@skillsmith/core 0.11.3 → 0.11.4

package/dist/src/security/scanner/SecurityScanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAsB5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAgBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU;IA6DlD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AA0B5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAkBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU;IA2FlD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.evidence.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Security Scanner — evidence-tier severity resolution (SMI-5876)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.evidence
+ *
+ * Turns a pattern's `EvidenceType` (classified in
+ * `patterns.jailbreak.evidence.ts`'s `EVIDENCE_TYPE_BY_PATTERN`, SMI-5881)
+ * plus documentation context into a severity/confidence pair, and provides
+ * the corroboration escalation that lifts a `mention`-tier finding when it
+ * co-occurs with a genuinely dangerous non-documentation signal elsewhere in
+ * the same scan.
+ */
+import type { EvidenceType, SecurityFinding, SecuritySeverity, FindingConfidence } from './types.js';
+/**
+ * Classify a pattern's evidence tier by object identity. Unmapped patterns
+ * (i.e. a pattern added to JAILBREAK_PATTERNS/AI_DEFENCE_PATTERNS without an
+ * `EVIDENCE_TYPE_BY_PATTERN` entry) default to `imperative_instruction` —
+ * fail-closed: forgetting to classify a new pattern makes it the STRONGEST
+ * tier, never the weakest, so a missed classification can never silently
+ * soften detection.
+ */
+export declare function classifyEvidence(p: RegExp): EvidenceType;
+/**
+ * Relative strength ordering used by the merge-loop in
+ * `SecurityScanner.helpers.ts` to pick the strongest evidence per line across
+ * both the multi-line and single-line scan passes. `imperative_instruction`,
+ * `instruction_override`, and `state_assertion` are equal rank — the
+ * severity table below treats them identically, and none needs to out-rank
+ * the others. `state_assertion` (SMI-5876 design-pass follow-up) is a
+ * distinct machine-readable REASON CODE for a declarative jailbroken-state
+ * assertion ("Jailbreak activated") rather than a directive aimed at the
+ * model — same severity tuple, different diagnostic label.
+ */
+export declare const EVIDENCE_RANK: Record<EvidenceType, number>;
+/** The highest rank in `EVIDENCE_RANK` — once reached, no later pattern on the same line can beat it. */
+export declare const MAX_EVIDENCE_RANK = 2;
+/**
+ * Severity/confidence decision table (SMI-5876 design §4.1). Doc-context
+ * confidence for the directive tiers is `medium`, not `low` — `low` would be
+ * self-contradictory next to a still-failing severity (it would also cut the
+ * risk-score weight to 0.3x, which is not the intent for a directive payload
+ * that merely happens to sit inside a fenced example).
+ */
+export declare const EVIDENCE_SEVERITY_TABLE: Record<EvidenceType, {
+    doc: {
+        severity: SecuritySeverity;
+        confidence: FindingConfidence;
+    };
+    nonDoc: {
+        severity: SecuritySeverity;
+        confidence: FindingConfidence;
+    };
+}>;
+/** Resolve the severity/confidence pair for an evidence tier + documentation context. */
+export declare function resolveEvidenceSeverity(tier: EvidenceType, inDocumentationContext: boolean): {
+    severity: SecuritySeverity;
+    confidence: FindingConfidence;
+};
+/**
+ * Escalate a `mention`-tier finding when an ALLOWLISTED non-documentation
+ * high/critical finding is ALSO present within `MAX_CORROBORATION_LINE_DISTANCE`
+ * lines in the same scan (SMI-5876 design §4.3, corrected post-implementation —
+ * see `CORROBORATING_SIGNALS`' doc comment for the denylist->allowlist fix and
+ * the locality-window rationale). Mutates findings in place, mirroring
+ * `escalateCodeExecution`'s mutation style (SecurityScanner.exec.ts).
+ *
+ * MUST run after `escalateCodeExecution` (SecurityScanner.ts's `scan()`) so a
+ * freshly-critical `code_execution` finding can itself serve as a
+ * corroborator. No feedback loop the other way: `CODE_EXECUTION_CO_OCCURRENCE`
+ * (SecurityScanner.exec.ts) contains only `data_exfiltration`,
+ * `privilege_escalation`, `sensitive_path`, and `obfuscated_directive` — never
+ * `jailbreak` or `ai_defence` — so lifting a mention here can never
+ * retroactively change `escalateCodeExecution`'s own decision (verified by
+ * reading SecurityScanner.exec.ts directly, SMI-5876 implementation).
+ */
+export declare function escalateCorroboratedMentions(findings: SecurityFinding[]): void;
+//# sourceMappingURL=SecurityScanner.evidence.d.ts.map

