@skillsmith/core 0.11.3 → 0.11.5

package/dist/src/security/scanner/multiline-category-closure.test.js

@@ -0,0 +1,287 @@
+/**
+ * SMI-5879 Wave 3 item 2 — structural closure test for cohort E's exclusion
+ * proof (design doc `smi-5879-edge-twin-parity-design.md` §8.3.1.2.2).
+ * @module @skillsmith/core/security/scanner/multiline-category-closure.test
+ *
+ * WHY THIS TEST EXISTS
+ *
+ * The SMI-5879 census (comparing pre-port vs post-port `skills.security_score`
+ * across ~344k rows) needs to fully re-simulate every row scoring `>= 8`
+ * (cohort C1) but can structurally EXCLUDE every row scoring `0-7` (cohort E)
+ * from that expensive re-simulation — *if and only if* three properties about
+ * how the multiline pass routes patterns hold. The design doc's §8.3.1.2.1
+ * proves those properties in prose ("P1/P2/P3"); this file promotes that proof
+ * to a machine-checked gate (design doc gate G-5) so a future source change
+ * that silently invalidates the premise fails CI instead of silently
+ * corrupting the census's soundness.
+ *
+ * THE +32 ARITHMETIC THIS TEST PROTECTS (not itself re-derived here — that is
+ * `weights.ts` + the design doc's §8.3.1.2 arithmetic; this file only proves
+ * the ROUTING facts the arithmetic depends on):
+ *   max joint contribution = 100 * CATEGORY_WEIGHTS.jailbreak.coefficient (0.20)
+ *                           + 100 * CATEGORY_WEIGHTS.ai_defence.coefficient (0.12)
+ *                           = 32.0
+ *   S <= 7  =>  S' <= S + 32 <= 39 < 40 (QUARANTINE_THRESHOLD)  =>  verdict
+ *   cannot flip to quarantined for any row starting at or below 7.
+ * That bound is sound ONLY IF the multiline pass can never inflate any
+ * category's subtotal OTHER than jailbreak / ai_defence. The three assertions
+ * below are exactly what closes that "only if".
+ *
+ * THE DOCUMENTED TRAP (design doc §8.3.1.2.3) — DELIBERATELY NOT REPEATED HERE
+ *
+ * The design doc warns against writing assertion 3 as "every pattern for
+ * which `isMultilinePattern()` returns true belongs to an AI-category array"
+ * — that predicate is syntactic (it fires on a NEGATED class `[^\n]`, the
+ * literal opposite of "spans lines") and is false today for 9 patterns across
+ * two non-AI arrays. This file does not use that predicate at all: assertions
+ * 1 and 3 are asserted over the multiline pass's CALL SITES (which pattern
+ * array is physically wired to `scanPatternsWithMultilineSupport`'s `patterns:`
+ * config field), not over any per-pattern syntactic test. That is the
+ * "routing, not predicate" distinction the trap section requires.
+ *
+ * SMI-5881 ADAPTATION (judgment call — flagged, not silently resolved)
+ *
+ * The design doc's assertion 2 is written directly against `isMultilinePattern()`
+ * as the definition of "PASS-1 pattern". SMI-5881 (merged before this file was
+ * written) DELETED `isMultilinePattern()` entirely — no compatibility shim —
+ * and replaced the syntactic heuristic with `PATTERN_SCOPE` /
+ * `resolvePatternScope()` (`./patterns.scope.ts`), an explicit per-pattern
+ * `'line' | 'content' | 'both'` declaration. `isMultilinePattern` cannot be
+ * imported here; it no longer exists anywhere under `packages/core/src`
+ * (guarded by `packages/core/tests/security/pattern-scope.test.ts`).
+ *
+ * `scanPatternsWithMultilineSupport`'s pass 1 (SecurityScanner.helpers.ts) now
+ * reads: `if (resolvePatternScope(pattern) === 'line') continue` — i.e. pass 1
+ * tests every pattern whose resolved scope is NOT `'line'` (`'content'` or
+ * `'both'`). That predicate is the faithful, current-source equivalent of the
+ * design doc's `routed.filter(isMultilinePattern)` — same set membership
+ * question ("which patterns does pass 1 actually read"), expressed against
+ * the model that replaced the deleted one. Assertion 2 below uses
+ * `resolvePatternScope(p) !== 'line'` for exactly this reason.
