fix(confinement,scanners): case-folding confinement, MCP launcher/DNS pinning, bounded SSE & secret redaction

src/nexus_symbiote/policy.py

@@ -159,16 +159,35 @@ def find_policy_path(project_root: Path) -> Path | None:
     belongs to whoever controls that directory, not to the project. Both file names
     at once are refused: either could silently shadow the other.
     """
+    from nexus_symbiote.utils.confined import fold_name
+
     current = project_root.resolve()
     if current.is_file():
         current = current.parent
+    try:
+        entries = sorted(os.listdir(current))
+    except OSError:
+        return None
+    folded_targets = {fold_name(name): name for name in POLICY_FILE_NAMES}
     found: list[Path] = []
-    for name in POLICY_FILE_NAMES:
-        candidate = current / name
+    variants: list[tuple[str, str]] = []
+    for entry in entries:
+        canonical = folded_targets.get(fold_name(entry))
+        if canonical is None:
+            continue
+        candidate = current / entry
         if candidate.is_symlink():
             raise PolicyError(f"policy must not be a symlink: {candidate}")
-        if candidate.exists():
-            found.append(candidate)
+        if entry in POLICY_FILE_NAMES:
+            if candidate.exists():
+                found.append(candidate)
+        else:
+            variants.append((entry, canonical))
+    if variants:
+        variant_name, canonical = variants[0]
+        raise PolicyError(
+            f"case-variant policy file {variant_name} in {current}; rename it to {canonical}"
+        )
     if len(found) > 1:
         raise PolicyError(
             f"both {POLICY_FILE_NAMES[0]} and {POLICY_FILE_NAMES[1]} exist in {current}; "

src/nexus_symbiote/scanners/live_mcp.py

@@ -545,23 +545,60 @@ def request(
     def _read_sse(self, response: http.client.HTTPResponse, body: bytes, maximum: int) -> bytes:
         """Read event lines until the requested response arrives.
 
-        HTTPResponse.readline decodes chunked transfer coding. A single line may
-        use the whole response byte limit, since SDK servers put an entire result
-        on one data line.
+        HTTPResponse.read1 / readline decodes chunked transfer coding. Lines may
+        terminate in CRLF, LF or bare CR (WHATWG SSE), and a single line may use
+        the whole response byte limit when SDK servers emit one large data line.
         """
         request_id = _json(body).get("id")
         decoder = _SSEDecoder(self._max_sse_events)
         payload = bytearray()
+        buffer = bytearray()
+        saw_bare_cr = False
+        use_read1 = hasattr(response, "read1")
         while True:
-            line = response.readline(maximum + 1 - len(payload))
-            if not line:
-                break
-            payload.extend(line)
-            if len(payload) > maximum:
+            remaining = maximum + 1 - len(payload) - len(buffer)
+            if remaining <= 0:
                 raise DiscoveryError("SSE response byte limit exceeded")
-            for message in decoder.feed(line):
-                if message.get("id") == request_id and ("result" in message or "error" in message):
-                    return bytes(payload)
+            chunk = (
+                response.read1(min(4096, remaining)) if use_read1 else response.readline(remaining)
+            )
+            eof = not chunk
+            buffer.extend(chunk)
+            while buffer:
+                cr = buffer.find(b"\r")
+                lf = buffer.find(b"\n")
+                if cr < 0 and lf < 0:
+                    if len(payload) + len(buffer) > maximum:
+                        raise DiscoveryError("SSE response byte limit exceeded")
+                    if not eof:
+                        break
+                    end = len(buffer)
+                elif lf >= 0 and (cr < 0 or lf < cr):
+                    end = lf + 1
+                elif cr + 1 < len(buffer):
+                    if buffer[cr + 1] == 0x0A:
+                        end = cr + 2
+                    else:
+                        saw_bare_cr = True
+                        end = cr + 1
+                elif eof or saw_bare_cr:
+                    end = cr + 1
+                else:
+                    if len(payload) + len(buffer) > maximum:
+                        raise DiscoveryError("SSE response byte limit exceeded")
+                    break
+                line = bytes(buffer[:end])
+                del buffer[:end]
+                payload.extend(line)
+                if len(payload) > maximum:
+                    raise DiscoveryError("SSE response byte limit exceeded")
+                for message in decoder.feed(line):
+                    if message.get("id") == request_id and (
+                        "result" in message or "error" in message
+                    ):
+                        return bytes(payload)
+            if eof:
+                break
         raise DiscoveryError("SSE ended without matching response")
 
