@skillsmith/core 0.11.4 → 0.11.5

package/dist/src/security/scanner/multiline-category-closure.test.js

@@ -0,0 +1,287 @@
+/**
+ * SMI-5879 Wave 3 item 2 — structural closure test for cohort E's exclusion
+ * proof (design doc `smi-5879-edge-twin-parity-design.md` §8.3.1.2.2).
+ * @module @skillsmith/core/security/scanner/multiline-category-closure.test
+ *
+ * WHY THIS TEST EXISTS
+ *
+ * The SMI-5879 census (comparing pre-port vs post-port `skills.security_score`
+ * across ~344k rows) needs to fully re-simulate every row scoring `>= 8`
+ * (cohort C1) but can structurally EXCLUDE every row scoring `0-7` (cohort E)
+ * from that expensive re-simulation — *if and only if* three properties about
+ * how the multiline pass routes patterns hold. The design doc's §8.3.1.2.1
+ * proves those properties in prose ("P1/P2/P3"); this file promotes that proof
+ * to a machine-checked gate (design doc gate G-5) so a future source change
+ * that silently invalidates the premise fails CI instead of silently
+ * corrupting the census's soundness.
+ *
+ * THE +32 ARITHMETIC THIS TEST PROTECTS (not itself re-derived here — that is
+ * `weights.ts` + the design doc's §8.3.1.2 arithmetic; this file only proves
+ * the ROUTING facts the arithmetic depends on):
+ *   max joint contribution = 100 * CATEGORY_WEIGHTS.jailbreak.coefficient (0.20)
+ *                           + 100 * CATEGORY_WEIGHTS.ai_defence.coefficient (0.12)
+ *                           = 32.0
+ *   S <= 7  =>  S' <= S + 32 <= 39 < 40 (QUARANTINE_THRESHOLD)  =>  verdict
+ *   cannot flip to quarantined for any row starting at or below 7.
+ * That bound is sound ONLY IF the multiline pass can never inflate any
+ * category's subtotal OTHER than jailbreak / ai_defence. The three assertions
+ * below are exactly what closes that "only if".
+ *
+ * THE DOCUMENTED TRAP (design doc §8.3.1.2.3) — DELIBERATELY NOT REPEATED HERE
+ *
+ * The design doc warns against writing assertion 3 as "every pattern for
+ * which `isMultilinePattern()` returns true belongs to an AI-category array"
+ * — that predicate is syntactic (it fires on a NEGATED class `[^\n]`, the
+ * literal opposite of "spans lines") and is false today for 9 patterns across
+ * two non-AI arrays. This file does not use that predicate at all: assertions
+ * 1 and 3 are asserted over the multiline pass's CALL SITES (which pattern
+ * array is physically wired to `scanPatternsWithMultilineSupport`'s `patterns:`
+ * config field), not over any per-pattern syntactic test. That is the
+ * "routing, not predicate" distinction the trap section requires.
+ *
+ * SMI-5881 ADAPTATION (judgment call — flagged, not silently resolved)
+ *
+ * The design doc's assertion 2 is written directly against `isMultilinePattern()`
+ * as the definition of "PASS-1 pattern". SMI-5881 (merged before this file was
+ * written) DELETED `isMultilinePattern()` entirely — no compatibility shim —
+ * and replaced the syntactic heuristic with `PATTERN_SCOPE` /
+ * `resolvePatternScope()` (`./patterns.scope.ts`), an explicit per-pattern
+ * `'line' | 'content' | 'both'` declaration. `isMultilinePattern` cannot be
+ * imported here; it no longer exists anywhere under `packages/core/src`
+ * (guarded by `packages/core/tests/security/pattern-scope.test.ts`).
+ *
+ * `scanPatternsWithMultilineSupport`'s pass 1 (SecurityScanner.helpers.ts) now
+ * reads: `if (resolvePatternScope(pattern) === 'line') continue` — i.e. pass 1
+ * tests every pattern whose resolved scope is NOT `'line'` (`'content'` or
+ * `'both'`). That predicate is the faithful, current-source equivalent of the
+ * design doc's `routed.filter(isMultilinePattern)` — same set membership
+ * question ("which patterns does pass 1 actually read"), expressed against
+ * the model that replaced the deleted one. Assertion 2 below uses
+ * `resolvePatternScope(p) !== 'line'` for exactly this reason.
+ *
+ * CODE-REVIEW REMEDIATION (Finding 1 — NO-GO, fixed)
+ *
