@shomra/agent 0.3.27 → 0.3.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "Shomra - adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/src/detect/sast/rules-javascript.mjs

@@ -15,13 +15,26 @@ export const JS_RULES = [
     remediation: 'Never eval strings. Parse structured input explicitly (JSON.parse) and dispatch on a fixed allowlist of handlers.',
     cwe: 'CWE-94',
   },
+  {
+    id: 'js.command_exec_import',
+    title: 'child_process imported (process-spawn capability)',
+    severity: 'LOW',
+    category: 'code-exec',
+    confidence: 0.5,
+    re: /require\(\s*['"](node:)?child_process['"]\s*\)|\bfrom\s+['"](node:)?child_process['"]|\bimport\(\s*['"](node:)?child_process['"]\s*\)/,
+    sink: (m) => m[0].trim(),
+    source: 'tool input / model output',
+    message: 'Imports child_process, so this file is able to spawn a shell or process. On its own that is a capability, not a finding - but an agent tool or MCP server that does not need to run commands should not be able to.',
+    remediation: 'If this tool has no reason to spawn processes, drop the import. If it does, confirm every invocation uses execFile with a fixed binary and an argument array - never a shell string built from input.',
+    cwe: 'CWE-78',
+  },
   {
     id: 'js.command_exec',
     title: 'Shell / process execution',
     severity: 'CRITICAL',
     category: 'code-exec',
     confidence: 0.8,
-    re: /\bchild_process\b|require\(\s*['"]child_process['"]\s*\)|\bfrom\s+['"]child_process['"]|\b(execSync|execFileSync|spawnSync|execFile)\s*\(/,
+    re: /(?<!\bfunction\s)\b(execSync|execFileSync|spawnSync|execFile)\s*\(/,
     sink: (m) => m[0].trim(),
     source: 'tool input / model output',
     message: 'Spawns a shell or child process. If any argument derives from tool input or model output this is command injection / RCE in the agent host.',
@@ -104,6 +117,6 @@ export const JS_RULES = [
 export const JS_TAINT = {
   lang: 'js',
   ruleId: 'js.llm_output_to_sink',
-  aiCall: /\.(generate|invoke|run|complete|stream|predict|call)\s*\(|\.chat\.completions\.create\s*\(|\.messages\.create\s*\(|\.create(Chat)?Completion\s*\(/,
-  execSink: /(?<![.\w])eval\s*\(|\bnew\s+Function\s*\(|\b(execSync|execFileSync|spawnSync|execFile|exec|spawn)\s*\(|\bvm\.\w+\s*\(/g,
+  aiCall: /\.(generate|invoke|complete|stream|predict)\s*\(|\b\w{0,64}(?:[Cc]hain|[Ll]lm|LLM|[Mm]odel|[Aa]gent|[Ee]xecutor)\w{0,64}\.(call|run|invoke)\s*\(|\.chat\.completions\.create\s*\(|\.messages\.create\s*\(|\.create(Chat)?Completion\s*\(/,
+  execSink: /(?<![.\w])eval\s*\(|\bnew\s+Function\s*\(|\b(execSync|execFileSync|spawnSync|execFile)\s*\(|(?<![.\w])(exec|spawn)\s*\(|\b(child_process|childProcess|cp|proc)\.(exec|spawn)\s*\(|\bvm\.\w+\s*\(/g,
 };

package/src/detect/sast/rules-python.mjs

@@ -3,9 +3,10 @@ export const PY_RULES = [
     id: 'python.dangerous_sinks',
     title: 'Dangerous code-execution sink',
     severity: 'CRITICAL',
+    codeOnly: true,
     category: 'code-exec',
     confidence: 0.85,
-    re: /(?<![.\w])(eval|exec|compile)\s*\(|\bos\.(system|popen|exec[lv]?[pe]*)\s*\(|\bsubprocess\.(run|call|check_output|check_call|Popen)\s*\(|(?<![.\w])__import__\s*\(|(?<![.\w])getattr\s*\(\s*__builtins__/,
+    re: /(?<![.\w])(?<!def )(eval|exec|compile)\s*\(|\bos\.(system|popen|exec[lv]?[pe]*|spawn[lv]?[pe]*)\s*\(|\bposix\.system\s*\(|\bsubprocess\.\w+\s*\([^\n]{0,300}shell\s*=\s*True|(?<![.\w])getattr\s*\(\s*__builtins__/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'model load / forward()',
     message: 'Model code invokes an arbitrary code-execution primitive. Under trust_remote_code this runs in the host process the moment the model is imported.',
@@ -19,7 +20,7 @@ export const PY_RULES = [
     category: 'deserialization',
     confidence: 0.9,
 
-    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\bmarshal\.loads?\s*\(|\btorch\.(load|jit\.load)\s*\(|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*yaml\.(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
+    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\bmarshal\.loads?\s*\(|\btorch\.(load|jit\.load)\s*\((?![^)]*(weights_only\s*=\s*True|use_safetensors\s*=\s*True))|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*(yaml\.)?\w*(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'weight / config file',
     message: 'Deserializes data with a pickle-backed loader. A crafted file runs arbitrary code via __reduce__ on load - the primary model-hub malware vector.',
@@ -125,10 +126,11 @@ export const PY_RULES = [
     id: 'python.langchain_code_exec',
     title: 'LLM-driven code-execution component',
     severity: 'HIGH',
+    codeOnly: true,
     category: 'agentic',
     confidence: 0.85,
 