+ *
+ * CODE-REVIEW REMEDIATION (Finding 1 — NO-GO, fixed)
+ *
+ * A first version of this file enumerated call sites with a bounded
+ * text-window regex scan (`CALL_TOKEN = 'scanPatternsWithMultilineSupport('`
+ * + an `EXTRACTION_WINDOW`-char lookahead for `type:`/`patterns:`). Codex
+ * (gpt-5.6-sol) review flagged that as a silent-false-negative hazard: a new
+ * call site using extra whitespace before `(`, a locally-aliased identifier,
+ * or a renamed import would be invisible to that regex while the existing two
+ * call sites kept the count green — defeating the point of a closure proof
+ * meant to catch exactly this class of drift. `extractMultilineCallSites`
+ * below instead walks the real TypeScript AST (`ts.createSourceFile` +
+ * `CallExpression` traversal resolved through `collectAliases`), which is
+ * exhaustive by construction against all three variants. Verified via mutation
+ * testing: a temporarily-added call through a whitespace-before-paren AND a
+ * locally-aliased form was both correctly detected (count became 3, assertion
+ * 1 failed) before being reverted.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it, expect } from 'vitest';
+import * as ts from 'typescript';
+import { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+import { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+import { resolvePatternScope } from './patterns.scope.js';
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const SCANNER_PATH = join(__dirname, 'SecurityScanner.ts');
+const SCANNER_SRC = readFileSync(SCANNER_PATH, 'utf-8');
+/** The only two pattern arrays a `scanPatternsWithMultilineSupport` call site may name. */
+const AI_CATEGORY_ARRAY_NAMES = ['JAILBREAK_PATTERNS', 'AI_DEFENCE_PATTERNS'];
+/**
+ * Every OTHER pattern array in the scanner (design doc §8.3.1.2.2 assertion 3's
+ * explicit exclusion list). `BLOCKED_PATTERNS` is not a real exported const
+ * (blocked patterns are an instance-level `ScannerOptions.blockedPatterns`,
+ * `SecurityScanner.ts:73`) — kept in the list anyway because the design doc
+ * names it explicitly and the check is "this identifier never appears as a
+ * `patterns:` value", which is true (and meaningfully checked) regardless of
+ * whether the identifier is otherwise reachable.
+ */
+const NON_AI_ARRAY_NAMES = [
+    'SUSPICIOUS_PATTERNS',
+    'DATA_EXFILTRATION_PATTERNS',
+    'PRIVILEGE_ESCALATION_PATTERNS',
+    'CODE_EXECUTION_PATTERNS',
+    'BLOCKED_PATTERNS',
+];
+const TARGET_FUNCTION_NAME = 'scanPatternsWithMultilineSupport';
+/** The textual callee name of a call expression: `foo(` -> "foo"; `x.bar(` -> "bar". */
+function calleeName(expr) {
+    if (ts.isIdentifier(expr))
+        return expr.text;
+    if (ts.isPropertyAccessExpression(expr))
+        return expr.name.text;
+    return undefined;
+}
+/**
+ * Every local identifier in `sourceFile` that resolves to `targetName` — the
+ * name itself, any `import { targetName as Local }` rename, and any simple
+ * `const Local = <alias>` variable alias (resolved transitively, to a fixed
+ * point, so a chain like `const a = target; const b = a` also resolves).
+ * This is what makes the call-site walk below exhaustive against the "an
+ * alias" failure mode the code review named: a call reached through a
+ * renamed import or a locally-aliased identifier still resolves back to
+ * `targetName` and is detected, where a literal-token text scan would miss it.
+ */
+function collectAliases(sourceFile, targetName) {
+    const aliases = new Set([targetName]);
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt) || !stmt.importClause?.namedBindings)
+            continue;
+        const bindings = stmt.importClause.namedBindings;
+        if (!ts.isNamedImports(bindings))
+            continue;
+        for (const el of bindings.elements) {
+            const imported = el.propertyName?.text ?? el.name.text;
+            if (imported === targetName)
+                aliases.add(el.name.text);
+        }
+    }
+    let changed = true;
+    while (changed) {
+        changed = false;
+        const visit = (node) => {
+            if (ts.isVariableDeclaration(node) &&
+                ts.isIdentifier(node.name) &&
+                node.initializer &&
+                ts.isIdentifier(node.initializer) &&
+                aliases.has(node.initializer.text) &&
+                !aliases.has(node.name.text)) {
+                aliases.add(node.name.text);
+                changed = true;
+            }
+            ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(sourceFile, visit);
+    }
+    return aliases;
+}
+/** The textual name of an object-literal member (identifier or string-literal key). */
+function memberName(prop) {
+    if (!prop.name)
+        return undefined;
+    if (ts.isIdentifier(prop.name))
+        return prop.name.text;
+    if (ts.isStringLiteral(prop.name))
+        return prop.name.text;
+    return undefined;
+}
+/**
+ * Extract every `scanPatternsWithMultilineSupport(...)` call site in `source`
+ * (at path `filePath`, used only for error messages), together with its
+ * config object's `type:` and `patterns:` values — via full TypeScript AST
+ * traversal (`ts.createSourceFile` + a `CallExpression` walk resolved through
+ * `collectAliases`), NOT text/regex matching over a bounded window. This is
+ * exhaustive by construction: extra whitespace before `(`, a call reached
+ * through a renamed import or a locally-aliased identifier, and a config
+ * object appearing in any argument position are all still found — closing
+ * the class of silent false-negative a bounded text-window regex scan cannot
+ * rule out (the defect the code review's Finding 1 identified).
+ *
+ * Throws (rather than silently skipping) when a matched call's arguments
+ * don't have the expected `{ type: '<string literal>', patterns: <bare
+ * identifier> }` shape — an unparseable/unexpected call site must fail
+ * loudly, not be dropped from the count assertion 1 depends on, exactly as
+ * the prior text-based version did for its own class of unparseable input.
