewExpression') {
         const names = chainNames(node.callee)
         const joined = names.join('.')
@@ -416,11 +684,21 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
       }
     })
   }
+  const obfuscated = []
+  for (const [file, facts] of fileFacts) {
+    if (facts.base64Line !== null && facts.evalLike) {
+      obfuscated.push({ file, line: facts.base64Line, what: 'base64-decoded payload in the same file as eval/new Function' })
+    }
+  }
   const dynamicEvidence = dynamic.slice(0, 5).map(item => `${item.file}:${item.line}`)
+  const obfuscatedEvidence = obfuscated.slice(0, 5).map(item => `${item.file}:${item.line}`)
   const subprocessEvidence = subprocess.slice(0, 5).map(item => `${item.file}:${item.line}`)
   for (const item of dynamic.slice(0, 8)) {
     details.push(detail(item.item, 'FAIL', `dynamic execution (code:dynamic): ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
   }
+  for (const item of obfuscated.slice(0, 4)) {
+    details.push(detail('C-16.1', 'FAIL', `dynamic execution (code:obfuscated): ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
+  }
   for (const item of subprocess.slice(0, 8)) {
     details.push(detail('C-16.3', 'WARN', `subprocess capability observed: ${item.what} at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
   }
@@ -433,9 +711,10 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
   const coverage = closure.parseErrors.length > 0 || closure.packageImports.length > 0 || closure.unresolved.length > 0 ? 'partial' : 'full'
   let result
   let reason = ''
-  if (dynamic.length > 0) {
+  if (dynamic.length > 0 || obfuscated.length > 0) {
     result = 'FAIL'
     reason = `${dynamic.length} dynamic-execution site(s) in the server entry closure (code:dynamic)`
+    if (obfuscated.length > 0) reason += `; ${obfuscated.length} base64-obfuscated execution clue(s)`
     if (closure.parseErrors.length > 0) reason += `; ${closure.parseErrors.length} file(s) could not be parsed`
   } else if (closure.parseErrors.length > 0) {
     result = 'ERROR'
@@ -455,7 +734,7 @@ export function checkDynamicExecution(manifest, sources, entry, kind = null) {
     coverage: result === 'ERROR' ? 'not-run' : coverage,
     reason,
     details,
-    evidence: dynamicEvidence.length > 0 ? dynamicEvidence : subprocessEvidence.length > 0 ? subprocessEvidence : [...closure.visited].slice(0, 3),
+    evidence: dynamicEvidence.length > 0 ? dynamicEvidence : obfuscatedEvidence.length > 0 ? obfuscatedEvidence : subprocessEvidence.length > 0 ? subprocessEvidence : [...closure.visited].slice(0, 3),
   })
 }
 
@@ -474,6 +753,175 @@ function classifySecretPath(value) {
   return null
 }
 
+const HOME_ENV_NAMES = new Set(['HOME', 'USERPROFILE', 'DSH_HOME', 'XDG_CONFIG_HOME'])
+const SECRET_STRONG = /(?:^|[^a-z0-9])(?:\.ssh|id_rsa|id_ed25519|credentials?(?![a-z0-9])|tokens?(?![a-z0-9-]))(?:[^a-z0-9]|$)/i
+const SECRET_WEAK = /(?:^|[^a-z0-9])\.dsh(?:[^a-z0-9]|$)/i
+const FUNCTION_SCOPE_NODES = new Set([
+  'FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression',
+  'ObjectMethod', 'ClassMethod', 'ClassPrivateMethod', 'Program',
+])
+const FUNCTION_LIKE_NODES = new Set([...FUNCTION_SCOPE_NODES].filter(type => type !== 'Program'))
+const PATH_LIKE_NAME = /(?:path|file|dir|folder|config|secret|cred|token|home)/i
+
+function secretStrengthOfText(text) {
+  if (typeof text !== 'string' || text === '') return null
+  if (SECRET_STRONG.test(text)) return 'strong'
+  if (SECRET_WEAK.test(text)) return 'weak'
+  return null
+}
+
+function strongerSecret(left, right) {
+  if (left === 'strong' || right === 'strong') return 'strong'
+  return left ?? right ?? null
+}
+
+/** Literal text, template text or regex pattern; comments never reach the AST. */
+function literalPathText(node) {
+  if (!node) return null
+  if (node.type === 'Literal') {
+    if (node.regex && typeof node.regex.pattern === 'string') return node.regex.pattern
+    if (typeof node.value === 'string') return node.value
+  }
+  if (node.type === 'TemplateElement' && node.value) {
+    return typeof node.value.cooked === 'string' ? node.value.cooked : (typeof node.value.raw === 'string' ? node.value.raw : null)
+  }
+  return null
+}
+
+/**
+ * Only path-like literals count. A sentence such as "invalid credentials" is
+ * not a clue; `'.dsh'`, `'~/.ssh/id_rsa'`, `'credentials.json'` and a regex like
+ * `/^\.?credentials/` are.