-    re: /\b(PythonREPL|PythonREPLTool|PythonAstREPLTool|PALChain|CPALChain|LLMMathChain|create_pandas_dataframe_agent|create_spark_dataframe_agent|create_csv_agent|PandasQueryEngine|PandasInstructionParser|CodeInterpreterToolSpec|CodeAgent|LocalPythonExecutor|local_python_executor|PythonInterpreterTool)\b|\bload_tools\s*\([^)]*['"](python_repl|terminal|shell|bash)/,
+    re: /(?<!class )(?<!def )\b(PythonREPL|PythonREPLTool|PythonAstREPLTool|PALChain|CPALChain|LLMMathChain|create_pandas_dataframe_agent|create_spark_dataframe_agent|create_csv_agent|PandasQueryEngine|PandasInstructionParser|CodeInterpreterToolSpec|CodeAgent|LocalPythonExecutor|local_python_executor|PythonInterpreterTool)\s*\(|\bload_tools\s*\([^)]*['"](python_repl|terminal|shell|bash)/,
     sink: (m) => m[0].trim(),
     source: 'LLM output',
     message: 'Uses an agent-framework component that executes LLM-generated code (exec/eval on model output). If the model can be steered (prompt injection), this is remote code execution in the agent host (CVE-2023-29374 / CVE-2024-4181 class).',
@@ -195,7 +197,7 @@ export const PY_RULES = [
   {
     id: 'python.reduce_payload',
     title: 'Custom __reduce__ (pickle RCE gadget)',
-    severity: 'CRITICAL',
+    severity: 'LOW',
     category: 'deserialization',
     confidence: 0.8,
     re: /def\s+__reduce__\s*\(|def\s+__reduce_ex__\s*\(|def\s+__setstate__\s*\(/,
@@ -224,7 +226,7 @@ export const PY_RULES = [
     severity: 'HIGH',
     category: 'obfuscation',
     confidence: 0.7,
-    re: /\bimportlib\.import_module\s*\(|\b__import__\s*\(\s*['"]?\s*(os|subprocess|socket|base64|marshal|ctypes)|\bexec\s*\(\s*(base64|bytes|marshal|codecs)/,
+    re: /\bimportlib\.import_module\s*\(\s*['"](os|subprocess|socket|base64|marshal|ctypes|pty|commands|pickle)\b|\b__import__\s*\(\s*['"]?\s*(os|subprocess|socket|base64|marshal|ctypes)|\bexec\s*\(\s*(base64|bytes|marshal|codecs)/,
     sink: (m) => m[0].trim(),
     message: 'Imports or executes a module chosen at runtime, often to hide os/subprocess/socket usage from a quick read.',
     remediation: 'Resolve what is imported and why. Obfuscated dynamic imports in model code are a strong malware tell.',
@@ -287,6 +289,6 @@ export const PY_RULES = [
 export const PY_TAINT = {
   lang: 'python',
   ruleId: 'python.llm_output_to_sink',
-  aiCall: /\.(a?generate|a?predict|a?invoke|a?run|complete|acomplete|chat|stream|__call__|predict_messages)\s*\(|\.(chat\.)?completions\.create\s*\(|\.messages\.create\s*\(|\bllm\s*\(/,
+  aiCall: /\.(chat\.)?completions\.create\s*\(|\.messages\.create\s*\(|\b\w{0,64}(?:llm|chain|model|agent|executor|client|openai|anthropic|bedrock|gemini|claude|gpt|ollama|mistral|cohere)\w{0,64}\.(a?generate|a?predict|a?invoke|a?run|complete|acomplete|chat|stream|__call__|predict_messages)\s*\(|\bllm\s*\(/i,
   execSink: /(?<![.\w])(eval|exec|compile)\s*\(|\bos\.(system|popen)\s*\(|\bsubprocess\.(run|call|check_output|check_call|Popen)\s*\(/g,
 };

package/src/detect/signals/artifacts.mjs

@@ -101,7 +101,7 @@ export function localAgentCard(content) {
 export function localCommandExtras(content) {
   const out = [];
   const body = content || '';
-  const bang = [...body.matchAll(/^!\s*`?([^`\n]+)`?/gm)];
+  const bang = [...body.matchAll(/^!\s*`?([A-Za-z_./~$][^`\n]*)`?/gm)].filter((m) => !/^(?:function|class|void|\(|\[)/.test(m[1]));
   if (bang.length) {
     const line = bang[0].index != null ? lineAt(body, bang[0].index) : undefined;
     out.push({ severity: 'LOW', title: `Command runs ${bang.length} shell command(s) before the prompt`, remediationText: 'Confirm each "!" command is fixed and safe; avoid interpolating untrusted arguments.', ...(line ? { line } : {}) });

package/src/detect/signals/autonomy.mjs

@@ -7,7 +7,7 @@ const AUTONOMY_RULES = [
   { family: 'concealment', label: 'Own actions hidden from the user', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:mention|tell|inform|notify|report to|disclose to|reveal to|show)\s+(?:the\s+)?(?:user|human|operator|them|anyone)\b|\bwithout (?:telling|informing|notifying|alerting)\s+(?:the\s+)?(?:user|human|operator|anyone)\b/i },
   { family: 'concealment', label: 'Work not reported back', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:summari[sz]e|report|log|record|list|describe|explain)[^.\n]{0,40}\b(?:what you (?:did|changed|ran|edited|deleted|installed)|the (?:changes|commands|actions|edits) you|your (?:changes|actions|edits|commands))\b/i },
   { family: 'concealment', label: 'Instructions kept secret', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:mention|reveal|disclose|quote|repeat|share|output)[^.\n]{0,30}\b(?:these|this|your|the)\s+(?:instructions?|rules?|prompt|guidelines?|file)\b|\bkeep (?:this|these|it) (?:secret|hidden|confidential|between us|to yourself)\b/i },
-  { family: 'guardrail', label: 'Safety control overridden', re: /\b(?:ignore|disable|bypass|override|turn off|switch off|work around|circumvent|disregard)(?:\s+\w+){0,3}\s+(?:the\s+|any\s+|all\s+)?(?:safety|guardrails?|guard|security (?:check|control|policy)|restrictions?|limitations?|policies|policy|safeguards?|protections?)\b/i },
+  { family: 'guardrail', label: 'Safety control overridden', re: /\b(?:ignore|disable|bypass|override|turn off|switch off|work around|circumvent|disregard)(?:\s+\w+){0,3}\s+(?:the\s+|any\s+|all\s+)?(?:safety|guardrails?|guard|security (?:check|control|policy)|policies|policy|safeguards?|protections?|(?:safety|security|content|moderation|usage|access|policy|system)[ -]?(?:restrictions?|limitations?))\b/i },
   { family: 'verification', label: 'Verification waived', re: /\b(?:do(?:es)? not|don'?t|never|no need to|skip)\s+(?:bother\s+)?(?:run(?:ning)?|execut\w+)?\s*(?:the\s+)?(?:tests?|test suite|linter|lint|type ?check|build|review|checks)\s*(?:before|first|prior to)\b|\b(?:skip|bypass)\s+(?:the\s+)?(?:review|code review|tests?|test suite|ci)\b/i },
 ];
 
@@ -22,6 +22,13 @@ function insideQuotedSpan(line, at) {
   return dq % 2 === 1 || tick % 2 === 1;
 }
 