+ */
+function extractMultilineCallSites(filePath, source) {
+    const sourceFile = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const aliases = collectAliases(sourceFile, TARGET_FUNCTION_NAME);
+    const sites = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const name = calleeName(node.expression);
+            if (name && aliases.has(name)) {
+                sites.push(extractCallSiteConfig(node, sourceFile, filePath));
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return sites;
+}
+/** Extract and validate the `{ type, patterns }` config object of a matched call. */
+function extractCallSiteConfig(call, sourceFile, filePath) {
+    const offset = call.getStart(sourceFile);
+    const configArg = call.arguments.find((arg) => ts.isObjectLiteralExpression(arg) &&
+        arg.properties.some((p) => memberName(p) === 'type') &&
+        arg.properties.some((p) => memberName(p) === 'patterns'));
+    if (!configArg) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has no ` +
+            `object-literal argument with both 'type' and 'patterns' properties. Either the call shape ` +
+            `changed (update this extraction) or this is a genuine new/malformed call site — both ` +
+            `invalidate the closure proof and must be resolved before this test can pass.`);
+    }
+    const typeProp = configArg.properties.find((p) => memberName(p) === 'type');
+    const patternsProp = configArg.properties.find((p) => memberName(p) === 'patterns');
+    if (!typeProp ||
+        !ts.isPropertyAssignment(typeProp) ||
+        !ts.isStringLiteral(typeProp.initializer)) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has a ` +
+            `'type' property that is not a plain string literal — this is exactly the "expression ` +
+            `argument" shape this AST census exists to catch. Resolve explicitly before this test can pass.`);
+    }
+    if (!patternsProp ||
+        !ts.isPropertyAssignment(patternsProp) ||
+        !ts.isIdentifier(patternsProp.initializer)) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has a ` +
+            `'patterns' property that is not a bare identifier — either a property-access / expression ` +
+            `argument was introduced (the exact "silent miss" class this test exists to catch) or the ` +
+            `call shape genuinely changed. Resolve explicitly before this test can pass.`);
+    }
+    return {
+        offset,
+        type: typeProp.initializer.text,
+        patternsIdent: patternsProp.initializer.text,
+    };
+}
+describe('SMI-5879 Wave 3 item 2 — multiline-pass category closure (design doc §8.3.1.2.2)', () => {
+    const callSites = extractMultilineCallSites(SCANNER_PATH, SCANNER_SRC);
+    // --------------------------------------------------------------------
+    // Assertion 1 — the multiline pass has exactly two call sites, both AI-category
+    // --------------------------------------------------------------------
+    describe('assertion 1 — exactly two call sites, both AI-category (design doc P1/P2)', () => {
+        it('scanPatternsWithMultilineSupport is called exactly twice in SecurityScanner.ts', () => {
+            expect(callSites).toHaveLength(2);
+        });
+        it('the extracted type: multiset equals exactly [ai_defence, jailbreak] — no more, no fewer, no substitution', () => {
+            const types = callSites.map((s) => s.type).sort();
+            expect(types).toEqual(['ai_defence', 'jailbreak']);
+        });
+    });
+    // --------------------------------------------------------------------
+    // Assertion 2 — every PASS-1 pattern is explicitly classified
+    // --------------------------------------------------------------------
+    describe('assertion 2 — every pass-1 pattern is explicitly classified (SMI-5881-adapted)', () => {
+        // "Pass 1" = every pattern scanPatternsWithMultilineSupport's first pass
+        // actually reads: resolvePatternScope(pattern) !== 'line' (see the
+        // SMI-5881 ADAPTATION module-doc comment above for why this replaces the
+        // design doc's isMultilinePattern-filter wording).
