@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/security/session-encryption.js

@@ -10,6 +10,8 @@ import * as crypto from 'crypto';
 import fs from 'fs-extra';
 import * as path from 'path';
 import * as os from 'os';
+import { logger } from '../utils/logger.js';
+import { writeFileAtomic } from '../utils/atomic-write.js';
 // AES-256-GCM parameters
 const ALGORITHM = 'aes-256-gcm';
 const KEY_LENGTH = 32; // 256 bits
@@ -17,6 +19,9 @@ const IV_LENGTH = 16; // 128 bits
 const AUTH_TAG_LENGTH = 16; // 128 bits
 const SALT_LENGTH = 32;
 const PBKDF2_ITERATIONS = 100000;
+const HKDF_DIGEST = 'sha256';
+const HKDF_INFO = 'codebuddy-session-encryption/v2';
+const ENCRYPTION_VERSION = 2;
 const DEFAULT_CONFIG = {
     keyPath: path.join(os.homedir(), '.codebuddy', '.encryption-key'),
     usePassword: false,
@@ -54,7 +59,7 @@ export class SessionEncryption {
                 this.key = crypto.randomBytes(KEY_LENGTH);
                 // Store key securely
                 await fs.ensureDir(path.dirname(this.config.keyPath));
-                await fs.writeFile(this.config.keyPath, this.key, { mode: 0o600 });
+                await writeFileAtomic(this.config.keyPath, this.key, { mode: 0o600 });
             }
             this.initialized = true;
         }
@@ -94,7 +99,8 @@ export class SessionEncryption {
         }
         const iv = crypto.randomBytes(IV_LENGTH);
         const salt = crypto.randomBytes(SALT_LENGTH);
-        const cipher = crypto.createCipheriv(ALGORITHM, this.key, iv, {
+        const subkey = this.deriveSubkey(salt);
+        const cipher = crypto.createCipheriv(ALGORITHM, subkey, iv, {
             authTagLength: AUTH_TAG_LENGTH,
         });
         const encrypted = Buffer.concat([
@@ -106,9 +112,13 @@ export class SessionEncryption {
             iv: iv.toString('base64'),
             authTag: cipher.getAuthTag().toString('base64'),
             salt: salt.toString('base64'),
-            version: 1,
+            version: ENCRYPTION_VERSION,
         };
     }
+    /** Derive a domain-separated AES key for one encrypted record. */
+    deriveSubkey(salt) {
+        return Buffer.from(crypto.hkdfSync(HKDF_DIGEST, this.key, salt, HKDF_INFO, KEY_LENGTH));
+    }
     /**
      * Decrypt data
      */
@@ -120,7 +130,13 @@ export class SessionEncryption {
         const iv = Buffer.from(encrypted.iv, 'base64');
         const authTag = Buffer.from(encrypted.authTag, 'base64');
         const ciphertext = Buffer.from(encrypted.ciphertext, 'base64');
-        const decipher = crypto.createDecipheriv(ALGORITHM, this.key, iv, {
+        if (encrypted.version >= ENCRYPTION_VERSION && !encrypted.salt) {
+            throw new Error('Encrypted session is missing its per-record salt');
+        }
+        const key = encrypted.version >= ENCRYPTION_VERSION
+            ? this.deriveSubkey(Buffer.from(encrypted.salt, 'base64'))
+            : this.key;
+        const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
             authTagLength: AUTH_TAG_LENGTH,
         });
         decipher.setAuthTag(authTag);
@@ -176,8 +192,11 @@ export class SessionEncryption {
         return crypto.createHash('sha256').update(machineId).digest();
     }
     /**
-     * Rotate encryption key
-     * Re-encrypts all data with a new key
+     * Rotate the master encryption key.
+     *
+     * This method cannot re-encrypt stored sessions because it does not own the
+     * session store. Callers must retain the returned old key until every stored
+     * blob has been decrypted and re-encrypted with the new key.