+const LINE_COMMENT_RE = /(?<!:)\/\/|\/\*/;
+
+function inCodeComment(line, at) {
+  const m = LINE_COMMENT_RE.exec(line);
+  return m != null && m.index != null && at > m.index;
+}
+
 export function localAutonomy(text) {
   const body = String(text ?? '');
   if (!body.trim()) return [];
@@ -35,6 +42,7 @@ export function localAutonomy(text) {
       if (seen.has(rule.label)) continue;
       const m = rule.re.exec(line);
       if (!m) continue;
+      if (inCodeComment(line, m.index)) continue;
       if (isDocumentationLine(line)) continue;
       if (prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       if (insideQuotedSpan(line, m.index)) continue;

package/src/detect/signals/consequence.mjs

@@ -15,7 +15,9 @@
  * the server blocks work no server verdict would have blocked, and looser puts
  * a hole in the floor at exactly the moment the floor is all there is.
  */
-const SEVERE_VERB = /\b(delete|destroy|drop|purge|revoke|terminate|shutdown|wipe|erase|truncate|force[-_]?push|rm)\b/i;
+const SEVERE_VERB = /\b(delete|destroy|drop|purge|revoke|terminate|shutdown|wipe|erase|truncate|force[-_]?push)\b/i;
+
+const RM_COMMAND = /(?<![-\w])rm\b/i;
 
 const MATERIAL_VERB =
   /\b(transfer|pay|payment|refund|charge|invoice|wire|send|email|post|publish|deploy|release|merge|approve|grant|invite|share|upload|export)\b/i;
@@ -43,10 +45,10 @@ export function classifyConsequence(input) {
   const blob = raw.replace(/[_-]+/g, ' ').replace(/([a-z0-9])([A-Z])/g, '$1 $2');
 
   if (typeof input.amount === 'number' && input.amount > 0) {
-    return SEVERE_VERB.test(blob) ? 'severe' : 'material';
+    return SEVERE_VERB.test(blob) || RM_COMMAND.test(raw) ? 'severe' : 'material';
   }
   if (PERSISTENCE_TARGET.test(raw)) return 'severe';
-  if (SEVERE_VERB.test(blob) || FORCE_PUSH.test(raw)) return 'severe';
+  if (SEVERE_VERB.test(blob) || RM_COMMAND.test(raw) || FORCE_PUSH.test(raw)) return 'severe';
   if (AUTHORITY_GRANT.test(blob)) return PRIVILEGED_TARGET.test(blob) ? 'severe' : 'material';
   if (input.isShell) return 'material';
   if (MATERIAL_VERB.test(blob)) return 'material';

package/src/detect/signals/credential-harvest.mjs

@@ -12,7 +12,7 @@ const HARVEST_PROMPTS = [
 const HARVEST_STORES = [
   { re: /\bsecurity\s+(?:dump-keychain|find-(?:generic|internet)-password|export)\b/i, family: 'credential-store', label: 'macOS keychain read' },
   { re: /(?:~|\$HOME|\/Users\/[^/\s]+)\/Library\/Keychains\b/i, family: 'credential-store', label: 'macOS keychain files' },
-  { re: /\bLogin\s?Data\b|\bLocal\s?State\b(?=[\s\S]{0,80}(?:Chrome|Chromium|Edge|Brave))/i, family: 'credential-store', label: 'Chromium credential database' },
+  { re: /\bLogin[ \t]Data\b|(?:\bLogin\s?Data\b|\bLocal\s?State\b)(?=[\s\S]{0,80}(?:Chrome|Chromium|Edge|Brave))/i, family: 'credential-store', label: 'Chromium credential database' },
   { re: /\b(?:logins\.json|key[34]\.db|cert9\.db)\b/i, family: 'credential-store', label: 'Firefox credential database' },
   { re: /\bcookies\.sqlite\b|\bCookies\b(?=[\s\S]{0,80}(?:Chrome|Chromium|Edge|Brave|Safari))/i, family: 'credential-store', label: 'browser cookie store' },
   { re: /(?:~|\$HOME)\/\.(?:mozilla|config\/google-chrome|config\/chromium|config\/BraveSoftware)\b/i, family: 'credential-store', label: 'browser profile directory' },

package/src/detect/signals/execution-hijack.mjs

@@ -35,7 +35,7 @@ const GIT_EXEC_KEYS =
 
 const GIT_ALIAS_KEY = /\balias\.[\w-]+\b/i;
 
-const HIJACK_PLAIN_PROGRAM = /^[\w./-]{1,64}(?:\s+-{1,2}[\w-]{1,32}){0,4}$/;
+const HIJACK_PLAIN_PROGRAM = /^(?:[A-Za-z]:[\\/])?[\w.\\/-]{1,64}(?:\s+-{1,2}[\w-]{1,32}){0,4}$/;
 
 const HIJACK_SHELLY = /[;&|`$(){}<>]|\s-c\s|(?<![.\w])(?:sh|bash|zsh|dash|python\d?|node|perl|ruby|eval)\b/i;
 
@@ -49,6 +49,8 @@ const HIJACK_GIT_CONFIG =
 
 const hijackUnquote = (raw) => String(raw ?? '').replace(/^["']|["']$/g, '');
 
+const hijackConfigValue = (raw) => String(raw ?? '').trim().replace(/^["'`]{1,4}/, '').replace(/["'`.,;:!?)\]]{1,4}$/, '');
+
 function hijackForeignTarget(value) {
   if (HIJACK_SHELLY.test(value)) return true;
   for (const raw of String(value).split(/[\s,]+/)) {
@@ -111,7 +113,7 @@ export function detectExecutionHijack(command) {
     const m = HIJACK_GIT_CONFIG.exec(line);
     if (!m) continue;
     const key = m[1];
-    const value = hijackUnquote(m[2].trim());
+    const value = hijackConfigValue(m[2]);
     const isAlias = GIT_ALIAS_KEY.test(key) && /^\s*!/.test(value);
     if (!GIT_EXEC_KEYS.test(key) && !isAlias) continue;
     const shelly = HIJACK_SHELLY.test(value) || HIJACK_WORLD_WRITABLE.test(value) || isAlias;

package/src/detect/signals/gate.mjs

@@ -3,7 +3,7 @@ import { autonomySeverity, localAutonomy } from './autonomy.mjs';
 import { localMemory, offendingLine } from './memory.mjs';
 import { INSTALL_LURE } from './packages.mjs';
 import { localPropagation } from './propagation.mjs';
-import { localScan } from './scan.mjs';
+import { downrankCodeContext, localScan } from './scan.mjs';
 import { grade } from './severity.mjs';
 
 const INSTRUCTION_BASENAMES = new Set([
@@ -14,6 +14,10 @@ const INSTRUCTION_BASENAMES = new Set([
 
 const MEMORY_BASENAMES = new Set(['memory.md', 'mem0.json', 'letta_memory.json', 'memgpt_memory.json']);
 
