@skillsmith/core 0.11.3 → 0.11.5

package/dist/src/security/scanner/SecurityScanner.evidence.js

@@ -0,0 +1,176 @@
+/**
+ * Security Scanner — evidence-tier severity resolution (SMI-5876)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.evidence
+ *
+ * Turns a pattern's `EvidenceType` (classified in
+ * `patterns.jailbreak.evidence.ts`'s `EVIDENCE_TYPE_BY_PATTERN`, SMI-5881)
+ * plus documentation context into a severity/confidence pair, and provides
+ * the corroboration escalation that lifts a `mention`-tier finding when it
+ * co-occurs with a genuinely dangerous non-documentation signal elsewhere in
+ * the same scan.
+ */
+import { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+/**
+ * Classify a pattern's evidence tier by object identity. Unmapped patterns
+ * (i.e. a pattern added to JAILBREAK_PATTERNS/AI_DEFENCE_PATTERNS without an
+ * `EVIDENCE_TYPE_BY_PATTERN` entry) default to `imperative_instruction` —
+ * fail-closed: forgetting to classify a new pattern makes it the STRONGEST
+ * tier, never the weakest, so a missed classification can never silently
+ * soften detection.
+ */
+export function classifyEvidence(p) {
+    return EVIDENCE_TYPE_BY_PATTERN.get(p) ?? 'imperative_instruction';
+}
+/**
+ * Relative strength ordering used by the merge-loop in
+ * `SecurityScanner.helpers.ts` to pick the strongest evidence per line across
+ * both the multi-line and single-line scan passes. `imperative_instruction`,
+ * `instruction_override`, and `state_assertion` are equal rank — the
+ * severity table below treats them identically, and none needs to out-rank
+ * the others. `state_assertion` (SMI-5876 design-pass follow-up) is a
+ * distinct machine-readable REASON CODE for a declarative jailbroken-state
+ * assertion ("Jailbreak activated") rather than a directive aimed at the
+ * model — same severity tuple, different diagnostic label.
+ */
+export const EVIDENCE_RANK = {
+    mention: 0,
+    role_turn_with_body: 1,
+    imperative_instruction: 2,
+    instruction_override: 2,
+    state_assertion: 2,
+};
+/** The highest rank in `EVIDENCE_RANK` — once reached, no later pattern on the same line can beat it. */
+export const MAX_EVIDENCE_RANK = 2;
+/**
+ * Severity/confidence decision table (SMI-5876 design §4.1). Doc-context
+ * confidence for the directive tiers is `medium`, not `low` — `low` would be
+ * self-contradictory next to a still-failing severity (it would also cut the
+ * risk-score weight to 0.3x, which is not the intent for a directive payload
+ * that merely happens to sit inside a fenced example).
+ */
+export const EVIDENCE_SEVERITY_TABLE = {
+    mention: {
+        nonDoc: { severity: 'low', confidence: 'low' },
+        doc: { severity: 'low', confidence: 'low' },
+    },
+    role_turn_with_body: {
+        nonDoc: { severity: 'high', confidence: 'high' },
+        doc: { severity: 'medium', confidence: 'medium' },
+    },
+    imperative_instruction: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+    instruction_override: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+    // SMI-5876 design-pass follow-up: same tuple as imperative_instruction —
+    // state_assertion is a distinct reason code, not a distinct severity tier.
+    state_assertion: {
+        nonDoc: { severity: 'critical', confidence: 'high' },
+        doc: { severity: 'high', confidence: 'medium' },
+    },
+};
+/** Resolve the severity/confidence pair for an evidence tier + documentation context. */
+export function resolveEvidenceSeverity(tier, inDocumentationContext) {
+    const entry = EVIDENCE_SEVERITY_TABLE[tier];
+    return inDocumentationContext ? entry.doc : entry.nonDoc;
+}
+/**
+ * SMI-5876 (post-implementation correction): corroborator eligibility is an
+ * ALLOWLIST of INSTRUCTION-BEARING attack categories, not a denylist of
+ * everything-except-self.
