penthera 1.5.0 → 1.6.0

package/lib/deps/report.js

@@ -3,10 +3,11 @@
  * the full report, and a short PR comment centred on the capability diff.
  */
 import { CAPABILITIES, CAPABILITY_ORDER } from "./capabilities.js";
+import { FOOTER } from "../../src/report/footer.js";
 
 const plain = (s) => s;
 const label = (id) => CAPABILITIES[id]?.label || id;
-const RISKY = new Set(["install-scripts", "shell", "network", "fs-write", "env-bulk", "eval", "obfuscated", "ai-config-write", "ai-cli-invoke", "token-harvest"]);
+const RISKY = new Set(["install-scripts", "shell", "network", "fs-write", "env-bulk", "eval", "obfuscated", "ai-config-write", "ai-cli-invoke", "token-harvest", "startup-hook"]);
 
 function countsLine(counts) {
   return CAPABILITY_ORDER.filter((id) => counts[id]).map((id) => `${label(id)} ${counts[id]}`).join(" · ");
@@ -19,10 +20,11 @@ export function formatDepsTerminal(deps, c = {}, opts = {}) {
   const k = { bold: plain, dim: plain, red: plain, yellow: plain, green: plain, cyan: plain, ...c };
   const L = [];
   const missing = deps.notInstalled.length;
-  L.push(`  Packages   ${k.bold(String(deps.total))} in ${deps.lockfile} ${k.dim(`(v${deps.lockfileVersion}${deps.prod ? ", prod only" : ""}, ${deps.network})`)}`);
+  L.push(`  Packages   ${k.bold(String(deps.total))} in ${deps.lockfile} ${k.dim(`(${deps.format || `v${deps.lockfileVersion}`}${deps.prod ? ", prod only" : ""}, ${deps.network})`)}`);
   L.push(`  Scanned    ${deps.scanned}${missing ? k.yellow(` · ${missing} not installed or cached`) : ""}${deps.skippedOptional ? k.dim(` · ${deps.skippedOptional} optional for other platforms`) : ""}`);
   const cl = countsLine(deps.capabilityCounts);
   if (cl) L.push(`  Can do     ${k.dim(cl)}`);
+  if (deps.online?.note) L.push(`  Online     ${k.dim(deps.online.note)}`);
   if (deps.typosquats.length) L.push(`  Names      ${k.yellow(`${deps.typosquats.length} look like popular packages`)}`);
   if (deps.licenses) L.push(`  Licenses   ${licenseLine(deps.licenses, k)}`);
 
@@ -68,8 +70,36 @@ export function formatDepsTerminal(deps, c = {}, opts = {}) {
   return L;
 }
 
-const esc = (s) => String(s ?? "").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\n/g, " ");
-const code = (s) => "`" + String(s).replace(/`/g, "ˋ") + "`";
+// Package names, versions, paths and snippets come from the lockfile and the
+// package files, so in a PR comment they are attacker-controlled text.
+const MAX_FIELD = 200;
+const ZW = "\u200b"; // zero-width space: breaks mentions, refs and autolinks invisibly
+const cap = (s) => {
+  const t = String(s ?? "").replace(/[\u0000-\u001f\u007f\u2028\u2029]+/g, " ");
+  return t.length > MAX_FIELD ? `${t.slice(0, MAX_FIELD - 1)}…` : t;
+};
+/** Neutralise GitHub's text-level features: @mentions, #refs and bare-URL autolinks. */
+const defuse = (t) => t
+  .replace(/@/g, `@${ZW}`)
+  .replace(/#/g, `#${ZW}`)
+  .replace(/:\/\//g, `:${ZW}//`)
+  .replace(/\bwww\./gi, (m) => `${m.slice(0, 3)}${ZW}.`);
+
+/** Plain text safe inside Markdown (tables included): no HTML, links, images, emphasis, mentions. */
+export function esc(s) {
+  const t = cap(s)
+    .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+    .replace(/[\\`*_{}[\]()!|~]/g, (c) => `\\${c}`);
+  return defuse(t);
+}
+
+/**
+ * An inline code span: one line, no backticks, no table pipes, no angle
+ * brackets (an HTML tag that starts before a code span outranks it), capped.
+ */
+export function code(s) {
+  return "`" + defuse(cap(s).replace(/`/g, "ˋ").replace(/\|/g, "¦").replace(/</g, "‹").replace(/>/g, "›")) + "`";
+}
 
