@opengsd/gsd-core 1.9.0 → 1.10.0

package/scripts/lint-example-parser-parity.cjs

@@ -0,0 +1,395 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-example-parser-parity.cjs — asserts examples/dynamic-context-management/
+ * context-predicates.cjs (reference prototype, ADR-1671) and production's
+ * src/context-predicates.cts (compiled to gsd-core/bin/lib/context-predicates.cjs)
+ * agree on parsing behavior, and that the example's own committed
+ * CONTEXT-INDEX.json has not silently drifted from a fresh parse.
+ *
+ * Lives OUTSIDE tests/ deliberately. ADR-1671
+ * (docs/adr/1671-dynamic-context-management-platform.md:102) places
+ * examples/dynamic-context-management/ outside FOUR surfaces: the build
+ * (src/ -> bin/lib/), the npm package files[], the installer, and the CI test
+ * suite (tests/). A lint script wired into `npm run lint:ci` is none of
+ * those four — it does not compile, package, install, or test-suite-import
+ * the example; it only READS both modules from a repo-root script and
+ * asserts they agree, the same shape as every other scripts/lint-*.cjs in
+ * this repo that reads source it does not own (see e.g.
+ * lint-compiled-artifact-sync.cjs).
+ *
+ * Two parity surfaces:
+ *   1. production vs. example, parsed against the real repo-root CONTEXT.md:
+ *      predicate count, class map, duplicate-id set, the full set of
+ *      (id, value) pairs, and a representative accept/reject id-shape table
+ *      (including the embedded-CR-in-value case production already rejected
+ *      and the example silently accepted before this fix).
+ *   2. the example's OWN committed CONTEXT-INDEX.json vs. a fresh parse by
+ *      the example's own parser of the real CONTEXT.md — LINE-NUMBER-
+ *      INDEPENDENT (see below). This guards the same #2944 merge-race
+ *      staleness class this PR fixed for docs/CONTEXT-INDEX.json, but for the
+ *      example's own copy, which nothing previously guarded at all.
+ *
+ * Why `line` is excluded from surface 2 (ADR-1671 open question 4): the
+ * example's CONTEXT-INDEX.json bakes source line numbers into every
+ * predicate entry. Any unrelated CONTEXT.md line-shift (e.g. inserting a
+ * sentence above the predicates) re-drifts that artifact even though every
+ * predicate id/value/class is byte-identical. Wiring the example's own
+ * `gen-context-index.cjs --check` into lint:ci — which DOES compare line
+ * numbers — would make CI routinely red for reasons unrelated to predicate
+ * integrity. This lint instead derives the LINE-INDEPENDENT facts from the
+ * committed index (count, class map, duplicate-id set, (id,value) pairs) and
+ * compares those to a fresh parse: genuine content drift (the #2944
+ * merge-race defect class) is still caught; a pure line-shift is not.
+ *
+ * `--context-path` / `--example-index-path` override the two hardcoded paths
+ * (mirrors scripts/gen-context-index.cjs) so this script's non-vacuousness
+ * can be proven against a throwaway temp fixture without ever touching the
+ * real committed artifacts.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const PROD_PREDICATES_PATH = path.join(ROOT, 'gsd-core', 'bin', 'lib', 'context-predicates.cjs');
+const EXAMPLE_DIR = path.join(ROOT, 'examples', 'dynamic-context-management');
+const EXAMPLE_PREDICATES_PATH = path.join(EXAMPLE_DIR, 'context-predicates.cjs');
+const DEFAULT_EXAMPLE_INDEX_PATH = path.join(EXAMPLE_DIR, 'CONTEXT-INDEX.json');
+const DEFAULT_CONTEXT_PATH = path.join(ROOT, 'CONTEXT.md');
+
+// ─── Loaders ──────────────────────────────────────────────────────────────────
+
+/**
+ * Load the compiled production predicates library. Throws a clean ExitError
+ * (never a bare MODULE_NOT_FOUND stack) naming the remedy when it is missing.
+ */
+function loadProdPredicates() {
+  try {
+    delete require.cache[require.resolve(PROD_PREDICATES_PATH)];
+    return require(PROD_PREDICATES_PATH);
+  } catch (err) {
+    throw new ExitError(
+      1,
+      `Cannot load ${path.relative(ROOT, PROD_PREDICATES_PATH)}: ${err && err.message}\n` +
+        'Run:\n  npm run build:lib\n',
+    );
+  }
+}
+
+/** Load the example's self-contained predicates module (no build step). */