package/dist/src/security/scanner/SecurityScanner.evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.evidence.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAEf,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,YAAY,CAAA;AAGnB;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,YAAY,CAExD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAMtD,CAAA;AAED,yGAAyG;AACzG,eAAO,MAAM,iBAAiB,IAAI,CAAA;AAElC;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAC1C,YAAY,EACZ;IACE,GAAG,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAA;KAAE,CAAA;IAClE,MAAM,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAA;KAAE,CAAA;CACtE,CAwBF,CAAA;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,EAClB,sBAAsB,EAAE,OAAO,GAC9B;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CAG/D;AA0DD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CA4B9E"}

package/dist/src/security/scanner/SecurityScanner.evidence.js

@@ -0,0 +1,176 @@
+/**
+ * Security Scanner — evidence-tier severity resolution (SMI-5876)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.evidence
+ *
+ * Turns a pattern's `EvidenceType` (classified in
+ * `patterns.jailbreak.evidence.ts`'s `EVIDENCE_TYPE_BY_PATTERN`, SMI-5881)
+ * plus documentation context into a severity/confidence pair, and provides
+ * the corroboration escalation that lifts a `mention`-tier finding when it
+ * co-occurs with a genuinely dangerous non-documentation signal elsewhere in
+ * the same scan.
+ */
+import { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+/**
+ * Classify a pattern's evidence tier by object identity. Unmapped patterns
+ * (i.e. a pattern added to JAILBREAK_PATTERNS/AI_DEFENCE_PATTERNS without an
+ * `EVIDENCE_TYPE_BY_PATTERN` entry) default to `imperative_instruction` —
+ * fail-closed: forgetting to classify a new pattern makes it the STRONGEST
+ * tier, never the weakest, so a missed classification can never silently
+ * soften detection.
+ */
+export function classifyEvidence(p) {
+    return EVIDENCE_TYPE_BY_PATTERN.get(p) ?? 'imperative_instruction';
+}
+/**
+ * Relative strength ordering used by the merge-loop in
+ * `SecurityScanner.helpers.ts` to pick the strongest evidence per line across
+ * both the multi-line and single-line scan passes. `imperative_instruction`,
+ * `instruction_override`, and `state_assertion` are equal rank — the
+ * severity table below treats them identically, and none needs to out-rank
+ * the others. `state_assertion` (SMI-5876 design-pass follow-up) is a
+ * distinct machine-readable REASON CODE for a declarative jailbroken-state
+ * assertion ("Jailbreak activated") rather than a directive aimed at the
+ * model — same severity tuple, different diagnostic label.
+ */
+export const EVIDENCE_RANK = {
+    mention: 0,
+    role_turn_with_body: 1,
+    imperative_instruction: 2,
+    instruction_override: 2,
+    state_assertion: 2,
+};
+/** The highest rank in `EVIDENCE_RANK` — once reached, no later pattern on the same line can beat it. */
+export const MAX_EVIDENCE_RANK = 2;
+/**
+ * Severity/confidence decision table (SMI-5876 design §4.1). Doc-context
+ * confidence for the directive tiers is `medium`, not `low` — `low` would be
+ * self-contradictory next to a still-failing severity (it would also cut the
+ * risk-score weight to 0.3x, which is not the intent for a directive payload
+ * that merely happens to sit inside a fenced example).
+ */
+export const EVIDENCE_SEVERITY_TABLE = {
+    mention: {
+        nonDoc: { severity: 'low', confidence: 'low' },
+        doc: { severity: 'low', confidence: 'low' },
+    },
+    role_turn_with_body: {
+        nonDoc: { severity: 'high', confidence: 'high' },
+        doc: { severity: 'medium', confidence: 'medium' },
+    },
+    imperative_instruction: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+    instruction_override: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+    // SMI-5876 design-pass follow-up: same tuple as imperative_instruction —
+    // state_assertion is a distinct reason code, not a distinct severity tier.
+    state_assertion: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+};
+/** Resolve the severity/confidence pair for an evidence tier + documentation context. */
+export function resolveEvidenceSeverity(tier, inDocumentationContext) {
+    const entry = EVIDENCE_SEVERITY_TABLE[tier];
+    return inDocumentationContext ? entry.doc : entry.nonDoc;
+}
+/**
+ * SMI-5876 (post-implementation correction): corroborator eligibility is an
+ * ALLOWLIST of INSTRUCTION-BEARING attack categories, not a denylist of
+ * everything-except-self.
+ *
+ * The original design specified `type ∉ {jailbreak, ai_defence}`, reasoning only
+ * about same-category circularity. That is the classic denylist failure — it