+ * A first version of this file enumerated call sites with a bounded
+ * text-window regex scan (`CALL_TOKEN = 'scanPatternsWithMultilineSupport('`
+ * + an `EXTRACTION_WINDOW`-char lookahead for `type:`/`patterns:`). Codex
+ * (gpt-5.6-sol) review flagged that as a silent-false-negative hazard: a new
+ * call site using extra whitespace before `(`, a locally-aliased identifier,
+ * or a renamed import would be invisible to that regex while the existing two
+ * call sites kept the count green — defeating the point of a closure proof
+ * meant to catch exactly this class of drift. `extractMultilineCallSites`
+ * below instead walks the real TypeScript AST (`ts.createSourceFile` +
+ * `CallExpression` traversal resolved through `collectAliases`), which is
+ * exhaustive by construction against all three variants. Verified via mutation
+ * testing: a temporarily-added call through a whitespace-before-paren AND a
+ * locally-aliased form was both correctly detected (count became 3, assertion
+ * 1 failed) before being reverted.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, it, expect } from 'vitest';
+import * as ts from 'typescript';
+import { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
+import { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
+import { resolvePatternScope } from './patterns.scope.js';
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const SCANNER_PATH = join(__dirname, 'SecurityScanner.ts');
+const SCANNER_SRC = readFileSync(SCANNER_PATH, 'utf-8');
+/** The only two pattern arrays a `scanPatternsWithMultilineSupport` call site may name. */
+const AI_CATEGORY_ARRAY_NAMES = ['JAILBREAK_PATTERNS', 'AI_DEFENCE_PATTERNS'];
+/**
+ * Every OTHER pattern array in the scanner (design doc §8.3.1.2.2 assertion 3's
+ * explicit exclusion list). `BLOCKED_PATTERNS` is not a real exported const
+ * (blocked patterns are an instance-level `ScannerOptions.blockedPatterns`,
+ * `SecurityScanner.ts:73`) — kept in the list anyway because the design doc
+ * names it explicitly and the check is "this identifier never appears as a
+ * `patterns:` value", which is true (and meaningfully checked) regardless of
+ * whether the identifier is otherwise reachable.
+ */
+const NON_AI_ARRAY_NAMES = [
+    'SUSPICIOUS_PATTERNS',
+    'DATA_EXFILTRATION_PATTERNS',
+    'PRIVILEGE_ESCALATION_PATTERNS',
+    'CODE_EXECUTION_PATTERNS',
+    'BLOCKED_PATTERNS',
+];
+const TARGET_FUNCTION_NAME = 'scanPatternsWithMultilineSupport';
+/** The textual callee name of a call expression: `foo(` -> "foo"; `x.bar(` -> "bar". */
+function calleeName(expr) {
+    if (ts.isIdentifier(expr))
+        return expr.text;
+    if (ts.isPropertyAccessExpression(expr))
+        return expr.name.text;
+    return undefined;
+}
+/**
+ * Every local identifier in `sourceFile` that resolves to `targetName` — the
+ * name itself, any `import { targetName as Local }` rename, and any simple
+ * `const Local = <alias>` variable alias (resolved transitively, to a fixed
+ * point, so a chain like `const a = target; const b = a` also resolves).
+ * This is what makes the call-site walk below exhaustive against the "an
+ * alias" failure mode the code review named: a call reached through a
+ * renamed import or a locally-aliased identifier still resolves back to
+ * `targetName` and is detected, where a literal-token text scan would miss it.
+ */
+function collectAliases(sourceFile, targetName) {
+    const aliases = new Set([targetName]);
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt) || !stmt.importClause?.namedBindings)
+            continue;
+        const bindings = stmt.importClause.namedBindings;
+        if (!ts.isNamedImports(bindings))
+            continue;
+        for (const el of bindings.elements) {
+            const imported = el.propertyName?.text ?? el.name.text;
+            if (imported === targetName)
+                aliases.add(el.name.text);
+        }
+    }
+    let changed = true;
+    while (changed) {
+        changed = false;