+function loadExamplePredicates() {
+  delete require.cache[require.resolve(EXAMPLE_PREDICATES_PATH)];
+  return require(EXAMPLE_PREDICATES_PATH);
+}
+
+/**
+ * Read a CONTEXT.md-shaped markdown file. Throws a clean ExitError naming the
+ * path when it is missing or unreadable.
+ *
+ * @param {string} contextPath
+ * @returns {string}
+ */
+function readContextMarkdown(contextPath) {
+  try {
+    return fs.readFileSync(contextPath, 'utf8');
+  } catch (err) {
+    throw new ExitError(1, `Cannot read ${path.relative(ROOT, contextPath)}: ${err && err.message}`);
+  }
+}
+
+// ─── Diffing helpers ────────────────────────────────────────────────────────
+
+/**
+ * Diff two predicate-shaped arrays by id, comparing ONLY `klass`/`value`
+ * (never `line`/`section` — see the module doc comment's "Why `line` is
+ * excluded"). Returns human-readable divergence strings naming the exact
+ * predicate id(s), so a failure reads as an actionable list, never "objects
+ * differ".
+ *
+ * @param {Array<{id:string,klass:string,value:string}>} leftPredicates
+ * @param {Array<{id:string,klass:string,value:string}>} rightPredicates
+ * @param {string} leftLabel
+ * @param {string} rightLabel
+ * @returns {string[]}
+ */
+function diffPredicatesById(leftPredicates, rightPredicates, leftLabel, rightLabel) {
+  const leftMap = new Map(leftPredicates.map((p) => [p.id, p]));
+  const rightMap = new Map(rightPredicates.map((p) => [p.id, p]));
+  const allIds = new Set([...leftMap.keys(), ...rightMap.keys()]);
+  const diffs = [];
+  for (const id of Array.from(allIds).sort()) {
+    const l = leftMap.get(id);
+    const r = rightMap.get(id);
+    if (l && !r) {
+      diffs.push(`${id}: present in ${leftLabel} but absent from ${rightLabel}`);
+    } else if (!l && r) {
+      diffs.push(`${id}: present in ${rightLabel} but absent from ${leftLabel}`);
+    } else if (l.value !== r.value) {
+      diffs.push(
+        `${id}: value diverged (${leftLabel}=${JSON.stringify(l.value)}, ${rightLabel}=${JSON.stringify(r.value)})`,
+      );
+    } else if (l.klass !== r.klass) {
+      diffs.push(
+        `${id}: klass diverged (${leftLabel}=${JSON.stringify(l.klass)}, ${rightLabel}=${JSON.stringify(r.klass)})`,
+      );
+    }
+  }
+  return diffs;
+}
+
+/** Sorted, deduplicated id list from a `duplicates` array (either `{id,count}` or `{id,lines}` shape). */
+function duplicateIds(duplicates) {
+  return duplicates.map((d) => d.id).sort();
+}
+
+/** Build a single-line `` `id=value` `` markdown fixture wrapping one candidate id=value pair. */
+function backtickLine(idEqualsValue) {
+  return '`' + idEqualsValue + '`';
+}
+
+// Representative accept/reject id-shape table both parsers must agree on —
+// this is what PROVES the parity claim rather than merely asserting it.
+// FINDING 4 (ADR-1671 PR review): the embedded-CR-in-value case below was the
+// one real divergence the earlier parity claim missed — production rejected
+// it, the example silently accepted it. Both now reject it (ported fix).
+const ID_SHAPE_CASES = [
+  { idEqualsValue: 'A=1', expectAccept: true },
+  { idEqualsValue: 'FOO=x', expectAccept: true },
+  { idEqualsValue: 'PRED.k320.rule=x', expectAccept: true },
+  { idEqualsValue: 'RELEASE-NOTES.x=y', expectAccept: true },
+  { idEqualsValue: 'A..b=1', expectAccept: false },
+  { idEqualsValue: 'foo.bar=x', expectAccept: false },
+  { idEqualsValue: 'FOO BAR=x', expectAccept: false },
+  { idEqualsValue: '=v', expectAccept: false },
+  { idEqualsValue: 'ID', expectAccept: false },
+];
+
+/**
+ * The embedded-CR case needs its own fixture, not the plain
+ * `` `ID=value` `` shape backtickLine() builds: a lone CR with no following
+ * LF never reaches a closing backtick at all (a separate, documented parser
+ * limit — see src/context-predicates.cts's module doc comment), so the CR
+ * must sit INSIDE an otherwise well-formed, LF-terminated backtick line.
+ */
+const CR_VALUE_MARKDOWN = '`ID=ab\rcd`\n';
+
+// ─── Parity checks (surface 1: production vs. example) ────────────────────────
+
+/**
+ * @param {object} prodPredicates
+ * @param {object} examplePredicates
+ * @param {string} markdown