+ */
+function isPathLikeSecretLiteral(node, text) {
+  const strength = secretStrengthOfText(text)
+  if (!strength) return null
+  if (node.type === 'Literal' && node.regex) return strength
+  const trimmed = String(text).trim()
+  if (trimmed === '') return null
+  if (trimmed.startsWith('.') || /[\\/]/.test(trimmed)) return strength
+  if (/^(?:credentials?|tokens?|id_rsa|id_ed25519|\.dsh|\.ssh)$/i.test(trimmed)) return strength
+  if (/^[\w@.-]*(?:credentials?|tokens?|id_rsa|id_ed25519)[\w@.-]*\.(?:json|ya?ml|txt|pem|key|env|ini|conf)$/i.test(trimmed)) return strength
+  return null
+}
+
+/** Follow the argument through local assignments for a secret-path clue. */
+function containsSecretSource(node, bindings, depth = 0, seen = new Set()) {
+  if (!node || depth > 4 || seen.has(node)) return null
+  const text = literalPathText(node)
+  if (text !== null) {
+    const strength = isPathLikeSecretLiteral(node, text)
+    if (strength) return strength
+  }
+  if (node.type === 'Identifier') {
+    const init = bindings.get(node.name)
+    if (!init || FUNCTION_LIKE_NODES.has(init.type)) return null
+    return containsSecretSource(init, bindings, depth + 1, new Set(seen).add(node))
+  }
+  let best = null
+  for (const key of Object.keys(node)) {
+    if (key === 'loc') continue
+    const value = node[key]
+    const children = Array.isArray(value) ? value : [value]
+    for (const child of children) {
+      if (!child || typeof child.type !== 'string' || FUNCTION_LIKE_NODES.has(child.type)) continue
+      const found = containsSecretSource(child, bindings, depth + 1, new Set(seen).add(node))
+      if (found === 'strong') return 'strong'
+      if (found === 'weak') best = 'weak'
+    }
+  }
+  return best
+}
+
+/** Home markers: os.homedir(), process.env.HOME/USERPROFILE/DSH_HOME/XDG_CONFIG_HOME. */
+function containsHomeSource(node, bindings, depth = 0, seen = new Set()) {
+  if (!node || depth > 4 || seen.has(node)) return false
+  if (node.type === 'CallExpression') {
+    const names = chainNames(node.callee)
+    if (names[names.length - 1] === 'homedir') return true
+  }
+  if (node.type === 'MemberExpression') {
+    const property = memberPropertyName(node)
+    const object = node.object
+    if (property && HOME_ENV_NAMES.has(property) && object?.type === 'MemberExpression'
+      && identifierName(object.object) === 'process' && memberPropertyName(object) === 'env') return true
+  }
+  if (node.type === 'Identifier') {
+    if (HOME_ENV_NAMES.has(node.name)) return true
+    const init = bindings.get(node.name)
+    if (!init || FUNCTION_LIKE_NODES.has(init.type)) return false
+    return containsHomeSource(init, bindings, depth + 1, new Set(seen).add(node))
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'loc') continue
+    const value = node[key]
+    const children = Array.isArray(value) ? value : [value]
+    for (const child of children) {
+      if (!child || typeof child.type !== 'string' || FUNCTION_LIKE_NODES.has(child.type)) continue
+      if (containsHomeSource(child, bindings, depth + 1, new Set(seen).add(node))) return true
+    }
+  }
+  return false
+}
+
+/** A variable argument whose name suggests a path, e.g. configPath or secretFile. */
+function argumentLooksPathLike(node) {
+  let found = false
+  walkAst(node, (child) => {
+    if (found) return
+    if (child.type === 'Identifier' && PATH_LIKE_NAME.test(child.name)) found = true
+    if (child.type === 'MemberExpression') {
+      const property = memberPropertyName(child)
+      if (property && PATH_LIKE_NAME.test(property)) found = true
+    }
+  })
+  return found
+}
+
+function isDshDirectoryPath(value) {
+  const normalized = String(value).replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase()
+  return /(?:^|\/)\.dsh$/.test(normalized)
+}
+
+function securityScopeOf(ancestors, root) {
+  for (let index = ancestors.length - 1; index >= 0; index -= 1) {
+    if (FUNCTION_SCOPE_NODES.has(ancestors[index].type)) return ancestors[index]
+  }
+  return root
+}
+
+function resolveMemberCallee(callee, bindings, depth = 0, seen = new Set()) {
+  if (!callee || depth > 3 || seen.has(callee)) return null
+  if (callee.type === 'MemberExpression') return callee
+  if (callee.type !== 'Identifier') return null
+  const init = bindings.get(callee.name)
+  if (!init) return null
+  if (init.type === 'MemberExpression') return init
+  if (init.type === 'Identifier') return resolveMemberCallee(init, bindings, depth + 1, new Set(seen).add(callee))
+  return null
+}
+
+/**
+ * fetch / http(s).get called directly, through a one-level alias, or through a
+ * statically folded computed property such as globalThis['fe' + 'tch'].