+ * silently admits every category nobody considered. It admitted `pii`, whose
+ * plain-email pattern fires on the author-contact bullet that nearly every
+ * SKILL.md carries, so an unrelated `- Email: support@…` 74 lines away lifted a
+ * benign "jailbreak" mention to high in this repo's OWN bundled SKILL.md — one of
+ * SMI-5876's three acceptance fixtures.
+ *
+ * Both existing precedents here are allowlists: CODE_EXECUTION_CO_OCCURRENCE
+ * (SecurityScanner.exec.ts) and SUPPLY_CHAIN_CO_SIGNALS
+ * (SecurityScanner.hostile-update.ts). This restores that discipline.
+ *
+ * Inclusion rule — the category must be INSTRUCTION-BEARING (its patterns match
+ * an instruction to do something adversarial). Deliberately excluded:
+ *   • `pii` / `sensitive_path` — REFERENCE-bearing. A contact email or a `.env`
+ *     path says something about data hygiene, nothing about whether a jailbreak
+ *     ATTEMPT is present.
+ *   • `suspicious_pattern` — `eval(` / `child_process` are ordinary vocabulary in
+ *     dev-tooling skills.
+ *   • `social_engineering` / `prompt_leaking` — semantically ADJACENT to jailbreak;
+ *     admitting them recreates the very circularity the self-exclusion prevents
+ *     (a persona/roleplay skill would lift its own jailbreak mentions).
+ *   • `typosquat` — a property of the skill NAME, not its content.
+ *   • `url` — capped at medium, so it could never qualify anyway.
+ *   • `jailbreak` / `ai_defence` — same-category self-lift (original exclusion).
+ */
+const CORROBORATING_SIGNALS = new Set([
+    'code_execution',
+    'obfuscated_directive',
+    'data_exfiltration',
+    'privilege_escalation',
+    'ssrf',
+]);
+/**
+ * Maximum line distance between a mention and its corroborator.
+ *
+ * Why a bounded window is NOT a bypass vector: corroboration is a risk-SCORE and
+ * hostile-update amplifier only — it can never flip `passed`, because any
+ * qualifying corroborator is itself high/critical and therefore already fails the
+ * scan on its own (`passed = !hasCritical && !hasHigh && !exceedsThreshold`). An
+ * attacker who separates the two signals to duck the window still fails on the
+ * corroborator alone; all they achieve is a slightly lower numeric score on a
+ * scan that already blocks.
+ *
+ * 40 lines comfortably spans a real payload block (persona preamble plus the
+ * instructions it sets up) while excluding the "unrelated finding in a different
+ * section of a long document" case that motivated this constraint.
+ */
+const MAX_CORROBORATION_LINE_DISTANCE = 40;
+/**
+ * Escalate a `mention`-tier finding when an ALLOWLISTED non-documentation
+ * high/critical finding is ALSO present within `MAX_CORROBORATION_LINE_DISTANCE`
+ * lines in the same scan (SMI-5876 design §4.3, corrected post-implementation —
+ * see `CORROBORATING_SIGNALS`' doc comment for the denylist->allowlist fix and
+ * the locality-window rationale). Mutates findings in place, mirroring
+ * `escalateCodeExecution`'s mutation style (SecurityScanner.exec.ts).
+ *
+ * MUST run after `escalateCodeExecution` (SecurityScanner.ts's `scan()`) so a
+ * freshly-critical `code_execution` finding can itself serve as a
+ * corroborator. No feedback loop the other way: `CODE_EXECUTION_CO_OCCURRENCE`
+ * (SecurityScanner.exec.ts) contains only `data_exfiltration`,
+ * `privilege_escalation`, `sensitive_path`, and `obfuscated_directive` — never
+ * `jailbreak` or `ai_defence` — so lifting a mention here can never
+ * retroactively change `escalateCodeExecution`'s own decision (verified by
+ * reading SecurityScanner.exec.ts directly, SMI-5876 implementation).
+ */
+export function escalateCorroboratedMentions(findings) {
+    const corroborators = findings.filter((f) => (f.severity === 'high' || f.severity === 'critical') &&
+        f.inDocumentationContext !== true &&
+        CORROBORATING_SIGNALS.has(f.type) &&
+        typeof f.lineNumber === 'number');
+    if (corroborators.length === 0)
+        return;
+    for (const finding of findings) {
+        if (finding.evidenceType !== 'mention')
+            continue;
+        if (typeof finding.lineNumber !== 'number')
+            continue;
+        const corroborator = corroborators.find((c) => Math.abs(c.lineNumber - finding.lineNumber) <=
+            MAX_CORROBORATION_LINE_DISTANCE);
+        if (!corroborator)
+            continue;
+        const inDoc = finding.inDocumentationContext === true;
+        finding.severity = inDoc ? 'medium' : 'high';
+        finding.confidence = inDoc ? 'low' : 'medium';
+        finding.corroborated = true;
+        finding.message =
+            `Corroborated by a co-occurring non-documentation ${corroborator.type} ` +
+                `finding at line ${corroborator.lineNumber} — ${finding.message}`;
+    }
+}
+//# sourceMappingURL=SecurityScanner.evidence.js.map