+        const routed = [...JAILBREAK_PATTERNS, ...AI_DEFENCE_PATTERNS];
+        const pass1 = routed.filter((p) => resolvePatternScope(p) !== 'line');
+        it('the pass-1 subset is non-empty — the pass is not vacuous', () => {
+            expect(pass1.length).toBeGreaterThan(0);
+        });
+        it('every pass-1 pattern has an explicit EVIDENCE_TYPE_BY_PATTERN entry (object identity, not fail-closed default)', () => {
+            for (const p of pass1) {
+                expect(EVIDENCE_TYPE_BY_PATTERN.has(p), `pattern /${p.source}/${p.flags} has no explicit evidence-tier entry`).toBe(true);
+            }
+        });
+    });
+    // --------------------------------------------------------------------
+    // Assertion 3 — no non-AI pattern array is routed through the multiline pass
+    // --------------------------------------------------------------------
+    describe('assertion 3 — no non-AI pattern array is routed through the multiline pass (design doc P3, NOT the isMultilinePattern predicate)', () => {
+        it('every call site patterns: identifier is one of the two AI-category arrays', () => {
+            for (const site of callSites) {
+                expect(AI_CATEGORY_ARRAY_NAMES, `call site at offset ${site.offset} routes ${site.patternsIdent}, not an AI-category array`).toContain(site.patternsIdent);
+            }
+        });
+        it.each(NON_AI_ARRAY_NAMES)('%s never appears as a patterns: identifier at any call site', (arrayName) => {
+            const idents = callSites.map((s) => s.patternsIdent);
+            expect(idents).not.toContain(arrayName);
+        });
+    });
+});
+//# sourceMappingURL=multiline-category-closure.test.js.map

package/dist/src/security/scanner/multiline-category-closure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiline-category-closure.test.js","sourceRoot":"","sources":["../../../../src/security/scanner/multiline-category-closure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,YAAY,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAA;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AAEvD,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAA;AAEtF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+BAA+B;IAC/B,yBAAyB;IACzB,kBAAkB;CACV,CAAA;AAWV,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AAE/D,wFAAwF;AACxF,SAAS,UAAU,CAAC,IAAmB;IACrC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC3C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IAC9D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,UAAyB,EAAE,UAAkB;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa;YAAE,SAAQ;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAA;QAChD,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAC1C,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAA;YACtD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAA;QACf,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,IAAI,CAAC,WAAW;gBAChB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3B,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC,CAAA;QACD,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,IAAiC;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAChC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACrD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACxD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,QAAgB,EAAE,MAAc;IACjE,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,MAAM,EACN,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,EAAE,CAAC,UAAU,CAAC,EAAE,CACjB,CAAA;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAA;IAChE,MAAM,KAAK,GAAwB,EAAE,CAAA;IAErC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IACD,KAAK,CAAC,UAAU,CAAC,CAAA;IACjB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAC5B,IAAuB,EACvB,UAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,GAAG,EAAqC,EAAE,CACzC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACpD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAC3D,CAAA;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,UAAU;YAC1F,4FAA4F;YAC5F,uFAAuF;YACvF,8EAA8E,CACjF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;IAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAA;IAEnF,IACE,CAAC,QAAQ;QACT,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAClC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,SAAS;YACzF,uFAAuF;YACvF,gGAAgG,CACnG,CAAA;IACH,CAAC;IACD,IACE,CAAC,YAAY;QACb,CAAC,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QACtC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,SAAS;YACzF,4FAA4F;YAC5F,2FAA2F;YAC3F,6EAA6E,CAChF,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI;QAC/B,aAAa,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI;KAC7C,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAChG,MAAM,SAAS,GAAG,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;IAEtE,uEAAuE;IACvE,gFAAgF;IAChF,uEAAuE;IACvE,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACzF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;YACxF,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,0GAA0G,EAAE,GAAG,EAAE;YAClH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,8DAA8D;IAC9D,uEAAuE;IACvE,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC9F,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;QAErE,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gHAAgH,EAAE,GAAG,EAAE;YACxH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CACJ,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAC/B,YAAY,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,sCAAsC,CACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,uEAAuE;IACvE,QAAQ,CAAC,kIAAkI,EAAE,GAAG,EAAE;QAChJ,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;YACnF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,CACJ,uBAA4C,EAC5C,uBAAuB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,aAAa,4BAA4B,CAC5F,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACjC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CACzB,6DAA6D,EAC7D,CAAC,SAAS,EAAE,EAAE;YACZ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;YACpD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzC,CAAC,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/security/scanner/patterns.d.ts

@@ -7,7 +7,34 @@ export declare const DEFAULT_ALLOWED_DOMAINS: string[];
 export declare const ENV_PATH_PATTERN: RegExp;
 export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
 export declare const VALUE_GATED_KEYWORD_PATTERNS: ReadonlySet<RegExp>;
-export declare const JAILBREAK_PATTERNS: RegExp[];
+export { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+export { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+/**
+ * SMI-5876 §0.1/§0.2: bump on ANY pattern-array or evidence-table change in
+ * this module or patterns.jailbreak.ts. The security-audit baseline
+ * (packages/mcp-server/src/audit/security-baseline.ts /
+ * security-audit.ts) stamps every stored entry with the version that
+ * produced it and treats a mismatch as "not comparable" — forcing a re-scan
+ * instead of silently reusing a stale verdict from a scanner that no longer
+ * exists. Without this, the pattern/evidence-tier fix could not clear an
+ * already-flagged skill's stale `malicious` baseline on any machine that had
+ * scanned it before (see the security-audit.ts `comparable` gate).
+ *
+ * Bumped to `.2`: SMI-5876 design-pass follow-up added the `state_assertion`
+ * evidence tier + 5 new JAILBREAK_PATTERNS entries (J-S1/S2/S3a/S3b/S4) and
+ * widened #6 (bypass) + J-N1 in place — this is precisely the
+ * previously-clean-content-now-fires scenario the ruleset-version gate
+ * exists for.
+ *
+ * Bumped to `2026-07-29.1`: SMI-5881 P0 — AD_CRLF_INJECTION's source changed
+ * (ReDoS fix, same match language, see patterns.jailbreak.ts) and 4
+ * AI_DEFENCE_PATTERNS entries were promoted from 'line' to 'both' scope
+ * (AD_HTML_COMMENT_VERB/NOUN, AD_NESTED_INSTRUCTION_BLOCK, AD_ZERO_WIDTH — new
+ * cross-line matches now possible where none fired before), plus SSRF_
+ * INSTRUCTION_PATTERNS word-boundary narrowing (some previously-firing
+ * substring FPs, e.g. "budget to localhost", no longer match).