      */
     async rotateKey() {
         if (!this.key) {
@@ -187,8 +206,10 @@ export class SessionEncryption {
         // Generate new key
         const newKey = crypto.randomBytes(KEY_LENGTH);
         // Store new key
-        await fs.writeFile(this.config.keyPath, newKey, { mode: 0o600 });
+        await writeFileAtomic(this.config.keyPath, newKey, { mode: 0o600 });
         this.key = newKey;
+        logger.warn('Session encryption key rotated without re-encrypting stored sessions; ' +
+            'retain oldKey until migration completes.');
         return {
             oldKey,
             newKey: newKey.toString('base64'),

package/dist/security/shell-env-policy.js

@@ -25,8 +25,11 @@ const CORE_VARS = new Set([
     'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'TERM_PROGRAM',
     'LANG', 'LC_ALL', 'LC_CTYPE', 'TZ', 'TMPDIR', 'TEMP', 'TMP',
     'PWD', 'OLDPWD', 'SHLVL', 'COLORTERM', 'CLICOLOR',
-    // Node.js / npm
-    'NODE_ENV', 'NODE_PATH', 'NPM_CONFIG_PREFIX',
+    // Windows process/session essentials
+    'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'COMSPEC', 'PATHEXT', 'SYSTEMROOT',
+    // Node.js / npm — NODE_PATH exclu volontairement (détournement de résolution
+    // de modules) ; NODE_OPTIONS ne l'a jamais été et ne doit pas l'être.
+    'NODE_ENV', 'NPM_CONFIG_PREFIX',
     // Common CI vars (non-sensitive)
     'CI', 'GITHUB_ACTIONS', 'GITLAB_CI',
 ]);
@@ -40,6 +43,12 @@ const DEFAULT_EXCLUDE_PATTERNS = [
     '*CREDENTIAL*', '*PRIVATE*', '*AUTH*',
     // Specific suffix patterns
     '*_CERT', '*_CERTIFICATE',
+    // Injection de code dans les sous-processus (voir env-blocklist.ts)
+    'NODE_OPTIONS', 'NODE_PATH',
+    // Substitution de module / de bibliothèque à l'interpréteur ou au chargeur
+    'PYTHONPATH', 'PYTHONHOME', 'PYTHONSTARTUP',
+    'LD_PRELOAD', 'LD_LIBRARY_PATH', 'DYLD_INSERT_LIBRARIES', 'DYLD_LIBRARY_PATH',
+    'PERL5LIB', 'PERL5OPT', 'RUBYLIB', 'RUBYOPT', 'GEM_PATH', 'GEM_HOME',
     // Cloud providers
     'AWS_*', 'OPENAI_*', 'ANTHROPIC_*', 'GOOGLE_*API*',
     'AZURE_*', 'DIGITALOCEAN_*', 'HETZNER_*',

package/dist/security/skill-scanner.d.ts

@@ -18,7 +18,7 @@ export interface ScanResult {
     findings: ScanFinding[];
     scannedAt: number;
 }
-export type SkillFirewallCapability = 'dynamic-code' | 'filesystem' | 'network' | 'prototype-pollution' | 'secrets' | 'shell';
+export type SkillFirewallCapability = 'dynamic-code' | 'filesystem' | 'network' | 'prompt-injection' | 'prototype-pollution' | 'secrets' | 'shell';
 export type SkillFirewallVerdict = 'allow' | 'review' | 'quarantine';
 export interface SkillFirewallReport {
     schemaVersion: 1;
@@ -39,7 +39,7 @@ export declare function scanFile(filePath: string): ScanResult;
 /**
  * Scan a directory of skill files recursively.
  */
-export declare function scanDirectory(dirPath: string): ScanResult[];
+export declare function scanDirectory(dirPath: string, withinScripts?: boolean): ScanResult[];
 /**
  * Scan all skill locations (bundled, managed, workspace).