package/dist/src/security/scanner/SecurityScanner.evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.evidence.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAE3E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAA;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiC;IACzD,OAAO,EAAE,CAAC;IACV,mBAAmB,EAAE,CAAC;IACtB,sBAAsB,EAAE,CAAC;IACzB,oBAAoB,EAAE,CAAC;IACvB,eAAe,EAAE,CAAC;CACnB,CAAA;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAMhC;IACF,OAAO,EAAE;QACP,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;QAC9C,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;KAC5C;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;QAChD,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;KAClD;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,eAAe,EAAE;QACf,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;CACF,CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CACrC,IAAkB,EAClB,sBAA+B;IAE/B,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,qBAAqB,GAAqC,IAAI,GAAG,CAAC;IACtE,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,MAAM;CACP,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA2B;IACtE,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACpD,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CACnC,CAAA;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,SAAQ;QAChD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAQ;QACpD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,GAAG,CAAE,CAAC,CAAC,UAAqB,GAAI,OAAO,CAAC,UAAqB,CAAC;YACnE,+BAA+B,CAClC,CAAA;QACD,IAAI,CAAC,YAAY;YAAE,SAAQ;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAA;QACrD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QAC5C,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC7C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAA;QAC3B,OAAO,CAAC,OAAO;YACb,oDAAoD,YAAY,CAAC,IAAI,GAAG;gBACxE,mBAAmB,YAAY,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACrE,CAAC;AACH,CAAC"}

package/dist/src/security/scanner/SecurityScanner.exec.d.ts

@@ -55,9 +55,16 @@ export declare function scanObfuscatedDirective(content: string): SecurityFindin
 /**
  * Escalate the code_execution finding to CRITICAL when a NON-documentation
  * high/critical exfiltration / privilege / credential-path / obfuscation signal
- * is also present. Mutates the finding in place. Requiring the co-signal to be
+ * is also present WITHIN `MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE` lines
+ * (SMI-5880 — previously any distance qualified, so an unrelated finding in a
+ * different section of a long document escalated an unrelated code_execution
+ * finding). Mutates the finding in place. Requiring the co-signal to be
  * non-documentation keeps legitimate security-research skills (whose examples
  * live in fenced blocks) at MEDIUM.
+ *
+ * Runs BEFORE the sibling corroboration mechanism in `scan()` — see that
+ * function's doc comment (SecurityScanner.evidence.ts) for why the ordering is
+ * safe in both directions.
  */
 export declare function escalateCodeExecution(findings: SecurityFinding[]): void;
 //# sourceMappingURL=SecurityScanner.exec.d.ts.map

