@skillsmith/core 0.11.6 → 0.12.0

package/dist/src/security/scanner/SecurityScanner.compound.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.compound.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.compound.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF;;;;;;;;GAQG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,0FAA0F;AAC1F,wFAAwF;AACxF,uFAAuF;AACvF,oFAAoF;AACpF,8EAA8E;AAC9E,sFAAsF;AACtF,qFAAqF;AACrF,4DAA4D;AAC5D,MAAM,gBAAgB,GACpB,2GAA2G,CAAA;AAC7G,0FAA0F;AAC1F,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,kEAAkE,CAAA;AAC9F,2FAA2F;AAC3F,yFAAyF;AACzF,8CAA8C;AAC9C,MAAM,YAAY,GAChB,mHAAmH,CAAA;AACrH,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AACD,yFAAyF;AACzF,4FAA4F;AAC5F,8FAA8F;AAC9F,qGAAqG;AACrG,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAU,EAAE;QACrD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA,CAAC,4BAA4B;QAC9D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,CAAA,CAAC,sCAAsC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAChG,IAAI,IAAI;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAC/E,IAAI,KAAK;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAC5E,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;IACxE,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,mBAAwC,EACxC,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,+EAA+E;IAC/E,uFAAuF;IACvF,iFAAiF;IACjF,kDAAkD;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAEtF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,yEAAyE;QACzE,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAM;QAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,gEAAgE;QAChE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,uEAAuE;QACvE,MAAM,aAAa,GAAG,aAAa,CAAC,mBAAmB,EAAE,MAAM,CAAC,KAAK,IAAI,CAAA;QACzE,mFAAmF;QACnF,uFAAuF;QACvF,oFAAoF;QACpF,qFAAqF;QACrF,0FAA0F;QAC1F,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,uEAAuE;QACvE,MAAM,EAAE,GAAG,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;YAC9D,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,iDAAiD,YAAY,CAAC,IAAI,CAAC,gBAAgB,CACpF,CAAA;gBACD,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;YACzF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU;YAAE,OAAM,CAAC,uCAAuC;QAEjF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;QACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,6DAA6D;YAC7D,yEAAyE;YACzE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YACvC,OAAO,EAAE,wEAAwE,KAAK,CAAC,CAAC,CAAC,GAAG;YAC5F,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,sBAAsB;YAChC,sBAAsB,EAAE,YAAY;YACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAC1C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.compound.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.compound.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF;;;;;;;;GAQG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,wCAAwC,CAAA;AAE/C;;;;;;;;;;;;;;GAcG;AACH,0FAA0F;AAC1F,wFAAwF;AACxF,uFAAuF;AACvF,oFAAoF;AACpF,8EAA8E;AAC9E,sFAAsF;AACtF,qFAAqF;AACrF,4DAA4D;AAC5D,MAAM,gBAAgB,GACpB,2GAA2G,CAAA;AAC7G,2FAA2F;AAC3F,yFAAyF;AACzF,8CAA8C;AAC9C,MAAM,YAAY,GAChB,mHAAmH,CAAA;AAErH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,mBAAwC,EACxC,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,+EAA+E;IAC/E,uFAAuF;IACvF,mFAAmF;IACnF,kDAAkD;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAExF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAA;QAC5B,yEAAyE;QACzE,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAM;QAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,gEAAgE;QAChE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,uEAAuE;QACvE,MAAM,aAAa,GAAG,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,IAAI,CAAA;QAC3E,wFAAwF;QACxF,uFAAuF;QACvF,oFAAoF;QACpF,qFAAqF;QACrF,0FAA0F;QAC1F,yFAAyF;QACzF,uFAAuF;QACvF,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,uEAAuE;QACvE,MAAM,EAAE,GAAG,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YAC7C,IAAI,yBAAyB,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACtD,UAAU,GAAG,gCAAgC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU;YAAE,OAAM,CAAC,uCAAuC;QAEjF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;QACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,sBAAsB;YAC5B,6DAA6D;YAC7D,yEAAyE;YACzE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YACvC,OAAO,EAAE,wEAAwE,KAAK,CAAC,CAAC,CAAC,GAAG;YAC5F,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,UAAU;YACV,QAAQ,EAAE,sBAAsB;YAChC,sBAAsB,EAAE,YAAY;YACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAC1C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,eAAe,GAAG,6CAA6C,CAAA;AACrE,MAAM,uBAAuB,GAC3B,2EAA2E,CAAA;AAC7E,MAAM,sBAAsB,GAAG,0DAA0D,CAAA;AACzF,MAAM,8BAA8B,GAClC,6FAA6F,CAAA;AAE/F;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,CAAC,GACL,aAAa,CAAC,sBAAsB,EAAE,IAAI,CAAC;QAC3C,aAAa,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAA;IACrD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACjB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B,EAC5B,iBAAiB,GAAG,KAAK;IAEzB,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,kEAAkE;IAClE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAExF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GACT,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,aAAa,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAA;QACtF,IAAI,CAAC,KAAK;YAAE,OAAM;QAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;QACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;QAE9E,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,UAAU,GACd,yBAAyB,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC;YACjD,gCAAgC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC1D,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAA;QAElE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACjE,OAAO,EAAE,oEAAoE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG;YAC7G,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,UAAU,EAAE,KAAK,GAAG,CAAC;YACrB,QAAQ,EAAE,mBAAmB;YAC7B,sBAAsB,EAAE,YAAY;YACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SAC1C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.d.ts

@@ -5,10 +5,12 @@
  */
 import type { ScanReport, ScannerOptions } from './types.js';
 import type { LineContext } from './SecurityScanner.helpers.js';
-import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore } from './SecurityScanner.helpers.js';
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode } from './SecurityScanner.helpers.js';
+import { extractUrls } from './SecurityScanner.urls.js';
+import { calculateRiskScore } from './SecurityScanner.risk-score.js';
 import { scanSsrfPatterns } from './SecurityScanner.ssrf.js';
 import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary } from './SecurityScanner.formatters.js';
-export { LineContext, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, };
+export { LineContext, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, extractUrls, };
 export { scanSsrfPatterns };
 export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
 export declare class SecurityScanner {
@@ -17,7 +19,6 @@ export declare class SecurityScanner {
     private maxContentLength;
     private riskThreshold;
     constructor(options?: ScannerOptions);
-    private extractUrls;
     private isAllowedDomain;
     private scanUrls;
     private scanJailbreakPatterns;
@@ -25,7 +26,43 @@ export declare class SecurityScanner {
     private scanAIDefenceVulnerabilities;
     /** @deprecated Use standalone calculateRiskScore function for new code */
     calculateRiskScore: typeof calculateRiskScore;
-    scan(skillId: string, content: string): ScanReport;
+    /**
+     * Run every content-scanning detector against `content` and return the
+     * combined findings. Factored out of `scan()` (SMI-6033 Wave 2, Gap 2) so
+     * the encoded-payload detector's recursive rescan of DECODED content can
+     * reuse the exact same detector suite instead of a parallel, narrower
+     * reimplementation.
+     *
+     * `skipEncodedPayload` is the STRUCTURAL depth-1 recursion guarantee: the
+     * recursive callback passed to `scanEncodedPayload` below always calls this
+     * method with `skipEncodedPayload: true`, so a base64 blob discovered
+     * INSIDE already-decoded content can never itself be decoded — the inner
+     * call cannot reach `scanEncodedPayload` again no matter what the decoded
+     * text contains. This disables ONLY the encoded-payload detector on the
+     * inner call, not the rest of the suite — a decoded `curl|bash` still
+     * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
+     */
+    private runDetectors;
+    /**
+     * SMI-6033 Wave 3 (Gap 5): `isHighTrustAuthor` (default `false`) is the
+     * Gatekeeper-bypass trust-tier carve-out — see `scanGatekeeperBypass`'s own
+     * header (`SecurityScanner.compound.ts`) for the full policy. No in-repo
+     * caller of this method currently has a verified author signal to pass
+     * here (the indexer scans via the edge twin, not this core class); the
+     * parameter exists so a future verified-author caller can opt in, and so
+     * every existing call site (skill_validate, skill_rescan,
+     * bundled-sibling-scan, skill-installation.*) defaults closed by
+     * construction, not by convention.