+const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|rb|go|rs|java|kt|scala|php|cs|swift|c|cc|cpp|h|hpp)$/i;
+
+const isSourceFile = (p) => SOURCE_EXT_RE.test(String(p ?? '').split(/[\\/]+/).pop() ?? '');
+
 function governedKindFor(kind, path) {
   if (kind === 'rules') return 'INSTRUCTION';
   if (kind === 'memory') return 'MEMORY';
@@ -38,7 +42,8 @@ export function localGate(content, { kind, path } = {}) {
     for (const f of localScan(content || '', { categories: ['config'] }).findings) push(f.severity, f.label, undefined, f.line);
   } else {
     const scan = localScan(content || '', { categories: ['shell', 'injection', 'secret', 'config', 'egress', 'pii'] });
-    for (const f of scan.findings) {
+    const graded = isSourceFile(path) ? downrankCodeContext(scan.findings) : scan.findings;
+    for (const f of graded) {
 
       if ((kind === 'agent-card' || kind === 'mcp') && f.category === 'pii' && f.label.includes('IPv4')) continue;
       push(f.severity, f.label, undefined, f.line);

package/src/detect/signals/masking.mjs

@@ -12,6 +12,17 @@ const UNICODE_ESCAPE_RUN_RE = /(?:\\u\{?00[0-9A-Fa-f]{2}\}?){3,}/g;
 
 const DECIMAL_CHAR_RUN_RE = /(?:\b(?:3[2-9]|[4-9]\d|1[01]\d|12[0-6])\s*,\s*){6,}(?:3[2-9]|[4-9]\d|1[01]\d|12[0-6])\b/g;
 
+const COMMAND_SHAPE_RE = /[|;&><]|\$\(|\$\{|`|(?:^|\s)-{1,2}[A-Za-z]|\/[\w.]|https?:\/\/|\\x[0-9A-Fa-f]{2}/;
+
+const SOURCE_MAP_RE = /^\s*\{[\s\S]{0,400}?"version"\s*:\s*3[\s\S]{0,400}?"(?:mappings|sources|sourcesContent)"\s*:/;
+
+const INERT_DATA_URI_RE = /data:(?:application\/json|image\/[\w.+-]+|font\/[\w.+-]+|text\/css|audio\/[\w.+-]+|video\/[\w.+-]+)[^,]{0,64},$/i;
+
+function inertEncodedBlob(text, index, decoded) {
+  if (SOURCE_MAP_RE.test(decoded)) return true;
+  return INERT_DATA_URI_RE.test(text.slice(Math.max(0, index - 96), index));
+}
+
 const printableRatio = (s) => (s ? s.replace(/[^\x09\x0a\x0d\x20-\x7e]/g, '').length / s.length : 0);
 
 export function deobfuscate(text) {
@@ -21,6 +32,8 @@ export function deobfuscate(text) {
     let out = '';
     try { out = Buffer.from(m[0].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'); } catch { continue; }
     if (!out || printableRatio(out) < 0.85) continue;
+    if (inertEncodedBlob(text, m.index ?? 0, out)) continue;
+    if (!COMMAND_SHAPE_RE.test(out)) continue;
     if (DECODED_PAYLOAD_RE.test(out)) { decoded.push(out); payload = true; }
   }
   const literal = (run, decode) => {
@@ -69,7 +82,7 @@ export function codeMask(text) {
       if (c === "'") { state = 1; mask[i++] = 1; continue; }
       if (c === '"') { state = 2; mask[i++] = 1; continue; }
       if (c === '`') { state = 3; mask[i++] = 1; continue; }
-      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '/' && text[i - 1] !== ':') { state = 4; mask[i++] = 1; continue; }
       if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
       if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
       if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = MARK_CONCEALED; continue; }

package/src/detect/signals/memory.mjs

@@ -1,17 +1,21 @@
 import { CLAIM_LABEL, claimSeverity, detectDurableClaims } from './durable-claims.mjs';
 import { LOCAL_URL_RE, egressHost } from './egress.mjs';
 import { lineOf, lineTextAt } from './lines.mjs';
-import { citationGoverns, describesAt, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
+import { citationGoverns, describesAt, insideMarkdownLinkLabel, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
 import { localScan } from './scan.mjs';
 import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
 import { DANGEROUS_SHELL } from './shell.mjs';
-import { containsWord } from './text-match.mjs';
 
 const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
 
 const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|do not (tell|inform|mention|reveal|disclose) (the |any)?(user|anyone|them)|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
 
-const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es)\b[^.\n]{0,30}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety))\b/i;
+const PRECEDENCE_OBJECT = String.raw`\b[^.\n]{0,40}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety|memor(?:y|ies)|previous|prior|earlier|above)\b`;
+
+const PRECEDENCE_MARKERS = new RegExp(
+  String.raw`\b(regardless of (what|any|your|the)|(supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es))${PRECEDENCE_OBJECT})`,
+  'i',
+);
 
 const OVERRIDE_MARKERS = new RegExp(`${MALICIOUS_OVERRIDE.source}|${PRECEDENCE_MARKERS.source}`, 'i');
 
@@ -27,7 +31,7 @@ const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must n
 
 const SABOTAGE_RULES = [
 
-  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|(?<!-)controls?|restrictions?|(?<!-)policies|(?<!-)policy|filters?)\b/i, label: 'disable-safety', guarded: true },
   { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
   { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
 
