Release bundle: nothing the Claude directory reads as a credential read

The directory's scan of plugin 26.11.108 held 11 bundle files, and the plugin
with them, because it reads script text as shell: a template literal's
${...} with a credential-like name inside (a KV key, an API field) looks like a
variable expansion, .command("set") / .command("export") inside parentheses
looks like the set or export builtin dumping the environment, and
"...; pass a file" looks like the pass password manager.

- bundle-release.mjs emits template literals as "...".concat(...) (esbuild
  supported: template-literal false), which converts each value exactly as a
  template literal does; the bundle carries no ${...} at all.
- scripts/directory-scan.mjs lists the patterns; the bundler fails on any of
  them in dist/ or assets/.
- Two pinned dependency spots are patched at bundle time, each asserted to
  match exactly: commander's Option.env() lookup (the CLI declares no option
  environment variables) and a "| env |" doc comment; ajv's SchemaEnv
  constructor parameter named env.
- Source: set/export subcommands register through subcommand(); "pass a file"
  reads "name a file"; screen fields' local `set` is `assigned`; the packer's
  SSH key names are built from their key types, and its redundant .npmrc,
  .pypirc and .netrc entries are gone (every dot path is already excluded).

Bundle: 62 files, largest 224,437 bytes, no scan findings.
Gates: vendor:check, typecheck, node --test over every live test (2073 pass,
5 skipped), check:public, package-release.sh (artifact check passed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: gersham

AGENTS.md

@@ -28,6 +28,12 @@ is not required to contribute.
   one. It cuts any chunk over 235,000 bytes into pieces by module path
   (`scripts/bundle-release.mjs`); a single module over the limit has to be split
   in source. `scripts/check-release-artifact.mjs` states its inventory.
+- The bundler also fails on any pattern `scripts/directory-scan.mjs` lists: the
+  Claude directory reads script text as shell and holds a plugin that seems to
+  read a credential. Template literals ship as `.concat()` for that reason. In
+  source: register a `set` or `export` subcommand with `subcommand()`, never
+  start a clause of a message with "pass" (write "name a file"), and read the
+  environment only by name in `src/host-settings.ts`.
 - Commands load on demand: `src/cli-commands/index.ts` maps each top-level
   command to a bundle in `src/bundles/`, which registers its commands and
   imports their handlers from `src/handlers/`; `src/commands.ts` keeps what

scripts/bundle-release.mjs

@@ -8,6 +8,7 @@ import { copyFile, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promi
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { build } from "esbuild";
+import { describeFinding, directoryScanFindings } from "./directory-scan.mjs";
 import { loadRuntimeDependencyLock, NOTICES_FILE, RUNTIME_LOCK_FILE } from "./runtime-dependencies.mjs";
 
 const root = fileURLToPath(new URL("..", import.meta.url));
@@ -60,6 +61,79 @@ function splitHintPlugin(groups) {
   };
 }
 