+ *
+ * The original design specified `type ∉ {jailbreak, ai_defence}`, reasoning only
+ * about same-category circularity. That is the classic denylist failure — it
+ * silently admits every category nobody considered. It admitted `pii`, whose
+ * plain-email pattern fires on the author-contact bullet that nearly every
+ * SKILL.md carries, so an unrelated `- Email: support@…` 74 lines away lifted a
+ * benign "jailbreak" mention to high in this repo's OWN bundled SKILL.md — one of
+ * SMI-5876's three acceptance fixtures.
+ *
+ * Both existing precedents here are allowlists: CODE_EXECUTION_CO_OCCURRENCE
+ * (SecurityScanner.exec.ts) and SUPPLY_CHAIN_CO_SIGNALS
+ * (SecurityScanner.hostile-update.ts). This restores that discipline.
+ *
+ * Inclusion rule — the category must be INSTRUCTION-BEARING (its patterns match
+ * an instruction to do something adversarial). Deliberately excluded:
+ *   • `pii` / `sensitive_path` — REFERENCE-bearing. A contact email or a `.env`
+ *     path says something about data hygiene, nothing about whether a jailbreak
+ *     ATTEMPT is present.
+ *   • `suspicious_pattern` — `eval(` / `child_process` are ordinary vocabulary in
+ *     dev-tooling skills.
+ *   • `social_engineering` / `prompt_leaking` — semantically ADJACENT to jailbreak;
+ *     admitting them recreates the very circularity the self-exclusion prevents
+ *     (a persona/roleplay skill would lift its own jailbreak mentions).
+ *   • `typosquat` — a property of the skill NAME, not its content.
+ *   • `url` — capped at medium, so it could never qualify anyway.
+ *   • `jailbreak` / `ai_defence` — same-category self-lift (original exclusion).
+ */
+const CORROBORATING_SIGNALS = new Set([
+    'code_execution',
+    'obfuscated_directive',
+    'data_exfiltration',
+    'privilege_escalation',
+    'ssrf',
+]);
+/**
+ * Maximum line distance between a mention and its corroborator.
+ *
+ * Why a bounded window is NOT a bypass vector: corroboration is a risk-SCORE and
+ * hostile-update amplifier only — it can never flip `passed`, because any
+ * qualifying corroborator is itself high/critical and therefore already fails the
+ * scan on its own (`passed = !hasCritical && !hasHigh && !exceedsThreshold`). An
+ * attacker who separates the two signals to duck the window still fails on the
+ * corroborator alone; all they achieve is a slightly lower numeric score on a
+ * scan that already blocks.
+ *
+ * 40 lines comfortably spans a real payload block (persona preamble plus the
+ * instructions it sets up) while excluding the "unrelated finding in a different
+ * section of a long document" case that motivated this constraint.
+ */
+const MAX_CORROBORATION_LINE_DISTANCE = 40;
+/**
+ * Escalate a `mention`-tier finding when an ALLOWLISTED non-documentation
+ * high/critical finding is ALSO present within `MAX_CORROBORATION_LINE_DISTANCE`
+ * lines in the same scan (SMI-5876 design §4.3, corrected post-implementation —
+ * see `CORROBORATING_SIGNALS`' doc comment for the denylist->allowlist fix and
+ * the locality-window rationale). Mutates findings in place, mirroring
+ * `escalateCodeExecution`'s mutation style (SecurityScanner.exec.ts).
+ *
+ * MUST run after `escalateCodeExecution` (SecurityScanner.ts's `scan()`) so a
+ * freshly-critical `code_execution` finding can itself serve as a
+ * corroborator. No feedback loop the other way: `CODE_EXECUTION_CO_OCCURRENCE`
+ * (SecurityScanner.exec.ts) contains only `data_exfiltration`,
+ * `privilege_escalation`, `sensitive_path`, and `obfuscated_directive` — never
+ * `jailbreak` or `ai_defence` — so lifting a mention here can never
+ * retroactively change `escalateCodeExecution`'s own decision (verified by
+ * reading SecurityScanner.exec.ts directly, SMI-5876 implementation).