  */

package/dist/security/skill-scanner.js

@@ -7,8 +7,74 @@
 import fs from 'fs';
 import path from 'path';
 import { logger } from '../utils/logger.js';
+import { deobfuscateForScanWindows, deobfuscateSafeForScanWindows, sliceScanWindows, } from './text-deobfuscation.js';
+const SCRIPT_EXTENSIONS = new Set([
+    '.bash',
+    '.bat',
+    '.cmd',
+    '.cjs',
+    '.ex',
+    '.exs',
+    '.go',
+    '.js',
+    '.lua',
+    '.mjs',
+    '.php',
+    '.pl',
+    '.ps1',
+    '.py',
+    '.r',
+    '.rb',
+    '.rs',
+    '.sh',
+    '.ts',
+    '.zsh',
+]);
+function isScannableSkillFile(fileName) {
+    const lowerName = fileName.toLowerCase();
+    return lowerName.endsWith('.skill.md')
+        || lowerName === 'skill.md'
+        || SCRIPT_EXTENSIONS.has(path.extname(lowerName));
+}
+function isExecutableOrShebang(filePath) {
+    try {
+        if ((fs.statSync(filePath).mode & 0o111) !== 0)
+            return true;
+        const fd = fs.openSync(filePath, 'r');
+        try {
+            const prefix = Buffer.alloc(2);
+            return fs.readSync(fd, prefix, 0, prefix.length, 0) === 2 && prefix.toString() === '#!';
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+}
 const DANGEROUS_PATTERNS = [
-    // Code execution
+    // Code execution & droppers
+    { pattern: /\b(?:curl|wget)\b[^|\n]*\|\s*(?:sh|bash|zsh)\b/i, severity: 'critical', description: 'Remote download piped directly to a shell', name: 'remote-download-pipe-shell', capability: 'shell' },
+    { pattern: /\bbash(?:\.exe)?\s+-c\b[^\n]*\bcurl\b/i, severity: 'critical', description: 'Shell command executes a downloaded curl payload', name: 'bash-curl-command', capability: 'shell' },
+    { pattern: /\bpowershell(?:\.exe)?\s+-c(?:ommand)?\b[^\n]*\biwr\b[^|\n]*\|\s*iex\b/i, severity: 'critical', description: 'PowerShell downloads and executes a remote payload', name: 'powershell-download-execute', capability: 'shell' },
+    {
+        pattern: /\b(?:base64\s+(?:-d|--decode|-D)|openssl\s+base64\s+-d)\b[^|\n]*\|\s*(?:sh|bash|zsh|dash)\b/i,
+        severity: 'critical',
+        description: 'Base64 decoding piped directly to shell',
+        name: 'base64-decode-pipe-shell',
+        capability: 'shell',
+        justification: 'Base64 droppers decode obfuscated commands on the fly into an active shell interpreter',
+    },
+    {
+        pattern: /\b(?:printf|echo\s+-e)\s+['"][^'"]*\\x[0-9a-fA-F]{2}[^'"]*['"]\s*\|\s*(?:sh|bash|zsh|dash)\b/i,
+        severity: 'critical',
+        description: 'Hex/octal encoded payload piped directly to shell',
+        name: 'hex-printf-pipe-shell',
+        capability: 'shell',
+        justification: 'Hex escape sequences in printf/echo piped into shells reconstruct binary or shell payloads stealthily',
+    },
+    { pattern: /\beval\s+\$\(\s*[^)]*\)/i, severity: 'critical', description: 'Dynamic evaluation of shell command substitution', name: 'eval-command-substitution', capability: 'shell' },
     { pattern: /\beval\s*\(/, severity: 'critical', description: 'Dynamic code execution via eval()', name: 'eval', capability: 'dynamic-code' },
     { pattern: /\bnew\s+Function\s*\(/, severity: 'critical', description: 'Dynamic function creation', name: 'new-function', capability: 'dynamic-code' },
     { pattern: /\bchild_process\b/, severity: 'high', description: 'Child process module usage', name: 'child_process', capability: 'shell' },
@@ -21,24 +87,111 @@ const DANGEROUS_PATTERNS = [
     { pattern: /\bunlinkSync\s*\(/, severity: 'medium', description: 'Synchronous file deletion', name: 'unlinkSync', capability: 'filesystem' },