 /** Capability diff as Markdown (used in the full report and the PR comment). */
 export function formatDiffMarkdown(deps) {
@@ -105,7 +135,7 @@ export function formatDiffMarkdown(deps) {
   }
   const unavailable = d.upgraded.filter((u) => u.unavailable);
   if (unavailable.length) {
-    L.push(`> Not compared, old version not available offline: ${unavailable.map((u) => `${esc(u.name)} ${esc(u.from)}`).join(", ")}. Install the base tree and pass it to \`--diff\`, or use \`--online\`.`);
+    L.push(`> Not compared, old version not available offline: ${unavailable.map((u) => `${esc(u.name)} ${esc(u.from)}`).join(", ")}. Install the base tree and pass it to \`--diff\`${deps.ecosystem === "pypi" ? "" : ", or use \`--online\`"}.`);
     L.push("");
   }
   const withEvidence = [...gained.map((u) => [`${u.name}@${u.to}`, u.gained]), ...added.map((a) => [`${a.name}@${a.version}`, a.capabilities.filter((id) => RISKY.has(id))])]
@@ -144,7 +174,7 @@ export function formatDepsMarkdown(deps) {
   const L = [];
   L.push("## Dependencies");
   L.push("");
-  L.push(`**${deps.total}** packages in \`${esc(deps.lockfile)}\` (lockfile v${deps.lockfileVersion}${deps.prod ? ", production only" : ""}), ${deps.scanned} scanned ${deps.network}.${deps.notInstalled.length ? ` ${deps.notInstalled.length} not installed or cached.` : ""}`);
+  L.push(`**${deps.total}** packages in \`${esc(deps.lockfile)}\` (${deps.format ? esc(deps.format) : `lockfile v${deps.lockfileVersion}`}${deps.prod ? ", production only" : ""}), ${deps.scanned} scanned ${deps.network}.${deps.notInstalled.length ? ` ${deps.notInstalled.length} not installed or cached.` : ""}`);
   L.push("");
   const rows = CAPABILITY_ORDER.filter((id) => deps.capabilityCounts[id]);
   if (rows.length) {
@@ -186,5 +216,6 @@ export function formatPrComment(result, opts = {}) {
     L.push("");
   }
   L.push(`<sub>[penthera deps](https://github.com/danoszz/penthera)${opts.version ? ` v${opts.version}` : ""}: offline static analysis, no telemetry. Capabilities are what code can do, not a verdict.</sub>`);
+  if (opts.footer !== false) L.push("", FOOTER);
   return L.join("\n") + "\n";
 }

package/lib/deps/source.js

@@ -18,9 +18,10 @@ const MAX_FILES = 5000;
 
 /** Files of an installed package folder. Skips nested node_modules and symlinks. */
 export class DirSource {
-  constructor(dir) {
+  constructor(dir, { skip } = {}) {
     this.dir = dir;
     this.kind = "installed";
+    this.skip = skip || null;
   }
 
   files() {
@@ -35,7 +36,7 @@ export class DirSource {
         const p = join(d, e.name);
         if (e.isSymbolicLink()) continue;
         if (e.isDirectory()) {
-          if (e.name === "node_modules" || e.name === ".git") continue;
+          if (e.name === "node_modules" || e.name === ".git" || this.skip?.has(e.name)) continue;
           walk(p);
         } else if (e.isFile()) {
           out.push(relative(this.dir, p).split(sep).join("/"));
@@ -56,11 +57,17 @@ export class DirSource {
   }
 }
 
-/** Files of an unpacked tarball, held in memory. */
+/**
+ * Files of an unpacked tarball, held in memory. `anomaly` is set when the
+ * archive could not be read safely (the scan then fails closed, see
+ * scanPackage). `oversize` maps files too large to hold to their real size.
+ */
 export class MapSource {
-  constructor(map, kind = "npm-cache") {
+  constructor(map, kind = "npm-cache", { anomaly = null } = {}) {
     this.map = map;
     this.kind = kind;
+    this.anomaly = anomaly;
+    this.oversize = map.oversize || new Map();
   }
 
   files() {
@@ -68,7 +75,7 @@ export class MapSource {
   }
 
   size(rel) {
-    return this.map.get(rel)?.length || 0;
+    return this.oversize.get(rel) ?? (this.map.get(rel)?.length || 0);
   }
 
   read(rel) {
@@ -78,6 +85,19 @@ export class MapSource {
 
 // ── Tarballs ──────────────────────────────────────────────────────────────
 
+/** Unpacked size limits, enforced while reading, not afterwards. */
+export const MAX_UNPACKED_BYTES = 256 * 1024 * 1024;
+export const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_ENTRIES = 50_000;
+
+/** A tarball that could not be parsed unambiguously. Callers fail closed. */
+export class TarError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TarError";
+  }
+}
+
 function cstr(buf, start, len) {
   const s = buf.subarray(start, start + len);
   const z = s.indexOf(0);
@@ -85,45 +105,141 @@ function cstr(buf, start, len) {
 }
 