+     *
+     * SMI-6033 Wave 2 (Gap 8) fix (2026-08-17): `isMarkdown` defaults `true`,
+     * preserving byte-identical behavior for every existing caller. Pass
+     * `false` when `content` is a real source file, not markdown — see
+     * `analyzeMarkdownContext`'s own header (SecurityScanner.helpers.ts) for
+     * why the markdown-only indented-code-block heuristic must never apply to
+     * non-markdown content. `bundled-sibling-scan.ts`'s
+     * `collectExecutableCodeFiles` candidates are the first real caller.
+     */
+    scan(skillId: string, content: string, isHighTrustAuthor?: boolean, isMarkdown?: boolean): ScanReport;
     quickCheck(content: string): boolean;
     addAllowedDomain(domain: string): void;
     addBlockedPattern(pattern: RegExp): void;

package/dist/src/security/scanner/SecurityScanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AA0B5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAkBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU;IA2FlD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAGpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAsC5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAkBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IAwGpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,UAAQ,EAAE,UAAU,UAAO,GAAG,UAAU;IA+ChG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.decoy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Security Scanner — decoy/misdirection URL-target heuristic
+ * @module @skillsmith/core/security/scanner/SecurityScanner.decoy
+ *
+ * SMI-6033 Wave 4 (Gap 6): reuses the typosquat detector's brand data —
+ * `BRAND_ALIASES` (typosquat.ts) and `AUTHORITY_CLAIMING_AFFIXES`
+ * (typosquat.ts, exported for exactly this reuse as part of Wave 1's Gap 6
+ * prerequisite) — to catch a fetch/exec instruction whose surrounding prose
+ * claims a specific vendor (a brand token, optionally reinforced by an
+ * authority-claiming affix like "official"/"verified") while the fetch
+ * target's actual domain does not belong to that vendor and is not in the
+ * general `DEFAULT_ALLOWED_DOMAINS` allowlist.
+ *
+ * Per the plan's §9 reconciliation table: `decoy_misdirection` is "N/A —
+ * never standalone... Approximate NL heuristic by construction; co-signal
+ * required (medium tier), unchanged." This detector therefore NEVER emits
+ * `high`/`critical` — only `medium`, or nothing (see the doc-context
+ * downgrade below, which uses `low`, not a third severity choice for the
+ * non-doc case). The co-signal mechanism that would let this medium finding
+ * contribute toward escalating a separate weak `code_execution` finding is a
+ * SEPARATE dispatch's job — `SecurityScanner.exec.ts`'s
+ * `CO_SIGNAL_MIN_SEVERITY` replacement — and is NOT implemented in this file.
+ *
+ * Design note, NOT explicit in the plan text and flagged here for review:
+ * the plan says to compare "the claimed vendor's canonical domain" against
+ * the fetch target's domain, but `BRAND_ALIASES`'s values are GitHub OWNER
+ * SLUGS (`anthropics`, `google-gemini`, ...) — they answer "whose GitHub org
+ * publishes this," not "what is this vendor's real website." A small
+ * curated `BRAND_CANONICAL_DOMAINS` map below, scoped to the exact same six
+ * brand tokens `BRAND_ALIASES` already curates, fills that gap; a brand
+ * token with no entry here is not currently possible (the two maps share the
+ * same key set by construction) but the lookup fails safe (empty domain
+ * list -> never matches -> never suppresses) if that ever drifts.