 

src/nexus_symbiote/scanners/mcp.py

@@ -750,12 +750,17 @@ def _purl(package: Package) -> str | None:
     " unsafeHttpWhitelist checksumBehavior enableOfflineMode injectEnvironmentFiles"
     " packageExtensions"
 )
+_BUN_IDENTITY_SETTINGS = frozenset({"preload", "run.preload"})
+_BUN_CODE_SETTINGS = frozenset({"run.shell"})
+_BUN_SOURCE_SETTINGS = frozenset({"install.ca", "install.cafile"})
+_DENO_SOURCE_SETTINGS = frozenset({"importMap", "imports", "scopes"})
 _RESOLVER_FILES = {
     "npm": (".npmrc",),
-    "deno": (".npmrc",),
+    "deno": (".npmrc", "deno.json", "deno.jsonc"),
     "bun": (".npmrc", "bunfig.toml"),
     "yarn": (".yarnrc.yml", ".yarnrc", ".env.yarn"),
     "uv-project": ("uv.toml", "pyproject.toml"),
+    "uv-tool": ("uv.toml", "pyproject.toml"),
 }
 # Setting names exported in clear: fixed vocabularies, never a name taken from input.
 _KNOWN_SETTINGS = (
@@ -765,6 +770,10 @@ def _purl(package: Package) -> str | None:
     | _NPM_CODE_SETTINGS
     | _YARN_CODE_SETTINGS
     | _YARN_SOURCE_SETTINGS
+    | _BUN_IDENTITY_SETTINGS
+    | _BUN_CODE_SETTINGS
+    | _BUN_SOURCE_SETTINGS
+    | _DENO_SOURCE_SETTINGS
     | frozenset(_UV_SETTINGS)
     | {"registry", "npmRegistryServer", "offline", "prefer-offline", "strict-ssl", "environment"}
 )
@@ -974,6 +983,14 @@ def _file_setting(path: str, family: str, key: str, value: str, launched: set[st
             "enableOfflineMode": "false",
         }
         return "inert" if relaxed.get(key) == value else "source"
+    if path == "bunfig.toml":
+        if key in _BUN_IDENTITY_SETTINGS:
+            return "identity"
+        if key in _BUN_CODE_SETTINGS:
+            return "code"
+        return "source" if key in _BUN_SOURCE_SETTINGS else "inert"
+    if path in {"deno.json", "deno.jsonc"}:
+        return "source" if key in _DENO_SOURCE_SETTINGS else "inert"
     if path in {"uv.toml", "pyproject.toml"}:
         return "source" if not key.startswith("sources.") or key[8:] in launched else "inert"
     return "unresolved" if path == ".env.yarn" else "inert"
@@ -1135,14 +1152,67 @@ def _read(self, path: str) -> _ResolverFile:
                 if key in _YARN_CODE_SETTINGS or key in _YARN_SOURCE_SETTINGS
             ]
             return _ResolverFile(tuple(entries))
+        if path in {"deno.json", "deno.jsonc"}:
+            text = self._text(path)
+            if text is None:
+                return _ResolverFile()
+            try:
+                data = _load_jsonc(text)
+            except (ValueError, RecursionError):
+                self._result.scan_failures.append(f"{path}: invalid JSON or duplicate keys")
+                return _ResolverFile()
+            if not isinstance(data, dict):
+                return _ResolverFile()
+            deno_entries: list[tuple[str, str]] = []
+            import_map = data.get("importMap")
+            if isinstance(import_map, str) and import_map:
+                deno_entries.append(("importMap", import_map))
+            imports = data.get("imports")
+            if isinstance(imports, dict):
+                for target in imports.values():
+                    if isinstance(target, str):
+                        deno_entries.append(("imports", target))
+            scopes = data.get("scopes")
+            if isinstance(scopes, dict) and scopes:
+                deno_entries.append(("scopes", json.dumps(scopes, sort_keys=True, default=str)))
+            return _ResolverFile(tuple(deno_entries))