+ */
+export function escalateCorroboratedMentions(findings) {
+    const corroborators = findings.filter((f) => (f.severity === 'high' || f.severity === 'critical') &&
+        f.inDocumentationContext !== true &&
+        CORROBORATING_SIGNALS.has(f.type) &&
+        typeof f.lineNumber === 'number');
+    if (corroborators.length === 0)
+        return;
+    for (const finding of findings) {
+        if (finding.evidenceType !== 'mention')
+            continue;
+        if (typeof finding.lineNumber !== 'number')
+            continue;
+        const corroborator = corroborators.find((c) => Math.abs(c.lineNumber - finding.lineNumber) <=
+            MAX_CORROBORATION_LINE_DISTANCE);
+        if (!corroborator)
+            continue;
+        const inDoc = finding.inDocumentationContext === true;
+        finding.severity = inDoc ? 'medium' : 'high';
+        finding.confidence = inDoc ? 'low' : 'medium';
+        finding.corroborated = true;
+        finding.message =
+            `Corroborated by a co-occurring non-documentation ${corroborator.type} ` +
+                `finding at line ${corroborator.lineNumber} — ${finding.message}`;
+    }
+}
+//# sourceMappingURL=SecurityScanner.evidence.js.map

package/dist/src/security/scanner/SecurityScanner.evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.evidence.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAE3E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAA;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiC;IACzD,OAAO,EAAE,CAAC;IACV,mBAAmB,EAAE,CAAC;IACtB,sBAAsB,EAAE,CAAC;IACzB,oBAAoB,EAAE,CAAC;IACvB,eAAe,EAAE,CAAC;CACnB,CAAA;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAMhC;IACF,OAAO,EAAE;QACP,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;QAC9C,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;KAC5C;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;QAChD,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE;KAClD;IACD,sBAAsB,EAAE;QACtB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,eAAe,EAAE;QACf,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE;QACpD,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChD;CACF,CAAA;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CACrC,IAAkB,EAClB,sBAA+B;IAE/B,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,qBAAqB,GAAqC,IAAI,GAAG,CAAC;IACtE,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,MAAM;CACP,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA2B;IACtE,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACpD,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CACnC,CAAA;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,SAAQ;QAChD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAQ;QACpD,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,GAAG,CAAE,CAAC,CAAC,UAAqB,GAAI,OAAO,CAAC,UAAqB,CAAC;YACnE,+BAA+B,CAClC,CAAA;QACD,IAAI,CAAC,YAAY;YAAE,SAAQ;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAA;QACrD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QAC5C,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC7C,OAAO,CAAC,YAAY,GAAG,IAAI,CAAA;QAC3B,OAAO,CAAC,OAAO;YACb,oDAAoD,YAAY,CAAC,IAAI,GAAG;gBACxE,mBAAmB,YAAY,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACrE,CAAC;AACH,CAAC"}

package/dist/src/security/scanner/SecurityScanner.exec.d.ts

@@ -55,9 +55,16 @@ export declare function scanObfuscatedDirective(content: string): SecurityFindin
 /**
  * Escalate the code_execution finding to CRITICAL when a NON-documentation
  * high/critical exfiltration / privilege / credential-path / obfuscation signal
- * is also present. Mutates the finding in place. Requiring the co-signal to be
+ * is also present WITHIN `MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE` lines
+ * (SMI-5880 — previously any distance qualified, so an unrelated finding in a
+ * different section of a long document escalated an unrelated code_execution
+ * finding). Mutates the finding in place. Requiring the co-signal to be
  * non-documentation keeps legitimate security-research skills (whose examples
  * live in fenced blocks) at MEDIUM.
+ *
+ * Runs BEFORE the sibling corroboration mechanism in `scan()` — see that
+ * function's doc comment (SecurityScanner.evidence.ts) for why the ordering is
+ * safe in both directions.
  */
 export declare function escalateCodeExecution(findings: SecurityFinding[]): void;
 //# sourceMappingURL=SecurityScanner.exec.d.ts.map

package/dist/src/security/scanner/SecurityScanner.exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.exec.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAA;AAGtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA4B/D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AA0BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAuC1E;AAaD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAgBvE"}
+{"version":3,"file":"SecurityScanner.exec.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,MAAM,YAAY,CAAA;AAGtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA4B/D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AA0BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA6BnB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CAuC1E;AA8DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAiBvE"}

package/dist/src/security/scanner/SecurityScanner.exec.js

@@ -168,12 +168,67 @@ const CODE_EXECUTION_CO_OCCURRENCE = new Set([
     'sensitive_path',
     'obfuscated_directive',
 ]);
+/**
+ * Maximum line distance between the `code_execution` finding and the co-signal
+ * that escalates it (SMI-5880). Before this bound, a co-signal ANYWHERE in the
+ * document — any distance, any unrelated section — escalated the single
+ * `code_execution` finding to critical.