 /**
- * Minimal tar reader (ustar + pax/GNU long names). Returns Map<path, Buffer>
- * with the leading "package/" directory stripped. Only regular files are kept;
- * paths that try to climb out ("..") are dropped.
+ * A numeric header field: octal (NUL or space terminated), or GNU base-256
+ * (high bit of the first byte set). Anything else is an error, never 0: a size
+ * read wrong desyncs the parser from what npm (node-tar) extracts.
  */
-export function untar(buf) {
+export function tarNumber(header, start, len, field) {
+  const f = header.subarray(start, start + len);
+  if (f[0] & 0x80) {
+    if (f[0] === 0xff) throw new TarError(`negative base-256 ${field}`);
+    let n = BigInt(f[0] & 0x7f);
+    for (let i = 1; i < f.length; i++) n = (n << 8n) | BigInt(f[i]);
+    if (n > BigInt(Number.MAX_SAFE_INTEGER)) throw new TarError(`${field} too large`);
+    return Number(n);
+  }
+  const s = f.toString("latin1").replace(/[\0 ]+$/, "").replace(/^ +/, "");
+  if (s === "") return 0;
+  if (!/^[0-7]+$/.test(s)) throw new TarError(`malformed ${field} ${JSON.stringify(s)}`);
+  return parseInt(s, 8);
+}
+
+function checksumOk(header) {
+  const want = tarNumber(header, 148, 8, "checksum");
+  let sum = 0;
+  for (let i = 0; i < 512; i++) sum += i >= 148 && i < 156 ? 32 : header[i];
+  return sum === want;
+}
+
+/** pax extended header records ("<len> <key>=<value>\n"). */
+function parsePax(body) {
+  const out = {};
+  let i = 0;
+  while (i < body.length) {
+    if (body[i] === 0) break; // NUL padding after the last record
+    const sp = body.indexOf(0x20, i);
+    if (sp === -1) throw new TarError("malformed pax header");
+    const len = Number(body.subarray(i, sp).toString("latin1"));
+    if (!Number.isInteger(len) || len <= sp - i || i + len > body.length || body[i + len - 1] !== 0x0a) {
+      throw new TarError("malformed pax record");
+    }
+    const rec = body.subarray(sp + 1, i + len - 1).toString("utf-8");
+    const eq = rec.indexOf("=");
+    if (eq === -1) throw new TarError("malformed pax record");
+    out[rec.slice(0, eq)] = rec.slice(eq + 1);
+    i += len;
+  }
+  return out;
+}
+
+/**
+ * Tar reader (ustar, pax and GNU extensions). Returns Map<path, Buffer> with
+ * the leading "package/" directory stripped. Only regular files are kept;
+ * paths that try to climb out ("..") are dropped. Files over MAX_FILE_BYTES
+ * are listed in map.oversize (path -> size) instead of being copied.
+ *
+ * Fails closed: a bad checksum, a malformed or impossible size, a truncated
+ * entry, or data after the end-of-archive marker throws TarError, so a crafted
+ * archive can never show this reader different files than npm extracts.
+ */
+export function untar(buf, { maxTotal = MAX_UNPACKED_BYTES, maxFile = MAX_FILE_BYTES } = {}) {
   const files = new Map();
+  files.oversize = new Map();
   let off = 0;
+  let pax = {};
   let longName = null;
+  let total = 0;
+  let entries = 0;
   while (off + 512 <= buf.length) {
     const header = buf.subarray(off, off + 512);
-    if (header.every((b) => b === 0)) break;
-    let name = cstr(header, 0, 100);
-    const size = parseInt(cstr(header, 124, 12).trim() || "0", 8) || 0;
+    if (header.every((b) => b === 0)) {
+      // End of archive. Everything after it must be zero padding too.
+      for (let i = off; i < buf.length; i++) if (buf[i] !== 0) throw new TarError(`data after the end-of-archive marker at byte ${off}`);
+      return files;
+    }
+    if (++entries > MAX_ENTRIES) throw new TarError(`more than ${MAX_ENTRIES} entries`);
+    if (!checksumOk(header)) throw new TarError(`bad header checksum at byte ${off}`);
     const type = String.fromCharCode(header[156] || 48);
-    const prefix = cstr(header, 345, 155);
+    let size = tarNumber(header, 124, 12, "size");
+    if (pax.size != null && type !== "x" && type !== "g" && type !== "L" && type !== "K") {
+      if (!/^\d+$/.test(pax.size)) throw new TarError(`malformed pax size ${JSON.stringify(pax.size)}`);
+      size = Number(pax.size);
+    }
+    if (size > maxTotal) throw new TarError(`entry larger than ${maxTotal} bytes`);
+    if (off + 512 + size > buf.length) throw new TarError(`truncated entry at byte ${off}`);
+    total += size;
+    if (total > maxTotal) throw new TarError(`unpacked size over ${maxTotal} bytes`);
+    let name = cstr(header, 0, 100);
+    const ustar = header.subarray(257, 263).toString("latin1") === "ustar\0";
+    const prefix = ustar ? cstr(header, 345, 155) : "";
     if (prefix) name = `${prefix}/${name}`;
     const body = buf.subarray(off + 512, off + 512 + size);
     off += 512 + Math.ceil(size / 512) * 512;
 