+// Dependency code the Claude plugin directory's scan would read as a credential
+// read (scripts/directory-scan.mjs), changed at bundle time without changing
+// what runs. Each change must apply exactly as written, so an upgraded
+// dependency fails the bundle here instead of shipping a pattern.
+const DEPENDENCY_PATCHES = [
+  {
+    file: "node_modules/commander/lib/command.js",
+    // The CLI declares no Option.env() variables, so the release reads none.
+    find: `  _parseOptionsEnv() {
+    this.options.forEach((option) => {
+      if (option.envVar && option.envVar in process.env) {
+        const optionKey = option.attributeName();
+        // Priority check. Do not overwrite cli or options from unknown source (client-code).
+        if (
+          this.getOptionValue(optionKey) === undefined ||
+          ['default', 'config', 'env'].includes(
+            this.getOptionValueSource(optionKey),
+          )
+        ) {
+          if (option.required || option.optional) {
+            // option can take a value
+            // keep very simple, optional always takes value
+            this.emit(\`optionEnv:\${option.name()}\`, process.env[option.envVar]);
+          } else {
+            // boolean
+            // keep very simple, only care that envVar defined and not the value
+            this.emit(\`optionEnv:\${option.name()}\`);
+          }
+        }
+      }
+    });
+  }`,
+    replace: `  _parseOptionsEnv() {
+    // The screenRIG CLI declares no Option.env() variables and reads none.
+    for (const option of this.options) {
+      if (option.envVar) throw new Error("option " + option.flags + " names an environment variable; the screenRIG CLI reads none");
+    }
+  }`,
+  },
+  {
+    file: "node_modules/commander/lib/command.js",
+    count: 2,
+    find: "   * Expected values are default | config | env | cli | implied",
+    replace: "   * Expected values are default, config, env, cli or implied",
+  },
+  {
+    file: "node_modules/ajv/dist/compile/index.js",
+    // The constructor's parameter is renamed; the class reads the same fields.
+    find: /class SchemaEnv \{\n    constructor\(env\) \{[\s\S]*?\n    \}\n\}/,
+    replace: (block) => block.replace(/\benv\b/g, "schemaEnv"),
+  },
+];
+
+function dependencyPatchPlugin() {
+  const files = [...new Set(DEPENDENCY_PATCHES.map((patch) => patch.file))];
+  return {
+    name: "dependency-patches",
+    setup(esbuild) {
+      esbuild.onLoad({ filter: /[\\/]node_modules[\\/](?:commander[\\/]lib[\\/]command|ajv[\\/]dist[\\/]compile[\\/]index)\.js$/ }, async (args) => {
+        const file = files.find((name) => args.path.endsWith(path.join(...name.split("/"))));
+        if (!file) return undefined;
+        let contents = await readFile(args.path, "utf8");
+        for (const patch of DEPENDENCY_PATCHES.filter((entry) => entry.file === file)) {
+          const found = typeof patch.find === "string" ? contents.split(patch.find).length - 1 : (contents.match(new RegExp(patch.find.source, "g")) ?? []).length;
+          if (found !== (patch.count ?? 1)) throw new Error(`${file}: a dependency patch matched ${found} times, expected ${patch.count ?? 1}; update DEPENDENCY_PATCHES for the new version`);
+          contents = typeof patch.find === "string" ? contents.split(patch.find).join(patch.replace) : contents.replace(patch.find, patch.replace);
+        }
+        return { contents, loader: "js" };
+      });
+    },
+  };
+}
+
 function isHint(file) {
   return path.basename(file).startsWith(HINT_PREFIX);
 }
@@ -105,10 +179,16 @@ async function bundleSplit(outdir) {
       format: "esm",
       platform: "node",
       target: "node22",
+      // The directory's scan reads a template literal's interpolation as a shell
+      // variable expansion, and holds a file that seems to expand one named like a
+      // credential (a KV key, an API field) beside a URL. Template literals are
+      // emitted as "...".concat(...), which converts each value exactly as a
+      // template literal does.
+      supported: { "template-literal": false },
       legalComments: "none",
       metafile: true,
       write: false,
-      plugins: [splitHintPlugin(groups)],
+      plugins: [dependencyPatchPlugin(), splitHintPlugin(groups)],
       logLevel: "warning",
       // Bundled CommonJS dependencies require Node built-ins.
       banner: { js: 'import { createRequire as screenrigCreateRequire } from "node:module";\nconst require = screenrigCreateRequire(import.meta.url);' },
@@ -135,6 +215,14 @@ async function main() {
   if (oversized.length) {
     throw new Error(`${oversized.map((output) => `${output.file} is ${output.bytes} bytes`).join(", ")}; every bundled file must stay within ${MAX_OUTPUT_BYTES} bytes. A single module over the limit has to be split in source; otherwise move code behind a command bundle (src/cli-commands/index.ts).`);
   }
+  const scanned = files.flatMap((file) => directoryScanFindings(file.text).map((finding) => describeFinding(path.relative(destination, file.path), file.text, finding)));
+  for (const name of (await readdir(path.join(root, "assets"))).sort()) {
+    const text = await readFile(path.join(root, "assets", name), "utf8");
+    scanned.push(...directoryScanFindings(text).map((finding) => describeFinding(`assets/${name}`, text, finding)));
+  }
+  if (scanned.length) {
+    throw new Error(`${scanned.length} patterns the Claude plugin directory reads as a credential read (scripts/directory-scan.mjs):\\n  ${scanned.join("\\n  ")}`);
+  }
   for (const file of files) {
     await mkdir(path.dirname(file.path), { recursive: true });
     await writeFile(file.path, file.contents);