     { pattern: /\bwriteFileSync\s*\(/, severity: 'low', description: 'Synchronous file write', name: 'writeFileSync', capability: 'filesystem' },
     { pattern: /\brmdirSync\s*\(/, severity: 'medium', description: 'Directory removal', name: 'rmdirSync', capability: 'filesystem' },
-    // Network
+    // Network & Exfiltration
     { pattern: /\bfetch\s*\(\s*['"`]http/, severity: 'medium', description: 'External HTTP request', name: 'fetch-http', capability: 'network' },
     { pattern: /\baxios\b/, severity: 'low', description: 'HTTP client library usage', name: 'axios', capability: 'network' },
     { pattern: /\brequire\s*\(\s*['"`]https?['"`]\s*\)/, severity: 'medium', description: 'HTTP module import', name: 'http-require', capability: 'network' },
     { pattern: /\bWebSocket\b/, severity: 'medium', description: 'WebSocket usage', name: 'websocket', capability: 'network' },
-    // Dynamic imports
+    {
+        pattern: /(?:(?:curl|wget)\b[^|\n]*(?:-d|--data|--data-binary|--data-raw|-F|--upload-file|-T)\s+[@<]?(?:~|\$HOME|\/home\/[^/\s]+|\.)?\/?(?:\.ssh\/|\.aws\/|\.codebuddy\/|\.env(?!\.(?:example|sample|template|dist))\b))|(?:\bcat\s+[^|\n]*(?:\.ssh\/|\.aws\/|\.codebuddy\/|\.env(?!\.(?:example|sample|template|dist))\b)[^|\n]*\|\s*(?:curl|wget|nc|ncat|netcat|socat)\b)|(?:\b(?:nc|ncat|netcat|socat)\b[^<\n]*<\s*(?:~|\$HOME|\/home\/[^/\s]+|\.)?\/?(?:\.ssh\/|\.aws\/|\.codebuddy\/|\.env(?!\.(?:example|sample|template|dist))\b))|(?:\bscp\b[^|\n]*(?:~|\$HOME|\/home\/[^/\s]+|\.)?\/?(?:\.ssh\/id_|\.aws\/credentials|\.codebuddy\/[^\s|&;]*\.env|\.env(?!\.(?:example|sample|template|dist))\b)\s+[^\s]+:)/i,
+        severity: 'critical',
+        description: 'Exfiltration of credentials or sensitive environment files via network',
+        name: 'credential-network-exfiltration',
+        capability: 'network',
+        justification: 'Transmitting private keys, environment files, or credentials via curl/nc/scp to remote destinations is exfiltration',
+    },
+    // Dynamic imports (JS & Python)
     { pattern: /\brequire\s*\(\s*[a-zA-Z_$[]/, severity: 'high', description: 'Dynamic require with variable', name: 'dynamic-require', capability: 'dynamic-code' },
-    { pattern: /\bimport\s*\(\s*[a-zA-Z_$[]/, severity: 'high', description: 'Dynamic import with variable', name: 'dynamic-import', capability: 'dynamic-code' },
+    { pattern: /(?<!\bfrom\s+[\w.]+\s+)\bimport\s*\(\s*[a-zA-Z_$[]/, severity: 'high', description: 'Dynamic import with variable', name: 'dynamic-import', capability: 'dynamic-code' },
+    {
+        pattern: /\b__import__\s*\(\s*['"][a-zA-Z0-9_.]+['"]/,
+        severity: 'high',
+        description: 'Dynamic Python module import via __import__()',
+        name: 'py-dunder-import',
+        capability: 'dynamic-code',
+        justification: 'Python __import__() dynamically loads arbitrary modules at runtime bypassing static import declarations',
+    },
+    {
+        pattern: /\bimportlib\s*\.\s*import_module\s*\(/,
+        severity: 'high',
+        description: 'Dynamic Python module import via importlib.import_module()',
+        name: 'py-importlib-import',
+        capability: 'dynamic-code',
+        justification: 'importlib.import_module() enables dynamic resolution and execution of arbitrary Python packages at runtime',
+    },
     // Environment/secrets
     { pattern: /process\.env\[/, severity: 'low', description: 'Dynamic environment variable access', name: 'env-dynamic', capability: 'secrets' },
     { pattern: /\b(API_KEY|SECRET|PASSWORD|TOKEN)\b/i, severity: 'info', description: 'Possible secret reference', name: 'secret-ref', capability: 'secrets' },
+    {