-    if (type === "x") { // pax extended header
-      const m = body.toString("utf-8").match(/\d+ path=([^\n]*)\n/);
-      if (m) longName = m[1];
+    if (type === "x") { // pax extended header, for the next entry
+      pax = parsePax(body);
+      continue;
+    }
+    if (type === "g") { // pax global header: validated, not used
+      parsePax(body);
       continue;
     }
     if (type === "L") { // GNU long name
       longName = cstr(body, 0, body.length);
       continue;
     }
-    if (type === "g") continue;
-    if (longName) { name = longName; longName = null; }
+    if (type === "K") continue; // GNU long link name
+    if (pax.path != null) name = pax.path;
+    else if (longName) name = longName;
+    pax = {};
+    longName = null;
     if (type !== "0" && type !== "\0" && type !== "7") continue;
     const parts = name.split("/").filter(Boolean);
     parts.shift(); // top-level folder, usually "package"
     if (parts.length === 0 || parts.includes("..")) continue;
-    files.set(parts.join("/"), Buffer.from(body));
+    const rel = parts.join("/");
+    if (size > maxFile) {
+      files.set(rel, Buffer.alloc(0));
+      files.oversize.set(rel, size);
+    } else {
+      files.set(rel, Buffer.from(body));
+      files.oversize.delete(rel);
+    }
   }
+  if (off !== buf.length) throw new TarError(`trailing partial block at byte ${off}`);
   return files;
 }
 
+/** gunzip with an output cap, then untar. Throws on any anomaly. */
+export function unpackTgz(tgz) {
+  return untar(gunzipSync(tgz, { maxOutputLength: MAX_UNPACKED_BYTES }));
+}
+
+/** A verified tarball that could not be unpacked safely: no files, an anomaly. */
+function unreadable(kind, e) {
+  return new MapSource(new Map(), kind, { anomaly: `tarball could not be read safely (${e.message})` });
+}
+
 /** Split an SRI string into { algo, hex } entries. */
 export function parseIntegrity(sri) {
   return String(sri || "").split(/\s+/).filter(Boolean).map((s) => {
@@ -155,11 +271,16 @@ export function sourceFromNpmCache(integrity, cacheDir = npmCacheDir()) {
   for (const { algo, hex } of parseIntegrity(integrity)) {
     const p = join(cacheDir, "_cacache", "content-v2", algo, hex.slice(0, 2), hex.slice(2, 4), hex.slice(4));
     if (!existsSync(p)) continue;
+    let tgz;
+    try { tgz = readFileSync(p); } catch { continue; }
+    if (!verifyIntegrity(tgz, integrity)) continue; // corrupt entry, try the next hash
+    // The bytes are the ones the lockfile pins. If they do not unpack cleanly,
+    // say so: returning null would let the package pass as merely "not cached".
     try {
-      const tgz = readFileSync(p);
-      if (!verifyIntegrity(tgz, integrity)) continue;
-      return new MapSource(untar(gunzipSync(tgz)), "npm-cache");
-    } catch { /* corrupt entry, try the next hash */ }
+      return new MapSource(unpackTgz(tgz), "npm-cache");
+    } catch (e) {
+      return unreadable("npm-cache", e);
+    }
   }
   return null;
 }
@@ -167,5 +288,9 @@ export function sourceFromNpmCache(integrity, cacheDir = npmCacheDir()) {
 /** Unpack a verified tarball buffer (used by --online). */
 export function sourceFromTarball(tgz, integrity, kind = "registry") {
   if (integrity && !verifyIntegrity(tgz, integrity)) return null;
-  return new MapSource(untar(gunzipSync(tgz)), kind);
+  try {
+    return new MapSource(unpackTgz(tgz), kind);
+  } catch (e) {
+    return unreadable(kind, e);
+  }
 }