+ * @returns {string[]} diagnostics; empty when the two parsers fully agree
+ */
+function checkProdExampleParity(prodPredicates, examplePredicates, markdown) {
+  const diagnostics = [];
+
+  const prodParsed = prodPredicates.parsePredicates(markdown);
+  const exampleParsed = examplePredicates.parsePredicates(markdown);
+  const prodIndex = prodPredicates.buildIndex(prodParsed.predicates);
+  const exampleIndex = examplePredicates.buildIndex(exampleParsed.predicates);
+
+  if (exampleIndex.count !== prodIndex.count) {
+    diagnostics.push(`predicate count diverged: example=${exampleIndex.count} production=${prodIndex.count}`);
+  }
+
+  const prodClassKeys = Object.keys(prodIndex.classes).sort();
+  const exampleClassKeys = Object.keys(exampleIndex.classes).sort();
+  if (JSON.stringify(exampleClassKeys) !== JSON.stringify(prodClassKeys)) {
+    diagnostics.push(
+      `class set diverged: example=${JSON.stringify(exampleClassKeys)} production=${JSON.stringify(prodClassKeys)}`,
+    );
+  } else if (JSON.stringify(exampleIndex.classes) !== JSON.stringify(prodIndex.classes)) {
+    diagnostics.push(
+      `per-class predicate counts diverged: example=${JSON.stringify(exampleIndex.classes)} ` +
+        `production=${JSON.stringify(prodIndex.classes)}`,
+    );
+  }
+
+  const prodDupIds = duplicateIds(prodIndex.duplicates);
+  const exampleDupIds = duplicateIds(exampleIndex.duplicates);
+  if (JSON.stringify(exampleDupIds) !== JSON.stringify(prodDupIds)) {
+    diagnostics.push(
+      `duplicate-id set diverged: example=${JSON.stringify(exampleDupIds)} production=${JSON.stringify(prodDupIds)}`,
+    );
+  }
+
+  diagnostics.push(...diffPredicatesById(exampleIndex.predicates, prodIndex.predicates, 'example', 'production'));
+
+  for (const { idEqualsValue, expectAccept } of ID_SHAPE_CASES) {
+    const line = backtickLine(idEqualsValue);
+    const exampleCount = examplePredicates.parsePredicates(line).predicates.length;
+    const prodCount = prodPredicates.parsePredicates(line).predicates.length;
+    if (exampleCount !== prodCount) {
+      diagnostics.push(
+        `id-shape verdict diverged for ${JSON.stringify(idEqualsValue)}: ` +
+          `example found ${exampleCount} predicate(s), production found ${prodCount}`,
+      );
+      continue;
+    }
+    const actualAccept = prodCount === 1;
+    if (actualAccept !== expectAccept) {
+      diagnostics.push(
+        `id-shape verdict wrong for ${JSON.stringify(idEqualsValue)}: expected ` +
+          `${expectAccept ? 'ACCEPT' : 'REJECT'}, both modules agreed on ${actualAccept ? 'ACCEPT' : 'REJECT'} instead`,
+      );
+    }
+  }
+
+  const exampleCrCount = examplePredicates.parsePredicates(CR_VALUE_MARKDOWN).predicates.length;
+  const prodCrCount = prodPredicates.parsePredicates(CR_VALUE_MARKDOWN).predicates.length;
+  if (exampleCrCount !== prodCrCount) {
+    diagnostics.push(
+      `id-shape verdict diverged for embedded-CR-in-value: example found ${exampleCrCount} predicate(s), ` +
+        `production found ${prodCrCount}`,
+    );
+  } else if (prodCrCount !== 0) {
+    diagnostics.push(
+      `embedded-CR-in-value must be REJECTED by both parsers; both instead ACCEPTED it (${prodCrCount} predicate(s))`,
+    );
+  }
+
+  return diagnostics;
+}
+
+// ─── Parity check (surface 2: example's committed index vs. fresh parse) ──────
+
+/** Strip a predicate down to the line-number-independent fields used for comparison. */
+function toLineIndependent(p) {
+  return { id: p.id, klass: p.klass, value: p.value };
+}
+
+/**
+ * @param {object} examplePredicates
+ * @param {string} markdown
+ * @param {string} exampleIndexPath
+ * @returns {string[]} diagnostics; empty when the committed index and a fresh
+ *   parse agree on every LINE-NUMBER-INDEPENDENT fact
+ */
+function checkExampleIndexParity(examplePredicates, markdown, exampleIndexPath) {
+  const diagnostics = [];
+
+  let committed;
+  try {
+    committed = JSON.parse(fs.readFileSync(exampleIndexPath, 'utf8'));
+  } catch (err) {
+    diagnostics.push(`cannot read/parse ${exampleIndexPath}: ${err && err.message}`);
+    return diagnostics;
+  }
+  if (!committed || !Array.isArray(committed.predicates)) {