+        pattern: /(?<!\bssh-keygen\b[^\n]*)(?:~|\$HOME|\/home\/[^/\s]+)\/\.ssh\/id_(?:rsa|ecdsa|ed25519|dsa)\b(?!\.pub\b)/i,
+        severity: 'high',
+        description: 'Access or reading of private SSH keys',
+        name: 'ssh-private-key-access',
+        capability: 'secrets',
+        justification: 'Direct access to SSH private keys allows unauthorized server access and identity impersonation',
+    },
+    {
+        pattern: /\b(?:cat|head|tail|grep|source)\s+(?:(?:\.\/)?\.env|~[^\s/]*\/\.env)(?!\.(?:example|sample|template|dist|test|local\.example))\b/i,
+        severity: 'high',
+        description: 'Access or extraction of sensitive .env environment file',
+        name: 'dotenv-file-access',
+        capability: 'secrets',
+        justification: '.env files contain local application secrets, API keys, and connection credentials',
+    },
+    {
+        pattern: /(?:~|\$HOME|\/home\/[^/\s]+)\/(?:\.aws\/(?:credentials|config)|\.codebuddy\/[^\s|&;]*\.env)\b/i,
+        severity: 'high',
+        description: 'Access to cloud provider credentials or CodeBuddy environment files',
+        name: 'cloud-credential-access',
+        capability: 'secrets',
+        justification: 'Accessing ~/.aws/credentials or ~/.codebuddy/*.env compromises infrastructure and agent secrets',
+    },
     // Prototype pollution
     { pattern: /__proto__/, severity: 'high', description: 'Prototype pollution risk', name: 'proto', capability: 'prototype-pollution' },
     { pattern: /\bconstructor\s*\[/, severity: 'high', description: 'Constructor access via bracket notation', name: 'constructor-bracket', capability: 'prototype-pollution' },
     // Shell injection
     { pattern: /`\$\{.*\}`/, severity: 'medium', description: 'Template literal with interpolation (potential injection)', name: 'template-injection', capability: 'shell' },
     { pattern: /\$\(.*\)/, severity: 'medium', description: 'Shell command substitution', name: 'shell-subst', capability: 'shell' },
+    // Prompt injection / jailbreak (a skill is injected into the agent context)
+    { pattern: /\b(?:ignore|disregard|override|forget)\b.{0,80}\b(?:all|any|previous|prior|system|developer)\b.{0,80}\b(?:instruction|prompt|message)s?\b/i, severity: 'critical', description: 'Instruction to override higher-priority prompts', name: 'prompt-override', capability: 'prompt-injection' },
+    { pattern: /\b(?:jailbreak|godmode|g0dm0d3)\b/i, severity: 'critical', description: 'Jailbreak / GODMODE skill content', name: 'jailbreak-godmode', capability: 'prompt-injection' },
+    { pattern: /\b(?:disable|bypass)\b.{0,60}\b(?:all|every|any)\b.{0,40}\b(?:safety|guardrail|restriction)s?\b/i, severity: 'critical', description: 'Instruction to disable safety policies', name: 'disable-safety', capability: 'prompt-injection' },
+    {
+        pattern: /<!--[\s\S]*?\b(?:ignore|disregard|override|forget)\b.{0,80}\b(?:all|any|previous|prior|system|developer)\b.{0,80}\b(?:instruction|prompt|message|rule)s?[\s\S]*?-->/i,
+        severity: 'critical',
+        description: 'Prompt injection or instruction override hidden inside HTML comment',
+        name: 'html-comment-prompt-injection',
+        capability: 'prompt-injection',
+        justification: 'HTML comments are invisible in rendered markdown but parsed by LLMs, creating a stealth prompt injection vector',
+    },
+    {
+        pattern: /<!--[\s\S]*?\b(?:(?:curl|wget)\b[^|\n]*\|\s*(?:sh|bash|zsh)|rm\s+-rf|base64\s+(?:-d|--decode))\b[\s\S]*?-->/i,
+        severity: 'critical',
+        description: 'Dangerous shell command or dropper hidden inside HTML comment',
