fix(installer): gate SDK probe on provenance

[andrei-hasna]

Summary

• execute installed SDK code only after exact package and registry provenance checks pass
• run the SDK import with only BUN_INSTALL_GLOBAL_DIR instead of the parent process environment
• add negative package/registry execution controls and preserve the positive global-root import check with a credential-shaped parent sentinel

Verification

• bun run typecheck
• bun test test/bun-registry-installer.test.ts test/apps.test.ts test/cli.test.ts (61 pass, 0 fail)
• secrets scan staged . --json (findingCount: 0)

Task: 5f50a02b-892a-4f50-89ff-aab3a3471872
Successor remediation for #90.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #92 @ c72de2c — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Exact candidate reviewed

• Base: freshly fetched origin/main at 53620e74ac86cfe5d1d03e3b60524e09e442644a.
• Head: c72de2c3f0e2f56d3be69a77b550045be66b58f3.
• Read: the full diff for src/commands/bun-registry-installer.ts and test/bun-registry-installer.test.ts, plus the complete changed files, surrounding exact-Bun plan/probe/transaction code, controller status caller, fixtures, and repository contract text.

Commands and gates

• git log --oneline origin/main..HEAD — exit 0; one commit.
• git diff origin/main...HEAD --stat — exit 0; 2 files, 56 insertions, 9 deletions.
• bun install — exit 0; setup only, 116 packages installed; no test pass/fail counts apply.
• bun run typecheck — exit 0; tsc --noEmit, zero diagnostics; test pass/fail counts do not apply.
• bun run test — exit 0; 611 pass, 0 fail, 611 tests across 66 files.
• git diff --check origin/main...HEAD — exit 0.

Blocking P0/P1 findings

1. P1 security — the status path still executes unproven installed package code with the full parent environment when the new provenance gates fail.
   • statusProbeForStep() now correctly gates the SDK import on packageJsonOk && registryOk and supplies only BUN_INSTALL_GLOBAL_DIR.
   • The immediately adjacent CLI probe remains unconditional: any executable at <bunRoot>/bin/<package-bin> is run with --help even when the package version is wrong or the registry lock lacks the expected integrity. Because runQuiet() defaults to process.env, that unproven executable receives the target process environment.
   • Reachable path: a stale, tampered, or non-canonical install leaves a mismatched package manifest or lock plus an executable package bin; the read-only status command skips the SDK but still runs that bin and permits it to read or exfiltrate ambient credentials/session configuration.
   • Required focused remedy: gate the CLI probe on the same package/version and registry checks, give it the same minimal probe environment, and extend the negative marker plus parent-sentinel controls to prove neither SDK nor CLI code executes before provenance and neither receives ambient credential-shaped variables after provenance.

Non-blocking follow-ups

• None.

Verdict: NO_GO until the one named provenance boundary and its direct regression controls are fixed. The declared repository gates are otherwise green.

[andrei-hasna]

[REVIEW] GO — #92 @ fab9152 — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Focused remediation-cycle-one re-review of the single P1 finding reported at c72de2c3f0e2f56d3be69a77b550045be66b58f3 and its direct regressions.

What I read

• The exact remediation diff from c72de2c3f0e2f56d3be69a77b550045be66b58f3 to fab91528c003d4fdbe9e8a7899a87f08d3cf9192 in the installer and its tests.
• The surrounding package/registry checks, SDK and CLI probe execution, child-environment construction, and current-head commit trailer.

Named defect rechecked

• Both installed-code probes now require packageJsonOk && registryOk before execution.
• The SDK import still receives only BUN_INSTALL_GLOBAL_DIR and runs from the global install root.
• The CLI probe receives only BUN_INSTALL_GLOBAL_DIR plus a PATH narrowed to the pinned Bun bin directory required by its executable shim; it no longer inherits ambient credential/session variables.
• Negative package-version and registry-lock controls prove neither the SDK nor CLI marker executes before provenance. The positive parent sentinel proves both probes omit the ambient credential-shaped variable.

Commands and results

• Regression before the source fix: bun run test — exit 1; 609 pass, 2 fail, 611 tests across 66 files; the two named exact-Bun probe tests failed.
• Final bun run typecheck — exit 0; tsc --noEmit, zero diagnostics; test pass/fail counts do not apply.
• Final bun run test — exit 0; 611 pass, 0 fail, 611 tests across 66 files.
• git diff --check — exit 0.
• secrets scan staged . --json before commit — exit 0; 2 files, 70,154 bytes, findingCount: 0, truncated: false.
• Commit fab91528c003d4fdbe9e8a7899a87f08d3cf9192 carries the final trailer Agent: Hostus and was pushed to task/5f50a02b-machines90-provenance with exit 0.

Blocking P0/P1 findings

• None remain.

Non-blocking follow-ups

• None.

Verdict: GO. The named P1 is fixed, its direct regressions pass, and the declared repository gates are green at the current head.