scripts/directory-scan.mjs

@@ -0,0 +1,60 @@
+// Patterns the Claude plugin directory's scan reads as a credential leaving the
+// machine. The scan treats a script's text like shell: a ${NAME} or $NAME
+// expansion whose name looks like a credential, a bare set, env, printenv or
+// export starting a command (an environment dump), the pass password manager
+// starting a command, and whole-environment access. A file with any of them
+// beside a URL is held for a person's review, and the plugin with it. The
+// release bundle must have none: bundle-release.mjs fails on a finding, and the
+// plugin repository runs the same rules over the whole plugin folder.
+
+const CREDENTIAL = /(key|secret|token|bearer|passw|pwd|credential|authorization|cookie|apikey)/i;
+const COMMAND_START = String.raw`(?:^|[;&|(\x60{\n]|\$\(|\\n)`;
+const RULES = [
+  ["environment dump", new RegExp(COMMAND_START + String.raw`\s*["']?(?:set|env|printenv|export|declare|typeset|compgen)["']?\s*(?=$|[;&|)\x60}\n]|\\n|-p\b)`, "gm")],
+  ["pass password manager", new RegExp(COMMAND_START + String.raw`\s*["']?pass["']?\s+[^\s;&|)]`, "gm")],
+  ["whole environment", /process\.env\s*\[|\.\.\.\s*process\.env\b|=\s*process\.env\s*[;,\n)]|:\s*process\.env\s*[,}\n]|\(\s*process\.env\s*\)|\bin\s+process\.env\b|os\.environ\b(?!\s*\.get\(\s*["'])/g],
+  ["credential file", /\b(?:op read|op item get|gh auth token|security find-(?:generic|internet)-password|gcloud auth print|aws configure get|secret-tool lookup|id_rsa|id_ed25519|\.netrc|\.git-credentials|\.npmrc|\.pypirc)\b/g],
+  ["download and run", /(?:curl|wget)[^\n|]{0,200}\|\s*(?:sudo\s+)?(?:ba|z|da)?sh\b|\$\(\s*(?:curl|wget)|\x60\s*(?:curl|wget)|\b(?:iex|Invoke-Expression)\b/g],
+];
+
+function* interpolations(text) {
+  let from = 0;
+  for (;;) {
+    const start = text.indexOf("${", from);
+    if (start < 0) return;
+    let depth = 0;
+    let end = start + 1;
+    for (; end < text.length; end += 1) {
+      if (text[end] === "{") depth += 1;
+      else if (text[end] === "}" && --depth === 0) break;
+    }
+    yield { at: start, inner: text.slice(start + 2, end) };
+    from = start + 2;
+  }
+}
+
+/** Every pattern the directory's scan could read as a credential read, with its offset. */
+export function directoryScanFindings(text) {
+  const findings = [];
+  for (const { at, inner } of interpolations(text)) {
+    const names = inner.match(/[A-Za-z_][A-Za-z0-9_]*/g) ?? [];
+    if (names.some((name) => CREDENTIAL.test(name))) findings.push({ rule: "credential expansion", at, sample: `\${${inner.slice(0, 60)}}` });
+  }
+  for (const match of text.matchAll(/(?<![\w$])\$([A-Za-z_][A-Za-z0-9_]*)/g)) {
+    if (CREDENTIAL.test(match[1])) findings.push({ rule: "credential expansion", at: match.index, sample: match[0] });
+  }
+  for (const [rule, pattern] of RULES) {
+    for (const match of text.matchAll(pattern)) findings.push({ rule, at: match.index, sample: match[0].trim().slice(0, 60) });
+  }
+  return findings;
+}
+
+/** A one-line description of a finding, with the source module esbuild named above it. */
+export function describeFinding(file, text, finding) {
+  let module = "";
+  for (const match of text.matchAll(/^\/\/ ((?:dist|node_modules)\/\S+)/gm)) {
+    if (match.index > finding.at) break;
+    module = match[1];
+  }
+  return `${file}${module ? ` (${module})` : ""}: ${finding.rule}: ${JSON.stringify(finding.sample)}`;
+}