         settings = self._toml(path)
         if path == "bunfig.toml":
             install = settings.get("install")
-            return _ResolverFile(
-                tuple(
-                    _registries(install if isinstance(install, dict) else {}, "registry", "scopes")
+            install_map = install if isinstance(install, dict) else {}
+            bun_entries = _registries(install_map, "registry", "scopes")
+            for ca_key in ("ca", "cafile"):
+                if ca_key in install_map and install_map[ca_key]:
+                    bun_entries.append(
+                        (
+                            f"install.{ca_key}",
+                            install_map[ca_key]
+                            if isinstance(install_map[ca_key], str)
+                            else json.dumps(install_map[ca_key], default=str),
+                        )
+                    )
+            if settings.get("preload"):
+                bun_entries.append(
+                    (
+                        "preload",
+                        settings["preload"]
+                        if isinstance(settings["preload"], str)
+                        else json.dumps(settings["preload"], default=str),
+                    )
                 )
-            )
+            run_cfg = settings.get("run")
+            if isinstance(run_cfg, dict):
+                for run_key in ("preload", "shell"):
+                    if run_cfg.get(run_key):
+                        bun_entries.append(
+                            (
+                                f"run.{run_key}",
+                                run_cfg[run_key]
+                                if isinstance(run_cfg[run_key], str)
+                                else json.dumps(run_cfg[run_key], default=str),
+                            )
+                        )
+            return _ResolverFile(tuple(bun_entries))
         if path == "pyproject.toml":
             tool = settings.get("tool")
             uv = tool.get("uv") if isinstance(tool, dict) else None
@@ -1860,18 +1930,19 @@ def _resolver_view(
                 view.names.append(label)
                 kind = _file_setting(path, family, key, value, launched)
                 if kind == "identity":
-                    view.identity.append(
-                        f"npm {key} setting from {path}"
-                        if path == ".npmrc"
-                        else f"{path} {key} replaces or extends yarn"
-                    )
+                    if path == ".npmrc":
+                        view.identity.append(f"npm {key} setting from {path}")
+                    elif path == "bunfig.toml":
+                        view.identity.append(f"{path} {key} preloads local code")
+                    else:
+                        view.identity.append(f"{path} {key} replaces or extends yarn")
                 elif kind == "code":
                     view.code += 1
                 elif kind == "source":
                     view.sources.append((label, value))
                 elif kind == "unresolved":
                     view.unresolved.append(label)
-            if path in {"uv.toml", "pyproject.toml", ".env.yarn"}:
+            if path in {"uv.toml", "pyproject.toml", ".env.yarn", "deno.json", "deno.jsonc"}:
                 continue
             default = "npmRegistryServer" if path == ".yarnrc.yml" else "registry"
             scope_label, scope = (

