OPU-33: decodeRe's hex alternative matched an ENCODE, not a decode

[MoSLoF]

The finding

An FP sweep of the OPU-32 markers against real-world install scripts (esbuild, edge-js, ntsuspend, run under -fail-on-eligible) came back clean — none of the three new OPU-32 markers fired anywhere, including on esbuild, the exact package D-25/D-28's own design comments already cite as the FP case to avoid.

The sweep's one hit was VC-002e on esbuild, and it traced to decodeRe (internal/installsurface/analyze.go) — pre-existing since the initial public release, confirmed here by git blame (e3dd322) and by independently reproducing the identical finding against the pre-OPU-32 binary.

decodeRe's hex alternative was a bare ['"]hex['"]\s*\) — it matched the literal string hex") anywhere in a file. esbuild's real install.js computes crypto.createHash("sha256").update(bytes).digest("hex") to verify a downloaded binary's checksum: an ENCODE (bytes → hex string, for display/comparison — the thing a security-conscious installer should do), not a decode. The bare literal couldn't distinguish that from Buffer.from(x, 'hex'), a genuine decode.

The fix

Tightened to the same context-required shape the base64 alternative in the same regex already used: Buffer\.from\s*\([^)]*['"]hex['"]|from_?hex|hex::decode — mirroring base64's Buffer.from(...,'base64') plus the Rust-style naming alternatives already present (base64::decode/base64::engine). No existing test depended on the old bare shape (verified before touching it).

The repo's own D-25 esbuild regression fixture (esbuildLikeInstallJS) was a faithful reduction that didn't include this real line — extended it with the actual checksum-verify idiom so the existing regression test (TestEsbuildInstallerNotObfuscated) exercises the real FP directly, rather than adding a parallel synthetic test that would prove less than it claimed.

Validation

• New tests (opu33_test.go): hex ENCODE (digest/toString) no longer reads as obfuscation; genuine hex decode (Buffer.from, from_hex, hex::decode) still does.
• Mutation-proven: reverting the regex to its pre-fix shape fails both the new negative tests and the now-faithful esbuild fixture test; restore green.
• Live end-to-end: the sweep's cited shape now scores exit 2 with only legitimate VC-002b (real network egress) firing — VC-002e no longer trips.
• Full suite green (34 packages), -race clean, go vet silent, gofmt no diffs.

Files

• internal/installsurface/analyze.go — tightened decodeRe hex alternative.
• internal/installsurface/esbuild_regression_test.go — enriched fixture with the real checksum-verify idiom.
• internal/installsurface/opu33_test.go — new tests.
• docs/DECISIONS.md — D-125.

🤖 Generated with Claude Code

---

Generated by Claude Code