package/lib/deps/typosquat.js

@@ -1,12 +1,15 @@
 /**
- * Typosquat and slopsquat checks for npm package names (`penthera deps`).
+ * Typosquat and slopsquat checks for npm and PyPI package names (`penthera deps`).
  *
  * Compares each dependency name against a vendored list of popular package
  * names (lib/deps/popular-packages.json, refreshed at release time by
  * scripts/refresh-popular-packages.mjs; never fetched at runtime). A name that
  * is one or two edits away from a popular package, but is not itself popular,
  * is worth a second look: that is how `crossenv` (for cross-env) and
- * `electorn` (for electron) shipped malware.
+ * `electorn` (for electron) shipped malware on npm, and `python3-dateutil`
+ * and `jeIlyfish` on PyPI. PyPI names are compared after PEP 503
+ * normalisation, so `python_dateutil` (the same project as python-dateutil)
+ * is not a hit, while `pythondateutil` is.
  *
  * Slopsquatting is the same attack aimed at AI assistants: registering names
  * a model is likely to hallucinate. Offline, the useful signal is the same
@@ -14,15 +17,17 @@
  */
 import { readFileSync } from "node:fs";
 
-let _popular = null;
+const _popular = {};
+// PyPI's list is lib/deps/popular-pypi.json (scripts/refresh-popular-pypi.mjs).
+const LISTS = { npm: "./popular-packages.json", pypi: "./popular-pypi.json" };
 
-/** The vendored popular-name list: { source, names: string[] }. */
-export function loadPopular() {
-  if (!_popular) {
-    const data = JSON.parse(readFileSync(new URL("./popular-packages.json", import.meta.url), "utf-8"));
-    _popular = { ...data, set: new Set(data.names), rank: new Map(data.names.map((n, i) => [n, i + 1])) };
+/** The vendored popular-name list for an ecosystem: { source, names: string[] }. */
+export function loadPopular(ecosystem = "npm") {
+  if (!_popular[ecosystem]) {
+    const data = JSON.parse(readFileSync(new URL(LISTS[ecosystem], import.meta.url), "utf-8"));
+    _popular[ecosystem] = { ...data, ecosystem, set: new Set(data.names), rank: new Map(data.names.map((n, i) => [n, i + 1])) };
   }
-  return _popular;
+  return _popular[ecosystem];
 }
 
 /** Damerau-Levenshtein (optimal string alignment) distance, capped at max+1. */
@@ -51,6 +56,8 @@ export function editDistance(a, b, max = 2) {
 }
 
 const JS_SUFFIX = /(?:[.-]?js|-node)$/;
+// PyPI: "python-requests", "requests-py", "py-requests" imitate "requests".
+const PY_AFFIX = /^(?:python3?|py)-|-(?:python3?|py)$/;
 
 /** Separator- and scope-insensitive form: "@types/lodash.merge" -> "typeslodashmerge". */
 const squash = (s) => s.replace(/^@/, "").replace(/[-_./]/g, "");
@@ -80,9 +87,12 @@ export function checkName(name, popular = loadPopular()) {
     if (squash(name) === tSquash) {
       distance = 1;
       kind = "separator or scope swap";
-    } else if (name.replace(JS_SUFFIX, "") === target) {
+    } else if (popular.ecosystem !== "pypi" && name.replace(JS_SUFFIX, "") === target) {
       distance = 1;
       kind = "popular name plus a js/node suffix";
+    } else if (popular.ecosystem === "pypi" && target.length >= 4 && name.replace(PY_AFFIX, "") === target) {
+      distance = 1;
+      kind = "popular name plus a python/py affix";
     } else if (max > 0 && !isScoped === !target.startsWith("@")) {
       distance = editDistance(name, target, max);
       if (distance > max) continue;
@@ -100,10 +110,11 @@ export function checkName(name, popular = loadPopular()) {
 