@@ -42,9 +46,10 @@ export function offendingLine(sig, text) {
     if (m.index == null) continue;
     const line = lineTextAt(text, m.index);
     if (sig.refine && !sig.refine(line)) continue;
-    if (isDocumentationLine(line)) continue;
-    if (prohibitsAt(line, line.indexOf(m[0]))) continue;
-    if (describesAt(line, line.indexOf(m[0]))) continue;
+    const at = line.indexOf(m[0]);
+    if (isDocumentationLine(line, at < 0 ? undefined : at)) continue;
+    if (prohibitsAt(line, at)) continue;
+    if (describesAt(line, at)) continue;
     if (isRiskTableRow(line)) continue;
     return line;
   }
@@ -55,7 +60,7 @@ function firstDirectiveLine(text, re) {
   for (const line of text.split(/\r?\n/)) {
     if (!re.test(line)) continue;
     if (NEGATION_GUARD.test(line)) continue;
-    if (isDescriptiveLine(line)) continue;
+    if (isDescriptiveLine(stripSelfReference(line))) continue;
     if (citationGoverns(line, re.exec(line)?.index)) continue;
     return line;
   }
@@ -69,13 +74,30 @@ function lineMatchingAll(text, ...res) {
   return null;
 }
 
+const EXFIL_OBJECT_RE =
+  /(?:\b(?:env(?:ironment)?|secrets?|credentials?|tokens?|api[- ]?keys?|keys?|passwords?|cookies?|sessions?|data|files?|contents?|conversations?|history|context|output|transcript|prompt|clipboard|id_rsa|private[- ]?key|database|dump)|\.env(?:ironment)?|\.ssh)\b/i;
+
+function urlIsMarkdownTarget(line, matched) {
+  const um = /https?:\/\/\S+/.exec(matched);
+  if (!um) return false;
+  const at = line.indexOf(um[0]);
+  if (at < 1) return false;
+  return line[at - 1] === '(' && line.slice(0, at - 1).trimEnd().endsWith(']');
+}
+
+const SEND_AS_NOUN_RE =
+  /\b(?:a|an|the|this|that|your|our|each|any|bug|security|error|crash|incident|status|progress|test|coverage|issue)\s+(?:reports?|pushes?|transfers?|uploads?|deliver(?:y|ies))\b/i;
+
+const PASSIVE_SEND_RE =
+  /\b(?:are|is|was|were|been|being|get|gets|got)\s+(?:\w+\s+){0,2}?(?:published|posted|sent|shipped|forwarded|transferred|delivered|uploaded|transmitted|reported)\b/i;
+
 const EXFIL_RULES = [
   { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
-  { re: /\bleak\w*\b[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+  { re: /\bleak\w*\b(?!\s+(?:memory|memories|resources?|handles?|descriptors?|sockets?|connections?|goroutines?|threads?|references?|buffers?))[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
 
   { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
   { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
-  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)\w*\b[^.\n]{0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
+  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)(?:s|es|ed|ing|ted|ping)?\b(?:[^.\n]|\.(?!\s)){0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
 
   {
     re: /\b(?:read|open|cat|load|import|source|inspect|include|copy|dump|print|show)\b(?:[^.\n]|\.(?!\s)){0,50}(?:~?\/?\.ssh\/(?:id_[a-z0-9]+|config)(?!\.pub)|~?\/?\.aws\/credentials|~?\/?\.kube\/config|~?\/?\.gnupg|\bid_(?:rsa|ed25519|dsa)\b(?!\.pub)|~?\/?\.npmrc|~?\/?\.netrc|\/etc\/shadow|(?:^|[\s'"`(])\.env(?:\.[\w-]+)?\b)/i,
@@ -106,6 +128,12 @@ function scanDirectives(text) {
       if (r.descGuard && citationGoverns(line, m.index)) continue;
       if (r.descGuard && isRiskTableRow(line)) continue;
       if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
+      if (r.label === 'send-to-external' && m.index != null && insideMarkdownLinkLabel(line, m.index)) continue;
+      if (r.label === 'send-to-external' && m.index != null) {
+        const around = line.slice(Math.max(0, m.index - 24), m.index + 24);
+        if (SEND_AS_NOUN_RE.test(around) || PASSIVE_SEND_RE.test(around)) continue;
+        if (urlIsMarkdownTarget(line, m[0]) && !EXFIL_OBJECT_RE.test(m[0])) continue;
+      }
       const prev = exfil.get(r.label);
       if (!prev || (prev === 'HIGH' && r.severity === 'CRITICAL')) exfil.set(r.label, r.severity);
     }
@@ -119,6 +147,8 @@ const SELF_REFERENCE =
 const SELF_RECREATE =
   /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
 
+const stripSelfReference = (line) => String(line).replace(SELF_REFERENCE, ' ');
+
 const SELF_PROPAGATE =
   /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
 
@@ -244,12 +274,22 @@ function reportStagedPayload(text, { noun }, push) {
   }
 }
 
+function hasWordFrom(line, words) {
+  const low = line.toLowerCase();
+  return words.some((w) => {
+    const t = w.toLowerCase().trim();
+    if (!t) return false;
+    if (/^[a-z0-9]+$/.test(t)) return new RegExp(`\\b${t}\\b`).test(low);
+    return low.includes(t);
+  });
+}
+
 function reportToxicFlow(text, { noun }, push) {
   if (!IMPERATIVE.test(text)) return;
   const line = text.split(/\r?\n/).find((candidate) => IMPERATIVE.test(candidate)
     && !NEGATION_GUARD.test(candidate)
-    && containsWord(candidate, SENSITIVE_READ)
-    && containsWord(candidate, NETWORK_VERBS)
+    && hasWordFrom(candidate, SENSITIVE_READ)
+    && hasWordFrom(candidate, NETWORK_VERBS)
     && !isDescriptiveLine(candidate));
   if (!line) return;
   push(

