machine-bridge-mcp 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.3 - 2026-07-14
+
+### Code-scanning and supply-chain integrity
+
+- Fix the SARIF gate so results with omitted rule metadata fail closed instead of being silently classified as non-security. Remove stale broad CodeQL exceptions, harden the generic process boundary with a fixed-option non-shell `child_process.spawn` wrapper and behavior regression, and retain only one exact, expiring false-positive record for that intentional authority boundary.
+- Gate OpenSSF Scorecard SARIF before upload. Replace mutable npm bootstrap commands with an exact npm 12.0.1 tarball plus pinned SHA-512 verification, make the source wrapper use `npm ci`, and convert randomized security properties to a deterministic `fast-check` `.js` suite recognized by the pinned Scorecard scanner, and separate the signed Scorecard analysis job from the failing SARIF gate job required by the action's workflow-verification rules.
+- Record only four expiring Scorecard governance/time exceptions that cannot be repaired by source code alone, reject remediable pinning/fuzzing exceptions, and require exact-commit CI, CodeQL, Governance, and Scorecard success before creating a source release.
+
 ## 1.0.2 - 2026-07-14
 
 ### Deadline and architecture integrity

package/CONTRIBUTING.md

@@ -26,7 +26,7 @@ Before the reviewed code is pushed to `main`:
 4. inspect the complete diff and the npm package manifest;
 5. commit and push the reviewed change to GitHub.
 
-After all required pull-request checks pass, repository automation completes the source release under [AGENTS.md](AGENTS.md): squash-merge through local `gh`, verify the exact `main` push CI, create the annotated version tag, and create or update the matching final GitHub Release. The release operator separately publishes the same version to npm and performs any live machine update. Automation must not publish, deprecate, or unpublish npm packages; install the CLI globally; deploy the Worker; rotate credentials; mutate live deployment state; or start/stop/install/remove the daemon or autostart service without explicit user authorization.
+After all required pull-request checks pass, repository automation completes the source release under [AGENTS.md](AGENTS.md): squash-merge through local `gh`, verify the exact `main` push CI, CodeQL, Governance, and Scorecard runs, create the annotated version tag, and create or update the matching final GitHub Release. The release operator separately publishes the same version to npm and performs any live machine update. Automation must not publish, deprecate, or unpublish npm packages; install the CLI globally; deploy the Worker; rotate credentials; mutate live deployment state; or start/stop/install/remove the daemon or autostart service without explicit user authorization.
 
 After npm publication, the standard machine update is:
 

package/SECURITY.md

@@ -23,7 +23,7 @@ Tests, examples, documentation, release notes, and package metadata are publicat
 
 Removing a value from the current branch does not remove it from Git history, caches, forks, or an already published npm package. Rotate any exposed credential immediately and coordinate destructive history rewriting separately when its risk is justified.
 
-CodeQL is enforced as a security gate, not merely uploaded as advisory output. The workflow parses generated SARIF and rejects every security-tagged result unless `.github/codeql-accepted-findings.json` contains the exact rule and path, a substantive authority-boundary rationale, and a non-expired review date. Rule-wide suppression is not an acceptable substitute.
+CodeQL and OpenSSF Scorecard are enforced as gates, not merely uploaded as advisory output. The shared SARIF gate rejects every security result and fails closed when a result omits the rule metadata needed to prove it non-security. Any exception requires an exact rule/path entry, a substantive rationale, and a non-expired review date; rule-wide suppression is not acceptable. CodeQL has one exact, expiring accepted result for the authorized non-shell direct-process boundary; its fixed option set and metacharacter behavior are tested. Scorecard exceptions are limited to documented governance or time-dependent conditions that repository code cannot truthfully repair, while remediable dependency-pinning and fuzzing findings remain release-blocking.
 