+    diagnostics.push(`${exampleIndexPath} does not have the expected ContextIndex shape`);
+    return diagnostics;
+  }
+
+  const { predicates } = examplePredicates.parsePredicates(markdown);
+  const fresh = examplePredicates.buildIndex(predicates);
+
+  if (committed.count !== fresh.count) {
+    diagnostics.push(`example index predicate count diverged: committed=${committed.count} fresh=${fresh.count}`);
+  }
+  if (JSON.stringify(committed.classes) !== JSON.stringify(fresh.classes)) {
+    diagnostics.push(
+      `example index class-count map diverged: committed=${JSON.stringify(committed.classes)} ` +
+        `fresh=${JSON.stringify(fresh.classes)}`,
+    );
+  }
+
+  const committedDupIds = duplicateIds(committed.duplicates || []);
+  const freshDupIds = duplicateIds(fresh.duplicates);
+  if (JSON.stringify(committedDupIds) !== JSON.stringify(freshDupIds)) {
+    diagnostics.push(
+      `example index duplicate-id set diverged: committed=${JSON.stringify(committedDupIds)} ` +
+        `fresh=${JSON.stringify(freshDupIds)}`,
+    );
+  }
+
+  const committedIndependent = committed.predicates.map(toLineIndependent);
+  const freshIndependent = fresh.predicates.map(toLineIndependent);
+  const diffs = diffPredicatesById(committedIndependent, freshIndependent, 'committed example index', 'fresh parse');
+  diagnostics.push(...diffs.map((d) => `example index: ${d}`));
+
+  return diagnostics;
+}
+
+// ─── Argument parsing ─────────────────────────────────────────────────────────
+
+/**
+ * @param {string[]} argv - process.argv.slice(2)
+ * @returns {{ contextPath: string, exampleIndexPath: string }}
+ */
+function parseArgs(argv) {
+  const opts = { contextPath: DEFAULT_CONTEXT_PATH, exampleIndexPath: DEFAULT_EXAMPLE_INDEX_PATH };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--context-path') {
+      opts.contextPath = path.resolve(argv[++i] ?? '');
+    } else if (arg === '--example-index-path') {
+      opts.exampleIndexPath = path.resolve(argv[++i] ?? '');
+    } else {
+      throw new ExitError(
+        1,
+        `Unknown argument: ${arg}\n` +
+          'Usage: lint-example-parser-parity.cjs [--context-path <path>] [--example-index-path <path>]\n',
+      );
+    }
+  }
+  return opts;
+}
+
+// ─── Main ─────────────────────────────────────────────────────────────────────
+
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+
+  const prodPredicates = loadProdPredicates();
+  const examplePredicates = loadExamplePredicates();
+  const markdown = readContextMarkdown(opts.contextPath);
+
+  const diagnostics = [
+    ...checkProdExampleParity(prodPredicates, examplePredicates, markdown),
+    ...checkExampleIndexParity(examplePredicates, markdown, opts.exampleIndexPath),
+  ];
+
+  if (diagnostics.length > 0) {
+    process.stderr.write(
+      `\nERROR lint-example-parser-parity: ${diagnostics.length} divergence(s) found\n\n`,
+    );
+    for (const d of diagnostics) process.stderr.write(`  - ${d}\n`);
+    process.stderr.write(
+      '\nexamples/dynamic-context-management/context-predicates.cjs and ' +
+        'src/context-predicates.cts (gsd-core/bin/lib/context-predicates.cjs) must agree; ' +
+        'the committed examples/dynamic-context-management/CONTEXT-INDEX.json must match a ' +
+        'fresh parse of CONTEXT.md on every line-number-independent fact (run:\n' +
+        '  node examples/dynamic-context-management/gen-context-index.cjs --write\n' +
+        ').\n',
+    );
+    throw new ExitError(1);
+  }
+
+  process.stdout.write(
+    'ok lint-example-parser-parity: production and example parsers agree on the real CONTEXT.md ' +
+      `(count/classes/duplicates/(id,value) pairs), on ${ID_SHAPE_CASES.length + 1} representative ` +
+      'accept/reject id-shape cases, and the committed example index matches a fresh parse ' +
+      '(line-number-independent)\n',
+  );
+}
+
+module.exports = {
+  loadProdPredicates,
+  loadExamplePredicates,
+  readContextMarkdown,
+  diffPredicatesById,
+  checkProdExampleParity,
+  checkExampleIndexParity,
+  parseArgs,
+  ID_SHAPE_CASES,
+  CR_VALUE_MARKDOWN,
+};
+
+if (require.main === module) {
+  runMain(main);
+}