 /**
  * Check a list of package names. Returns hits sorted by name.
- * @param {string[]} names
+ * @param {string[]} names PyPI names must already be PEP 503 normalised
+ * @param {"npm"|"pypi"} ecosystem
  */
-export function findTyposquats(names) {
-  const popular = loadPopular();
+export function findTyposquats(names, ecosystem = "npm") {
+  const popular = loadPopular(ecosystem);
   const out = [];
   for (const name of [...new Set(names)].sort()) {
     const hit = checkName(name, popular);

package/lib/fix/apply.js

@@ -2,12 +2,13 @@
  * applyDiff: the one place fix recipes' diffs get written to disk.
  *
  * Planning never writes. Applying is a separate, explicit step that refuses to
- * write outside the repo, into .git, or into a dirty git tree (unless the caller
- * passes allowDirty), and writes nothing unless every hunk applies.
+ * write outside the repo, into any .git (any case, any depth), to .gitmodules,
+ * through a symlink anywhere in the path, or into a dirty git tree (unless the
+ * caller passes allowDirty), and writes nothing unless every hunk applies.
  */
-import { existsSync, readFileSync, writeFileSync, mkdirSync, realpathSync } from "node:fs";
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, mkdirSync, realpathSync, lstatSync, openSync, writeSync, closeSync, constants } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createGit } from "../../src/agent/git.js";
 import { parsePatch, applyHunks } from "./diff.js";
 
 export class FixError extends Error {
@@ -23,19 +24,64 @@ function inside(root, p) {
   return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
 }
 
+// Code points HFS+ ignores in names, so ".g\u200cit" is ".git" on macOS (CVE-2014-9390).
+const IGNORABLE = /[\u200b-\u200f\u202a-\u202e\u2060-\u2064\u206a-\u206f\ufeff]/g;
+
+/**
+ * The name a path segment resolves to on case-insensitive file systems
+ * (macOS, Windows): case folded, ignorable code points dropped, and the
+ * trailing dots and spaces Windows strips removed.
+ */
+export function canonicalSegment(seg) {
+  return String(seg).normalize("NFC").replace(IGNORABLE, "").replace(/[. ]+$/, "").toLowerCase();
+}
+
+/** True for a segment that names the git directory: .git, .GIT, .Git., or the 8.3 alias GIT~1. */
+export function isGitDirSegment(seg) {
+  const c = canonicalSegment(seg);
+  return c === ".git" || /^git~\d+$/.test(c);
+}
+
+/** Files a fix diff may never touch even though they live in the work tree. */
+const PROTECTED_FILES = new Set([".gitmodules"]);
+
+/**
+ * Throws unless no component of `target` below `root` is a symlink. Every
+ * existing component is lstat-ed, so neither a symlinked directory nor a
+ * dangling symlink at the file itself can redirect a write.
+ */
+function assertNoSymlinks(root, target, file) {
+  let cur = root;
+  for (const seg of relative(root, target).split(sep)) {
+    cur = join(cur, seg);
+    let st;
+    try {
+      st = lstatSync(cur);
+    } catch (e) {
+      if (e.code === "ENOENT") return;
+      throw e;
+    }
+    if (st.isSymbolicLink()) {
+      throw new FixError(`Refusing to write ${file}: ${relative(root, cur)} is a symlink, and fix diffs never write through symlinks`, "SYMLINK");
+    }
+  }
+}
+
 /** Resolve a diff path to an absolute path inside the repo, or throw. */
 function safeTarget(root, file) {
-  if (!file || isAbsolute(file) || file.includes("\0")) {
+  if (!file || isAbsolute(file) || file.includes("\0") || /^[a-zA-Z]:/.test(file)) {
     throw new FixError(`Refusing to write ${JSON.stringify(file)}: paths in a diff must be relative to the repo`, "OUTSIDE_REPO");
   }
+  const segs = file.split(/[\\/]/);
+  if (segs.includes("..")) throw new FixError(`Refusing to write ${file}: it is outside the repo`, "OUTSIDE_REPO");
+  // Any .git at any depth, in any case: on macOS .GIT/hooks/pre-commit is .git/hooks/pre-commit.
+  if (segs.some(isGitDirSegment)) throw new FixError(`Refusing to write ${file}: it is inside .git`, "OUTSIDE_REPO");
+  if (segs.some((s) => PROTECTED_FILES.has(canonicalSegment(s)))) {
+    throw new FixError(`Refusing to write ${file}: fix diffs never edit .gitmodules (it can point git at other repositories)`, "PROTECTED");
+  }
   const target = resolve(root, file);
-  if (!inside(root, target)) throw new FixError(`Refusing to write ${file}: it is outside the repo`, "OUTSIDE_REPO");
-  if (relative(root, target).split(sep)[0] === ".git") throw new FixError(`Refusing to write ${file}: it is inside .git`, "OUTSIDE_REPO");
-  // Follow symlinks: the real location of the file (or its nearest existing
-  // parent, for a new file) must still be inside the repo.
-  let probe = target;
-  while (!existsSync(probe)) probe = dirname(probe);
-  if (!inside(root, realpathSync(probe))) throw new FixError(`Refusing to write ${file}: it resolves outside the repo`, "OUTSIDE_REPO");
+  if (!inside(root, target) || target === root) throw new FixError(`Refusing to write ${file}: it is outside the repo`, "OUTSIDE_REPO");
+  assertNoSymlinks(root, target, file);
   return target;
 }
 