+        name: 'html-comment-hidden-command',
+        capability: 'prompt-injection',
+        justification: 'Hiding shell droppers or destructive commands in HTML comments bypasses visual human review while targeting agents',
+    },
 ];
+const DYNAMIC_IMPORT_PATTERN_LEGACY = /\bimport\s*\(\s*[a-zA-Z_$[]/;
+function isDeobAllEnabled() {
+    return (process.env.CODEBUDDY_SKILL_FIREWALL_DEOB_ALL !== 'false' &&
+        process.env.CODEBUDDY_SKILL_FIREWALL_DEOB_ALL !== '0');
+}
+function getDangerousPatterns() {
+    if (isDeobAllEnabled()) {
+        return DANGEROUS_PATTERNS;
+    }
+    return DANGEROUS_PATTERNS.map((dp) => {
+        if (dp.name === 'dynamic-import') {
+            return {
+                ...dp,
+                pattern: DYNAMIC_IMPORT_PATTERN_LEGACY,
+            };
+        }
+        return dp;
+    });
+}
 /**
  * Scan a single file for dangerous patterns.
  */
@@ -47,6 +200,7 @@ export function scanFile(filePath) {
     try {
         const content = fs.readFileSync(filePath, 'utf-8');
         const lines = content.split('\n');
+        const patterns = getDangerousPatterns();
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             if (line === undefined)
@@ -55,7 +209,7 @@ export function scanFile(filePath) {
             // Skip markdown comments and frontmatter delimiters
             if (line.trim().startsWith('<!--') || line.trim() === '---')
                 continue;
-            for (const dp of DANGEROUS_PATTERNS) {
+            for (const dp of patterns) {
                 if (dp.pattern.test(line)) {
                     findings.push({
                         severity: dp.severity,
@@ -68,6 +222,12 @@ export function scanFile(filePath) {
                 }
             }
         }
+        // Prompt-injection patterns also run over the FULL document. The line loop
+        // skips `<!-- … -->` (to avoid flagging example `eval()` in comments) and
+        // cannot see a jailbreak split across lines — that's how a no-shell
+        // override slipped through on 2026-09-03. Dotall matching here catches
+        // both without re-enabling those comment false positives for eval/shell.
+        findings.push(...collectPromptInjectionFindings(content, filePath, findings));
     }
     catch (error) {
         logger.debug(`Failed to scan file: ${filePath}`, { error });
@@ -81,7 +241,7 @@ export function scanFile(filePath) {
 /**
  * Scan a directory of skill files recursively.
  */
-export function scanDirectory(dirPath) {
+export function scanDirectory(dirPath, withinScripts = false) {
     const results = [];
     if (!fs.existsSync(dirPath))
         return results;
@@ -89,12 +249,11 @@ export function scanDirectory(dirPath) {
     for (const entry of entries) {
         const fullPath = path.join(dirPath, entry.name);
         if (entry.isDirectory()) {
-            results.push(...scanDirectory(fullPath));
+            results.push(...scanDirectory(fullPath, withinScripts || entry.name.toLowerCase() === 'scripts'));
         }
-        else if (entry.name.endsWith('.skill.md') ||
-            entry.name === 'SKILL.md' ||
-            entry.name.endsWith('.ts') ||
-            entry.name.endsWith('.js')) {
+        else if (withinScripts
+            || isScannableSkillFile(entry.name)
+            || isExecutableOrShebang(fullPath)) {
             const result = scanFile(fullPath);
             if (result.findings.length > 0) {
                 results.push(result);
@@ -181,6 +340,73 @@ export function formatScanReport(results) {
     }
     return lines.join('\n');
 }
+/**
+ * Full-document de-obfuscation pass across pattern capabilities.