+ */
+export declare const SCANNER_RULESET_VERSION: "2026-07-29.1";
 export declare const SUSPICIOUS_PATTERNS: RegExp[];
 /**
  * SMI-5359 Wave 4.2: Remote-fetch-to-interpreter ("code_execution") patterns.
@@ -33,30 +60,30 @@ export declare const CODE_EXECUTION_PATTERNS: RegExp[];
 export declare const SOCIAL_ENGINEERING_PATTERNS: RegExp[];
 export declare const PROMPT_LEAKING_PATTERNS: RegExp[];
 export declare const DATA_EXFILTRATION_PATTERNS: RegExp[];
+export declare const CREDENTIAL_SUBSTITUTION_PATTERNS: RegExp[];
 export declare const PRIVILEGE_ESCALATION_PATTERNS: RegExp[];
 /**
  * SMI-3509: SSRF instruction patterns
  * Detects content instructing fetches to internal/dangerous endpoints.
  * These are text-oriented patterns for skill content scanning (not URL validators).
- */
-export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
-/**
- * SMI-1532: AIDefence CVE-hardened injection patterns
- * Optimized for sub-10ms scan time with compiled regex and no backtracking
  *
- * These patterns detect sophisticated prompt injection attacks based on
- * known CVEs and security research findings.
- *
- * References:
- * - OWASP LLM Top 10: LLM01 Prompt Injection
- * - Anthropic Responsible Disclosure Program findings
- * - Academic research on prompt injection attacks
+ * SMI-5881: leading `\b` added to every verb alternation below — the verbs
+ * (fetch/request/curl/wget/get/open/load/read/connect/send) previously had no
+ * boundary, so they matched as a SUBSTRING of an unrelated word ("get" inside
+ * "budget"/"target"/"forget"/"widget", "connect" inside "disconnect", "load"
+ * inside "download"/"reload", "open" inside "reopen", "read" inside
+ * "bread"/"spread"/"thread"). A trailing `\b` was also added after the bare
+ * `localhost` literal (both the single-line and multiline forms) so
+ * "localhosting" no longer matches via a "localhost" prefix. Every existing
+ * `\s` quantifier is unchanged — replacing them with newline-exclusive classes
+ * was tried and reverted (breaks a verb+target split across a real line
+ * break, a real evasion). See scanner-ssrf-word-boundary.test.ts.
  */
+export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
 /**
  * SMI-3864: PII detection patterns
  * Detects personally identifiable information and credentials in skill content.
  * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
  */
 export declare const PII_PATTERNS: RegExp[];
-export declare const AI_DEFENCE_PATTERNS: RegExp[];
 //# sourceMappingURL=patterns.d.ts.map

package/dist/src/security/scanner/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AA4BD,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AAMjG,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAGF,eAAO,MAAM,kBAAkB,UAkB9B,CAAA;AAGD,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAmBnC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UA2DtC,CAAA;AAGD,eAAO,MAAM,6BAA6B,UA8CzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA;AAED,eAAO,MAAM,mBAAmB,UAwD/B,CAAA"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AA4BD,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AAMjG,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAUF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAIjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,uBAAuB,EAAG,cAAuB,CAAA;AAG9D,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,UAmBnC,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UA2DtC,CAAA;AAMD,eAAO,MAAM,gCAAgC,UAG5C,CAAA;AAGD,eAAO,MAAM,6BAA6B,UA8EzC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.d.ts

@@ -0,0 +1,41 @@
+/**
+ * SMI-5876 Wave 1: Jailbreak / AI-Defence pattern arrays + evidence-tier map.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak
+ *
+ * Split out of patterns.ts (which was approaching the 500-line audit:standards
+ * gate) to hold `JAILBREAK_PATTERNS` and `AI_DEFENCE_PATTERNS`; the
+ * evidence-tier classification that governs their severity now lives
+ * alongside them in `patterns.jailbreak.evidence.ts` (SMI-5881, split out for
+ * the same 500-line reason).
+ *
+ * Background: both arrays previously matched bare vocabulary with no context
+ * requirement (`/jailbreak/i`, `/\bDAN\b/`, a bare role marker, a bare `[[...]]`
+ * bracket, ...) — a security-checklist skill's prose tripped the same
+ * CRITICAL/HIGH severity as a real attack. `EVIDENCE_TYPE_BY_PATTERN`
+ * classifies every pattern in both arrays into one of FIVE evidence tiers
+ * (`types.ts`'s `EvidenceType` — `mention`, `role_turn_with_body`,
+ * `imperative_instruction`, `instruction_override`, and `state_assertion`, the
+ * last added in a design-pass follow-up for declarative state assertions like
+ * "Jailbreak activated" that no frame-based directive pattern can catch);
+ * `SecurityScanner.evidence.ts` turns that tier (+ documentation context) into
+ * a severity/confidence pair, and `SecurityScanner.helpers.ts`'s merge-loop
+ * picks the STRONGEST tier per line across both the multi-line and
+ * single-line scan passes.
