@skillsmith/cli 0.8.9 → 0.8.10

package/dist/cli.js

@@ -21005,6 +21005,60 @@ function safePatternMatch(value, pattern) {
   }
 }
 
+// ../core/dist/src/security/scanner/patterns.sensitive-path.js
+var ENV_PATH_PATTERN = /\.env(?![A-Za-z])(?!\.(?:example|sample|template|schema|dist))/i;
+var API_KEY_KEYWORD = /api[_-]?key/i;
+var AUTH_TOKEN_KEYWORD = /auth[_-]?token/i;
+var CREDENTIALS_FILE_PATTERN = /credentials\.(?:json|ya?ml|env|toml|txt)/i;
+var CREDENTIALS_ASSIGN_PATTERN = /credentials\s*[:=]/i;
+var SECRETS_ASSIGN_PATTERN = /\bsecrets?\s*[:=]/i;
+var SECRETS_PATH_PATTERN = /\bsecrets?\/[a-z0-9_.-]+/i;
+var PEM_PATTERN = /\.pem$/i;
+var KEY_FILE_PATTERN = /\.key$/i;
+var CRT_PATTERN = /\.crt$/i;
+var PASSWORD_ASSIGN_PATTERN = /password\s*[:=]/i;
+var SSH_DIR_PATTERN = /~\/\.ssh/i;
+var AWS_DIR_PATTERN = /~\/\.aws/i;
+var CONFIG_DIR_PATTERN = /~\/\.config/i;
+var ETC_SYSTEM_FILE_PATTERN = /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i;
+var SENSITIVE_PATH_PATTERNS = [
+  ENV_PATH_PATTERN,
+  CREDENTIALS_FILE_PATTERN,
+  CREDENTIALS_ASSIGN_PATTERN,
+  SECRETS_ASSIGN_PATTERN,
+  SECRETS_PATH_PATTERN,
+  PEM_PATTERN,
+  KEY_FILE_PATTERN,
+  CRT_PATTERN,
+  PASSWORD_ASSIGN_PATTERN,
+  API_KEY_KEYWORD,
+  AUTH_TOKEN_KEYWORD,
+  SSH_DIR_PATTERN,
+  AWS_DIR_PATTERN,
+  CONFIG_DIR_PATTERN,
+  ETC_SYSTEM_FILE_PATTERN
+];
+var VALUE_GATED_KEYWORD_PATTERNS = /* @__PURE__ */ new Set([
+  API_KEY_KEYWORD,
+  AUTH_TOKEN_KEYWORD
+]);
+var PATH_FORM_PATTERNS = /* @__PURE__ */ new Set([
+  CREDENTIALS_FILE_PATTERN,
+  SECRETS_PATH_PATTERN,
+  PEM_PATTERN,
+  KEY_FILE_PATTERN,
+  CRT_PATTERN,
+  SSH_DIR_PATTERN,
+  AWS_DIR_PATTERN,
+  CONFIG_DIR_PATTERN,
+  ETC_SYSTEM_FILE_PATTERN
+]);
+var VALUE_GATED_ASSIGNMENT_PATTERNS = /* @__PURE__ */ new Set([
+  CREDENTIALS_ASSIGN_PATTERN,
+  SECRETS_ASSIGN_PATTERN,
+  PASSWORD_ASSIGN_PATTERN
+]);
+
 // ../core/dist/src/security/scanner/patterns.jailbreak.js
 var JB_IGNORE_PREVIOUS = /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?|rules?)/i;
 var JB_DISREGARD_PREVIOUS = /disregard\s+(all\s+)?(previous|prior|your)\s+(instructions?|programming)/i;
@@ -21290,37 +21344,7 @@ var ANON_PASTE_HOSTS = [
 ];
 var TRANSIENT_TRANSFER_HOSTS = ["transfer.sh", "file.io", "tmpfiles.org", "temp.sh"];
 var URL_SHORTENER_DOMAINS = ["bit.ly", "tinyurl.com", "t.co", "is.gd"];
-var ENV_PATH_PATTERN = /\.env(?![A-Za-z])(?!\.(?:example|sample|template|schema|dist))/i;
-var API_KEY_KEYWORD = /api[_-]?key/i;
-var AUTH_TOKEN_KEYWORD = /auth[_-]?token/i;
-var SENSITIVE_PATH_PATTERNS = [
-  ENV_PATH_PATTERN,
-  // Contextual credentials: filename or assignment, not bare prose
-  /credentials\.(?:json|ya?ml|env|toml|txt)/i,
-  /credentials\s*[:=]/i,
-  // Contextual secrets: assignment or path, not bare word
-  /\bsecrets?\s*[:=]/i,
-  /\bsecrets?\/[a-z0-9_.-]+/i,
-  /\.pem$/i,
-  /\.key$/i,
-  /\.crt$/i,
-  // Contextual password: assignment or URL (postgres://user:pass@host) only
-  /password\s*[:=]/i,
-  API_KEY_KEYWORD,
-  AUTH_TOKEN_KEYWORD,
-  /~\/\.ssh/i,
-  /~\/\.aws/i,
-  /~\/\.config/i,