+ * Safe de-obfuscation (zero-width, homoglyphs, césures) is applied to all capabilities.
+ * Aggressive de-obfuscation (Base64, percent-decoding) is restricted to prompt-injection.
+ */
+function collectDeobfuscatedFindings(content, filePath, existing) {
+    const extra = [];
+    const seen = new Set(existing.map((finding) => finding.pattern));
+    const deobAll = isDeobAllEnabled();
+    const patterns = getDangerousPatterns();
+    const rawWindows = sliceScanWindows(content);
+    let safeWindows = null;
+    let aggressiveWindows = null;
+    for (const dp of patterns) {
+        const isInjection = dp.capability === 'prompt-injection';
+        if (!isInjection && !deobAll)
+            continue;
+        if (seen.has(dp.name))
+            continue;
+        const flags = isInjection && !dp.pattern.flags.includes('s')
+            ? `${dp.pattern.flags}s`
+            : dp.pattern.flags;
+        const re = new RegExp(dp.pattern.source, flags.replace('g', ''));
+        // Prompt-injection patterns also match against raw content across lines/comments
+        if (isInjection) {
+            let rawMatched = false;
+            for (const win of rawWindows) {
+                const match = re.exec(win);
+                if (match && match.index !== undefined) {
+                    seen.add(dp.name);
+                    extra.push({
+                        severity: dp.severity,
+                        pattern: dp.name,
+                        description: dp.description,
+                        file: filePath,
+                        line: 1,
+                        evidence: match[0].replace(/\s+/g, ' ').trim().slice(0, 120),
+                    });
+                    rawMatched = true;
+                    break;
+                }
+            }
+            if (rawMatched)
+                continue;
+        }
+        const targetWindows = isInjection
+            ? (aggressiveWindows ??= deobfuscateForScanWindows(content))
+            : (safeWindows ??= deobfuscateSafeForScanWindows(content));
+        for (const win of targetWindows) {
+            const normMatch = re.exec(win);
+            if (!normMatch || normMatch.index === undefined)
+                continue;
+            seen.add(dp.name);
+            extra.push({
+                severity: dp.severity,
+                pattern: dp.name,
+                description: `${dp.description} (obfuscated)`,
+                file: filePath,
+                line: 1,
+                evidence: normMatch[0].replace(/\s+/g, ' ').trim().slice(0, 120),
+            });
+            break;
+        }
+    }
+    return extra;
+}
+const collectPromptInjectionFindings = collectDeobfuscatedFindings;
 function countFindings(findings) {
     return {
         critical: findings.filter((finding) => finding.severity === 'critical').length,

package/dist/security/ssrf-guard.d.ts

@@ -18,6 +18,11 @@
 export interface SSRFCheckResult {
     safe: boolean;
     reason?: string;
+    /** DNS addresses that were resolved and validated for this check. */
+    addresses?: Array<{
+        address: string;
+        family: number;
+    }>;
 }
 export interface SSRFGuardConfig {
     /** Additional allowed hosts (exact hostname or *.domain.com wildcard) */
@@ -51,6 +56,14 @@ export declare class SSRFGuard {
 }
 export declare function getSSRFGuard(config?: SSRFGuardConfig): SSRFGuard;
 export declare function resetSSRFGuard(): void;
+/**
+ * True for http(s) URLs that target THIS machine's loopback only
+ * (`127.0.0.0/8`, `::1`, `localhost`). Used by user-authored sensory
+ * webhooks (local Home Assistant / n8n / a test listener). Does not
+ * weaken the global SSRF guard: RFC1918, link-local and metadata stay
+ * blocked, and callers must refuse redirects off loopback.
+ */
+export declare function isLoopbackHttpUrl(rawUrl: string): boolean;
 /**
  * Convenience wrapper — use in web_fetch, webhook delivery, media download.