+ *
+ * Why a bounded window is NOT a bypass vector: every eligible co-signal is
+ * already `high` or `critical`, and `scan()` (SecurityScanner.ts) computes
+ * `passed = !hasCritical && !hasHigh && !exceedsThreshold` across ALL findings
+ * with no locality filter and no documentation filter. A qualifying co-signal
+ * anywhere therefore forces `passed === false` on its own, BEFORE this function
+ * runs. Splitting the two signals to duck this window cannot turn a failing scan
+ * into a passing one; it changes only this finding's own label (medium vs
+ * critical) and the risk-score magnitude of a scan that already blocks.
+ * Hostile-update detection is likewise untouched: `detectSupplyChain()`
+ * (SecurityScanner.hostile-update.ts) pairs a NEW non-doc `code_execution` of ANY
+ * severity with a NEW non-doc high/critical co-signal at ANY distance, so a
+ * far-apart rug-pull still returns the `hostile` verdict and its supply-chain
+ * reason string.
+ *
+ * Deliberately the same 40 as the sibling corroboration mechanism's locality
+ * constant (SecurityScanner.evidence.ts) so the scanner has ONE locality model
+ * — but kept as its own constant, not imported: the two mechanisms are
+ * independently tunable, and the edge twins (SMI-5879) cannot import from core
+ * and must carry their own copy.
+ */
+const MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE = 40;
+/**
+ * Locality gate for `escalateCodeExecution`. Fail-CLOSED on missing metadata:
+ * when either side has no `lineNumber` the distance is unknowable, and this
+ * subsystem's convention is that missing metadata must never SILENTLY weaken
+ * detection — cf. `classifyEvidence` (SecurityScanner.evidence.ts), whose
+ * unmapped-pattern default is the STRONGEST tier for exactly this reason. An
+ * unknowable distance therefore preserves the pre-SMI-5880 unbounded behavior for
+ * that pair rather than suppressing the co-signal.
+ *
+ * Unreachable through `scan()` today: `scanCodeExecution` above and every emitter
+ * of the four CODE_EXECUTION_CO_OCCURRENCE types set `lineNumber` unconditionally
+ * (the sensitive-path/data-exfiltration/privilege-escalation scanners in the
+ * scanners module, the chmod-compound detector, and `scanObfuscatedDirective`
+ * above). Kept as an explicit, directly-tested branch so a future detector that
+ * forgets `lineNumber` degrades safe instead of silently ceasing to escalate.
+ */
+function isWithinCoSignalWindow(codeExecLine, coSignalLine) {
+    if (typeof codeExecLine !== 'number' || typeof coSignalLine !== 'number')
+        return true;
+    return Math.abs(codeExecLine - coSignalLine) <= MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE;
+}
 /**
  * Escalate the code_execution finding to CRITICAL when a NON-documentation
  * high/critical exfiltration / privilege / credential-path / obfuscation signal
- * is also present. Mutates the finding in place. Requiring the co-signal to be
+ * is also present WITHIN `MAX_CODE_EXECUTION_CO_SIGNAL_LINE_DISTANCE` lines
+ * (SMI-5880 — previously any distance qualified, so an unrelated finding in a
+ * different section of a long document escalated an unrelated code_execution
+ * finding). Mutates the finding in place. Requiring the co-signal to be
  * non-documentation keeps legitimate security-research skills (whose examples
  * live in fenced blocks) at MEDIUM.
+ *
+ * Runs BEFORE the sibling corroboration mechanism in `scan()` — see that
+ * function's doc comment (SecurityScanner.evidence.ts) for why the ordering is
+ * safe in both directions.