package/dist/src/security/scanner/SecurityScanner.exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.exec.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAA;AAGtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA4B/D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AA0BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAuC1E;AAaD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAgBvE"}
+{"version":3,"file":"SecurityScanner.exec.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAA;AAGtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA4B/D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AA0BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAuC1E;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAiBvE"}

package/dist/src/security/scanner/SecurityScanner.exec.js

@@ -168,12 +168,67 @@ const CODE_EXECUTION_CO_OCCURRENCE = new Set([
     'sensitive_path',
     'obfuscated_directive',
 ]);
+/**
+ * Maximum line distance between the `code_execution` finding and the co-signal
+ * that escalates it (SMI-5880). Before this bound, a co-signal ANYWHERE in the
+ * document — any distance, any unrelated section — escalated the single
+ * `code_execution` finding to critical.
+ *
+ * Why a bounded window is NOT a bypass vector: every eligible co-signal is
+ * already `high` or `critical`, and `scan()` (SecurityScanner.ts) computes
+ * `passed = !hasCritical && !hasHigh && !exceedsThreshold` across ALL findings
+ * with no locality filter and no documentation filter. A qualifying co-signal
+ * anywhere therefore forces `passed === false` on its own, BEFORE this function
+ * runs. Splitting the two signals to duck this window cannot turn a failing scan
+ * into a passing one; it changes only this finding's own label (medium vs
+ * critical) and the risk-score magnitude of a scan that already blocks.
+ * Hostile-update detection is likewise untouched: `detectSupplyChain()`
+ * (SecurityScanner.hostile-update.ts) pairs a NEW non-doc `code_execution` of ANY
+ * severity with a NEW non-doc high/critical co-signal at ANY distance, so a
+ * far-apart rug-pull still returns the `hostile` verdict and its supply-chain
+ * reason string.
+ *
+ * Deliberately the same 40 as the sibling corroboration mechanism's locality
+ * constant (SecurityScanner.evidence.ts) so the scanner has ONE locality model
+ * — but kept as its own constant, not imported: the two mechanisms are
+ * independently tunable, and the edge twins (SMI-5879) cannot import from core
+ * and must carry their own copy.
+ */
+const MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE = 40;
+/**
+ * Locality gate for `escalateCodeExecution`. Fail-CLOSED on missing metadata:
+ * when either side has no `lineNumber` the distance is unknowable, and this
+ * subsystem's convention is that missing metadata must never SILENTLY weaken
+ * detection — cf. `classifyEvidence` (SecurityScanner.evidence.ts), whose
+ * unmapped-pattern default is the STRONGEST tier for exactly this reason. An
+ * unknowable distance therefore preserves the pre-SMI-5880 unbounded behavior for
+ * that pair rather than suppressing the co-signal.
+ *
+ * Unreachable through `scan()` today: `scanCodeExecution` above and every emitter
+ * of the four CODE_EXECUTION_CO_OCCURRENCE types set `lineNumber` unconditionally
+ * (the sensitive-path/data-exfiltration/privilege-escalation scanners in the
+ * scanners module, the chmod-compound detector, and `scanObfuscatedDirective`
+ * above). Kept as an explicit, directly-tested branch so a future detector that
+ * forgets `lineNumber` degrades safe instead of silently ceasing to escalate.
+ */
+function isWithinCoSignalWindow(codeExecLine, coSignalLine) {
+    if (typeof codeExecLine !== 'number' || typeof coSignalLine !== 'number')
+        return true;
+    return Math.abs(codeExecLine - coSignalLine) <= MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE;
+}
 /**
  * Escalate the code_execution finding to CRITICAL when a NON-documentation
  * high/critical exfiltration / privilege / credential-path / obfuscation signal
- * is also present. Mutates the finding in place. Requiring the co-signal to be
+ * is also present WITHIN `MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE` lines
+ * (SMI-5880 — previously any distance qualified, so an unrelated finding in a
+ * different section of a long document escalated an unrelated code_execution
+ * finding). Mutates the finding in place. Requiring the co-signal to be
  * non-documentation keeps legitimate security-research skills (whose examples
  * live in fenced blocks) at MEDIUM.
+ *
+ * Runs BEFORE the sibling corroboration mechanism in `scan()` — see that
+ * function's doc comment (SecurityScanner.evidence.ts) for why the ordering is
+ * safe in both directions.
  */
 export function escalateCodeExecution(findings) {
     const codeExec = findings.find((f) => f.type === 'code_execution');
@@ -182,7 +237,8 @@ export function escalateCodeExecution(findings) {
     const hasDangerousCoSignal = findings.some((f) => f !== codeExec &&
         CODE_EXECUTION_CO_OCCURRENCE.has(f.type) &&
         f.inDocumentationContext !== true &&
-        (f.severity === 'high' || f.severity === 'critical'));
+        (f.severity === 'high' || f.severity === 'critical') &&
+        isWithinCoSignalWindow(codeExec.lineNumber, f.lineNumber));
     if (hasDangerousCoSignal) {
         codeExec.severity = 'critical';
         codeExec.message = `Remote fetch piped to an interpreter, co-occurring with exfiltration/privilege/credential signals — likely supply-chain execution. ${codeExec.message}`;