-  // SMI-4396 Wave 2: explicit system-file paths. Added so that tightening
-  // bare /credentials/i and /password/i into assignment-context variants
-  // doesn't drop coverage of obvious sensitive references like /etc/passwd.
-  /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i
-];
-var VALUE_GATED_KEYWORD_PATTERNS = /* @__PURE__ */ new Set([
-  API_KEY_KEYWORD,
-  AUTH_TOKEN_KEYWORD
-]);
-var SCANNER_RULESET_VERSION = "2026-08-15.1";
+var SCANNER_RULESET_VERSION = "2026-09-07.1";
 var SUSPICIOUS_PATTERNS = [
   /eval\s*\(/i,
   /exec\s*\(/i,
@@ -21647,7 +21671,7 @@ var CATEGORY_WEIGHTS = {
 
 // ../core/dist/src/security/scanner/regex-utils.js
 var MAX_LINE_LENGTH_FOR_REGEX = 1e4;
-var MAX_CONTENT_LENGTH_FOR_REGEX = MAX_LINE_LENGTH_FOR_REGEX;
+var MAX_CONTENT_LENGTH_FOR_REGEX = 1e6;
 function safeRegexTest(pattern, input7, maxLength = MAX_LINE_LENGTH_FOR_REGEX) {
   const safeInput = input7.length > maxLength ? input7.slice(0, maxLength) : input7;
   return safeInput.match(pattern);
@@ -21956,34 +21980,56 @@ function isWithinInlineCode(line, matchIndex) {
   }
   return false;
 }
+var MAX_MULTILINE_LINES_PER_PATTERN = 64;
+var MAX_MULTILINE_ITERATIONS_PER_PATTERN = 1e4;
 function scanPatternsWithMultilineSupport(content, config2, lineContexts, maxLength) {
   const lines = content.split("\n");
   const contexts = lineContexts ?? analyzeMarkdownContext(content);
   const bestByLine = /* @__PURE__ */ new Map();
+  let truncated = false;
   const rank = (t) => EVIDENCE_RANK[t];
+  const scannedContent = maxLength !== void 0 && content.length > maxLength ? content.slice(0, maxLength) : content;
   for (const pattern of config2.patterns) {
     if (resolvePatternScope(pattern) === "line")
       continue;
-    const match = safeRegexTest(pattern, content, maxLength);
-    if (!match)
-      continue;
-    const matchIndex = match.index ?? content.indexOf(match[0]);
-    const lineNumber = content.slice(0, matchIndex).split("\n").length;
-    const ctx = contexts[lineNumber - 1];
-    const matchLine = lines[lineNumber - 1] ?? "";
-    const lineOffset = content.lastIndexOf("\n", matchIndex - 1) + 1;
-    const matchCol = matchIndex - lineOffset;
-    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
-    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-    const tier = config2.classify(pattern);
-    const incumbent = bestByLine.get(lineNumber);
-    if (!incumbent || rank(tier) > rank(incumbent.tier)) {
-      bestByLine.set(lineNumber, {
-        tier,
-        matchText: match[0],
-        location: match[0].trim().slice(0, 100),
-        inDocContext
-      });
+    const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
+    const g = new RegExp(pattern.source, flags);
+    const seenLines = /* @__PURE__ */ new Set();
+    let iterations = 0;
+    let m;
+    while ((m = g.exec(scannedContent)) !== null) {
+      if (m[0].length === 0)
+        g.lastIndex++;
+      if (++iterations > MAX_MULTILINE_ITERATIONS_PER_PATTERN) {
+        truncated = true;
+        break;
+      }
+      const matchIndex = m.index;
+      let contentIndex = matchIndex;