+        const visit = (node) => {
+            if (ts.isVariableDeclaration(node) &&
+                ts.isIdentifier(node.name) &&
+                node.initializer &&
+                ts.isIdentifier(node.initializer) &&
+                aliases.has(node.initializer.text) &&
+                !aliases.has(node.name.text)) {
+                aliases.add(node.name.text);
+                changed = true;
+            }
+            ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(sourceFile, visit);
+    }
+    return aliases;
+}
+/** The textual name of an object-literal member (identifier or string-literal key). */
+function memberName(prop) {
+    if (!prop.name)
+        return undefined;
+    if (ts.isIdentifier(prop.name))
+        return prop.name.text;
+    if (ts.isStringLiteral(prop.name))
+        return prop.name.text;
+    return undefined;
+}
+/**
+ * Extract every `scanPatternsWithMultilineSupport(...)` call site in `source`
+ * (at path `filePath`, used only for error messages), together with its
+ * config object's `type:` and `patterns:` values — via full TypeScript AST
+ * traversal (`ts.createSourceFile` + a `CallExpression` walk resolved through
+ * `collectAliases`), NOT text/regex matching over a bounded window. This is
+ * exhaustive by construction: extra whitespace before `(`, a call reached
+ * through a renamed import or a locally-aliased identifier, and a config
+ * object appearing in any argument position are all still found — closing
+ * the class of silent false-negative a bounded text-window regex scan cannot
+ * rule out (the defect the code review's Finding 1 identified).
+ *
+ * Throws (rather than silently skipping) when a matched call's arguments
+ * don't have the expected `{ type: '<string literal>', patterns: <bare
+ * identifier> }` shape — an unparseable/unexpected call site must fail
+ * loudly, not be dropped from the count assertion 1 depends on, exactly as
+ * the prior text-based version did for its own class of unparseable input.
+ */
+function extractMultilineCallSites(filePath, source) {
+    const sourceFile = ts.createSourceFile(filePath, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const aliases = collectAliases(sourceFile, TARGET_FUNCTION_NAME);
+    const sites = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const name = calleeName(node.expression);
+            if (name && aliases.has(name)) {
+                sites.push(extractCallSiteConfig(node, sourceFile, filePath));
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return sites;
+}
+/** Extract and validate the `{ type, patterns }` config object of a matched call. */
+function extractCallSiteConfig(call, sourceFile, filePath) {
+    const offset = call.getStart(sourceFile);
+    const configArg = call.arguments.find((arg) => ts.isObjectLiteralExpression(arg) &&
+        arg.properties.some((p) => memberName(p) === 'type') &&
+        arg.properties.some((p) => memberName(p) === 'patterns'));
+    if (!configArg) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has no ` +
+            `object-literal argument with both 'type' and 'patterns' properties. Either the call shape ` +
+            `changed (update this extraction) or this is a genuine new/malformed call site — both ` +
+            `invalidate the closure proof and must be resolved before this test can pass.`);
+    }
+    const typeProp = configArg.properties.find((p) => memberName(p) === 'type');
+    const patternsProp = configArg.properties.find((p) => memberName(p) === 'patterns');
+    if (!typeProp ||
+        !ts.isPropertyAssignment(typeProp) ||
+        !ts.isStringLiteral(typeProp.initializer)) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has a ` +
+            `'type' property that is not a plain string literal — this is exactly the "expression ` +
+            `argument" shape this AST census exists to catch. Resolve explicitly before this test can pass.`);
+    }
+    if (!patternsProp ||