package/dist/src/security/scanner/SecurityScanner.exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.exec.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,mCAAmC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,eAAe,GACnB,yGAAyG,CAAA;AAC3G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,GAAG,CAAC,CAAA;AAC3F,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,IAAI,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,CAAS;IAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,6BAA6B,GACjC,0ZAA0Z,CAAA;AAE5Z,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACvB,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9D,OAAO;oBACL;wBACE,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,0CAA0C,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GACtE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EACjC,GAAG;wBACH,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,gBAAgB;wBAC1B,sBAAsB,EAAE,YAAY;wBACpC,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;YAAE,SAAQ;QACvC,8DAA8D;QAC9D,IAAI,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEhE,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,IAAI,YAAY;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,IAAI,YAAY,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAErF,KAAK,MAAM,WAAW,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,WAAW,KAAK,GAAG;gBAAE,SAAQ;YACjC,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,yFAAyF,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9G,CAAC,EACD,EAAE,CACH,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;wBACxC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,sBAAsB;wBAChC,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,4BAA4B,GAAqC,IAAI,GAAG,CAAC;IAC7E,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,QAAQ;QACd,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACvD,CAAA;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAAA;QAC9B,QAAQ,CAAC,OAAO,GAAG,sIAAsI,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC7K,CAAC;AACH,CAAC"}
+{"version":3,"file":"SecurityScanner.exec.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,mCAAmC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,eAAe,GACnB,yGAAyG,CAAA;AAC3G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,GAAG,CAAC,CAAA;AAC3F,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,IAAI,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,CAAS;IAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,6BAA6B,GACjC,0ZAA0Z,CAAA;AAE5Z,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACvB,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9D,OAAO;oBACL;wBACE,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,0CAA0C,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GACtE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EACjC,GAAG;wBACH,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,gBAAgB;wBAC1B,sBAAsB,EAAE,YAAY;wBACpC,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;YAAE,SAAQ;QACvC,8DAA8D;QAC9D,IAAI,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEhE,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,IAAI,YAAY;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,IAAI,YAAY,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAErF,KAAK,MAAM,WAAW,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,WAAW,KAAK,GAAG;gBAAE,SAAQ;YACjC,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,yFAAyF,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9G,CAAC,EACD,EAAE,CACH,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;wBACxC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,sBAAsB;wBAChC,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,4BAA4B,GAAqC,IAAI,GAAG,CAAC;IAC7E,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,0CAA0C,GAAG,EAAE,CAAA;AAErD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAAC,YAAqB,EAAE,YAAqB;IAC1E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACrF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,0CAA0C,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,QAAQ;QACd,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACpD,sBAAsB,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAC5D,CAAA;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAAA;QAC9B,QAAQ,CAAC,OAAO,GAAG,sIAAsI,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC7K,CAAC;AACH,CAAC"}