+ *
+ * Second design note: the plan text reads "a brand token OR an
+ * authority-claiming phrase implying a specific vendor." An authority-
+ * claiming affix ALONE ("the official installer") never names a specific
+ * vendor and so cannot resolve a canonical domain to compare against — this
+ * detector therefore requires a brand-token match to identify "the claimed
+ * vendor" at all (necessary for the domain comparison to mean anything), and
+ * treats a co-occurring authority-claiming affix as a confidence booster
+ * (medium -> high), not an alternate, independently-sufficient trigger. This
+ * mirrors typosquat.ts's own rule 3 (`hasBrandToken && hasAuthorityAffix`),
+ * which also requires both signals together.
+ *
+ * Two fixes from adversarial review (2026-08-16 — see
+ * docs/internal/code_review/2026-08-15-smi6033-wave4-escalation-model.md
+ * for the full account):
+ *
+ *  1. Fetch-target correlation. The original version treated ANY URL on a
+ *     line that ALSO matched the generic FETCH_COMMAND_PATTERN as the fetch
+ *     target — including a URL that was merely mentioned in prose alongside
+ *     an unrelated fetch-verb usage on the same line (e.g.
+ *     "curl --version; see mirror documentation at <url>", where curl is
+ *     checking its own version, not fetching that URL). Replaced with
+ *     `isActualFetchTarget`, which requires the fetch verb to be
+ *     IMMEDIATELY followed (only flag-like tokens and whitespace, no
+ *     command separator, no prose) by the URL — i.e. the URL must actually
+ *     be the verb's argument.
+ *
+ *  2. Authority-affix proximity. `hasAuthorityAffix` used to scan the ENTIRE
+ *     ±5-line window independently of where the brand token itself was
+ *     found, so an unrelated authority phrase elsewhere in the window (e.g.
+ *     "for official documentation on Python packaging, see PEP 517") could
+ *     wrongly boost confidence to 'high' for a brand claim it has nothing to
+ *     do with. Now scoped to a tight window around the brand token's OWN
+ *     line (`DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES`).
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+export declare function scanDecoyMisdirection(content: string, lineContexts?: LineContext[]): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.decoy.d.ts.map

package/dist/src/security/scanner/SecurityScanner.decoy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.decoy.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.decoy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAuK/D,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAiDnB"}

package/dist/src/security/scanner/SecurityScanner.decoy.js

@@ -0,0 +1,265 @@
+/**
+ * Security Scanner — decoy/misdirection URL-target heuristic
+ * @module @skillsmith/core/security/scanner/SecurityScanner.decoy
+ *
+ * SMI-6033 Wave 4 (Gap 6): reuses the typosquat detector's brand data —
+ * `BRAND_ALIASES` (typosquat.ts) and `AUTHORITY_CLAIMING_AFFIXES`
+ * (typosquat.ts, exported for exactly this reuse as part of Wave 1's Gap 6
+ * prerequisite) — to catch a fetch/exec instruction whose surrounding prose
+ * claims a specific vendor (a brand token, optionally reinforced by an
+ * authority-claiming affix like "official"/"verified") while the fetch
+ * target's actual domain does not belong to that vendor and is not in the
+ * general `DEFAULT_ALLOWED_DOMAINS` allowlist.
+ *
+ * Per the plan's §9 reconciliation table: `decoy_misdirection` is "N/A —
+ * never standalone... Approximate NL heuristic by construction; co-signal
+ * required (medium tier), unchanged." This detector therefore NEVER emits
+ * `high`/`critical` — only `medium`, or nothing (see the doc-context
+ * downgrade below, which uses `low`, not a third severity choice for the
+ * non-doc case). The co-signal mechanism that would let this medium finding
+ * contribute toward escalating a separate weak `code_execution` finding is a
+ * SEPARATE dispatch's job — `SecurityScanner.exec.ts`'s
+ * `CO_SIGNAL_MIN_SEVERITY` replacement — and is NOT implemented in this file.