  *

package/dist/security/ssrf-guard.js

@@ -17,6 +17,7 @@
  */
 import * as dns from 'dns/promises';
 import { logger } from '../utils/logger.js';
+import { isLoopbackHost } from './dev-origins.js';
 // ============================================================================
 // Private IP range matchers (IPv4)
 // ============================================================================
@@ -292,6 +293,9 @@ export class SSRFGuard {
         if (this.config.resolveDns) {
             try {
                 const addresses = await dns.lookup(host, { all: true });
+                if (addresses.length === 0) {
+                    return { safe: false, reason: `DNS resolution returned no addresses for ${host}` };
+                }
                 for (const { address, family } of addresses) {
                     const result = family === 6
                         ? this.checkIPv6(address)
@@ -300,6 +304,10 @@ export class SSRFGuard {
                         return { safe: false, reason: `Host ${host} resolves to private IP: ${address} — ${result.reason}` };
                     }
                 }
+                return {
+                    safe: true,
+                    addresses: addresses.map(({ address, family }) => ({ address, family })),
+                };
             }
             catch (err) {
                 // DNS resolution failure → fail closed
@@ -392,6 +400,25 @@ export function getSSRFGuard(config) {
 export function resetSSRFGuard() {
     _guard = null;
 }
+/**
+ * True for http(s) URLs that target THIS machine's loopback only
+ * (`127.0.0.0/8`, `::1`, `localhost`). Used by user-authored sensory
+ * webhooks (local Home Assistant / n8n / a test listener). Does not
+ * weaken the global SSRF guard: RFC1918, link-local and metadata stay
+ * blocked, and callers must refuse redirects off loopback.
+ */
+export function isLoopbackHttpUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol))
+        return false;
+    return isLoopbackHost(parsed.hostname);
+}
 /**
  * Convenience wrapper — use in web_fetch, webhook delivery, media download.
  *

package/dist/security/text-deobfuscation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Text de-obfuscation for static security scanners.
+ *
+ * Prompt-injection / jailbreak content that is INJECTED into an LLM context
+ * (skills, imported guidance) is read by the model even when a human-invisible
+ * trick hides it from a raw regex: zero-width characters, soft hyphens,
+ * hyphenated word-wraps across lines, HTML comment/tag wrappers, homoglyphs,
+ * bidi/format controls, percent-encoding, and a single layer of Base64.
+ *
+ * NOTE: the strategy gate (`src/agent/self-improvement/strategy-gate.ts`) keeps
+ * its own equivalent `normalizeDirectiveText` — that module is reserved by the
+ * self-improvement lane, so this is an intentional independent copy in the
+ * security layer rather than a cross-lane import. Keep the two in sync.
+ */
+export declare const SCAN_WINDOW_SIZE: number;
+export declare const SCAN_WINDOW_OVERLAP: number;
+/**
+ * Slice text into overlapping scan windows so that large files cannot evade
+ * regex scanning by stuffing content past the first 256 KB.
+ * Overlap guarantees that patterns spanning window boundaries are not cut.
+ */
+export declare function sliceScanWindows(text: string, windowSize?: number, overlap?: number): string[];
+export declare function deobfuscateText(text: string): string;
+/**
+ * Safe layer of text de-obfuscation across windows:
+ * Strips format/bidi controls (\p{Cf}), applies homoglyph mappings,
+ * unicode normalizations (NFKC/NFKD + diacritic strip), zero-width characters,
+ * hyphenated line-wraps, and HTML comments/tags.
+ * Safe for all pattern capabilities without risk of false positives from
+ * decoding Base64 or URL-percent blobs.
+ */
+export declare function deobfuscateSafeForScanWindows(text: string): string[];
+export declare function deobfuscateSafeForScan(text: string): string;
+/**
+ * Scanner-facing de-obfuscation across windows: one bounded pass that also folds
+ * bidi/format controls, a single percent-decode, NFKC + diacritic strip, a homoglyph
+ * table, and a single layer of strict Base64 (≥16 chars). Used by `scanSkillFirewall`
+ * for prompt-injection capabilities.
+ */
+export declare function deobfuscateForScanWindows(text: string): string[];
+export declare function deobfuscateForScan(text: string): string;