fix(registry): route unsafe_install_pipeline base64 through hasBase64DecodedShell

[wondercreatemaster]

Summary

• Replace the stale bounded-window base64 … | sh|bash regex in submission-risk.js with hasBase64DecodedShell from command-safety-lib.js, so unsafe_install_pipeline catches the same evasions the shared helper already handles for shell-safety triage.
• Mirror the #5556 curl/wget pattern: scan line-by-line and double-quoted interiors via a small hasUnsafeBase64DecodedShell wrapper (bundled flags, sudo, pipe-chain passthroughs).
• Leave command-safety-lib.js untouched (out of scope); curl/wget / iex / powershell / destructive-rm branches unchanged.

Closes #5591

Submission Source

• This is not a direct content submission.
• Changed routes/components/endpoints/tools are listed below.
• Screenshots or No visual impact are included when relevant.
• This PR links the issue it resolves, or the no-issue maintainer-lane rationale is written in Notes.

Schema and Quality Checks

• Platform/code PR: focused validation is listed below.
• No forbidden fields were added (viewCount, copyCount, popularityScore)

Quality Evidence

• Changed surface:

  • packages/registry/src/submission-risk.js — hasUnsafeBase64DecodedShell replaces the stale base64 regex
  • tests/submission-risk-invariants.test.ts — fix: unsafe_install_pipeline base64-decode check is a stale regex that misses -di, sudo, and pipe-chain evasions #5591 true-positives + non-shell negative

• Expected behavior / before→after flag results:

  install text	before	after
  echo cGF5 | base64 -d | bash	flagged	flagged (unchanged)
  echo cGF5 | base64 --decode | sh	flagged	flagged (unchanged)
  echo cGF5 | base64 -di | bash	not flagged	flagged
  echo cGF5 | base64 -d | sudo -E bash	not flagged	flagged
  echo cGF5 | base64 -d | cat | bash	not flagged	flagged
  echo cGF5 | base64 -d | jq .	not flagged	not flagged (unchanged)

• Invariants: curl/wget, iex, powershell -encodedcommand, and destructive rm branches of unsafe_install_pipeline are untouched. command-safety-lib.js is not modified.

• Screenshots: No visual impact — registry risk-detection correctness only; no routes/UI.

Validation

• pnpm exec vitest run tests/submission-risk-invariants.test.ts — 72 passed
• pnpm exec vitest run tests/command-safety-lib.test.ts tests/command-safety.test.ts tests/command-safety-posix-shell.test.ts — 90 passed
• pnpm exec vitest run tests/non-ui-branch-matrix.test.ts — 20 passed
• pnpm build — passed
• pnpm validate:clean — passed
• pnpm exec prettier --check on touched files — clean
• trunk check --upstream origin/main — no issues
• git diff --check / node --check packages/registry/src/submission-risk.js — clean

Notes

• No open or closed PR existed for fix: unsafe_install_pipeline base64-decode check is a stale regex that misses -di, sudo, and pipe-chain evasions #5591 at start (timeline empty). Closest sibling is merged fix(registry): make unsafe_install_pipeline command-boundary-aware #5563 (curl/wget → hasPipeToShellInstall); this PR applies the same wiring pattern to the base64 branch.
• Related historical failures to avoid: fix(registry): detect bundled base64 decode flags in shell safety scan #4921 (CI/required-pr-gate auto-close before retry as fix(registry): detect bundled base64 decode flags in shell safety scan #4923), fix(web): escape compatibility-matrix CSV header client labels #5600 (CI failing → LoopOver close). This PR: two-file focused diff, one-shot commit, local trunk + build + focused tests green before open, no post-open pushes.
• command-safety-lib.js left untouched per issue out-of-scope.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-27 18:38:57 UTC}

2 files · 1 AI reviewer · no blockers · CI pending · blocked

⏸️ Suggested Action - Manual Review

Review summary
This PR swaps a stale, bounded-window base64→shell regex for the shared hasBase64DecodedShell helper used elsewhere for curl/wget detection, adding a small hasUnsafeBase64DecodedShell wrapper that scans line-by-line and double-quoted interiors. The change is well-scoped, mirrors the existing #5556 pattern, and comes with focused before/after test coverage validating the specific evasions (bundled flags, sudo, pipe passthrough) it claims to fix. The diff is minimal and consistent with the file's established conventions.

Nits — 3 non-blocking

• The double-quoted-interior scan in hasUnsafeBase64DecodedShell (submission-risk.js) only handles " delimiters, not single-quoted segments — worth confirming hasBase64DecodedShell itself doesn't already need that, or note it as a known gap mirroring the curl/wget helper's same limitation.
• No test case for base64 decode embedded inside a JSON config_snippet field (only install_command), unlike the sibling curl/wget test that explicitly covers config snippets.
• Consider a regression test for base64-in-config_snippet analogous to the existing 'blocks unsafe executable pipelines in issue config snippets' test, since config_snippet is a known vector for this flag.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#5591
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 33 registered-repo PR(s), 21 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	wondercreatemaster; Gittensor profile; 33 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: minor

Linked issue satisfaction

Addressed
The PR replaces the stale bounded-window regex with a call to hasBase64DecodedShell (via a line-scanning wrapper mirroring the curl/wget helper), imports it from command-safety-lib.js, and adds regression tests for all three evasion cases (-di, sudo, and cat pipe-chain) plus a non-shell negative, matching the issue's scope and acceptance criteria.

Review context

• Author: wondercreatemaster
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 33 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.42%. Comparing base (712b6e7) to head (67000c9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5603   +/-   ##
=======================================
  Coverage   96.42%   96.42%           
=======================================
  Files         529      529           
  Lines       16314    16321    +7     
  Branches     3734     3734           
=======================================
+ Hits        15731    15738    +7     
  Misses        195      195           
  Partials      388      388           

Files with missing lines	Coverage Δ
packages/registry/src/submission-risk.js	95.04% <100.00%> (+0.04%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.