+      while (scannedContent[contentIndex] === "\n")
+        contentIndex++;
+      const lineNumber = scannedContent.slice(0, contentIndex).split("\n").length;
+      if (seenLines.has(lineNumber))
+        continue;
+      if (seenLines.size >= MAX_MULTILINE_LINES_PER_PATTERN)
+        break;
+      seenLines.add(lineNumber);
+      const ctx = contexts[lineNumber - 1];
+      const matchLine = lines[lineNumber - 1] ?? "";
+      const lineOffset = scannedContent.lastIndexOf("\n", contentIndex - 1) + 1;
+      const matchCol = contentIndex - lineOffset;
+      const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
+      const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+      const tier = config2.classify(pattern);
+      const incumbent = bestByLine.get(lineNumber);
+      if (!incumbent || rank(tier) > rank(incumbent.tier)) {
+        bestByLine.set(lineNumber, {
+          tier,
+          matchText: m[0],
+          location: m[0].trim().slice(0, 100),
+          inDocContext
+        });
+      }
     }
   }
   lines.forEach((line, index) => {
@@ -22020,11 +22066,11 @@ function scanPatternsWithMultilineSupport(content, config2, lineContexts, maxLen
     if (!candidate)
       continue;
     const { severity, confidence } = resolveEvidenceSeverity(candidate.tier, candidate.inDocContext);
-    const truncated = candidate.matchText.slice(0, 50);
+    const truncatedText = candidate.matchText.slice(0, 50);
     findings.push({
       type: config2.type,
       severity,
-      message: `${config2.messagePrefix}: "${truncated}${candidate.matchText.length > 50 ? "..." : ""}"`,
+      message: `${config2.messagePrefix}: "${truncatedText}${candidate.matchText.length > 50 ? "..." : ""}"`,
       location: candidate.location,
       lineNumber,
       category: config2.type,
@@ -22033,7 +22079,7 @@ function scanPatternsWithMultilineSupport(content, config2, lineContexts, maxLen
       evidenceType: candidate.tier
     });
   }
-  return findings;
+  return { findings, truncated };
 }
 
 // ../core/dist/src/security/scanner/confusables.js
@@ -22629,6 +22675,279 @@ function scanPiiPatterns(content, lineContexts) {
   return findings;
 }
 
+// ../core/dist/src/security/scanner/SecurityScanner.prose-lexicon.js
+var NEGATION_TOKENS = /* @__PURE__ */ new Set([
+  "no",
+  "not",
+  "never",
+  "without",
+  "cannot",
+  "can't",
+  "doesn't",
+  "don't",
+  "won't",
+  "didn't",
+  "isn't",
+  "aren't",
+  "nor",
+  "neither"
+]);
+var NOUN_DETERMINERS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "my",
+  "your",
+  "our",
+  "their",
+  "its",
+  "his",
+  "her"
+]);
+var DETECTION_FRAMING = /* @__PURE__ */ new Set([
+  "detect",
+  "detects",
+  "detecting",
+  "detection",
+  "detector",
+  "detectors",
+  "flag",
+  "flags",
+  "flagging",
+  "flagged",
+  "identify",
+  "identifies",
+  "block",
+  "blocks",
+  "blocking",
+  "prevent",
+  "prevents",
+  "warn",
+  "warns",
+  "describe",
+  "describes",
+  "explain",
+  "explains",
+  "scan",
+  "scans",
+  "scanning",
+  "scanner",
+  "audit",
+  "audits",
+  "monitor",