+ *
+ * Design note, NOT explicit in the plan text and flagged here for review:
+ * the plan says to compare "the claimed vendor's canonical domain" against
+ * the fetch target's domain, but `BRAND_ALIASES`'s values are GitHub OWNER
+ * SLUGS (`anthropics`, `google-gemini`, ...) — they answer "whose GitHub org
+ * publishes this," not "what is this vendor's real website." A small
+ * curated `BRAND_CANONICAL_DOMAINS` map below, scoped to the exact same six
+ * brand tokens `BRAND_ALIASES` already curates, fills that gap; a brand
+ * token with no entry here is not currently possible (the two maps share the
+ * same key set by construction) but the lookup fails safe (empty domain
+ * list -> never matches -> never suppresses) if that ever drifts.
+ *
+ * Second design note: the plan text reads "a brand token OR an
+ * authority-claiming phrase implying a specific vendor." An authority-
+ * claiming affix ALONE ("the official installer") never names a specific
+ * vendor and so cannot resolve a canonical domain to compare against — this
+ * detector therefore requires a brand-token match to identify "the claimed
+ * vendor" at all (necessary for the domain comparison to mean anything), and
+ * treats a co-occurring authority-claiming affix as a confidence booster
+ * (medium -> high), not an alternate, independently-sufficient trigger. This
+ * mirrors typosquat.ts's own rule 3 (`hasBrandToken && hasAuthorityAffix`),
+ * which also requires both signals together.
+ *
+ * Two fixes from adversarial review (2026-08-16 — see
+ * docs/internal/code_review/2026-08-15-smi6033-wave4-escalation-model.md
+ * for the full account):
+ *
+ *  1. Fetch-target correlation. The original version treated ANY URL on a
+ *     line that ALSO matched the generic FETCH_COMMAND_PATTERN as the fetch
+ *     target — including a URL that was merely mentioned in prose alongside
+ *     an unrelated fetch-verb usage on the same line (e.g.
+ *     "curl --version; see mirror documentation at <url>", where curl is
+ *     checking its own version, not fetching that URL). Replaced with
+ *     `isActualFetchTarget`, which requires the fetch verb to be
+ *     IMMEDIATELY followed (only flag-like tokens and whitespace, no
+ *     command separator, no prose) by the URL — i.e. the URL must actually
+ *     be the verb's argument.
+ *
+ *  2. Authority-affix proximity. `hasAuthorityAffix` used to scan the ENTIRE
+ *     ±5-line window independently of where the brand token itself was
+ *     found, so an unrelated authority phrase elsewhere in the window (e.g.
+ *     "for official documentation on Python packaging, see PEP 517") could
+ *     wrongly boost confidence to 'high' for a brand claim it has nothing to
+ *     do with. Now scoped to a tight window around the brand token's OWN
+ *     line (`DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES`).
+ */
+import { analyzeMarkdownContext, isDocumentationContext } from './SecurityScanner.helpers.js';
+import { extractUrls } from './SecurityScanner.urls.js';
+import { DEFAULT_ALLOWED_DOMAINS } from './patterns.js';
+import { BRAND_ALIASES, AUTHORITY_CLAIMING_AFFIXES } from './typosquat.js';
+/** Bounded prose window (±N lines) around a fetch/exec instruction, per the plan's Gap 6 text. */
+const DECOY_WINDOW_LINES = 5;
+/**
+ * How close an authority-claiming affix ("official", "verified", ...) must
+ * be to the brand token's OWN line for it to count as a confidence booster.
+ * Same-line-only (adversarial-review fix, 2026-08-16) — the affix and the
+ * brand claim must plausibly be part of the SAME sentence/claim, not merely
+ * co-located somewhere in the wider fetch-correlation window OR on an
+ * adjacent line carrying an unrelated sentence (a real adversarial-review
+ * example: "For official documentation on Python packaging, see PEP 517."
+ * on the line right after a genuine, affix-free "Claude API" brand mention —
+ * a ±1-line window still wrongly pairs the two).