package/src/detect/signals/packages.mjs

@@ -1,6 +1,6 @@
 export const INSTALL_LURE = [
-  { name: 'Instructs downloading an executable/archive to run', re: /\b(download|install|fetch|grab|extract)\b[^\n]{0,180}\.(zip|exe|dmg|pkg|msi|bin|appimage|jar|scr|apk|deb|rpm|tar\.gz|tgz)\b/i, severity: 'MEDIUM' },
-  { name: 'Password-protected archive (evades AV / scanners)', re: /\b(extract|unzip|decompress|archive|zip|password)\b[^\n]{0,50}\b(pass(word|phrase)?|pwd)\s*[:=]\s*\S/i, severity: 'HIGH' },
+  { name: 'Instructs downloading an executable/archive to run', re: /\b(download|install|fetch|grab|extract)\b[^\n]{0,180}(?<=[\w-])\.(zip|exe|dmg|pkg|msi|bin|appimage|jar|scr|apk|deb|rpm|tar\.gz|tgz)\b(?![\w/])/i, severity: 'MEDIUM' },
+  { name: 'Password-protected archive (evades AV / scanners)', re: /(?<![.\w$-])(?:unzip|7z|7za|unrar|rar|zip|tar|gpg|openssl|extract|decompress|archive)\b(?![.:=\w])[^\n]{0,50}(?:^|[\s;|&(])(?:-P\b|--password\b|pass(?:word|phrase)?|pwd)\s*[:= ]\s*\S/i, severity: 'HIGH' },
   { name: 'Coercion: claims a helper is required before the task works', re: /\b(required to (function|work|deploy|run)|will not (work|function|run)( correctly| properly)?( without)?|does not work without|otherwise it is impossible|cannot [a-z ]{0,24} without (installing|running)|must (be )?(install(ed)?|run) (this |the )?)/i, severity: 'MEDIUM' },
   { name: 'Coercion: re-run / retry until it succeeds', re: /\b(re-?run (if needed|until|the command)|run (it |the command )?again|try again after)/i, severity: 'LOW' },
 ];

package/src/detect/signals/prose-context.mjs

@@ -4,8 +4,11 @@ import { IMPERATIVE } from './memory.mjs';
 const DESCRIPTIVE_MARKERS =
   /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?|treat(s|ed|ing)?|counts?|reads?)\w*/i;
 
+const URL_TOKEN_RE = /\b(?:https?|ftp|file|data):\/*[^\s<>"')\]]+/gi;
+
 export function isDescriptiveLine(line) {
-  return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
+  const prose = line.replace(URL_TOKEN_RE, ' ');
+  return DESCRIPTIVE_MARKERS.test(prose) && !IMPERATIVE.test(line);
 }
 
 const RESEARCH_CITATION_RE =
@@ -36,7 +39,26 @@ export function citationGoverns(segment, offset) {
 
 const ELLIPSIS_RE = /…|\.\.\./;
 
-const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\.\*|\.\+/;
+const ENUMERATION_RE = /[([][^)\]]*,[^)\]]*,[^)\]]*[)\]]|:\s*(?:[\w.-]+(?:\s+-\w+)?,\s*){2,}/;
+
+const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\[\^?[a-z0-9]-[a-z0-9]\]|\.\*|\.\+/;
+
+const MOOD_WINDOW = 140;
+
+function windowAround(line, offset) {
+  if (offset == null || line.length <= MOOD_WINDOW * 2) return line;
+  return line.slice(Math.max(0, offset - MOOD_WINDOW), offset + MOOD_WINDOW);
+}
+
+export function insideMarkdownLinkLabel(line, index) {
+  if (index < 0 || index >= line.length) return false;
+  const open = line.lastIndexOf('[', index);
+  if (open === -1) return false;
+  const close = line.indexOf(']', index);
+  if (close === -1) return false;
+  if (line.slice(open + 1, index).includes(']')) return false;
+  return line[close + 1] === '(';
+}
 
 const CREDENTIAL_PATH_RE =
   /~\/\.(ssh|aws|kube|gnupg|docker|npmrc?)\b|\bid_(rsa|ed25519|dsa)\b|\.pem\b|\bcredentials\b\s*(file)?|\bAWS_SECRET|\bANTHROPIC_API_KEY\b|\bOPENAI_API_KEY\b/i;
@@ -48,15 +70,20 @@ function carriesHardEvidence(line) {
   return CREDENTIAL_PATH_RE.test(line) || EXECUTABLE_FETCH_RE.test(line) || !!egressHost(line);
 }
 
-export function isDocumentationLine(line) {
+export function isDocumentationLine(line, offset) {
   if (!line) return false;
   if (carriesHardEvidence(line)) return false;
-  if (ELLIPSIS_RE.test(line) || REGEX_PATTERN_RE.test(line)) return true;
-  return isDescriptiveLine(line);
+
+  const win = windowAround(line, offset);
+  if (REGEX_PATTERN_RE.test(win)) return true;
+  if (ELLIPSIS_RE.test(win)) return true;
+  if (offset != null && insideCodeSpan(line, offset) && isDescriptiveLine(win)) return true;
+  if (ENUMERATION_RE.test(win) && !IMPERATIVE.test(win)) return true;
+  return isDescriptiveLine(win);
 }
 
 const PROHIBITION_MARKER_RE =
-  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of)\b[^.:;\n]{0,60}$/i;
+  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of|do NOT)\b[^.:;\n]{0,60}$/i;
 
 const DOUBLE_NEGATIVE_RE = /\b(?:hesitate|worry|be afraid|forget|fail|neglect|shy away)\b/i;
 

package/src/detect/signals/secrets.mjs

@@ -17,10 +17,10 @@ export const SECRET_PATTERNS = [
 
   {
     name: 'Database URL with password',
-    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)[^\s:@/]+:[^\s:@/]{4,}@/i,
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)(?!([^\s:@/]+):\1@)(?!(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*:(?:some|my|your|our|the|test|demo|example|dummy|fake|sample|foo|bar|placeholder)[\w-]*@)[^\s:@/]+:[^\s:@/]{4,}@/i,
   },
   { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
-  { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+  { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]{0,80}?[\r\n]+\s*[A-Za-z0-9+/=]{32,}/ },
 
   { name: 'Groq API key', re: /\bgsk_[A-Za-z0-9]{40,}/ },
   { name: 'Replicate API token', re: /\br8_[A-Za-z0-9]{30,}/ },

package/src/detect/signals/shell.mjs

@@ -1,17 +1,53 @@
 import { lineTextAt } from './lines.mjs';
 