+ *
+ * Discriminator (see the SMI-5876 design doc for the full worked argument): a
+ * pattern is `mention`-tier iff its matched text, read in isolation, instructs
+ * nothing — pure nouns/names/labels/structural markers/payload-free
+ * obfuscation artifacts. Anything with a verb+object pairing or a
+ * second-person predicate is directive-tier (`imperative_instruction` /
+ * `instruction_override`). A descriptive-frame negative guard (demote when
+ * preceded by "guards against" / "for example" / ...) was deliberately
+ * REJECTED — for prompt injection the text IS the attack, so any framing-based
+ * exemption is itself a bypass vector ("for example, ignore all previous
+ * instructions" would be suppressed). This is why JAILBREAK's `bypass ...
+ * restrictions/filters/safety` entry stays directive-tier: it's a genuine
+ * attack on its own, and the only tool that would separate it from the
+ * "guards against bypass" documentation case is the rejected frame guard.
+ */
+export declare const JAILBREAK_PATTERNS: RegExp[];
+export declare const AI_DEFENCE_PATTERNS: RegExp[];
+//# sourceMappingURL=patterns.jailbreak.d.ts.map

package/dist/src/security/scanner/patterns.jailbreak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAoLH,eAAO,MAAM,kBAAkB,UA4B9B,CAAA;AAuLD,eAAO,MAAM,mBAAmB,UAuB/B,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.evidence.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SMI-5876 Wave 1 / SMI-5881: evidence-tier classification for
+ * JAILBREAK_PATTERNS + AI_DEFENCE_PATTERNS.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak.evidence
+ *
+ * Split out of patterns.jailbreak.ts (SMI-5881 — that file was approaching
+ * the 500-line audit:standards gate again, same reason it was split out of
+ * patterns.ts in SMI-5876) so EVIDENCE_TYPE_BY_PATTERN's declaration doesn't
+ * grow patterns.jailbreak.ts every time a new pattern is added.
+ *
+ * Keyed by OBJECT IDENTITY, exhaustive over both arrays (asserted by test in
+ * scanner-evidence-tiers.test.ts), but classifyEvidence() (SecurityScanner.
+ * evidence.ts) still defaults UNMAPPED patterns to `imperative_instruction` —
+ * fail-closed: forgetting to classify a newly added pattern makes it
+ * strongest, never weakest.
+ *
+ * Built from parallel index-aligned arrays (not per-named-const references)
+ * because the individual pattern consts (JB_IGNORE_PREVIOUS, AD_ROLE_MARKER_
+ * BARE, ...) are private to patterns.jailbreak.ts and intentionally not
+ * exported — this file only ever sees the same JAILBREAK_PATTERNS /
+ * AI_DEFENCE_PATTERNS arrays every other consumer sees, so a length mismatch
+ * (pattern added to one array, tier forgotten here) is impossible to
+ * misalign silently: the two arrays below MUST stay index-aligned with the
+ * exported pattern arrays, or scanner-evidence-tiers.test.ts's exhaustiveness
+ * assertion catches it immediately.
+ *
+ * Consumed ONLY by SecurityScanner's severity resolution. Every other
+ * consumer of JAILBREAK_PATTERNS / AI_DEFENCE_PATTERNS (memory-injection-
+ * scanner.ts's quarantine gate, SecurityScanner.quickCheck()) ignores it by
+ * design — both those call sites test bare pattern presence, not evidence
+ * tier, and that is intentional (see their own inline comments).
+ */
+import type { EvidenceType } from './types.js';
+export declare const EVIDENCE_TYPE_BY_PATTERN: ReadonlyMap<RegExp, EvidenceType>;
+//# sourceMappingURL=patterns.jailbreak.evidence.d.ts.map

package/dist/src/security/scanner/patterns.jailbreak.evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.evidence.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAuD9C,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAMrE,CAAA"}

package/dist/src/security/scanner/patterns.jailbreak.evidence.js

@@ -0,0 +1,119 @@
+/**
+ * SMI-5876 Wave 1 / SMI-5881: evidence-tier classification for
+ * JAILBREAK_PATTERNS + AI_DEFENCE_PATTERNS.
+ * @module @skillsmith/core/security/scanner/patterns.jailbreak.evidence
+ *
+ * Split out of patterns.jailbreak.ts (SMI-5881 — that file was approaching
+ * the 500-line audit:standards gate again, same reason it was split out of
+ * patterns.ts in SMI-5876) so EVIDENCE_TYPE_BY_PATTERN's declaration doesn't
+ * grow patterns.jailbreak.ts every time a new pattern is added.
+ *
+ * Keyed by OBJECT IDENTITY, exhaustive over both arrays (asserted by test in
+ * scanner-evidence-tiers.test.ts), but classifyEvidence() (SecurityScanner.
+ * evidence.ts) still defaults UNMAPPED patterns to `imperative_instruction` —
+ * fail-closed: forgetting to classify a newly added pattern makes it
+ * strongest, never weakest.