+ */
+const DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES = 0;
+const FETCH_VERBS = new Set(['curl', 'wget', 'npx']);
+/** A bare flag token, e.g. `-o`, `-fsSL`, `--output`, `--data=x`. */
+const FLAG_TOKEN = /^-{1,2}[A-Za-z][\w-]*$/;
+/**
+ * Common curl/wget/npx flags that take a SEPARATE value token (e.g.
+ * `-o setup.sh`, `-X POST`) — that value token must be consumed as part of
+ * the flag, not mistaken for prose.
+ */
+const VALUE_TAKING_FLAGS = new Set([
+    '-o',
+    '-x',
+    '-h',
+    '-d',
+    '-a',
+    '-e',
+    '-u',
+    '-b',
+    '--output',
+    '--request',
+    '--header',
+    '--data',
+    '--data-raw',
+    '--data-binary',
+    '--data-urlencode',
+    '--user-agent',
+    '--referer',
+    '--proxy',
+    '--cookie',
+]);
+/**
+ * True when `url` (verbatim substring of `lineContent`) is actually the
+ * argument to a fetch verb (curl/wget/npx, or `git clone`) on that line —
+ * not merely co-located with one. Tokenizes the prefix before the URL:
+ * rejects outright on any command separator (`;`, `|`, `&`), requires the
+ * prefix to start with the fetch verb, and requires every remaining token to
+ * be either a flag or the value argument of a value-taking flag (e.g.
+ * `curl -o setup.sh <url>`) — any other token (prose) fails the match.
+ * Rejects "curl --version; see mirror documentation at <url>" (the URL is
+ * not curl's argument, and the `;` alone already disqualifies it); accepts
+ * "curl -fsSL <url>", "curl -o setup.sh <url>", "wget <url>",
+ * "git clone <url>", "npx --yes <url>".
+ */
+function isActualFetchTarget(lineContent, url) {
+    const urlIndex = lineContent.indexOf(url);
+    if (urlIndex < 0)
+        return false;
+    const prefix = lineContent.slice(0, urlIndex);
+    if (/[;|&]/.test(prefix))
+        return false;
+    const tokens = prefix
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    if (tokens.length === 0)
+        return false;
+    let i;
+    if (tokens[0]?.toLowerCase() === 'git' && tokens[1]?.toLowerCase() === 'clone') {
+        i = 2;
+    }
+    else if (FETCH_VERBS.has(tokens[0]?.toLowerCase() ?? '')) {
+        i = 1;
+    }
+    else {
+        return false;
+    }
+    for (; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (!FLAG_TOKEN.test(token))
+            return false;
+        if (VALUE_TAKING_FLAGS.has(token.toLowerCase()) && i + 1 < tokens.length) {
+            i++; // consume the flag's own value token too
+        }
+    }
+    return true;
+}
+/**
+ * Curated canonical domain(s) per `BRAND_ALIASES` brand token — see this
+ * file's own header for why this cannot simply reuse `BRAND_ALIASES`'
+ * values directly (those are GitHub owner slugs, not DNS domains).
+ */
+const BRAND_CANONICAL_DOMAINS = {
+    anthropic: ['anthropic.com', 'claude.ai'],
+    claude: ['anthropic.com', 'claude.ai'],
+    gemini: ['google.com', 'ai.google.dev', 'deepmind.google'],
+    copilot: ['github.com', 'microsoft.com'],
+    vercel: ['vercel.com'],
+    salesforce: ['salesforce.com'],
+};
+/** Split a line into lowercase alphanumeric tokens on any separator (mirrors typosquat.ts's own `tokenize`). */
+function tokenize(raw) {
+    return raw
+        .toLowerCase()
+        .split(/[^a-z0-9]+/i)
+        .filter((t) => t.length > 0);
+}
+/** Exact-or-subdomain match against a domain set (mirrors `isAllowedDomain`'s own logic in SecurityScanner.ts). */
+function matchesDomainSet(hostname, domains) {
+    return domains.some((d) => hostname === d || hostname.endsWith('.' + d));
+}
+/**
+ * Scan a bounded ±`DECOY_WINDOW_LINES` window around `lineIndex` for a brand
+ * token (required). Returns `null` when no brand token is present — nothing
+ * to compare a fetch target's domain against. `hasAuthorityAffix` is then
+ * resolved separately, scoped tightly to the brand token's OWN line (see
+ * `DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES` and this file's header note on the
+ * adversarial-review fix) — NOT the wider fetch-correlation window, so an
+ * authority phrase unrelated to this specific brand claim can't wrongly
+ * boost confidence.