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts

@@ -2,7 +2,7 @@
  * Security Scanner Helper Functions
  * @module @skillsmith/core/security/scanner/SecurityScanner.helpers
  */
-import type { SecurityFinding, SecurityFindingType, RiskScoreBreakdown, SecuritySeverity } from './types.js';
+import type { SecurityFinding, SecurityFindingType, RiskScoreBreakdown, EvidenceType } from './types.js';
 /**
  * Context information for each line in markdown content
  */
@@ -21,12 +21,6 @@ export interface LineContext {
      */
     inFrontmatter: boolean;
 }
-/**
- * SMI-1532: Check if a regex pattern requires multi-line matching
- * Patterns that contain newline/carriage-return characters or start with
- * multi-line anchors need to be tested against full content, not line-by-line.
- */
-export declare function isMultilinePattern(pattern: RegExp): boolean;
 /**
  * Analyze markdown content and return context for each line
  * Used to reduce false positives in documentation/examples
@@ -59,14 +53,45 @@ interface MultilineScanConfig {
     type: SecurityFindingType;
     messagePrefix: string;
     patterns: RegExp[];
-    /** Severity pair: [inDocContext, normalContext] */
-    severities: [SecuritySeverity, SecuritySeverity];
+    /**
+     * SMI-5876: replaces the flat `[docContext, normal]` severity pair — returns
+     * the evidence tier for a given pattern (by object identity) so
+     * severity/confidence can be resolved per-line via `resolveEvidenceSeverity`
+     * once the strongest tier for that line is known.
+     */
+    classify: (pattern: RegExp) => EvidenceType;
 }
 /**
  * Scan content for patterns that may span multiple lines.
  * Multi-line patterns are tested against full content; single-line patterns per-line.
+ *
+ * SMI-5876: patterns within a single category (jailbreak / ai_defence) can now
+ * carry DIFFERENT evidence tiers (a bare "jailbreak" mention vs. an explicit
+ * "ignore all previous instructions" override), so array-declaration order is
+ * no longer sufficient to decide which match wins on a line where multiple
+ * patterns fire — the STRONGEST evidence tier per line wins, computed via a
+ * merge across both passes (`bestByLine`), not "first match, in array order."
+ *
+ * Two hazards this closes (see the SMI-5876 design doc §5 for the full
+ * argument):
+ *   Hazard A — pass 2 used to `break` on the FIRST matching pattern
+ *     regardless of tier, so a weaker mention declared earlier in the array
+ *     could shadow a stronger directive declared later on the same line.
+ *   Hazard B — a multiline pattern match used to suppress ALL single-line
+ *     patterns on that line (`flaggedLines`), so a mention-tier multiline
+ *     match could hide a directive-tier single-line match on the same line.
+ *     `bestByLine` SEEDS pass 2 with pass 1's result instead of skipping the
+ *     line outright, so pass 2 can still find something stronger.
+ */
+export declare function scanPatternsWithMultilineSupport(content: string, config: MultilineScanConfig, lineContexts?: LineContext[], 
+/**
+ * SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
+ * regex scan — `Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`,
+ * computed once by SecurityScanner.scan() and threaded through so the
+ * truncation finding it emits matches what actually gets scanned. Omitted
+ * (undefined) falls back to safeRegexTest's own default.
  */
-export declare function scanPatternsWithMultilineSupport(content: string, config: MultilineScanConfig, lineContexts?: LineContext[]): SecurityFinding[];
+maxLength?: number): SecurityFinding[];
 /**
  * SMI-685: Calculate risk score from findings
  * SMI-1513: Accounts for confidence levels (low confidence = reduced weight)

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAQnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK3D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA0ErE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,mDAAmD;IACnD,UAAU,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAoEnB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,kBAAkB,CAAA;CAC9B,CA6HA"}
+{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAElB,YAAY,EACb,MAAM,YAAY,CAAA;AAcnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA0ErE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,eAAe,EAAE,CAmGnB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,kBAAkB,CAAA;CAC9B,CA6HA"}