  */
 export function escalateCodeExecution(findings) {
     const codeExec = findings.find((f) => f.type === 'code_execution');
@@ -182,7 +237,8 @@ export function escalateCodeExecution(findings) {
     const hasDangerousCoSignal = findings.some((f) => f !== codeExec &&
         CODE_EXECUTION_CO_OCCURRENCE.has(f.type) &&
         f.inDocumentationContext !== true &&
-        (f.severity === 'high' || f.severity === 'critical'));
+        (f.severity === 'high' || f.severity === 'critical') &&
+        isWithinCoSignalWindow(codeExec.lineNumber, f.lineNumber));
     if (hasDangerousCoSignal) {
         codeExec.severity = 'critical';
         codeExec.message = `Remote fetch piped to an interpreter, co-occurring with exfiltration/privilege/credential signals — likely supply-chain execution. ${codeExec.message}`;

package/dist/src/security/scanner/SecurityScanner.exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.exec.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,mCAAmC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,eAAe,GACnB,yGAAyG,CAAA;AAC3G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,GAAG,CAAC,CAAA;AAC3F,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,IAAI,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,CAAS;IAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,6BAA6B,GACjC,0ZAA0Z,CAAA;AAE5Z,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACvB,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9D,OAAO;oBACL;wBACE,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,0CAA0C,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GACtE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EACjC,GAAG;wBACH,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,gBAAgB;wBAC1B,sBAAsB,EAAE,YAAY;wBACpC,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;YAAE,SAAQ;QACvC,8DAA8D;QAC9D,IAAI,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEhE,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,IAAI,YAAY;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,IAAI,YAAY,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAErF,KAAK,MAAM,WAAW,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,WAAW,KAAK,GAAG;gBAAE,SAAQ;YACjC,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,yFAAyF,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9G,CAAC,EACD,EAAE,CACH,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;wBACxC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,sBAAsB;wBAChC,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,4BAA4B,GAAqC,IAAI,GAAG,CAAC;IAC7E,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,QAAQ;QACd,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CACvD,CAAA;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAAA;QAC9B,QAAQ,CAAC,OAAO,GAAG,sIAAsI,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC7K,CAAC;AACH,CAAC"}
+{"version":3,"file":"SecurityScanner.exec.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,4EAA4E;AAC5E,6EAA6E;AAC7E,qEAAqE;AACrE,mCAAmC;AACnC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,eAAe,GACnB,yGAAyG,CAAA;AAC3G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,GAAG,CAAC,CAAA;AAC3F,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,eAAe,GAAG,2BAA2B,EAAE,IAAI,CAAC,CAAA;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,CAAS;IAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,gBAAgB,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,6BAA6B,GACjC,0ZAA0Z,CAAA;AAE5Z,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACvB,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9D,OAAO;oBACL;wBACE,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,0CAA0C,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GACtE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EACjC,GAAG;wBACH,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,gBAAgB;wBAC1B,sBAAsB,EAAE,YAAY;wBACpC,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;YAAE,SAAQ;QACvC,8DAA8D;QAC9D,IAAI,cAAc,CAAC,6BAA6B,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEhE,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,IAAI,YAAY;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrD,IAAI,YAAY,IAAI,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAErF,KAAK,MAAM,WAAW,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,WAAW,KAAK,GAAG;gBAAE,SAAQ;YACjC,MAAM,KAAK,GAAG,aAAa,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,yFAAyF,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9G,CAAC,EACD,EAAE,CACH,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;wBACxC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAClC,UAAU,EAAE,CAAC,GAAG,CAAC;wBACjB,QAAQ,EAAE,sBAAsB;wBAChC,sBAAsB,EAAE,KAAK;wBAC7B,UAAU,EAAE,MAAM;qBACnB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,4BAA4B,GAAqC,IAAI,GAAG,CAAC;IAC7E,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,0CAA0C,GAAG,EAAE,CAAA;AAErD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,sBAAsB,CAAC,YAAqB,EAAE,YAAqB;IAC1E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACrF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,0CAA0C,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAA;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,QAAQ;QACd,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACpD,sBAAsB,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAC5D,CAAA;IAED,IAAI,oBAAoB,EAAE,CAAC;QACzB,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAAA;QAC9B,QAAQ,CAAC,OAAO,GAAG,sIAAsI,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC7K,CAAC;AACH,CAAC"}

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts

@@ -2,7 +2,7 @@
  * Security Scanner Helper Functions
  * @module @skillsmith/core/security/scanner/SecurityScanner.helpers
  */
-import type { SecurityFinding, SecurityFindingType, RiskScoreBreakdown, SecuritySeverity } from './types.js';
+import type { SecurityFinding, SecurityFindingType, RiskScoreBreakdown, EvidenceType } from './types.js';
 /**
  * Context information for each line in markdown content
  */
@@ -21,12 +21,6 @@ export interface LineContext {
      */
     inFrontmatter: boolean;
 }
-/**
- * SMI-1532: Check if a regex pattern requires multi-line matching
- * Patterns that contain newline/carriage-return characters or start with
- * multi-line anchors need to be tested against full content, not line-by-line.