+ */
+function findVendorClaimInWindow(lines, lineIndex) {
+    const start = Math.max(0, lineIndex - DECOY_WINDOW_LINES);
+    const end = Math.min(lines.length - 1, lineIndex + DECOY_WINDOW_LINES);
+    let brandToken = null;
+    let brandLineIndex = -1;
+    for (let i = start; i <= end && !brandToken; i++) {
+        for (const token of tokenize(lines[i] ?? '')) {
+            if (Object.prototype.hasOwnProperty.call(BRAND_ALIASES, token)) {
+                brandToken = token;
+                brandLineIndex = i;
+                break;
+            }
+        }
+    }
+    if (!brandToken)
+        return null;
+    const affixStart = Math.max(0, brandLineIndex - DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES);
+    const affixEnd = Math.min(lines.length - 1, brandLineIndex + DECOY_AUTHORITY_AFFIX_PROXIMITY_LINES);
+    const hasAuthorityAffix = tokenize(lines.slice(affixStart, affixEnd + 1).join(' ')).some((t) => AUTHORITY_CLAIMING_AFFIXES.has(t));
+    return { brandToken, hasAuthorityAffix };
+}
+export function scanDecoyMisdirection(content, lineContexts) {
+    const findings = [];
+    const lines = content.split('\n');
+    const contexts = lineContexts ?? analyzeMarkdownContext(content);
+    const urls = extractUrls(content);
+    for (const { url, line } of urls) {
+        const lineIndex = line - 1;
+        const lineContent = lines[lineIndex] ?? '';
+        // Only a URL that is ACTUALLY the argument to a fetch verb is in scope —
+        // a bare linked URL ("see https://docs.example.com") is not, and neither
+        // is a URL merely co-located on a line with an unrelated fetch-verb
+        // usage (adversarial-review fix, 2026-08-16 — see isActualFetchTarget's
+        // own doc comment).
+        if (!isActualFetchTarget(lineContent, url))
+            continue;
+        let hostname;
+        try {
+            hostname = new URL(url).hostname.toLowerCase();
+        }
+        catch {
+            continue;
+        }
+        const claim = findVendorClaimInWindow(lines, lineIndex);
+        if (!claim)
+            continue; // no vendor claim nearby -> nothing to compare against; not a general brand-mention detector
+        const canonicalDomains = BRAND_CANONICAL_DOMAINS[claim.brandToken] ?? [];
+        if (matchesDomainSet(hostname, canonicalDomains))
+            continue; // fetch target IS the claimed vendor's own domain
+        if (matchesDomainSet(hostname, DEFAULT_ALLOWED_DOMAINS))
+            continue; // generally-trusted host, excluded per the plan text
+        const ctx = contexts[lineIndex];
+        const inDocContext = ctx ? isDocumentationContext(ctx) : false;
+        findings.push({
+            type: 'decoy_misdirection',
+            // Never high/critical — an approximate NL heuristic by construction
+            // (plan §9 reconciliation table); the escalation-into-code_execution
+            // co-signal mechanism lives in a separate dispatch.