 ## Core trust model
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.2"
+  "version_name": "1.0.3"
 }

package/docs/AUDIT.md

@@ -1,6 +1,15 @@
 # Engineering and security audit
 
-This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, plus the version 1.0.2 elapsed-time and documentation-integrity review. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, including the version 1.0.2 elapsed-time review and the version 1.0.3 code-scanning inventory correction. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+
+
+## 2026-07-14 version 1.0.3 code-scanning and supply-chain gate audit
+
+After npm 1.0.2 and the live Worker/daemon upgrade succeeded, GitHub still reported nine open code-scanning alerts on the exact released `main` commit: one current CodeQL command-boundary result and eight OpenSSF Scorecard results. This disproved the earlier assumption that green CodeQL and Scorecard jobs implied a clean code-scanning inventory. The CodeQL analysis API reported one result, while the repository gate reported zero because the SARIF emitted to the post-analysis step omitted `tool.driver.rules`; the gate treated missing rule metadata as proof that a result was non-security. Scorecard had no gate at all and uploaded every low-score result while the workflow remained successful.
+
+The process boundary now routes through an isolated `node:child_process.spawn` call that copies only four allowed options, enforces final `shell: false`, and has a production-path metacharacter regression. CodeQL 2.26.0 nevertheless classifies the environment-derived executable path as a shell-command sink even though no shell interprets either the executable or argv. After reproducing the complete flow and eliminating ambiguous option propagation, the repository retains one exact rule/path exception with a short expiry rather than broad command-execution suppressions. The SARIF gate now fails closed for every result whose rule metadata is absent. The same gate runs on Scorecard output before upload. Four remediable Scorecard findings are addressed: source bootstrap uses `npm ci`; CI obtains npm 12.0.1 from an exact registry URL, rejects redirects, verifies a pinned SHA-512 SRI, and exposes the verified CLI without a mutable global install; and the randomized security suite now uses deterministic `fast-check` properties in a `.js` file, matching the pinned Scorecard v5.3.0 detector's `*.js`/`*.jsx` scope. The Scorecard action remains in a signed analysis job containing only pinned `uses` steps; a dependent gate job downloads its SARIF, enforces the accepted inventory, and uploads the reviewed result.
+
+Four Scorecard findings remain explicitly reviewed rather than hidden: the repository is younger than ninety days, historical commits predate mandatory CodeQL, only one human maintainer is available for review, and OpenSSF Best Practices enrollment requires external maintainer attestations. Their exact rule/path exceptions carry short expiry dates, while `PinnedDependenciesID` and `FuzzingID` are forbidden from the accepted inventory. Release orchestration now verifies successful push-triggered CI, CodeQL, Governance, and Scorecard runs for the exact `main` commit instead of checking only the CI workflow. This closes the semantic gap between “a workflow ran” and “the security/governance evidence required for release passed.”
 
 
 ## 2026-07-14 version 1.0.2 elapsed-time and documentation-integrity audit

package/docs/ENGINEERING.md

@@ -9,7 +9,7 @@ This document records project-wide decisions that must survive individual fixes,
 3. **Machine Bridge authority and host authority are separate.** `full` removes Machine Bridge's own policy, path, shell, and environment restrictions. It cannot override an MCP host, connector gateway, operating system, endpoint-security product, cloud IAM, remote authentication, or `sudo`.
 4. **Publication surfaces contain no real environment metadata.** Source, tests, fixtures, examples, release notes, filenames, package contents, tags, and release assets use synthetic identifiers and reserved example domains.
 5. **Secrets are never operational log data.** Tool arguments, command text, stdin, stdout, stderr, file content, OAuth bodies, credentials, and local resource values are not logged.
-6. **A release is one version with successful cross-platform evidence.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree, and the exact `origin/main` commit must have a completed successful push-triggered GitHub Actions run before a tag or release is created.
+6. **A release is one version with successful cross-platform evidence.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree, and the exact `origin/main` commit must have completed successful push-triggered CI, CodeQL, Governance, and OpenSSF Scorecard runs before a tag or release is created.
 7. **Generic local automation is structured, not arbitrary evaluation.** Browser/application features may expose broad user authority under canonical `full`, but must not accept caller-provided JavaScript, AppleScript, JXA, or extension code.
 8. **Daily-browser integration uses the existing profile.** The supported primary browser path is the packaged authenticated extension and machine-level loopback broker, preserving current tabs/login state; a separate automation profile is not an equivalent replacement.
 9. **Pairing and resource secrets are not conversation or log data.** Tokens and injected local-resource values must not be returned, embedded in URLs, or written to operational logs.
@@ -17,7 +17,7 @@ This document records project-wide decisions that must survive individual fixes,
 11. **Service and state removal are fail-closed state machines.** Stop the platform provider and every verified daemon before removing definitions or recursive state. An unreadable lock, failed stop, active job, or ambiguous identity retains state for diagnosis.
 12. **Read failure is not empty state.** Permission, type, symbolic-link, size, encoding, and I/O errors must propagate. Corrupt backup/reconstruction applies only after a successful read proves that JSON content is invalid.
 13. **The public protocol contract is current-only.** Shared metadata advertises only the current MCP protocol version. Compatibility code for obsolete protocol dates, lock formats, or state schemas is not retained in the final runtime; upgrade safety comes from explicit version negotiation, fail-closed state validation, and bounded operator convergence.
-14. **Security analysis is a failing gate.** CodeQL execution alone is not success. Generated SARIF must contain no unaccepted security result; an intentional authority boundary requires an exact rule/path record with a substantive rationale and an expiry date.
+14. **Security analysis is a failing gate.** CodeQL or Scorecard execution alone is not success. Generated SARIF must contain no unaccepted result, and missing rule metadata fails closed rather than being interpreted as non-security. An intentional or externally constrained finding requires an exact rule/path record with a substantive rationale and an expiry date.
 