+  "monitors",
+  "catch",
+  "catches",
+  "guard",
+  "guards",
+  "protect",
+  "protects",
+  "rule",
+  "rules",
+  "linter",
+  "analyzer"
+]);
+var RELATIVE_MARKERS = /* @__PURE__ */ new Set(["that", "which", "who", "whom", "whose"]);
+var PROSE_STOPWORDS = /* @__PURE__ */ new Set([
+  "never",
+  "not",
+  "your",
+  "you",
+  "this",
+  "that",
+  "these",
+  "those",
+  "is",
+  "are",
+  "was",
+  "were",
+  "be",
+  "been",
+  "will",
+  "would",
+  "can",
+  "could",
+  "should",
+  "must",
+  "do",
+  "does",
+  "into",
+  "onto",
+  "from",
+  "with",
+  "without",
+  "by",
+  "for",
+  "of",
+  "to",
+  "in",
+  "on",
+  "at",
+  "as",
+  "and",
+  "or",
+  "but",
+  "if",
+  "when",
+  "where",
+  "how",
+  "why",
+  "use",
+  "using",
+  "used",
+  "see",
+  "via",
+  "per",
+  "they",
+  "them",
+  "their",
+  "it",
+  "its",
+  "we",
+  "our",
+  "us",
+  "please",
+  "ensure",
+  "make",
+  "sure",
+  "the",
+  "a",
+  "an",
+  "all",
+  "any",
+  "each",
+  "no",
+  "nor",
+  "so",
+  "than",
+  "then",
+  "there",
+  "here",
+  "what",
+  "which",
+  "who",
+  "while",
+  "during",
+  "after",
+  "before",
+  "above",
+  "below",
+  "up",
+  "down",
+  "out",
+  "off",
+  "over",
+  "under",
+  "again",
+  "further",
+  "once",
+  "only",
+  "own",
+  "same",
+  "too",
+  "very",
+  "just",
+  "now"
+]);
+
+// ../core/dist/src/security/scanner/SecurityScanner.action-context.js
+var ACTION_VERBS = "cat|cp|mv|scp|rsync|curl|wget|fetch|tee|tar|zip|gzip|base64|xxd|dd|nc|netcat|chmod|ssh-add|openssl|uploads?|downloads?|sends?|posts?|exfiltrates?|steals?";
+var ACTION_VERB_EXACT = new RegExp(`^(?:${ACTION_VERBS})$`, "i");
+var SHELL_OPERATOR = /[|>]/;
+var NEGATION_LOOKBACK = 3;
+var NEGATION_LOOKAHEAD = 2;
+var RELATIVE_CLAUSE_LOOKBACK = 2;
+function inRelativeClause(norm, i) {
+  for (let j = Math.max(0, i - RELATIVE_CLAUSE_LOOKBACK); j < i; j++) {
+    if (RELATIVE_MARKERS.has(norm[j]))
+      return true;
+  }
+  return false;
+}
+function hasActionEvidence(rawLine) {
+  const line = rawLine.slice(0, MAX_LINE_LENGTH_FOR_REGEX);
+  if (SHELL_OPERATOR.test(line))
+    return true;
+  const words = line.split(/\s+/);
+  const norm = words.map((w) => w.toLowerCase().replace(/[^a-z']/g, ""));
+  const describesDetection = norm.some((w) => DETECTION_FRAMING.has(w));
+  for (let i = 0; i < words.length; i++) {
+    if (!ACTION_VERB_EXACT.test(words[i].replace(/[^A-Za-z-]/g, "")))
+      continue;
+    if (i > 0 && NOUN_DETERMINERS.has(norm[i - 1]))
+      continue;
+    if (describesDetection && inRelativeClause(norm, i))
+      continue;
+    let negated = false;
+    for (let j = Math.max(0, i - NEGATION_LOOKBACK); j <= Math.min(norm.length - 1, i + NEGATION_LOOKAHEAD); j++) {
+      if (j !== i && NEGATION_TOKENS.has(norm[j])) {
+        negated = true;
+        break;
+      }
+    }
+    if (!negated)
+      return true;
+  }
+  return false;
+}
+var MAX_PATH_ACTION_LINE_DISTANCE = 1;
+function hasPathActionContext(lines, index) {
+  const lo = Math.max(0, index - MAX_PATH_ACTION_LINE_DISTANCE);