 const EPHEMERAL_RM_TARGET_RE =
-  /^(\.\/)?(node_modules|dist|build|out|coverage|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+  /^(\.\/)?(node_modules|dist|build|out|coverage|\.nyc_output|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+
+const BENIGN_ABSOLUTE_RM_RE =
+  /^\/(var\/(lib\/apt\/lists|cache|tmp|log)|tmp|usr\/share\/(doc|man|locale|info)|root\/\.cache|home\/[\w.-]+\/\.cache|opt\/[\w.-]+\/\.cache)(\/|$|\*)/i;
+
+const CATASTROPHIC_RM_TARGET_RE = /^(\/|~|\$|\$\{|%\w+%|[A-Za-z]:[\\/]|\.\.?$|\.\.\/|\*$)/;
+
+const LOOPBACK_OR_PRIVATE_HOST_RE =
+  /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|0\.0\.0\.0|\[::1\]|::1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})$/i;
+
+const CLOUD_METADATA_HOSTS = new Set(['169.254.169.254', 'metadata.google.internal']);
+
+export function targetsExternalNetwork(line) {
+  const urls = line.match(/https?:\/\/[^\s'"`;|)&]+/gi);
+  if (!urls?.length) return true;
+  return urls.some((raw) => {
+    let host;
+    try {
+      host = new URL(raw).hostname.toLowerCase();
+    } catch {
+      return true;
+    }
+    if (CLOUD_METADATA_HOSTS.has(host)) return true;
+    return !LOOPBACK_OR_PRIVATE_HOST_RE.test(host);
+  });
+}
+
+const RM_RF_RE = /\brm\b(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*f|--force))/i;
+
+export function rmTargetClass(line) {
+  if (/\brm\s+-{1,2}[a-zA-Z][\w-]*\s*["'`,)\]}?!](?![\w./~$*-])/.test(line)) return 'local';
+  const m = /\brm\s+((?:--?[a-zA-Z][\w-]*\s+)+)(.*)$/.exec(line);
+  if (!m) return 'catastrophic';
 
-function rmTargetsRealData(line) {
-  const m = /\brm\s+((?:-[a-zA-Z]+\s+)+)(.*)$/.exec(line);
-  if (!m) return true;
   const targets = m[2]
     .split(/&&|\|\||[;|>&]/)[0]
     .split(/\s+/)
-    .filter((t) => t && !t.startsWith('-'));
-  if (!targets.length) return true;
-  return !targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t.replace(/^["']|["']$/g, '')));
+    .filter((t) => t && t !== '--' && !t.startsWith('-'))
+    .map((t) => t.replace(/^["']|["']$/g, ''));
+
+  if (!targets.length) {
+    const after = m[2] ?? '';
+    return /^\s*(?:[,)\]}?!"'`.]|$)/.test(after) ? 'local' : 'catastrophic';
+  }
+
+  if (targets.some((t) => CATASTROPHIC_RM_TARGET_RE.test(t) && !BENIGN_ABSOLUTE_RM_RE.test(t))) return 'catastrophic';
+  return targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t) || BENIGN_ABSOLUTE_RM_RE.test(t)) ? 'ephemeral' : 'local';
 }
 
 export function matchesShellSignal(sig, text) {
@@ -32,25 +68,30 @@ export const DANGEROUS_SHELL = [
   { name: 'Invoke-Expression of downloaded content', re: /\b(iex|invoke-expression)\b[^\n]{0,120}(downloadstring|net\.webclient|\(\s*(iwr|irm|invoke-)|\$\()/i, severity: 'CRITICAL' },
   { name: 'Reverse shell via /dev/tcp', re: /\/dev\/(tcp|udp)\//i, severity: 'CRITICAL' },
   { name: 'Base64 blob piped to a shell', re: /base64\s+(--?d(ecode)?)?\b[^\n|]{0,200}\|\s*(ba|z)?sh\b/i, severity: 'CRITICAL' },
-  { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method\s+Post)/i, severity: 'HIGH' },
-  { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },
-  { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
-  { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
+  { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method\s+Post)/i, severity: 'HIGH', refine: targetsExternalNetwork },
+  {
+    name: 'Command output piped into a network call',
+    re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|<\(|`[^`\n]*(?:\b(?:cat|ls|whoami|id|env|printenv|uname|hostname|pwd|base64|echo|head|tail|find|grep|awk|sed|curl|wget|nc|python\d?|node|perl|ruby|php|git|aws|kubectl|openssl)\b|\/(?:etc|var|tmp|home|root|usr|proc)\/|\$\w|\s-{1,2}\w)[^`\n]*`)/i,
+    severity: 'HIGH',
+  },
+  { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH', refine: targetsExternalNetwork },
+  { name: 'Writes to shell profile / SSH keys / crontab', re: /(>>?\s*(?:~\/|\$HOME\/|\/etc\/)?\.(bashrc|zshrc|bash_profile|profile)\b|>>?\s*\/etc\/profile\b|(tee|echo|cat|printf)\b[^\n]{0,80}(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys)|>>?\s*[^\n]{0,40}authorized_keys|crontab\s+(-|[^\n]{0,40}<)|id_rsa\b[^\n]{0,20}(>|cp|scp|curl|cat))/i, severity: 'HIGH' },
 
   {
     name: 'World-writable permissions on the filesystem root (chmod -R 777 /)',
-    re: /\bchmod\b(?=[^\n;|&]*(?:-[a-zA-Z]*R|--recursive))(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*\s\/(?:\s|\*|$))/i,
+    re: /\bchmod\b(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*R|--recursive))(?=[^\n;|&]{0,200}(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]{0,200}\s\/(?:\s|\*|$))/i,
     severity: 'CRITICAL',
   },
   {
     name: 'World-writable permissions on a credential or system path (chmod 777)',
-    re: /\bchmod\b(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*(?:~(?:\s|$|\/\.)|\$HOME\b|\/etc\b|\/root\b|\/usr\b|\/var\b|\/boot\b|\.ssh\b|id_rsa\b|authorized_keys\b|\.aws\b|\.gnupg\b|\.kube\b))/i,
+    re: /\bchmod\b(?=[^\n;|&]{0,200}(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]{0,200}(?:~(?:\s|$|\/\.)|\$HOME\b|\/etc\b|\/root\b|\/usr\b|\/var\b|\/boot\b|\.ssh\b|id_rsa\b|authorized_keys\b|\.aws\b|\.gnupg\b|\.kube\b))/i,
     severity: 'HIGH',
   },
-  { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
+  { name: 'Recursive force delete of a protected path (rm -rf)', re: RM_RF_RE, severity: 'HIGH', refine: (l) => rmTargetClass(l) === 'catastrophic' },
+  { name: 'Recursive force delete (rm -rf)', re: RM_RF_RE, severity: 'MEDIUM', refine: (l) => rmTargetClass(l) === 'local' },
 