+        !ts.isPropertyAssignment(patternsProp) ||
+        !ts.isIdentifier(patternsProp.initializer)) {
+        throw new Error(`[multiline-category-closure] ${TARGET_FUNCTION_NAME} call at ${filePath}:${offset} has a ` +
+            `'patterns' property that is not a bare identifier — either a property-access / expression ` +
+            `argument was introduced (the exact "silent miss" class this test exists to catch) or the ` +
+            `call shape genuinely changed. Resolve explicitly before this test can pass.`);
+    }
+    return {
+        offset,
+        type: typeProp.initializer.text,
+        patternsIdent: patternsProp.initializer.text,
+    };
+}
+describe('SMI-5879 Wave 3 item 2 — multiline-pass category closure (design doc §8.3.1.2.2)', () => {
+    const callSites = extractMultilineCallSites(SCANNER_PATH, SCANNER_SRC);
+    // --------------------------------------------------------------------
+    // Assertion 1 — the multiline pass has exactly two call sites, both AI-category
+    // --------------------------------------------------------------------
+    describe('assertion 1 — exactly two call sites, both AI-category (design doc P1/P2)', () => {
+        it('scanPatternsWithMultilineSupport is called exactly twice in SecurityScanner.ts', () => {
+            expect(callSites).toHaveLength(2);
+        });
+        it('the extracted type: multiset equals exactly [ai_defence, jailbreak] — no more, no fewer, no substitution', () => {
+            const types = callSites.map((s) => s.type).sort();
+            expect(types).toEqual(['ai_defence', 'jailbreak']);
+        });
+    });
+    // --------------------------------------------------------------------
+    // Assertion 2 — every PASS-1 pattern is explicitly classified
+    // --------------------------------------------------------------------
+    describe('assertion 2 — every pass-1 pattern is explicitly classified (SMI-5881-adapted)', () => {
+        // "Pass 1" = every pattern scanPatternsWithMultilineSupport's first pass
+        // actually reads: resolvePatternScope(pattern) !== 'line' (see the
+        // SMI-5881 ADAPTATION module-doc comment above for why this replaces the
+        // design doc's isMultilinePattern-filter wording).
+        const routed = [...JAILBREAK_PATTERNS, ...AI_DEFENCE_PATTERNS];
+        const pass1 = routed.filter((p) => resolvePatternScope(p) !== 'line');
+        it('the pass-1 subset is non-empty — the pass is not vacuous', () => {
+            expect(pass1.length).toBeGreaterThan(0);
+        });
+        it('every pass-1 pattern has an explicit EVIDENCE_TYPE_BY_PATTERN entry (object identity, not fail-closed default)', () => {
+            for (const p of pass1) {
+                expect(EVIDENCE_TYPE_BY_PATTERN.has(p), `pattern /${p.source}/${p.flags} has no explicit evidence-tier entry`).toBe(true);
+            }
+        });
+    });
+    // --------------------------------------------------------------------
+    // Assertion 3 — no non-AI pattern array is routed through the multiline pass
+    // --------------------------------------------------------------------
+    describe('assertion 3 — no non-AI pattern array is routed through the multiline pass (design doc P3, NOT the isMultilinePattern predicate)', () => {
+        it('every call site patterns: identifier is one of the two AI-category arrays', () => {
+            for (const site of callSites) {
+                expect(AI_CATEGORY_ARRAY_NAMES, `call site at offset ${site.offset} routes ${site.patternsIdent}, not an AI-category array`).toContain(site.patternsIdent);
+            }
+        });
+        it.each(NON_AI_ARRAY_NAMES)('%s never appears as a patterns: identifier at any call site', (arrayName) => {
+            const idents = callSites.map((s) => s.patternsIdent);
+            expect(idents).not.toContain(arrayName);
+        });
+    });
+});
+//# sourceMappingURL=multiline-category-closure.test.js.map