- */
-export declare function isMultilinePattern(pattern: RegExp): boolean;
 /**
  * Analyze markdown content and return context for each line
  * Used to reduce false positives in documentation/examples
@@ -59,14 +53,45 @@ interface MultilineScanConfig {
     type: SecurityFindingType;
     messagePrefix: string;
     patterns: RegExp[];
-    /** Severity pair: [inDocContext, normalContext] */
-    severities: [SecuritySeverity, SecuritySeverity];
+    /**
+     * SMI-5876: replaces the flat `[docContext, normal]` severity pair — returns
+     * the evidence tier for a given pattern (by object identity) so
+     * severity/confidence can be resolved per-line via `resolveEvidenceSeverity`
+     * once the strongest tier for that line is known.
+     */
+    classify: (pattern: RegExp) => EvidenceType;
 }
 /**
  * Scan content for patterns that may span multiple lines.
  * Multi-line patterns are tested against full content; single-line patterns per-line.
+ *
+ * SMI-5876: patterns within a single category (jailbreak / ai_defence) can now
+ * carry DIFFERENT evidence tiers (a bare "jailbreak" mention vs. an explicit
+ * "ignore all previous instructions" override), so array-declaration order is
+ * no longer sufficient to decide which match wins on a line where multiple
+ * patterns fire — the STRONGEST evidence tier per line wins, computed via a
+ * merge across both passes (`bestByLine`), not "first match, in array order."
+ *
+ * Two hazards this closes (see the SMI-5876 design doc §5 for the full
+ * argument):
+ *   Hazard A — pass 2 used to `break` on the FIRST matching pattern
+ *     regardless of tier, so a weaker mention declared earlier in the array
+ *     could shadow a stronger directive declared later on the same line.
+ *   Hazard B — a multiline pattern match used to suppress ALL single-line
+ *     patterns on that line (`flaggedLines`), so a mention-tier multiline
+ *     match could hide a directive-tier single-line match on the same line.
+ *     `bestByLine` SEEDS pass 2 with pass 1's result instead of skipping the
+ *     line outright, so pass 2 can still find something stronger.
+ */
+export declare function scanPatternsWithMultilineSupport(content: string, config: MultilineScanConfig, lineContexts?: LineContext[], 
+/**
+ * SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
+ * regex scan — `Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`,
+ * computed once by SecurityScanner.scan() and threaded through so the
+ * truncation finding it emits matches what actually gets scanned. Omitted
+ * (undefined) falls back to safeRegexTest's own default.
  */
-export declare function scanPatternsWithMultilineSupport(content: string, config: MultilineScanConfig, lineContexts?: LineContext[]): SecurityFinding[];
+maxLength?: number): SecurityFinding[];
 /**
  * SMI-685: Calculate risk score from findings
  * SMI-1513: Accounts for confidence levels (low confidence = reduced weight)

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAQnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK3D;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA0ErE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,mDAAmD;IACnD,UAAU,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAoEnB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,kBAAkB,CAAA;CAC9B,CA6HA"}
+{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAElB,YAAY,EACb,MAAM,YAAY,CAAA;AAcnB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA0ErE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,eAAe,EAAE,CAmGnB;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,kBAAkB,CAAA;CAC9B,CA6HA"}

package/dist/src/security/scanner/SecurityScanner.helpers.js

@@ -4,18 +4,8 @@
  */
 import { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 import { safeRegexTest } from './regex-utils.js';
-// ============================================================================
-// Pattern Helpers
-// ============================================================================
-/**
- * SMI-1532: Check if a regex pattern requires multi-line matching
- * Patterns that contain newline/carriage-return characters or start with
- * multi-line anchors need to be tested against full content, not line-by-line.