+ */
+function egressKindOf(node, bindings) {
+  if (!node || node.type !== 'CallExpression') return null
+  const callee = node.callee
+  if (callee.type === 'Identifier' && callee.name === 'fetch') return 'fetch'
+  const member = resolveMemberCallee(callee, bindings)
+  if (!member) return null
+  const name = foldedPropertyName(member, bindings)
+  if (name === 'fetch') return 'fetch'
+  const objectName = identifierName(member.object)
+  if ((objectName === 'http' || objectName === 'https') && (name === 'get' || name === 'request')) return name
+  return null
+}
+
+function isEgressCall(node, bindings) {
+  return egressKindOf(node, bindings) !== null
+}
+
 function isEnvEnumeration(node) {
   return node.type === 'CallExpression'
     && node.callee.type === 'MemberExpression'
@@ -484,17 +932,37 @@ function isEnvEnumeration(node) {
     && memberPropertyName(node.arguments[0]) === 'env'
 }
 
-function hasEgressCall(ast) {
+function hasEgressCall(ast, bindings) {
   let found = false
   walkAst(ast, (node) => {
-    if (found || node.type !== 'CallExpression') return
-    const names = chainNames(node.callee)
-    if (names[names.length - 1] === 'fetch') found = true
-    if (names.length >= 2 && ['http', 'https'].includes(names[0]) && ['get', 'request'].includes(names[names.length - 1])) found = true
+    if (!found && isEgressCall(node, bindings)) found = true
   })
   return found
 }
 
+/**
+ * Direct read API or a one-level alias: `const read = fs.readFileSync;
+ * read(path)`. Only a direct identifier declaration is resolved; destructuring
+ * aliases such as `{ readFileSync: read }` remain out of scope.
+ */
+function readApiOf(callee, bindings) {
+  if (!callee) return null
+  if (callee.type === 'Identifier') {
+    if (READ_APIS.has(callee.name)) return callee.name
+    const init = bindings.get(callee.name)
+    if (init?.type === 'MemberExpression') {
+      const property = memberPropertyName(init)
+      if (property && READ_APIS.has(property)) return property
+    }
+    return null
+  }
+  if (callee.type === 'MemberExpression') {
+    const property = memberPropertyName(callee)
+    return property && READ_APIS.has(property) ? property : null
+  }
+  return null
+}
+
 export function checkSensitiveFileReads(manifest, sources) {
   if (!sources || sources.length === 0) {
     return check({
@@ -512,28 +980,85 @@ export function checkSensitiveFileReads(manifest, sources) {
     const parsed = parseModule(source)
     if (parsed.error) { parseErrors += 1; continue }
     let envEnumeration = false
-    walkAst(parsed.ast, (node) => {
-      if (node.type !== 'CallExpression') return
+    const scopeFacts = new Map()
+    walkAst(parsed.ast, (node, ancestors) => {
+      const scope = securityScopeOf(ancestors, parsed.ast)
+      let facts = scopeFacts.get(scope)
+      if (!facts) {
+        facts = { secretLiteral: null, egress: false, reads: [] }
+        scopeFacts.set(scope, facts)
+      }
+      if (isEgressCall(node, parsed.bindings)) facts.egress = true
+      const literal = literalPathText(node)
+      if (literal !== null) {
+        const strength = isPathLikeSecretLiteral(node, literal)
+        if (strength) facts.secretLiteral = strongerSecret(facts.secretLiteral, strength)
+      }
       if (isEnvEnumeration(node)) envEnumeration = true
-      const api = node.callee.type === 'Identifier' ? node.callee.name : memberPropertyName(node.callee)
-      if (!READ_APIS.has(api) || node.arguments.length === 0) return
-      const value = stringFromNode(node.arguments[0], parsed.bindings)
-      if (value === null || value === '') return
-      const classification = classifySecretPath(value)
-      if (classification === null) return
-      const record = { file: source.relative, line: lineOf(node), api, value }
-      if (classification === 'fail') failures.push(record)
-      else warnings.push(record)
+      if (node.type !== 'CallExpression' || node.arguments.length === 0) return
+      const api = readApiOf(node.callee, parsed.bindings)
+      if (!api) return
+      const argument = node.arguments[0]
+      facts.reads.push({
+        api,
+        line: lineOf(node),
+        value: stringFromNode(argument, parsed.bindings),
+        homeDerived: containsHomeSource(argument, parsed.bindings),
+        secretDerived: containsSecretSource(argument, parsed.bindings),
+        pathNamed: argumentLooksPathLike(argument),
+      })
     })
-    if (envEnumeration && hasEgressCall(parsed.ast)) {