package/dist/src/security/scanner/multiline-category-closure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiline-category-closure.test.js","sourceRoot":"","sources":["../../../../src/security/scanner/multiline-category-closure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,YAAY,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAA;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AAEvD,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,CAAU,CAAA;AAEtF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+BAA+B;IAC/B,yBAAyB;IACzB,kBAAkB;CACV,CAAA;AAWV,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AAE/D,wFAAwF;AACxF,SAAS,UAAU,CAAC,IAAmB;IACrC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC3C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IAC9D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,UAAyB,EAAE,UAAkB;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IAE7C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa;YAAE,SAAQ;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAA;QAChD,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAC1C,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAA;YACtD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAA;QACf,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,IAAI,CAAC,WAAW;gBAChB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3B,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC,CAAA;QACD,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACpC,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,IAAiC;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAChC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACrD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACxD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,QAAgB,EAAE,MAAc;IACjE,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,QAAQ,EACR,MAAM,EACN,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,EAAE,CAAC,UAAU,CAAC,EAAE,CACjB,CAAA;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAA;IAChE,MAAM,KAAK,GAAwB,EAAE,CAAA;IAErC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IACD,KAAK,CAAC,UAAU,CAAC,CAAA;IACjB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAC5B,IAAuB,EACvB,UAAyB,EACzB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,GAAG,EAAqC,EAAE,CACzC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACpD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAC3D,CAAA;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,UAAU;YAC1F,4FAA4F;YAC5F,uFAAuF;YACvF,8EAA8E,CACjF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;IAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAA;IAEnF,IACE,CAAC,QAAQ;QACT,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAClC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,SAAS;YACzF,uFAAuF;YACvF,gGAAgG,CACnG,CAAA;IACH,CAAC;IACD,IACE,CAAC,YAAY;QACb,CAAC,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC;QACtC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gCAAgC,oBAAoB,YAAY,QAAQ,IAAI,MAAM,SAAS;YACzF,4FAA4F;YAC5F,2FAA2F;YAC3F,6EAA6E,CAChF,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI;QAC/B,aAAa,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI;KAC7C,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAChG,MAAM,SAAS,GAAG,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;IAEtE,uEAAuE;IACvE,gFAAgF;IAChF,uEAAuE;IACvE,QAAQ,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACzF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;YACxF,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,0GAA0G,EAAE,GAAG,EAAE;YAClH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,8DAA8D;IAC9D,uEAAuE;IACvE,QAAQ,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC9F,yEAAyE;QACzE,mEAAmE;QACnE,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,mBAAmB,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;QAErE,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gHAAgH,EAAE,GAAG,EAAE;YACxH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CACJ,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAC/B,YAAY,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,sCAAsC,CACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,6EAA6E;IAC7E,uEAAuE;IACvE,QAAQ,CAAC,kIAAkI,EAAE,GAAG,EAAE;QAChJ,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;YACnF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,CACJ,uBAA4C,EAC5C,uBAAuB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,aAAa,4BAA4B,CAC5F,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACjC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CACzB,6DAA6D,EAC7D,CAAC,SAAS,EAAE,EAAE;YACZ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;YACpD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzC,CAAC,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/services/recommend-guard.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @fileoverview Shared empty-derived-stack guard for skill recommendations.
+ * @module @skillsmith/core/services/recommend-guard
+ * @see SMI-5896 (Wave 3, discovery-tool consistency): CLI `recommend` and MCP
+ *   `skill_recommend` each derive a technology "stack" client-side — CLI from
+ *   codebase analysis (`buildStackFromAnalysis`), MCP from installed skills +
+ *   project context keywords — and either can legitimately derive `[]` (a
+ *   non-Node stack, an all-devDeps project, or an unsupported language). The
+ *   `skills-recommend` edge function hard-rejects an empty `stack` with a 400
+ *   (defense in depth, intentionally unchanged by this fix — see the plan's
+ *   Wave 3 Step 2 "decided contract").
+ *
+ *   Both callers now detect the empty-stack case BEFORE calling the API
+ *   instead of letting the guaranteed-400 round trip happen and reacting to
+ *   the failure after the fact — this is the one guidance string they both
+ *   surface, so it can't drift between CLI and MCP wording the way the two
+ *   tools' pre-fix behavior already had (a hard `process.exit(1)` crash on
+ *   CLI vs a silently-swallowed warning on MCP for the exact same input
+ *   shape).
+ */
+/**
+ * Guidance shown when no technology stack could be derived for
+ * recommendations. Written to read naturally from both a terminal (CLI) and
+ * an MCP tool response consumed by a calling agent — neither surface names
+ * its own flag here, since the same string serves both.
+ */
+export declare function buildEmptyStackGuidance(): string;
+//# sourceMappingURL=recommend-guard.d.ts.map