+  const hi = Math.min(lines.length - 1, index + MAX_PATH_ACTION_LINE_DISTANCE);
+  for (let i = lo; i <= hi; i++) {
+    if (hasActionEvidence(lines[i]))
+      return true;
+  }
+  return false;
+}
+
+// ../core/dist/src/security/scanner/SecurityScanner.value-gate.js
+var TEMPLATE_REFERENCE = /^\$|^\{\{|\$\{|^%[A-Za-z_]|^<%/;
+var MAX_LABEL_TOKENS = 2;
+var ASSIGNMENT_HEAD = /(?:credentials|\bsecrets?|password)\s*[:=]\s*/gi;
+function isProseValue(span) {
+  const v = span.replace(/^['"]|['"]$/g, "").trim();
+  if (v.length === 0)
+    return true;
+  if (TEMPLATE_REFERENCE.test(v))
+    return true;
+  if (PLACEHOLDER_SECRET_RE.test(v))
+    return true;
+  if (/^(.)\1+$/.test(v))
+    return true;
+  const tokens = v.split(/\s+/);
+  if (tokens.some((t) => PROSE_STOPWORDS.has(t.toLowerCase().replace(/[^a-z']/g, ""))))
+    return true;
+  if (tokens.length > 12)
+    return true;
+  if (tokens.length > 1 && tokens.length <= MAX_LABEL_TOKENS && tokens.every((t) => /^[a-z]{1,19}$/.test(t)))
+    return true;
+  return false;
+}
+function assignmentHasRealValue(lines, index) {
+  const line = lines[index].slice(0, MAX_LINE_LENGTH_FOR_REGEX);
+  const heads = [...line.matchAll(ASSIGNMENT_HEAD)];
+  if (heads.length === 0)
+    return false;
+  let trailingKeyIsBare = false;
+  for (let i = 0; i < heads.length; i++) {
+    const from = (heads[i].index ?? 0) + heads[i][0].length;
+    const to = i + 1 < heads.length ? heads[i + 1].index ?? line.length : line.length;
+    const value = line.slice(from, to);
+    if (value.trim().length === 0) {
+      trailingKeyIsBare = i === heads.length - 1;
+      continue;
+    }
+    trailingKeyIsBare = false;
+    if (!isProseValue(value))
+      return true;
+  }
+  if (!trailingKeyIsBare)
+    return false;
+  const next = lines[index + 1];
+  return next !== void 0 && !isProseValue(next.trim());
+}
+
 // ../core/dist/src/security/scanner/SecurityScanner.fetch-correlation.js
 var FETCH_COMMAND_PATTERN = /\b(?:curl|wget)\b|\bgit\s+clone\b|\bnpx\b[^\n]{0,80}https?:\/\//i;
 function escapeRegExp2(s) {
@@ -22813,6 +23132,10 @@ function scanSensitivePaths(content, lineContexts) {
         severity = "medium";
       } else if (pattern === ENV_PATH_PATTERN) {
         severity = safeRegexCheck(ENV_EXFIL_CONTEXT, line) ? "high" : "medium";
+      } else if (PATH_FORM_PATTERNS.has(pattern)) {
+        severity = hasPathActionContext(lines, index) ? "high" : "medium";
+      } else if (VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)) {
+        severity = assignmentHasRealValue(lines, index) ? "high" : "medium";
       } else {
         severity = "high";
       }
@@ -22820,7 +23143,20 @@ function scanSensitivePaths(content, lineContexts) {
       findings.push({
         type: "sensitive_path",
         severity,
-        message: `Reference to potentially sensitive path: ${pattern.source}`,
+        // SMI-5207: the matched TEXT is prepended additively — `pattern.source` is
+        // deliberately retained, not swapped out, because allowlist entries'
+        // `messagePattern` values match on that regex-source substring.