package/scripts/lint-test-file-count.allowlist.json

@@ -1,8 +1,9 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to \u2264 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
     "config": {
       "files": [
+        "config-defaults-runtime-exclusion.test.cjs",
         "config-field-docs.test.cjs",
         "config-get-default.test.cjs",
         "config-schema.property.test.cjs",
@@ -21,6 +22,15 @@
       ],
       "issue": "622"
     },
+    "init": {
+      "files": [
+        "init-debug-workflow-contract.test.cjs",
+        "init-debug.test.cjs",
+        "init-manager.test.cjs",
+        "init.test.cjs"
+      ],
+      "issue": "3149"
+    },
     "milestone": {
       "files": [
         "milestone-archive.test.cjs",
@@ -116,6 +126,22 @@
         "host-integration-descriptors.test.cjs"
       ],
       "issue": "1684"
+    },
+    "prompt-budget": {
+      "files": [
+        "prompt-budget-cli.test.cjs",
+        "prompt-budget-parity.test.cjs",
+        "prompt-budget.test.cjs"
+      ],
+      "issue": "2929"
+    },
+    "audit": {
+      "files": [
+        "audit-command-cutover.test.cjs",
+        "audit-fix-command.test.cjs",
+        "fix-2766-audit-uat-archived-and-table-shapes.test.cjs"
+      ],
+      "issue": "2766"
     }
   }
 }

package/scripts/mutation-matrix.cjs

@@ -130,6 +130,19 @@ const COVERED = {
     // minScore raised to TARGET (80) — module now meets ADR-456 goal.
     minScore: 80,
   },
+  // context-composer: extracted from prompt-budget by #2929. Needs its own entry because
+  // mutation coverage does not migrate with relocated code — scoring only prompt-budget.cjs
+  // would leave the extracted ladder unmeasured.
+  'context-composer': {
+    cjs: 'gsd-core/bin/lib/context-composer.cjs',
+    tests: [
+      'tests/prompt-budget-parity.test.cjs',
+      'tests/prompt-budget.unit.test.cjs',
+      'tests/context-composer.test.cjs',
+      'tests/context-composer.property.test.cjs',
+    ],
+    minScore: 66,
+  },
   'prompt-budget': {
     cjs: 'gsd-core/bin/lib/prompt-budget.cjs',
     tests: [