package/dist/src/services/recommend-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend-guard.d.ts","sourceRoot":"","sources":["../../../src/services/recommend-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAQhD"}

package/dist/src/services/recommend-guard.js

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview Shared empty-derived-stack guard for skill recommendations.
+ * @module @skillsmith/core/services/recommend-guard
+ * @see SMI-5896 (Wave 3, discovery-tool consistency): CLI `recommend` and MCP
+ *   `skill_recommend` each derive a technology "stack" client-side — CLI from
+ *   codebase analysis (`buildStackFromAnalysis`), MCP from installed skills +
+ *   project context keywords — and either can legitimately derive `[]` (a
+ *   non-Node stack, an all-devDeps project, or an unsupported language). The
+ *   `skills-recommend` edge function hard-rejects an empty `stack` with a 400
+ *   (defense in depth, intentionally unchanged by this fix — see the plan's
+ *   Wave 3 Step 2 "decided contract").
+ *
+ *   Both callers now detect the empty-stack case BEFORE calling the API
+ *   instead of letting the guaranteed-400 round trip happen and reacting to
+ *   the failure after the fact — this is the one guidance string they both
+ *   surface, so it can't drift between CLI and MCP wording the way the two
+ *   tools' pre-fix behavior already had (a hard `process.exit(1)` crash on
+ *   CLI vs a silently-swallowed warning on MCP for the exact same input
+ *   shape).
+ */
+/**
+ * Guidance shown when no technology stack could be derived for
+ * recommendations. Written to read naturally from both a terminal (CLI) and
+ * an MCP tool response consumed by a calling agent — neither surface names
+ * its own flag here, since the same string serves both.
+ */
+export function buildEmptyStackGuidance() {
+    return ('No technology stack could be derived for recommendations — this usually ' +
+        'means a non-Node project, a stack with no production dependencies, or an ' +
+        'unsupported language, not a backend or registry problem. Provide project ' +
+        'context (a short description of the project or its tooling) or an ' +
+        'explicit list of installed/currently-used skills, then try again.');
+}
+//# sourceMappingURL=recommend-guard.js.map

package/dist/src/services/recommend-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend-guard.js","sourceRoot":"","sources":["../../../src/services/recommend-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CACL,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,oEAAoE;QACpE,mEAAmE,CACpE,CAAA;AACH,CAAC"}

package/dist/src/services/recommend-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recommend-guard.test.d.ts.map

package/dist/src/services/recommend-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend-guard.test.d.ts","sourceRoot":"","sources":["../../../src/services/recommend-guard.test.ts"],"names":[],"mappings":""}

package/dist/src/services/recommend-guard.test.js

@@ -0,0 +1,28 @@
+/**
+ * @fileoverview Unit tests for the shared empty-derived-stack guidance string
+ *   (SMI-5896 Wave 3 Step 2). Both CLI `recommend` and MCP `skill_recommend`
+ *   surface this exact string so their empty-stack messaging can't drift.
+ * @module @skillsmith/core/services/recommend-guard.test
+ */
+import { describe, expect, it } from 'vitest';
+import { buildEmptyStackGuidance } from './recommend-guard.js';
+describe('buildEmptyStackGuidance (SMI-5896 Wave 3 Step 2)', () => {
+    it('returns a non-empty string', () => {
+        const guidance = buildEmptyStackGuidance();
+        expect(typeof guidance).toBe('string');
+        expect(guidance.length).toBeGreaterThan(0);
+    });
+    it('explains the empty stack is a legitimate under-detection, not a backend fault', () => {
+        const guidance = buildEmptyStackGuidance();
+        expect(guidance).toContain('No technology stack could be derived');
+    });
+    it('guides the caller toward providing context or an installed-skills list', () => {
+        const guidance = buildEmptyStackGuidance();
+        expect(guidance.toLowerCase()).toContain('project context');
+        expect(guidance.toLowerCase()).toContain('installed');
+    });
+    it('is deterministic (identical wording every call) so CLI and MCP never drift apart', () => {
+        expect(buildEmptyStackGuidance()).toBe(buildEmptyStackGuidance());
+    });
+});
+//# sourceMappingURL=recommend-guard.test.js.map

package/dist/src/services/recommend-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommend-guard.test.js","sourceRoot":"","sources":["../../../src/services/recommend-guard.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;QAC1C,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;QAC1C,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/services/skill-installation.content.d.ts

