Close detector bypasses: bracket env, unqualified getenv, custom-shell PR head

[Conalh]

Summary

Closes three real detection bypasses surfaced by a follow-up inspection of CapabilityEcho's regex-based detectors. All three are small, mechanical broadenings — same shape as agent-gov-core's "match what the agent will actually write" philosophy. No schema changes; one kind reused with broader semantic.

• JS bracket-notation process.env — js-capability.ts: addSecretVariable and referencesEnvSecret only matched dot notation. process.env['API_TOKEN'] / process.env[\"API_TOKEN\"] slipped both, so an inline exfil expression OR a stored secret variable referenced later was missed. Now both notations match.
• Python unqualified getenv / environ.get — py-capability.ts: both helpers required the os. prefix, so from os import getenv; k = getenv('API_TOKEN') (and the environ variant) bypassed secret-variable tracking. os. is now optional in both detection points. The secret-name suffix pattern (TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL|AUTH) keeps false positives bounded.
• PR-head reference under pull_request_target via custom shell — workflow-permissions.ts: isPullRequestHeadCheckoutLine only matched structured ref:/repository: keys. A workflow could trivially bypass by using a run: step:

  run: |
    git clone https://github.com/\${{ github.event.pull_request.head.repo.full_name }}
    git checkout \${{ github.event.pull_request.head.sha }}

  Now any reference to github.event.pull_request.head.{sha,ref,repo.full_name} inside a pull_request_target workflow is flagged. Function renamed referencesPullRequestHead; subject/message/recommendation reworded from "checkout" to "reference" to reflect the broadened semantic. kind (workflow_pr_head_checkout_on_target) preserved for downstream policy stability.

Why batched

All three are "broaden a regex to catch an obvious bypass" — same theme, low surface, no API changes. Total source delta is ~30 lines; tests add 6 cases.

Deferred (acknowledged from the same inspection)

• Multi-line statement context (yaml.load(...) across lines, multi-line YAML env secret values) — needs file-content lookback infrastructure; separate PR with shared helpers.
• Directory-mode git-failure hardening — silent bypass on modified files when git diff --no-index returns empty stdout. Real but narrow (git is always present on GHA runners); defensive fix in its own PR.
• Stream-based git diff — speculative for now; we haven't seen 20MB+ diffs in practice.

Declined: CLI parser refactor to mri/yargs-parser — adds a runtime dep to a 6-flag CLI on a security-adjacent tool.

Stacking note

This PR is independent of #19 ("Tighten CLI parity, monorepo annotations, and workflow noise"). The two touch different functions in workflow-permissions.ts and different parts of report.ts; either order of merge is fine. Whichever lands second will need a one-line bundle rebuild rebase, no source conflicts expected.

Test plan

• npm test — 70 passing (64 baseline + 6 new):
  • JS: bracket-notation inline exfil flagged; bracket-notation secret variable tracked across lines
  • Python: unqualified getenv inline exfil flagged; getenv and environ.get tracked across lines (with file context)
  • Workflow: custom-shell git clone/git checkout referencing head.{sha,repo.full_name} both flag under pull_request_target
• npm run build — clean tsc + ncc bundle
• Reviewer: confirm the broader PR-head reference detector doesn't fire on benign metadata uses you actually have in real workflows (e.g. \${{ github.event.pull_request.head.repo.owner.login }} is not matched — only sha, ref, repo.full_name)

🤖 Generated with Claude Code