package/scripts/prompt-injection-scan.sh

@@ -14,6 +14,19 @@ set -euo pipefail
 
 # ─── Patterns ────────────────────────────────────────────────────────────────
 # Each pattern is a POSIX extended regex. Keep alphabetized by category.
+#
+# Left-boundary prefix `(^|[^[:alnum:]])`: several trigger words are also
+# suffixes of ordinary English words or camelCase identifiers (fact/impact/
+# contract/artifact/interact all end in "act"; retrieval/medieval end in
+# "eval"; blueprint/reprint/fingerprint end in "print"; describeFunction/
+# wrapFunction end in "Function"; Jordan/Sudan end in "dan"), so an
+# unanchored keyword matches as a false-positive substring. `\b` is a GNU
+# grep extension and this script must also run under BSD/macOS grep, so the
+# boundary is spelled out as `(^|[^[:alnum:]])` instead. This never narrows
+# real detections: a genuine attack phrase is always preceded by start-of-
+# line, whitespace, or punctuation, never by another alnum character glued
+# directly onto the keyword. Only patterns whose leading keyword is provably
+# not a real-word suffix are left unanchored (#3175 audit).
 
 PATTERNS=(
   # Instruction override
@@ -27,7 +40,7 @@ PATTERNS=(
   'you[[:space:]]+are[[:space:]]+now[[:space:]]+(a|an|my)[[:space:]]'
   'from[[:space:]]+now[[:space:]]+on[[:space:]]+(you|pretend|act|behave)'
   'pretend[[:space:]]+(you[[:space:]]+are|to[[:space:]]+be)[[:space:]]'
-  'act[[:space:]]+as[[:space:]]+(a|an|if|my)[[:space:]]'
+  '(^|[^[:alnum:]])act[[:space:]]+as[[:space:]]+(a|an|if|my)[[:space:]]'
   'roleplay[[:space:]]+as[[:space:]]'
   'assume[[:space:]]+the[[:space:]]+role[[:space:]]+of[[:space:]]'
 
@@ -35,7 +48,7 @@ PATTERNS=(
   'output[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
   'reveal[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
   'show[[:space:]]+me[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
-  'print[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
+  '(^|[^[:alnum:]])print[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
   'what[[:space:]]+(is|are)[[:space:]]+(your|the)[[:space:]]+(system[[:space:]]+)?(prompt|instructions)'
   'repeat[[:space:]]+(your|the|all)[[:space:]]+(system[[:space:]]+)?(prompt|instructions|rules)'
 
@@ -51,13 +64,21 @@ PATTERNS=(
   '<</SYS>>'
 
   # Tool call injection / code execution in markdown
-  'eval[[:space:]]*\([[:space:]]*["\x27]'
-  'exec[[:space:]]*\([[:space:]]*["\x27]'
-  'Function[[:space:]]*\([[:space:]]*["\x27].*return'
+  #
+  # The quote-or-apostrophe class below is spelled ["'"'"'"] (a literal `'`
+  # via bash's close-quote/escape/reopen idiom), not `["\x27]` — `\x27` is a
+  # GNU-grep-only hex escape; BSD/macOS grep treats it as four literal
+  # characters (", \, x, 2, 7) and never matches an actual apostrophe, so
+  # `eval('...')` (single-quoted) silently went undetected on macOS while
+  # passing on GNU-grep CI runners. Found auditing #3175; fixed here since it
+  # is the same unanchored/portability defect class as the boundary fix.
+  '(^|[^[:alnum:]])eval[[:space:]]*\([[:space:]]*["'"'"']'
+  'exec[[:space:]]*\([[:space:]]*["'"'"']'
+  '(^|[^[:alnum:]])Function[[:space:]]*\([[:space:]]*["'"'"'].*return'
 
   # Jailbreak / DAN patterns
   'do[[:space:]]+anything[[:space:]]+now'
-  'DAN[[:space:]]+mode'
+  '(^|[^[:alnum:]])DAN[[:space:]]+mode'
   'developer[[:space:]]+mode[[:space:]]+(enabled|output|activated)'
   'jailbreak'
   'bypass[[:space:]]+(safety|content|security)[[:space:]]+(filter|check|rule|guard)'