+ *
+ * Built from parallel index-aligned arrays (not per-named-const references)
+ * because the individual pattern consts (JB_IGNORE_PREVIOUS, AD_ROLE_MARKER_
+ * BARE, ...) are private to patterns.jailbreak.ts and intentionally not
+ * exported — this file only ever sees the same JAILBREAK_PATTERNS /
+ * AI_DEFENCE_PATTERNS arrays every other consumer sees, so a length mismatch
+ * (pattern added to one array, tier forgotten here) is impossible to
+ * misalign silently: the two arrays below MUST stay index-aligned with the
+ * exported pattern arrays, or scanner-evidence-tiers.test.ts's exhaustiveness
+ * assertion catches it immediately.
+ *
+ * Consumed ONLY by SecurityScanner's severity resolution. Every other
+ * consumer of JAILBREAK_PATTERNS / AI_DEFENCE_PATTERNS (memory-injection-
+ * scanner.ts's quarantine gate, SecurityScanner.quickCheck()) ignores it by
+ * design — both those call sites test bare pattern presence, not evidence
+ * tier, and that is intentional (see their own inline comments).
+ */
+import { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+// Index-aligned with JAILBREAK_PATTERNS (patterns.jailbreak.ts) — keep in sync.
+const JAILBREAK_EVIDENCE = [
+    'instruction_override', // JB_IGNORE_PREVIOUS
+    'instruction_override', // JB_DISREGARD_PREVIOUS
+    'mention', // JB_DEVELOPER_MODE
+    'mention', // JB_DAN_BARE
+    'mention', // JB_DO_ANYTHING_NOW
+    'mention', // JB_JAILBREAK_BARE
+    'imperative_instruction', // JB_BYPASS_RESTRICTIONS
+    'imperative_instruction', // JB_PRETEND_NO_RESTRICTIONS
+    'imperative_instruction', // JB_ACT_NO_ETHICS
+    'imperative_instruction', // JB_YOU_ARE_NOW_FREE
+    'instruction_override', // JB_IGNORE_SAFETY_GUIDELINES
+    'imperative_instruction', // JB_HYPOTHETICAL_SCENARIO
+    'imperative_instruction', // JB_JN1_MODE_FRAME
+    'imperative_instruction', // JB_JN2_DEVELOPER_MODE_FRAME
+    'imperative_instruction', // JB_JN3_PERSONA_FRAME
+    'state_assertion', // JB_JS1_STATE_BARE
+    'state_assertion', // JB_JS2_NOUN_MODE_STATE
+    'state_assertion', // JB_JS3A_DEV_MODE_THEN_CAPABILITY
+    'state_assertion', // JB_JS3B_CAPABILITY_THEN_DEV_MODE
+    'imperative_instruction', // JB_JS4_OBEDIENCE_COMPULSION
+    'instruction_override', // JB_SPLIT_IGNORE
+    'instruction_override', // JB_SPLIT_DISREGARD
+    'imperative_instruction', // JB_SPLIT_BYPASS
+];
+// Index-aligned with AI_DEFENCE_PATTERNS (patterns.jailbreak.ts) — keep in sync.
+const AI_DEFENCE_EVIDENCE = [
+    'mention', // AD_ROLE_MARKER_BARE
+    'mention', // AD_BRACKET_HIDDEN
+    'instruction_override', // AD_HTML_COMMENT_VERB
+    'mention', // AD_HTML_COMMENT_NOUN
+    'imperative_instruction', // AD_HOMOGRAPH_RUN_PLUS_KEYWORD
+    'mention', // AD_MIXED_SCRIPT_WORD
+    'mention', // AD_XML_TAG_BARE
+    'imperative_instruction', // AD_BASE64_INSTRUCTIONS
+    'mention', // AD_DELIMITER_BARE
+    'mention', // AD_JSON_ROLE_FIELD
+    'role_turn_with_body', // AD_NESTED_INSTRUCTION_BLOCK
+    'instruction_override', // AD_CRLF_INJECTION
+    'mention', // AD_TEMPLATE_LITERAL
+    'mention', // AD_ZERO_WIDTH
+    'imperative_instruction', // AD_MARKDOWN_LINK_PAYLOAD
+    'imperative_instruction', // AD_ESCAPE_SEQUENCE_ABUSE
+    'mention', // AD_ZALGO_COMBINING
+    'role_turn_with_body', // AD_AN1_ROLE_BODY_SAME_LINE
+    'role_turn_with_body', // AD_AN2_ROLE_BODY_NEXT_LINE
+    'role_turn_with_body', // AD_AN3A_CHAT_TOKEN_BODY_SAME_LINE
+    'role_turn_with_body', // AD_AN3B_CHAT_TOKEN_BODY_NEXT_LINE
+];
+export const EVIDENCE_TYPE_BY_PATTERN = new Map([
+    ...JAILBREAK_PATTERNS.map((p, i) => [p, JAILBREAK_EVIDENCE[i]]),
+    ...AI_DEFENCE_PATTERNS.map((p, i) => [p, AI_DEFENCE_EVIDENCE[i]]),
+]);
+/**
+ * Module-load gate: unlike patterns.scope.ts's PATTERN_SCOPE, an unmapped
+ * entry here degrades safely (classifyEvidence() fail-closes to the
+ * strongest tier), so this isn't a silent-coverage-gap risk the way scope is.