 A proposed change that conflicts with an invariant requires an explicit owner decision and corresponding documentation update. It must not be hidden inside an unrelated refactor.
 
@@ -127,7 +127,7 @@ Every defect fix includes a regression test that fails for the original reason.
 The required matrix includes:
 
 - Linux, macOS, and Windows on the pinned Node/npm baseline;
-- current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit release-CI gating;
+- current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit CI/CodeQL/Governance/Scorecard release gating;
 - package-manifest and sensitive-artifact inspection;
 - generated type checks and recursively discovered JavaScript/shell syntax checks;
 - static undefined-identifier/redeclaration checks over all production JavaScript, tests, scripts, and browser-extension code;
@@ -185,7 +185,7 @@ A thorough review asks:
 - Are persistent files atomic, owner-only, size-bounded, and symlink-aware?
 - Can browser/app automation be expressed without arbitrary evaluation, and are pairing/resource values absent from results and logs?
 - Can a stale PID, stale socket, duplicate request, partial write, or ambiguous remote response violate integrity?
-- Are package, CI, Worker, service, and release behavior tested on every supported platform, and does publication verify the exact successful push CI run?
+- Are package, CI, Worker, service, and release behavior tested on every supported platform, and does publication verify every required exact-commit push workflow?
 - Does the complete diff contain any real identifier, path, host, account, or credential-shaped value?
 - Does the change require a new npm version and deployment?
 

package/docs/PROJECT_STANDARDS.md

@@ -114,9 +114,9 @@ Flaky tests are defects. A retry may diagnose environmental instability but may
 
 - GitHub workflow permissions default to read-only and are expanded per job only when required.
 - Third-party Actions are pinned to immutable commit SHAs and reviewed when Dependabot updates them.
-- npm dependencies use exact versions and a committed lockfile. Registry signatures and attestations are verified in CI.
-- Dependency review blocks newly introduced vulnerable dependencies. CodeQL performs JavaScript/TypeScript and workflow analysis. OpenSSF Scorecard periodically audits repository supply-chain posture.
-- CI generates and validates a CycloneDX SBOM. Release artifacts must be reproducible from a reviewed commit and tied to successful exact-commit CI evidence.
+- npm dependencies use exact versions and a committed lockfile. Source bootstrap uses `npm ci`; the CI npm baseline itself is downloaded from an exact URL and verified against a pinned SHA-512 SRI before use. Registry signatures and attestations are verified in CI.
+- Dependency review blocks newly introduced vulnerable dependencies. CodeQL performs JavaScript/TypeScript and workflow analysis. OpenSSF Scorecard audits supply-chain posture, and both SARIF streams are failing gates with exact, expiring exceptions rather than advisory-only uploads.
+- CI generates and validates a CycloneDX SBOM. Release artifacts must be reproducible from a reviewed commit and tied to successful exact-commit CI, CodeQL, Governance, and Scorecard evidence.
 - Secret scanning and push protection are enabled. Repository examples use synthetic identities and reserved domains; reachable history is scanned before release.
 - Long-lived publication tokens should be replaced by npm trusted publishing with GitHub OIDC. Until that external registry configuration is completed, release credentials remain an explicit operator responsibility and must never be stored in the repository.
 - Security reports follow [SECURITY.md](../SECURITY.md), not public issue templates.