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Content-based skill install path (private registry).
+ * @module @skillsmith/core/services/skill-installation.content
+ * @see SMI-5905 Wave 1: installFromContent() + resolveFreshAccessToken() extraction
+ * @see docs/internal/implementation/private-registry-skill-install.md
+ *
+ * `install()` (skill-installation.service.ts) only knows how to fetch a
+ * skill from GitHub. This module adds a second entry point,
+ * `installFromContent()`, for skills whose content has already been resolved
+ * elsewhere (a private-registry `content` JSONB column, read via a
+ * per-team-member Supabase session or the `private-registry-get` Edge
+ * Function — Waves 2/3 wire those transports; this module only needs the
+ * already-fetched `{skillId, version, content}` triple).
+ *
+ * SCOPE TRIM (Sol review #5 — read before extending this function):
+ * `installFromContent()` deliberately reuses only two things from the
+ * `install()` policy chain:
+ *   1. `writeInstallFiles()`'s disk-write + rollback-on-partial-write handling
+ *      (skill-installation.io.ts), plus this module's own manifest-driven
+ *      already-installed/force gate (mirrors `install()`'s ALREADY_INSTALLED
+ *      check).
+ *   2. A security scan at the `community` trust tier, via the same
+ *      `classifyBundledFile()`/`isRejectableScan()` policy `install()` uses
+ *      for optional bundled files (skill-installation.policy.ts) — applied
+ *      here to every content-map entry (including "SKILL.md" itself, which
+ *      falls through to the conservative 'structured' default class since it
+ *      has no BUNDLED_SCAN_FILES entry).
+ *
+ * It deliberately does NOT route through the rest of `install()`'s chain:
+ *   - `skipScan` is NOT an accepted option here. Registry-content installs
+ *     always scan — there is no opt-out, unlike `install()`'s tier-gated
+ *     skipScan.
+ *   - Dependency-intelligence extraction/persistence (extractDepIntel,
+ *     persistDependencies, checkDepsAgainstQuarantine), risk-history
+ *     recording, AI-defence feedback, and co-install-session recording are
+ *     all OUT of v1 scope — a known, intentional gap, not a silent drop.
+ *     Wave 3's MCP `install` action and Wave 4's CLI command do not get
+ *     these signals for private-registry installs yet.
+ *   - Frontmatter/manifest validation on `SKILL.md` itself DOES still run
+ *     (`validateSkillMd()`), same as any other install.
+ *
+ * PATH VALIDATION (Sol review #2, critical, confirmed exploitable): every key
+ * in `content` is attacker-controlled — any team member with publish access
+ * chooses these filenames — and flows into `writeInstallFiles()`'s
+ * `path.join(installPath, subSkill.filename)` (skill-installation.io.ts:167)
+ * with NO containment check of its own. `path.join('/a/b', '../../etc/passwd')`
+ * escapes `installPath` after normalization, so every key is validated here,
+ * BEFORE any disk write — see `validateContentKeys()`.
+ */
+import type { Database } from '../db/database-interface.js';
+import type { ClientId } from '../install/paths.js';
+import type { ProgressCallback, InstallFromContentOptions, InstallResult } from './skill-installation.types.js';
+import type { ManifestManager } from './skill-manifest.js';
+/**
+ * Validate every key in a content map before any disk write.
+ *
+ * Rejects (as a single combined error, first offense wins):
+ *   - path-traversal (`..` segment), absolute paths (posix or win32/UNC),
+ *     NUL bytes, backslashes, empty/bare-"."/".git"-adjacent keys;
+ *   - any key that, after `path.resolve()` against `installPath`, resolves
+ *     outside `installPath` (a lexical backstop behind the checks above,
+ *     matching `writeInstallFiles()`'s own lexical escape check);
+ *   - two keys that `path.normalize()` to the same on-disk path (a
+ *     collision — e.g. "SKILL.md" and "./SKILL.md").
+ */
+export declare function validateContentKeys(content: Record<string, string>, installPath: string): {
+    valid: true;
+} | {
+    valid: false;
+    error: string;
+};
+/** Internal params bag: the caller's InstallFromContentOptions plus the service state
+ *  installFromContent() needs (mirrors performUninstall()'s flattened-params convention
+ *  in skill-installation.helpers.ts). */
+export interface InstallFromContentParams extends InstallFromContentOptions {
+    db: Database;
+    skillsDir: string;
+    manifest: ManifestManager;
+    client: ClientId;
+    onProgress: ProgressCallback;
+}
+/**
+ * Install an already-resolved private-registry skill's content to disk.
+ *
+ * See this file's header doc comment for the full scope trim vs. `install()`.
+ */
+export declare function installFromContent(params: InstallFromContentParams): Promise<InstallResult>;
+//# sourceMappingURL=skill-installation.content.d.ts.map

package/dist/src/services/skill-installation.content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.content.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACd,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AA8C1D;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgCnD;AA8DD;;yCAEyC;AACzC,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,EAAE,EAAE,QAAQ,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;CAC7B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAkKjG"}