+        // Governance review L-5: `match?.[0] ?? ''` is kept (a plain `match[0]`
+        // fails `tsc` — TS cannot correlate the separate `safeRegexCheck`/
+        // `safeRegexTest` calls the way it narrows a local `if (match)` block, the
+        // pattern this file's OTHER scanners use). Behaviorally the `?? ''`
+        // fallback is unreachable: `safeRegexCheck` (.test()) already gated the
+        // loop above on this same pattern/line pair, and for a non-`g` pattern
+        // .test() and .match() can never disagree on the same input. If it ever
+        // WAS reached, it would silently diverge from the edge twins (which emit
+        // no finding at all rather than one with an empty quoted span) — a gap the
+        // twin-parity test can't catch, since it compares files, not behavior.
+        message: `Reference to potentially sensitive path: "${match?.[0]?.slice(0, 60) ?? ""}" (${pattern.source})`,
         location: line.trim().slice(0, 100),
         lineNumber: index + 1,
         inDocumentationContext: inDocContext,
@@ -23485,6 +23821,7 @@ function scanDecoyMisdirection(content, lineContexts) {
 }
 
 // ../core/dist/src/security/scanner/SecurityScanner.js
+var DIRECTIVE_JAILBREAK_PATTERNS = JAILBREAK_PATTERNS.filter((p) => classifyEvidence(p) !== "mention");
 var SecurityScanner = class {
   allowedDomains;
   blockedPatterns;
@@ -23603,13 +23940,26 @@ var SecurityScanner = class {
    * text contains. This disables ONLY the encoded-payload detector on the
    * inner call, not the rest of the suite — a decoded `curl|bash` still
    * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
-   */
-  runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true) {
+   *
+   * SMI-5879: `EncodedPayloadRescanner`'s contract is a bare
+   * `SecurityFinding[]` return (SecurityScanner.encoding.ts, out of scope for
+   * this change), so a recursive `runDetectors` call for decoded content has
+   * no return channel of its own to report multiline truncation.
+   * `truncationRef` is a shared mutable out-param instead: every call (outer
+   * and any recursive rescan) ORs its own jailbreak/AI-defence truncation
+   * into it, so truncation anywhere in the recursion is visible to the
+   * original (outermost) caller. Per `ScanReport.multilineTruncated`'s own
+   * doc: being truncated is only ever used to RAISE caution, never to lower
+   * it, so over-reporting here (e.g. attributing an inner rescan's
+   * truncation to the whole document) is safe by that same design.
+   */
+  runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true, truncationRef) {
     const findings = [];
     const effectiveMultilineLimit = Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, this.maxContentLength);
     findings.push(...this.scanUrls(content));
     findings.push(...scanSensitivePaths(content, lineContexts));
-    findings.push(...this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit));
+    const jailbreakResult = this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit);
+    findings.push(...jailbreakResult.findings);
     findings.push(...this.scanSuspiciousPatterns(content, lineContexts));
     findings.push(...scanSocialEngineering(content, lineContexts));
     findings.push(...scanPromptLeaking(content, lineContexts));
@@ -23621,7 +23971,11 @@ var SecurityScanner = class {
     findings.push(...scanArchiveEvasion(content, lineContexts));
     findings.push(...scanPasteHostFetch(content, lineContexts));
     findings.push(...scanDecoyMisdirection(content, lineContexts));
-    findings.push(...this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit));
+    const aiDefenceResult = this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit);
+    findings.push(...aiDefenceResult.findings);
+    if (truncationRef) {
+      truncationRef.truncated = truncationRef.truncated || jailbreakResult.truncated || aiDefenceResult.truncated;
+    }