package/docs/TESTING.md

@@ -89,7 +89,7 @@ npm run version:check
 npm run release-impact:check
 ```
 
-GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI explicitly disables setup-node's automatic package-manager cache and upgrades npm from the runner temporary directory before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job scans reachable Git history, audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. Separate pinned workflows validate governance titles, review dependency changes, run CodeQL over JavaScript/TypeScript and GitHub Actions, fail on unaccepted security-tagged SARIF results, and publish OpenSSF Scorecard results. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Third-party Actions are pinned to immutable 40-character commit SHAs; architecture tests reject movable tags, and Dependabot monitors both action and dependency updates.
+GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI downloads the exact npm 12.0.1 tarball from the canonical registry, rejects redirects, verifies its recorded SHA-512 SRI, and exposes that verified CLI through `GITHUB_PATH` before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job scans reachable Git history, audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. Separate pinned workflows validate governance titles, review dependency changes, run CodeQL over JavaScript/TypeScript and GitHub Actions, and run OpenSSF Scorecard. The SARIF gate fails closed when rule metadata is absent, CodeQL permits only one exact, expiring non-shell process-boundary result, and Scorecard permits only exact reviewed governance/time-dependent findings; new dependency-pinning, fuzzing, or other supply-chain results fail before upload. Scorecard's signed analysis job contains only pinned `uses` steps, while a dependent gate job downloads the SARIF, enforces the accepted inventory, and uploads it to code scanning. Security property tests use a `.js` `fast-check` suite with deterministic seeds because the pinned Scorecard scanner recognizes JavaScript property testing only in `*.js`/`*.jsx`. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Third-party Actions are pinned to immutable 40-character commit SHAs; architecture tests reject movable tags, and Dependabot monitors both action and dependency updates. Source release creation additionally requires successful push-triggered CI, CodeQL, Governance, and Scorecard runs for the exact `main` commit.
 
 ## Test design rules
 

package/mbm

@@ -4,6 +4,6 @@ DIR=$(CDPATH= cd "$(dirname "$0")" && pwd)
 cd "$DIR"
 if [ ! -d node_modules ] || [ ! -x node_modules/.bin/wrangler ]; then
   echo "Installing local dependencies..."
-  npm install
+  npm ci
 fi
 exec node bin/machine-mcp.mjs "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -102,7 +102,7 @@
     "tool-docs:check": "node scripts/generate-tool-reference.mjs --check",
     "account:test": "node tests/account-admin-test.mjs",
     "sarif-security:test": "node tests/sarif-security-gate-test.mjs",
-    "security-properties:test": "node tests/security-properties-test.mjs",
+    "security-properties:test": "node tests/security-properties-test.js",
     "lint": "eslint eslint.config.mjs bin src/local scripts tests browser-extension",
     "lint:test": "node tests/lint-gate-test.mjs",
     "shell:test": "node tests/shell-test.mjs",
@@ -117,6 +117,7 @@
   "devDependencies": {
     "@types/node": "26.1.1",
     "eslint": "10.7.0",
+    "fast-check": "4.9.0",
     "globals": "17.7.0",
     "typescript": "7.0.2"
   },

package/scripts/github-release.mjs

@@ -10,7 +10,7 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { runNetworkCommand } from "./network-retry.mjs";
-import { requireSuccessfulCiRun } from "./release-ci.mjs";
+import { requireSuccessfulWorkflowRun } from "./release-ci.mjs";
 import { tagSyncError } from "./release-state.mjs";
 import { fileURLToPath } from "node:url";
 
@@ -126,28 +126,38 @@ function remoteTagCommit(tag) {