-      warnings.push({ file: source.relative, line: 1, api: 'Object.keys(process.env)', value: 'environment enumeration with egress' })
+    for (const facts of scopeFacts.values()) {
+      for (const read of facts.reads) {
+        const where = `${source.relative}:${read.line}`
+        if (read.value !== null && read.value !== '') {
+          const classification = classifySecretPath(read.value)
+          if (classification === 'fail') {
+            failures.push({ file: source.relative, line: read.line, api: read.api, reason: `${read.api} reads a sensitive path at ${where}` })
+            continue
+          }
+          if (classification === 'warn') {
+            warnings.push({ file: source.relative, line: read.line, api: read.api, item: 'C-17.2', reason: `${read.api} reads a dotenv/environment surface at ${where}` })
+            continue
+          }
+          if (isDshDirectoryPath(read.value)) {
+            if (facts.egress && facts.secretLiteral) {
+              failures.push({ file: source.relative, line: read.line, api: read.api, reason: `${read.api} lists the DSH home directory while the same function handles credential-like names and network egress at ${where}` })
+            } else {
+              warnings.push({ file: source.relative, line: read.line, api: read.api, item: 'C-17.2', reason: `${read.api} lists the DSH home directory at ${where}` })
+            }
+          }
+          continue
+        }
+        // Variable argument: approximate taint using the argument's assignment
+        // chain, a sibling credential-like literal, and network egress.
+        if (!read.homeDerived && !read.secretDerived) {
+          // A sibling literal alone is weak: only a path-named variable plus a
+          // credential literal (and egress for FAIL) is actionable.
+          if (!facts.secretLiteral || !read.pathNamed) continue
+          if (facts.egress && facts.secretLiteral === 'strong') {
+            failures.push({ file: source.relative, line: read.line, api: read.api, reason: `${read.api} reads a path-named variable while the same function contains a credential-like literal and network egress at ${where}` })
+          } else {
+            warnings.push({ file: source.relative, line: read.line, api: read.api, item: 'C-17.2', reason: `${read.api} reads a path-named variable while the same function contains a credential-like literal at ${where}` })
+          }
+          continue
+        }
+        if (facts.egress) {
+          failures.push({ file: source.relative, line: read.line, api: read.api, reason: `${read.api} reads a home/secret-derived path and the same function performs network egress at ${where}` })
+        } else {
+          warnings.push({ file: source.relative, line: read.line, api: read.api, item: 'C-17.2', reason: `${read.api} uses a home/secret-derived path that cannot be fully resolved at ${where}` })
+        }
+      }
+    }
+    if (envEnumeration && hasEgressCall(parsed.ast, parsed.bindings)) {
+      warnings.push({ file: source.relative, line: 1, api: 'Object.keys(process.env)', item: 'C-17.2', reason: 'environment enumeration with egress' })
     }
   }
   for (const item of failures.slice(0, 8)) {
-    details.push(detail('C-17.1', 'FAIL', `${item.api} reads a sensitive path at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
+    details.push(detail('C-17.1', 'FAIL', item.reason, [`${item.file}:${item.line}`]))
   }
   for (const item of warnings.slice(0, 8)) {
-    details.push(detail('C-17.2', 'WARN', `${item.api} reads a dotenv/environment surface at ${item.file}:${item.line}`, [`${item.file}:${item.line}`]))
+    details.push(detail(item.item ?? 'C-17.2', 'WARN', item.reason, [`${item.file}:${item.line}`]))
   }
   if (parseErrors > 0) {
     details.push(detail('C-17.3', 'ERROR', `not-run: AST parse failed in ${parseErrors} source file(s)`, []))
@@ -616,8 +1141,7 @@ export function checkEgressEndpoints(manifest, sources) {
       let target = null
       if (node.type === 'CallExpression') {
         const names = chainNames(node.callee)
-        const last = names[names.length - 1]
-        if (last === 'fetch' || (names.length >= 2 && ['http', 'https'].includes(names[0]) && ['get', 'request'].includes(last)) || names[0] === 'axios') {
+        if (egressKindOf(node, parsed.bindings) !== null || names[0] === 'axios') {
           target = egressEndpointFrom(node.arguments[0], parsed.bindings)
         }
       } else if (node.type === 'NewExpression' && chainNames(node.callee).join('.') === 'WebSocket') {