     findings.push(...scanSsrfPatterns(content, lineContexts, effectiveMultilineLimit));
     findings.push(...scanPiiPatterns(content, lineContexts));
     findings.push(...scanCodeExecution(content, lineContexts));
@@ -23629,7 +23983,7 @@ var SecurityScanner = class {
     escalateCodeExecution(findings);
     escalateCorroboratedMentions(findings);
     if (!skipEncodedPayload) {
-      findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown)));
+      findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown, truncationRef)));
     }
     return findings;
   }
@@ -23671,7 +24025,8 @@ var SecurityScanner = class {
         message: `Multiline regex scan truncated at ${effectiveMultilineLimit} code units (content is ${content.length} code units; configured maxContentLength is ${this.maxContentLength} code units)`
       });
     }
-    findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown));
+    const truncationRef = { truncated: false };
+    findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown, truncationRef));
     const endTime = performance.now();
     const { total: riskScore, breakdown: riskBreakdown } = calculateRiskScore(findings);
     const hasCritical = findings.some((f) => f.severity === "critical");
@@ -23684,11 +24039,17 @@ var SecurityScanner = class {
       scannedAt: /* @__PURE__ */ new Date(),
       scanDurationMs: endTime - startTime,
       riskScore,
-      riskBreakdown
+      riskBreakdown,
+      multilineTruncated: truncationRef.truncated
     };
   }
+  /**
+   * SMI-5879 (design §5): tests only the directive-tier derived subset (a
+   * bare mention like "jailbreak" or "DAN" alone should not fail the quick
+   * path — see DIRECTIVE_JAILBREAK_PATTERNS above).
+   */
   quickCheck(content) {
-    for (const pattern of JAILBREAK_PATTERNS) {
+    for (const pattern of DIRECTIVE_JAILBREAK_PATTERNS) {
       if (safeRegexCheck(pattern, content))
         return false;
     }
@@ -35163,6 +35524,17 @@ function checkCursorMcpArtifact(path30) {
   };
 }
 
+// ../core/dist/src/utils/skill-name.js
+var VALID_SKILL_NAME_RE = /^[a-z][a-z0-9-]*$/;
+function validateSkillName(name) {
+  if (!name.trim())
+    return "Skill name is required";
+  if (!VALID_SKILL_NAME_RE.test(name)) {
+    return "Skill name must start with a lowercase letter and contain only lowercase letters, digits, and hyphens (e.g. my-skill)";
+  }
+  return true;
+}
+
 // ../core/dist/src/provenance/git-config.js
 import * as fs8 from "fs";
 import * as path10 from "path";
@@ -37758,16 +38130,6 @@ import { mkdir as mkdir9, writeFile as writeFile6, readFile as readFile12, stat
 import { dirname as dirname22, join as join51, resolve as resolve15 } from "path";
 import { createHash as createHash10 } from "crypto";
 
-// src/utils/skill-name.ts
-var VALID_SKILL_NAME_RE = /^[a-z][a-z0-9-]*$/;
-function validateSkillName(name) {
-  if (!name.trim()) return "Skill name is required";
-  if (!VALID_SKILL_NAME_RE.test(name)) {
-    return "Skill name must start with a lowercase letter and contain only lowercase letters, digits, and hyphens (e.g. my-skill)";
-  }
-  return true;
-}
-
 // src/commands/author/utils.ts
 import { access as access3 } from "fs/promises";
 import { mkdir as mkdir7 } from "fs/promises";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillsmith/cli",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "A registry for sharing, scanning, and tracking agent skills across teams.",
   "type": "module",
   "bin": {
@@ -39,14 +39,14 @@
     "yaml": "2.8.3"
   },
   "devDependencies": {
-    "@skillsmith/core": "^0.12.2",
-    "@skillsmith/mcp-server": "^0.7.13",
+    "@skillsmith/core": "^0.12.3",
+    "@skillsmith/mcp-server": "^0.7.14",
     "@types/node": "^25.9.3",
     "esbuild": "0.28.1",
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@smith-horn/enterprise": "^0.3.9"
+    "@smith-horn/enterprise": "^0.3.10"
   },
   "peerDependenciesMeta": {
     "@smith-horn/enterprise": {