 }
 
 function assertSuccessfulCi(head) {
-  const text = outputNetwork("gh", [
-    "run",
-    "list",
-    "--workflow",
-    ".github/workflows/ci.yml",
-    "--commit",
-    head,
-    "--event",
-    "push",
-    "--limit",
-    "20",
-    "--json",
-    "databaseId,status,conclusion,headSha,event,createdAt,url",
-  ]);
-  let runs;
-  try { runs = JSON.parse(text); }
-  catch { fail("GitHub Actions did not return valid JSON"); }
-  let run;
-  try { run = requireSuccessfulCiRun(runs, head); }
-  catch (error) { fail(String(error?.message || error)); }
-  console.log(`GitHub Actions CI succeeded for ${head} (run ${run.databaseId}).`);
-  return run;
+  const required = [
+    [".github/workflows/ci.yml", "CI"],
+    [".github/workflows/codeql.yml", "CodeQL"],
+    [".github/workflows/governance.yml", "Governance"],
+    [".github/workflows/scorecard.yml", "OpenSSF Scorecard"],
+  ];
+  const verified = [];
+  for (const [workflow, name] of required) {
+    const text = outputNetwork("gh", [
+      "run",
+      "list",
+      "--workflow",
+      workflow,
+      "--commit",
+      head,
+      "--event",
+      "push",
+      "--limit",
+      "20",
+      "--json",
+      "databaseId,status,conclusion,headSha,event,createdAt,url",
+    ]);
+    let runs;
+    try { runs = JSON.parse(text); }
+    catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    let run;
+    try { run = requireSuccessfulWorkflowRun(runs, head, name); }
+    catch (error) { fail(String(error?.message || error)); }
+    console.log(`GitHub Actions ${name} succeeded for ${head} (run ${run.databaseId}).`);
+    verified.push(run);
+  }
+  return verified;
 }
 
 function releaseInfo(tag) {

package/scripts/prepare-pinned-npm.mjs

@@ -0,0 +1,97 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const NPM_VERSION = "12.0.1";
+const NPM_TARBALL_URL = "https://registry.npmjs.org/npm/-/npm-12.0.1.tgz";
+const NPM_TARBALL_INTEGRITY = "sha512-L5T9i/YAQWQWqTS/xZxJkei/9zcu99hCeE4qi41IyBVV7mRQad3qc2JfuOktwmH+qwGI/V2rbCL+/UYxb1+RQA==";
+const MAX_TARBALL_BYTES = 20 * 1024 * 1024;
+
+const githubPath = process.env.GITHUB_PATH;
+if (!githubPath) throw new Error("GITHUB_PATH is required; this bootstrap is intended for GitHub Actions");
+
+const root = mkdtempSync(join(process.env.RUNNER_TEMP || tmpdir(), "mbm-npm-bootstrap-"));
+try {
+  const archive = join(root, `npm-${NPM_VERSION}.tgz`);
+  const extracted = join(root, "extracted");
+  const bin = join(root, "bin");
+  mkdirSync(extracted, { recursive: true });
+  mkdirSync(bin, { recursive: true });
+
+  const response = await fetch(NPM_TARBALL_URL, { redirect: "error" });
+  if (!response.ok) throw new Error(`failed to download pinned npm tarball: HTTP ${response.status}`);
+  const declaredBytes = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredBytes) && declaredBytes > MAX_TARBALL_BYTES) throw new Error("pinned npm tarball exceeds 20 MiB");
+  const bytes = await readBoundedBody(response, MAX_TARBALL_BYTES);
+  verifyIntegrity(bytes, NPM_TARBALL_INTEGRITY);
+  writeFileSync(archive, bytes, { mode: 0o600 });
+
+  run("tar", ["-xzf", archive, "-C", extracted]);
+  const cli = join(extracted, "package", "bin", "npm-cli.js");
+  const version = run(process.execPath, [cli, "--version"], { capture: true }).trim();
+  if (version !== NPM_VERSION) throw new Error(`pinned npm tarball reported ${version}, expected ${NPM_VERSION}`);
+
+  const posixWrapper = join(bin, "npm");
+  writeFileSync(posixWrapper, `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(cli)} "$@"\n`, { mode: 0o755 });
+  chmodSync(posixWrapper, 0o755);
+  writeFileSync(join(bin, "npm.cmd"), `@echo off\r\n"${cmdQuote(process.execPath)}" "${cmdQuote(cli)}" %*\r\n`);
+  writeFileSync(githubPath, `${bin}\n`, { flag: "a" });
+  console.log(`Prepared integrity-verified npm ${NPM_VERSION} at ${bin}`);
+} catch (error) {
+  rmSync(root, { recursive: true, force: true });
+  throw error;