- */
-export function isMultilinePattern(pattern) {
-    const patternStr = pattern.source;
-    return (patternStr.includes('\\r') || patternStr.includes('\\n') || patternStr.startsWith('(?:^|\\n)'));
-}
+import { EVIDENCE_RANK, MAX_EVIDENCE_RANK, resolveEvidenceSeverity, } from './SecurityScanner.evidence.js';
+import { resolvePatternScope } from './patterns.scope.js';
 // ============================================================================
 // Markdown Context Analysis
 // ============================================================================
@@ -130,70 +120,127 @@ export function isWithinInlineCode(line, matchIndex) {
 /**
  * Scan content for patterns that may span multiple lines.
  * Multi-line patterns are tested against full content; single-line patterns per-line.
+ *
+ * SMI-5876: patterns within a single category (jailbreak / ai_defence) can now
+ * carry DIFFERENT evidence tiers (a bare "jailbreak" mention vs. an explicit
+ * "ignore all previous instructions" override), so array-declaration order is
+ * no longer sufficient to decide which match wins on a line where multiple
+ * patterns fire — the STRONGEST evidence tier per line wins, computed via a
+ * merge across both passes (`bestByLine`), not "first match, in array order."
+ *
+ * Two hazards this closes (see the SMI-5876 design doc §5 for the full
+ * argument):
+ *   Hazard A — pass 2 used to `break` on the FIRST matching pattern
+ *     regardless of tier, so a weaker mention declared earlier in the array
+ *     could shadow a stronger directive declared later on the same line.
+ *   Hazard B — a multiline pattern match used to suppress ALL single-line
+ *     patterns on that line (`flaggedLines`), so a mention-tier multiline
+ *     match could hide a directive-tier single-line match on the same line.
+ *     `bestByLine` SEEDS pass 2 with pass 1's result instead of skipping the
+ *     line outright, so pass 2 can still find something stronger.
  */
-export function scanPatternsWithMultilineSupport(content, config, lineContexts) {
-    const findings = [];
+export function scanPatternsWithMultilineSupport(content, config, lineContexts, 
+/**
+ * SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
+ * regex scan — `Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`,
+ * computed once by SecurityScanner.scan() and threaded through so the
+ * truncation finding it emits matches what actually gets scanned. Omitted
+ * (undefined) falls back to safeRegexTest's own default.
+ */
+maxLength) {
     const lines = content.split('\n');
     const contexts = lineContexts ?? analyzeMarkdownContext(content);
-    const flaggedLines = new Set();
-    // First pass: multi-line patterns against full content
+    const bestByLine = new Map();
+    const rank = (t) => EVIDENCE_RANK[t];
+    // First pass: 'content' | 'both'-scope patterns against full content. No
+    // break — every such pattern is independently tested (same cost as before:
+    // at most one full-content scan per pattern), and the strongest tier per
+    // line wins.
     for (const pattern of config.patterns) {
-        if (isMultilinePattern(pattern)) {
-            const match = safeRegexTest(pattern, content);
-            if (match) {
-                const matchIndex = content.indexOf(match[0]);
-                const lineNumber = content.slice(0, matchIndex).split('\n').length;
-                const ctx = contexts[lineNumber - 1];
-                const matchLine = lines[lineNumber - 1] ?? '';
-                const lineOffset = content.lastIndexOf('\n', matchIndex - 1) + 1;
-                const matchCol = matchIndex - lineOffset;
-                const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
-                const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-                const confidence = inDocContext ? 'low' : 'high';
-                const severity = inDocContext ? config.severities[0] : config.severities[1];
-                const truncated = match[0].slice(0, 50);
-                findings.push({
-                    type: config.type,
-                    severity,
-                    message: `${config.messagePrefix}: "${truncated}${match[0].length > 50 ? '...' : ''}"`,
-                    location: match[0].trim().slice(0, 100),
-                    lineNumber,
-                    category: config.type,
-                    inDocumentationContext: inDocContext,
-                    confidence,
-                });
-                flaggedLines.add(lineNumber);
-            }
+        if (resolvePatternScope(pattern) === 'line')
+            continue;
+        const match = safeRegexTest(pattern, content, maxLength);
+        if (!match)
+            continue;
+        // SMI-5876: use the match's own reported index rather than a fresh
+        // content.indexOf(match[0]) — the latter misreports the line whenever the
+        // matched text ALSO occurs earlier in the content (a real hazard fixed in
+        // the same pass as the evidence-tier merge).