-  { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
-  { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
+  { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'\/])(eval|exec)\s*(?!\((?:[^()\n]{0,160}\)\s*\{|\s*_?[A-Za-z$][\w$]{0,64}\s*\??\s*:))[("`']/i, severity: 'HIGH' },
+  { name: 'Pipes an env dump to the network', re: /(?<![.\w$-])(env|printenv|set)\b(?![.:=\w])(?!\s*[:=])[^\n|]{0,80}(?<!\|)\|(?!\|)[^\n]{0,80}(curl\b|wget\b|nc\b|https?\b)/i, severity: 'HIGH' },
   { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },
   { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
   { name: 'node -e one-liner', re: /\bnode\s+-e\b/i, severity: 'MEDIUM' },
@@ -65,7 +106,7 @@ export const DANGEROUS_SHELL = [
   { name: 'Force-deletes a cloud storage bucket (aws s3 rb --force)', re: /\b(aws\s+s3\s+rb|gsutil\s+(rm\s+-r|rb)|az\s+storage\s+(account|container)\s+delete)\b[^\n]{0,80}(--force|--yes|-f\b|\bs3:\/\/|\bgs:\/\/)/i, severity: 'HIGH' },
   { name: 'Force-pushes over a protected branch (rewrites shared history)', re: /\bgit\s+push\b[^\n]{0,80}(--force\b(?!-with-lease)|(?:^|\s)-f\b)[^\n]{0,60}\b(main|master|release|prod(uction)?)\b/i, severity: 'MEDIUM' },
 
-  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /\brm\b(?=[^\n;|&]*(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]*(?:-[a-zA-Z]*f|--force))(?=[^\n;|&]*(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
+  { name: 'Recursive force delete of the filesystem root (rm -rf /, --no-preserve-root)', re: /\brm\b(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]{0,200}(?:-[a-zA-Z]*f|--force))(?=[^\n;|&]{0,200}(?:--no-preserve-root|\s\/(?:\s|\*|$)))/i, severity: 'CRITICAL' },
   { name: 'Fork bomb (process-exhaustion DoS)', re: /(:|\b[a-z_][a-z0-9_]*)\s*\(\s*\)\s*\{\s*\1\s*[^\n}]*\|\s*\1[^\n}]*&\s*\}\s*;\s*\1/i, severity: 'HIGH' },
   { name: 'Writes over a raw disk device (data destruction)', re: /\b(dd\b[^\n]{0,80}\bof=\/dev\/[sh]d|mkfs(\.\w+)?\s+[^\n]{0,40}\/dev\/|>\s*\/dev\/[sh]d[a-z])/i, severity: 'CRITICAL' },
   { name: 'Reads the system password-hash / sudo policy file', re: /\b(cat|less|more|head|tail|strings|xxd|od|grep|awk|sed|cp|scp|tar)\b[^\n]{0,80}\/etc\/(shadow|gshadow|sudoers(\.d)?)\b/i, severity: 'HIGH' },
@@ -85,7 +126,7 @@ export const DANGEROUS_SHELL = [
   { name: 'Preloads a shared library into every process (LD_PRELOAD)', re: /\b(?:LD_PRELOAD|LD_AUDIT|DYLD_INSERT_LIBRARIES)\s*=\s*\S|>>?\s*\/etc\/ld\.so\.preload\b/i, severity: 'HIGH' },
   { name: 'Installs a scheduled or boot-time persistence unit', re: /\bsystemd-run\b[^\n]{0,80}--on-(?:boot|calendar|active|unit)|>>?\s*\/etc\/(?:systemd\/system|cron\.(?:d|daily|hourly)|init\.d)\/\S|\bschtasks\b[^\n]{0,80}\/create\b|\blaunchctl\s+(?:load|bootstrap)\b|\b(?:echo|printf)\b[^\n]{0,120}\|\s*at\s+(?:now|\+|\d)/i, severity: 'MEDIUM' },
   { name: 'Opens a reverse tunnel to a remote host', re: /\bssh\b[^\n]{0,80}\s-\w*R\s*\d{1,5}:[^\n\s]{1,60}|\b(?:ngrok|cloudflared|localtunnel|frpc)\b[^\n]{0,60}\b(?:tcp|http|tunnel)\b/i, severity: 'HIGH' },
-  { name: 'Encodes command output into DNS lookups (exfiltration channel)', re: /(?:^|[\n;&|(]\s*)(?:dig|nslookup|drill|host)\s+[^\n]{0,120}(?:\$\(|`|\$\{)[^\n]{0,80}\.[a-z]{2,}/i, severity: 'HIGH' },
+  { name: 'Encodes command output into DNS lookups (exfiltration channel)', re: /(?:^|[\n;&|(]\s*)(?:dig|nslookup|drill|host)\s+(?![-+*/%|&^]?=)[^\n]{0,120}(?:\$\(|`|\$\{)[^\n]{0,80}\.[a-z]{2,}|\b(?:base64|base32|xxd|hexdump|od\s|openssl\s+enc)\b[^\n]{0,140}\b(?:dig|nslookup|drill|host)\s+[^\n]{0,60}\$\w+\.[\w.-]{2,}\.[a-z]{2,}/i, severity: 'HIGH' },
   { name: 'Copies credentials or home directories off the machine over ssh', re: new RegExp(String.raw`\b(?:scp|rsync)\b(?=[^\n]{0,200}\s\S{0,40}@[\w.-]+:)(?=[^\n]{0,200}(?:${SENSITIVE_PATH}))` + String.raw`|\btar\b(?=[^\n]{0,160}\|\s*ssh\b)(?=[^\n]{0,160}(?:${SENSITIVE_PATH}))`, 'i'), severity: 'HIGH' },
   { name: 'Flushes the host firewall', re: /\b(?:iptables|ip6tables|nft)\b[^\n]{0,60}(?:-F\b|--flush\b|flush ruleset)|\bufw\s+disable\b|\bnetsh\s+advfirewall\s+set\s+\S+\s+state\s+off\b/i, severity: 'MEDIUM' },
   { name: 'Kills the audit / EDR agent (anti-forensics)', re: /\b(?:pkill|killall|kill)\b[^\n]{0,40}\b(?:auditd|osqueryd?|falcon-sensor|falconctl|wazuh|ossec|filebeat|splunkd|sysmon|crowdstrike|carbonblack|cbagent)\b|\bSet-MpPreference\b[^\n]{0,60}-Disable\w*\s+\$?true/i, severity: 'HIGH' },