+}
+
+
+async function readBoundedBody(response, maximumBytes) {
+  if (!response.body) throw new Error("pinned npm tarball response has no body");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maximumBytes) throw new Error("pinned npm tarball exceeds 20 MiB");
+      chunks.push(Buffer.from(value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, total);
+}
+
+function verifyIntegrity(bytes, integrity) {
+  const match = /^sha512-(.+)$/.exec(integrity);
+  if (!match) throw new Error("pinned npm integrity must be SHA-512 SRI");
+  const actual = createHash("sha512").update(bytes).digest();
+  const expected = Buffer.from(match[1], "base64");
+  if (actual.length !== expected.length || !actual.equals(expected)) throw new Error("pinned npm tarball failed SHA-512 verification");
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: options.capture ? "utf8" : undefined,
+    stdio: options.capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = options.capture ? String(result.stderr || result.stdout || "").trim() : "";
+    throw new Error(`${command} exited ${result.status}${detail ? `: ${detail}` : ""}`);
+  }
+  return options.capture ? String(result.stdout || "") : "";
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'\\''`)}'`;
+}
+
+function cmdQuote(value) {
+  const text = String(value);
+  if (/[\0\r\n"%&|<>^!]/.test(text)) throw new Error("Windows wrapper path contains an unsupported character");
+  return text;
+}

package/scripts/release-ci.mjs

@@ -1,18 +1,23 @@
-export function requireSuccessfulCiRun(runs, head) {
+export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
   if (!Array.isArray(runs)) throw new Error("GitHub Actions response is not an array");
   if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+  const label = String(workflowName || "workflow");
   const matching = runs
     .filter((run) => run && run.headSha === head && run.event === "push")
     .sort((left, right) => String(right.createdAt || "").localeCompare(String(left.createdAt || "")));
   const run = matching[0];
   if (!run) {
-    throw new Error(`no push-triggered CI run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
+    throw new Error(`no push-triggered ${label} run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
   }
   if (run.status !== "completed") {
-    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
+    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
   }
   if (run.conclusion !== "success") {
-    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun CI before release`);
+    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
   }
   return run;
 }
+
+export function requireSuccessfulCiRun(runs, head) {
+  return requireSuccessfulWorkflowRun(runs, head, "CI");
+}

package/scripts/sarif-security-gate.mjs

@@ -12,7 +12,7 @@ if (!targets.length) throw new Error("usage: node scripts/sarif-security-gate.mj
 
 const accepted = loadAcceptedFindings(allowlistPath);
 const sarifFiles = targets.flatMap((target) => collectSarifFiles(resolve(target)));
-if (!sarifFiles.length) throw new Error("CodeQL security gate received no SARIF files");
+if (!sarifFiles.length) throw new Error("SARIF gate received no SARIF files");
 
 const blocked = [];
 const acknowledged = [];
@@ -22,28 +22,30 @@ for (const file of sarifFiles) {
 }
 
 for (const finding of acknowledged) {
-  process.stderr.write(`accepted CodeQL finding: ${finding.ruleId} at ${finding.path} (${finding.reason}; expires ${finding.expires})\n`);
+  process.stderr.write(`accepted SARIF finding: ${finding.ruleId} at ${finding.path} (${finding.reason}; expires ${finding.expires})\n`);
 }
 if (blocked.length) {
   for (const finding of blocked.slice(0, 100)) {
     process.stderr.write(`${finding.path}:${finding.line}: ${finding.ruleId}: ${finding.message}\n`);
   }
-  if (blocked.length > 100) process.stderr.write(`... ${blocked.length - 100} additional security findings omitted\n`);