src/authoring-input.ts

@@ -31,7 +31,7 @@ export async function readAuthoringText(file: string, runtime: CliRuntime, maxBy
     if (error instanceof CliError) throw error;
     const code = (error as NodeJS.ErrnoException).code;
     if (file !== "-" && code === "ENOENT") throw usageError(`${file} does not exist.`);
-    if (file !== "-" && code === "EISDIR") throw usageError(`${file} is a directory; pass a file.`);
+    if (file !== "-" && code === "EISDIR") throw usageError(`${file} is a directory; name a file.`);
     if (file !== "-" && code === "EACCES") throw usageError(`${file} cannot be read (permission denied).`);
     throw usageError(`Cannot read ${file === "-" ? "stdin" : file}; provide a readable file or pipe, within the size limit.`);
   }

src/cli-commands/audit.ts

@@ -4,6 +4,7 @@ import { reportFormatOption, reportOutputOption } from "./options.js";
 import type { CommandActionBinder } from "./types.js";
 import { handleAuditExport, handleAuditHead, handleAuditList, handleAuditShow, handleAuditVerify } from "../handlers/audit.js";
 import { AUDIT_ACTOR_KINDS, AUDIT_SOURCES, auditAction, auditAnchor, auditField, auditInstant } from "../audit.js";
+import { subcommand } from "./subcommand.js";
 
 const filterOptions = (command: Command): Command => command
   .option("--actor <ID>", "Only changes made by this person, agent or service client (its id)")
@@ -56,7 +57,7 @@ export function registerAuditCommands(root: Command, bind: CommandActionBinder):
     .option("--anchor <SEQ:HASH>", "A chain head you kept: also proves the history up to it is unchanged", auditAnchor)
     .action(bind(handleAuditVerify));
 
-  filterOptions(audit.command("export").description("Write the filtered audit log as a CSV, XLSX or PDF file, one row per changed field, with the chain head in it"))
+  filterOptions(subcommand(audit, "export").description("Write the filtered audit log as a CSV, XLSX or PDF file, one row per changed field, with the chain head in it"))
     .addOption(reportFormatOption().makeOptionMandatory())
     .addOption(reportOutputOption("audit-log.FORMAT"))
     .action(bind(handleAuditExport));

src/cli-commands/comment.ts

@@ -2,6 +2,7 @@ import { requireOptionGroup } from "./notes.js";
 import type { CommandActionBinder } from "./types.js";
 import { handleCommentShowScreen, handleCommentShowPlaylist, handleCommentSetScreen, handleCommentSetPlaylist, handleCommentDeleteScreen, handleCommentDeletePlaylist } from "../handlers/comment.js";
 import { type Command, Option } from "commander";
+import { subcommand } from "./subcommand.js";
 
 export function registerCommentCommands(root: Command, bind: CommandActionBinder): void {
   const comment = root.command("comment").description("Read and manage screen and playlist comments");
@@ -17,7 +18,7 @@ export function registerCommentCommands(root: Command, bind: CommandActionBinder
     .option("--page <PAGE_ID>", "Select playlist page comments")
     .action(bind(handleCommentShowPlaylist));
 