+ * Still asserted directly rather than relying solely on `Map.has()` via
+ * scanner-evidence-tiers.test.ts's exhaustiveness check: `new Map([[p,
+ * undefined]])` reports `.has(p) === true`, so an out-of-range EVIDENCE[i]
+ * read during construction (a length mismatch between a PATTERNS array and
+ * its index-aligned EVIDENCE array) would pass a has()-only check silently.
+ */
+function assertEvidenceCoverage() {
+    const pairs = [
+        { name: 'JAILBREAK_PATTERNS', patterns: JAILBREAK_PATTERNS, evidence: JAILBREAK_EVIDENCE },
+        { name: 'AI_DEFENCE_PATTERNS', patterns: AI_DEFENCE_PATTERNS, evidence: AI_DEFENCE_EVIDENCE },
+    ];
+    for (const { name, patterns, evidence } of pairs) {
+        if (patterns.length !== evidence.length) {
+            throw new Error(`[SecurityScanner] ${name} has ${patterns.length} pattern(s) but its evidence array has ` +
+                `${evidence.length} entries — they must be index-aligned and equal length. ` +
+                `Add or remove an evidence entry in patterns.jailbreak.evidence.ts to match.`);
+        }
+        patterns.forEach((pattern, index) => {
+            const evidenceType = EVIDENCE_TYPE_BY_PATTERN.get(pattern);
+            if (!EVIDENCE_TYPE_BY_PATTERN.has(pattern) || evidenceType === undefined) {
+                throw new Error(`[SecurityScanner] ${name}[${index}] (/${pattern.source}/${pattern.flags}) has no ` +
+                    `EVIDENCE_TYPE_BY_PATTERN entry.`);
+            }
+        });
+    }
+}
+assertEvidenceCoverage();
+//# sourceMappingURL=patterns.jailbreak.evidence.js.map

package/dist/src/security/scanner/patterns.jailbreak.evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.jailbreak.evidence.js","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.jailbreak.evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAEjF,gFAAgF;AAChF,MAAM,kBAAkB,GAA4B;IAClD,sBAAsB,EAAE,qBAAqB;IAC7C,sBAAsB,EAAE,wBAAwB;IAChD,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,qBAAqB;IAChC,SAAS,EAAE,oBAAoB;IAC/B,wBAAwB,EAAE,yBAAyB;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,mBAAmB;IAC7C,wBAAwB,EAAE,sBAAsB;IAChD,sBAAsB,EAAE,8BAA8B;IACtD,wBAAwB,EAAE,2BAA2B;IACrD,wBAAwB,EAAE,oBAAoB;IAC9C,wBAAwB,EAAE,8BAA8B;IACxD,wBAAwB,EAAE,uBAAuB;IACjD,iBAAiB,EAAE,oBAAoB;IACvC,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,mCAAmC;IACtD,iBAAiB,EAAE,mCAAmC;IACtD,wBAAwB,EAAE,8BAA8B;IACxD,sBAAsB,EAAE,kBAAkB;IAC1C,sBAAsB,EAAE,qBAAqB;IAC7C,wBAAwB,EAAE,kBAAkB;CAC7C,CAAA;AAED,iFAAiF;AACjF,MAAM,mBAAmB,GAA4B;IACnD,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,oBAAoB;IAC/B,sBAAsB,EAAE,uBAAuB;IAC/C,SAAS,EAAE,uBAAuB;IAClC,wBAAwB,EAAE,gCAAgC;IAC1D,SAAS,EAAE,uBAAuB;IAClC,SAAS,EAAE,kBAAkB;IAC7B,wBAAwB,EAAE,yBAAyB;IACnD,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,qBAAqB;IAChC,qBAAqB,EAAE,8BAA8B;IACrD,sBAAsB,EAAE,oBAAoB;IAC5C,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,gBAAgB;IAC3B,wBAAwB,EAAE,2BAA2B;IACrD,wBAAwB,EAAE,2BAA2B;IACrD,SAAS,EAAE,qBAAqB;IAChC,qBAAqB,EAAE,6BAA6B;IACpD,qBAAqB,EAAE,6BAA6B;IACpD,qBAAqB,EAAE,oCAAoC;IAC3D,qBAAqB,EAAE,oCAAoC;CAC5D,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAsC,IAAI,GAAG,CAGhF;IACA,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAU,CAAC;IACxE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAU,CAAC;CAC3E,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,SAAS,sBAAsB;IAC7B,MAAM,KAAK,GAIN;QACH,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;QAC1F,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE;KAC9F,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,QAAQ,QAAQ,CAAC,MAAM,yCAAyC;gBACvF,GAAG,QAAQ,CAAC,MAAM,0DAA0D;gBAC5E,6EAA6E,CAChF,CAAA;QACH,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC1D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,IAAI,KAAK,OAAO,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,WAAW;oBACjF,iCAAiC,CACpC,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,sBAAsB,EAAE,CAAA"}