-  throw new Error(`CodeQL security gate rejected ${blocked.length} unaccepted security finding(s)`);
+  if (blocked.length > 100) process.stderr.write(`... ${blocked.length - 100} additional SARIF findings omitted\n`);
+  throw new Error(`SARIF gate rejected ${blocked.length} unaccepted SARIF finding(s)`);
 }
-process.stderr.write(`CodeQL security gate ok (${sarifFiles.length} SARIF file(s); ${acknowledged.length} explicitly accepted finding(s))\n`);
+process.stderr.write(`SARIF gate ok (${sarifFiles.length} SARIF file(s); ${acknowledged.length} explicitly accepted finding(s))\n`);
 
 function inspectRun(run, file, allowlist, blockedFindings, acceptedFindings) {
   const rules = new Map();
   for (const rule of run.tool?.driver?.rules || []) rules.set(rule.id, rule);
   for (const result of run.results || []) {
-    const ruleId = String(result.ruleId || "");
-    const rule = rules.get(ruleId) || {};
-    if (!isSecurityRule(rule)) continue;
+    const ruleId = String(result.ruleId || "<unknown-rule>");
+    const rule = rules.get(ruleId);
+    // CodeQL's post-upload SARIF can omit rule metadata even when results exist.
+    // Missing metadata must fail closed because the result cannot be proven non-security.
+    if (rule && !isSecurityRule(rule)) continue;
     const location = primaryLocation(result);
     const path = normalizeSarifPath(location.path, run, file);
     const line = Number(location.line) || 1;
-    const message = boundedMessage(result.message?.text || result.message?.markdown || rule.shortDescription?.text || "security finding");
+    const message = boundedMessage(result.message?.text || result.message?.markdown || rule?.shortDescription?.text || "SARIF finding");
     const exception = allowlist.get(`${ruleId}\0${path}`);
     if (exception) acceptedFindings.push({ ruleId, path, ...exception });
     else blockedFindings.push({ ruleId, path, line, message });
@@ -101,7 +103,7 @@ function loadAcceptedFindings(file) {
     }
     if (expires < today) throw new Error(`accepted CodeQL finding expired: ${ruleId} at ${path}`);
     const key = `${ruleId}\0${path}`;
-    if (entries.has(key)) throw new Error(`duplicate accepted CodeQL finding: ${ruleId} at ${path}`);
+    if (entries.has(key)) throw new Error(`duplicate accepted SARIF finding: ${ruleId} at ${path}`);
     entries.set(key, { reason, expires });
   }
   return entries;

package/src/local/process-execution.mjs

@@ -9,8 +9,20 @@ import { clampInteger } from "./numbers.mjs";
 const MAX_STDIN_BYTES = 1024 * 1024;
 const DEFAULT_OUTPUT_BYTES = 512 * 1024;
 
+function spawnDirectProcess(command, args, options) {
+  // Keep the production child_process API call structurally separate from the
+  // injectable test seam and enforce non-shell execution at the final boundary.
+  return spawn(command, args, {
+    cwd: options.cwd,
+    env: options.env,
+    detached: options.detached,
+    windowsHide: options.windowsHide,
+    shell: false,
+  });
+}
+
 export class ProcessExecutionService {
-  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled, spawnProcess = spawn, terminateProcess = terminateProcessTreeWithEscalation }) {
+  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled, spawnProcess = spawnDirectProcess, terminateProcess = terminateProcessTreeWithEscalation }) {
     this.workspace = workspace;
     this.policy = policy;
     this.policyGate = policyGate;
@@ -80,6 +92,7 @@ export class ProcessExecutionService {
           env: executionEnv(this.workspace, { fullEnv: this.policy.minimalEnv === false, runtimeDir: this.runtimeDir }),
           detached: process.platform !== "win32",
           windowsHide: true,
+          shell: false,
         });
       } catch (error) {
         rejectPromise(error);

package/src/worker/index.ts

@@ -22,7 +22,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.2";
+const SERVER_VERSION = "1.0.3";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";