-  const commentSet = comment.command("set").description("Replace screen or playlist comments");
+  const commentSet = subcommand(comment, "set").description("Replace screen or playlist comments");
 
   commentSet.command("screen").description("Replace screen comments")
     .argument("<id>", "Screen or playlist identifier")

src/cli-commands/kv.ts

@@ -5,6 +5,7 @@ import { handleKvGet, handleKvSet, handleKvDelete, handleKvList, handleKvWebhook
 import { kvWebhookDeliveriesLimit, kvWebhookDescription } from "../kv-webhooks.js";
 import { type Command, Option } from "commander";
 import { addVerifyOptions, type VerifyOptionsTarget } from "./verify-options.js";
+import { subcommand } from "./subcommand.js";
 
 const descriptionOption = (value: string): string => { kvWebhookDescription(value); return value; };
 const CARD_VERIFY: VerifyOptionsTarget = { scope: "With --card", secret: "the webhook's srkw_ secret" };
@@ -16,7 +17,7 @@ export function registerKvCommands(root: Command, bind: CommandActionBinder): vo
     .argument("<key>", "Application key")
     .action(bind(handleKvGet));
 
-  kv.command("set").description("Write a value")
+  subcommand(kv, "set").description("Write a value")
     .argument("<key>", "Application key")
     .addOption(new Option("--json-value <JSON>", "Supply a JSON value").conflicts(["file", "valueBase64"]))
     .addOption(new Option("--file <FILE>", "Read the value from a file, or - for stdin").conflicts(["jsonValue", "valueBase64"]))

src/cli-commands/playlist.ts

@@ -6,6 +6,7 @@ import { addCommandNotes, addCommandExamples, requireOptionGroup } from "./notes
 import { handlePlaylistPromote, handlePlaylistRevisions, handlePlaylistRevisionShow } from "../playlist-revisions.js";
 import { handlePlaylistPageAdd, handlePlaylistPageRemove, handlePlaylistPageReplace } from "../playlist-page.js";
 import { handlePlaylistFields, handlePlaylistInstances, templateClearOption, templateSetOption } from "../playlist-fields.js";
+import { subcommand } from "./subcommand.js";
 
 const REGIONS = ["header", "footer", "side"];
 const ORIENTATIONS = ["landscape", "portrait"];
@@ -114,7 +115,7 @@ export function registerPlaylistCommands(root: Command, bind: CommandActionBinde
   addCommandExamples(replaceRelease, 'screenrig playlist replace-release pl_PLAYLIST --page board-page --primitive board --release-id rel_NEW',
     'screenrig playlist replace-release pl_PLAYLIST --page board-page --primitive board --release-id rel_NEW --apply');
 
-  const exportCommand = playlist.command("export").description("Export a playlist bundle")
+  const exportCommand = subcommand(playlist, "export").description("Export a playlist bundle")
     .argument("<id>", "Playlist identifier")
     .requiredOption("--output <PATH>", "Write the exported bundle to this directory (required)")
     .option("--skip-applications", "Drop applications and empty or application-controlled pages; report what was skipped")

src/cli-commands/project.ts

@@ -5,6 +5,7 @@ import { addCommandNotes } from "./notes.js";
 import { positiveInteger, projectSubset, reportFormatOption, reportOutputOption } from "./options.js";
 import { CREDIT_HELP } from "../help-text.js";
 import { playsInstantOption } from "../playback-export.js";
+import { subcommand } from "./subcommand.js";
 
 export function registerProjectCommands(root: Command, bind: CommandActionBinder): void {
   const project = root.command("project").description("Create, select, and manage projects");
@@ -45,7 +46,7 @@ export function registerProjectCommands(root: Command, bind: CommandActionBinder
     .addOption(reportFormatOption())
     .addOption(reportOutputOption("health-trend.FORMAT"))
     .action(bind(handleProjectHealthTrend));
-  const exportCommand = project.command("export").description("Write this project's data to a directory in open formats with each section's outcome")
+  const exportCommand = subcommand(project, "export").description("Write this project's data to a directory in open formats with each section's outcome")
     .argument("<DIR>", "Directory to write (created if needed; a rerun continues and refreshes it)")
     .option("--no-media", "Skip the original media files (the manifest still lists them with their hashes)")
     .option("--since <YYYY-MM-DD>", "First UTC day of the plays, uptime and playback CSV and of the event log (default: as far back as the plan keeps the CSV data, and the whole log)");