+        const matchIndex = match.index ?? content.indexOf(match[0]);
+        const lineNumber = content.slice(0, matchIndex).split('\n').length;
+        const ctx = contexts[lineNumber - 1];
+        const matchLine = lines[lineNumber - 1] ?? '';
+        const lineOffset = content.lastIndexOf('\n', matchIndex - 1) + 1;
+        const matchCol = matchIndex - lineOffset;
+        const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(matchLine, matchCol);
+        const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+        const tier = config.classify(pattern);
+        const incumbent = bestByLine.get(lineNumber);
+        if (!incumbent || rank(tier) > rank(incumbent.tier)) {
+            bestByLine.set(lineNumber, {
+                tier,
+                matchText: match[0],
+                location: match[0].trim().slice(0, 100),
+                inDocContext,
+            });
         }
     }
-    // Second pass: single-line patterns per-line
+    // Second pass: 'line' | 'both'-scope patterns, per-line. Seeds `best` from
+    // pass 1 (does NOT skip a line pass 1 already flagged) so a line-local
+    // directive can still beat a weaker multiline mention on the same line
+    // (Hazard B).
     lines.forEach((line, index) => {
-        if (flaggedLines.has(index + 1))
-            return;
+        const lineNumber = index + 1;
         const ctx = contexts[index];
+        let best = bestByLine.get(lineNumber) ?? null;
         for (const pattern of config.patterns) {
-            if (isMultilinePattern(pattern))
+            if (resolvePatternScope(pattern) === 'content')
                 continue;
             const match = safeRegexTest(pattern, line);
-            if (match) {
+            if (!match)
+                continue;
+            const tier = config.classify(pattern);
+            if (!best || rank(tier) > rank(best.tier)) {
                 const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
                 const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
-                const confidence = inDocContext ? 'low' : 'high';
-                const severity = inDocContext ? config.severities[0] : config.severities[1];
-                findings.push({
-                    type: config.type,
-                    severity,
-                    message: `${config.messagePrefix}: "${match[0].slice(0, 50)}${match[0].length > 50 ? '...' : ''}"`,
+                best = {
+                    tier,
+                    matchText: match[0],
                     location: line.trim().slice(0, 100),
-                    lineNumber: index + 1,
-                    category: config.type,
-                    inDocumentationContext: inDocContext,
-                    confidence,
-                });
-                break;
+                    inDocContext,
+                };
             }
+            // Cannot be beaten — stop scanning this line's remaining patterns.
+            if (rank(tier) === MAX_EVIDENCE_RANK)
+                break;
         }
+        if (best)
+            bestByLine.set(lineNumber, best);
     });
+    // Emit one finding per flagged line, in ascending line-number order
+    // (matches the line-by-line order callers/tests expect from a per-line
+    // scan; emission cardinality only ever tightens — one finding per line per
+    // category, same as before the merge).
+    const findings = [];
+    const orderedLines = Array.from(bestByLine.keys()).sort((a, b) => a - b);
+    for (const lineNumber of orderedLines) {
+        const candidate = bestByLine.get(lineNumber);
+        if (!candidate)
+            continue;
+        const { severity, confidence } = resolveEvidenceSeverity(candidate.tier, candidate.inDocContext);
+        const truncated = candidate.matchText.slice(0, 50);
+        findings.push({
+            type: config.type,
+            severity,
+            message: `${config.messagePrefix}: "${truncated}${candidate.matchText.length > 50 ? '...' : ''}"`,
+            location: candidate.location,
+            lineNumber,
+            category: config.type,
+            inDocumentationContext: candidate.inDocContext,
+            confidence,
+            evidenceType: candidate.tier,
+        });
+    }
     return findings;
 }
 // ============================================================================