src/nexus_symbiote/scanners/mcp_launch.py

@@ -18,6 +18,7 @@
 from __future__ import annotations
 
 import fnmatch
+import posixpath
 import re
 import shlex
 from collections.abc import Callable, Iterator
@@ -1740,12 +1741,18 @@ def _program_reason(name: str, rest: list[str], launch: Launch) -> str | None:
     return _embedded_reason(rest)
 
 
-def _start(words: list[str], launch: Launch) -> None:
+def _start(words: list[str], launch: Launch, *, package_entry: bool = False) -> None:
     """A program a runner starts by name: record it and check what it starts in turn."""
     launch.executable = normalize_command(words[0])
     family = _interpreter_family(launch.executable)
     reason = _interpreter_reason(family, words[1:], launch) if family else None
+    # What the words start in turn is the more specific reason, so it is named first.
     reason = reason or _embedded_reason(words)
+    if reason is None and package_entry:
+        if re.search(r"[\\/]", words[0]) or words[0].startswith("."):
+            reason = "runner command is a path, not a package entry point"
+        elif family is not None:
+            reason = f"runner starts {family} instead of a package entry point"
     if reason is not None:
         launch.fail(reason)
 
@@ -2181,7 +2188,7 @@ def _package_runner(
         launch.packages.append(package)
         return
     if position < len(rest):
-        _start(rest[position:], launch)
+        _start(rest[position:], launch, package_entry=True)
     launch.packages.extend(npm_spec(spec) for spec in specs)
 
 
@@ -2232,6 +2239,15 @@ def _npm(name: str, rest: list[str], launch: Launch) -> None:
         return
     if subcommand in {"exec", "x"}:
         launch.launcher = "npm exec"
+        scanned = _scan(remainder, _NPM_EXEC)
+        if scanned is not None:
+            _, pos = scanned
+            if pos < len(remainder) and (pos == 0 or remainder[pos - 1] != "--"):
+                after = remainder[pos + 1 :]
+                unquoted = after[: after.index("--")] if "--" in after else after
+                if any(word.startswith("-") and word != "-" for word in unquoted):
+                    launch.fail("npm exec options after the package without '--'")
+                    return
         _package_runner(remainder, launch, _NPM_EXEC, {"-p", "--package"}, options)
     elif subcommand in _NPM_LOCAL:
         launch.launcher = f"npm {subcommand}"
@@ -2342,7 +2358,7 @@ def _python_runner(
         if declared is not None:
             launch.packages.insert(0, python_spec(declared))
             if position < len(rest):
-                _start(rest[position:], launch)
+                _start(rest[position:], launch, package_entry=True)
         else:
             package = python_spec(rest[position], shorthand=shorthand)
             launch.packages.insert(0, package)
@@ -2492,12 +2508,18 @@ def _host_source(spec: str, *, mount: bool) -> str | None:
         if fields.get("type", "volume") != "bind":
             return None
         return fields.get("source") or fields.get("src") or None
+    if ":" not in spec:
+        return None
     source = spec.split(":", 1)[0]
     if re.match(r"[A-Za-z]:[\\/]", spec):
+        if ":" not in spec[2:]:
+            return None
         source = spec[:2] + spec[2:].split(":", 1)[0]
     return (
         source
-        if source.startswith(("/", "~", "$", "%", "\\")) or re.match(r"[A-Za-z]:", source)
+        if source in {".", ".."}
+        or source.startswith(("/", "./", "../", ".\\", "..\\", "~", "$", "%", "\\"))
+        or re.match(r"[A-Za-z]:", source)
         else None
     )
 
@@ -2525,12 +2547,22 @@ def _container_context(options: list[tuple[str, str | None]], launch: Launch) ->
             if source is None:
                 continue
             launch.mark("host_mounts")
-            normalized = source.rstrip("/\\") or "/"
-            if normalized in {"/", "\\"} or re.fullmatch(r"[A-Za-z]:[\\/]?", source):
+            normalized = source.rstrip("/\\") or ("/" if source.startswith("/") else "\\")
+            canonical = (
+                posixpath.normpath(normalized)
+                if normalized.startswith("/") and "\\" not in normalized
+                else normalized
+            )
+            if canonical in {"/", "\\"} or re.fullmatch(r"[A-Za-z]:[\\/]?", canonical):
                 launch.mark("host_root_mount")
-            elif source.lower().endswith(_SOCKETS):
+            elif canonical.lower().endswith(_SOCKETS):
                 launch.mark("runtime_socket_mount")
-            elif _BROAD.fullmatch(source):
+            elif (
+                _BROAD.fullmatch(canonical)
+                or canonical == ".."
+                or canonical.startswith(("../", "..\\"))
+                or posixpath.normpath(normalized.replace("\\", "/")).startswith("..")
+            ):
                 launch.mark("broad_host_mount")
         elif option == "--entrypoint":
             launch.mark("entrypoint_override")