@@ -43,8 +89,10 @@ function safeTarget(root, file) {
 export function assertCleanTree(repoPath) {
   let status;
   try {
-    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: repoPath, stdio: ["ignore", "pipe", "ignore"] });
-    status = execFileSync("git", ["status", "--porcelain", "--", "."], { cwd: repoPath, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    // The hardened runner: no fsmonitor, no hooks, no transports (src/agent/git.js).
+    const git = createGit(repoPath);
+    git.run("rev-parse", "--is-inside-work-tree");
+    status = git.run("status", "--porcelain", "--", ".");
   } catch {
     throw new FixError(`${repoPath} is not a git work tree, so a fix could not be reviewed or reverted. Commit it to git first, or pass --allow-dirty.`, "NOT_GIT");
   }
@@ -53,6 +101,24 @@ export function assertCleanTree(repoPath) {
   }
 }
 
+const NOFOLLOW = constants.O_NOFOLLOW || 0;
+
+/** Write one file: create exclusively, or overwrite in place, never through a symlink. */
+function writeTarget(root, w) {
+  assertNoSymlinks(root, w.target, w.path); // again, right before writing
+  mkdirSync(dirname(w.target), { recursive: true });
+  assertNoSymlinks(root, w.target, w.path);
+  const flags = constants.O_WRONLY | NOFOLLOW | (w.created ? constants.O_CREAT | constants.O_EXCL : constants.O_TRUNC);
+  const fd = openSync(w.target, flags, 0o644);
+  try {
+    const buf = Buffer.from(w.after, "utf-8");
+    let off = 0;
+    while (off < buf.length) off += writeSync(fd, buf, off, buf.length - off);
+  } finally {
+    closeSync(fd);
+  }
+}
+
 /**
  * Apply a unified diff to files under repoPath.
  *
@@ -73,6 +139,7 @@ export function applyDiff(repoPath, diff, opts = {}) {
     if (f.oldPath && f.oldPath !== f.newPath) throw new FixError(`Refusing to rename ${f.oldPath}: fix diffs never rename files`, "RENAME");
     const target = safeTarget(root, f.newPath);
     const exists = existsSync(target);
+    if (exists && !lstatSync(target).isFile()) throw new FixError(`Refusing to write ${f.newPath}: it is not a regular file`, "CONFLICT");
     if (!f.oldPath && exists) throw new FixError(`${f.newPath} already exists; the plan expected to create it`, "CONFLICT");
     if (f.oldPath && !exists) throw new FixError(`${f.newPath} does not exist; the plan expected to edit it`, "CONFLICT");
     const before = exists ? readFileSync(target, "utf-8") : null;
@@ -86,10 +153,7 @@ export function applyDiff(repoPath, diff, opts = {}) {
   }
 
   if (!opts.dryRun) {
-    for (const w of writes) {
-      mkdirSync(dirname(w.target), { recursive: true });
-      writeFileSync(w.target, w.after);
-    }
+    for (const w of writes) writeTarget(root, w);
   }
   return { applied: !opts.dryRun, files: writes.map((w) => ({ path: w.path, created: w.created })) };
 }