+            severity: inDocContext ? 'low' : 'medium',
+            message: `Fetch target domain ("${hostname}") does not match the "${claim.brandToken}" vendor claimed nearby in the skill's own prose: ${url}`,
+            location: lineContent.trim().slice(0, 100),
+            lineNumber: line,
+            category: 'decoy_misdirection',
+            inDocumentationContext: inDocContext,
+            confidence: inDocContext ? 'low' : claim.hasAuthorityAffix ? 'high' : 'medium',
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=SecurityScanner.decoy.js.map

package/dist/src/security/scanner/SecurityScanner.decoy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.decoy.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.decoy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAIH,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAE1E,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,qCAAqC,GAAG,CAAC,CAAA;AAE/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACpD,qEAAqE;AACrE,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAC3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,GAAW;IAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEtC,MAAM,MAAM,GAAG,MAAM;SAClB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAS,CAAA;IACb,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAC/E,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;SAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC,EAAE,CAAA,CAAC,yCAAyC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAgD;IAC3E,SAAS,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;IACzC,MAAM,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;IACtC,MAAM,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,CAAC;IAC1D,OAAO,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IACxC,MAAM,EAAE,CAAC,YAAY,CAAC;IACtB,UAAU,EAAE,CAAC,gBAAgB,CAAC;CAC/B,CAAA;AAED,gHAAgH;AAChH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG;SACP,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,mHAAmH;AACnH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAA0B;IACpE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC;AAOD;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,KAAe,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAA;IAEtE,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/D,UAAU,GAAG,KAAK,CAAA;gBAClB,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,qCAAqC,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,KAAK,CAAC,MAAM,GAAG,CAAC,EAChB,cAAc,GAAG,qCAAqC,CACvD,CAAA;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7F,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAClC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAA;QAC1B,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QAC1C,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,SAAQ;QAEpD,IAAI,QAAgB,CAAA;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK;YAAE,SAAQ,CAAC,6FAA6F;QAElH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACxE,IAAI,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAAE,SAAQ,CAAC,kDAAkD;QAC7G,IAAI,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YAAE,SAAQ,CAAC,qDAAqD;QAEvH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAE9D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,oEAAoE;YACpE,qEAAqE;YACrE,oDAAoD;YACpD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YACzC,OAAO,EAAE,yBAAyB,QAAQ,0BAA0B,KAAK,CAAC,UAAU,qDAAqD,GAAG,EAAE;YAC9I,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC1C,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,oBAAoB;YAC9B,sBAAsB,EAAE,YAAY;YACpC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/security/scanner/SecurityScanner.encoding.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Security Scanner — encoded (base64) payload detect-decode-recursively-rescan
+ * @module @skillsmith/core/security/scanner/SecurityScanner.encoding
+ *
+ * SMI-6033 Wave 2 (Gap 2): before this file, `base64 -d | sh` (the DECODE
+ * INVOCATION syntax) was already caught by CODE_EXECUTION_PATTERNS, but an
+ * inert base64 blob the agent is merely instructed to decode and run itself
+ * scored zero.
+ *
+ * Rather than a parallel "this looks suspicious" heuristic (high FP risk —
+ * base64 blobs are extremely common in legitimate skills: image data URIs,
+ * git hashes, JWTs), this detector DECODES the candidate and recursively runs
+ * the caller's full detector suite against the decoded text, reusing the
+ * whole pattern arsenal instead of duplicating it. The escalation this gap
+ * achieves is free: a decoded `curl|bash` natively trips `code_execution` at
+ * ITS OWN severity, exactly as if the attacker had shipped it undecoded.
+ *
+ * Depth-1-only, STRUCTURALLY (not by convention). This module never scans
+ * itself — `rescan`, the callback the caller supplies, is expected to be the
+ * caller's OWN "run every detector" entry point with the encoded-payload
+ * detector specifically disabled for that inner call (see
+ * `SecurityScanner.ts`'s `runDetectors(content, lineContexts,
+ * skipEncodedPayload)`, where the recursive callback always passes `true`).
+ * The inner call therefore cannot reach this detector again no matter what
+ * the decoded content contains — a base64 blob discovered INSIDE decoded
+ * content is never itself decoded.
+ *
+ * Candidate detection: a contiguous base64-alphabet run,
+ * `[A-Za-z0-9+/]{120,}={0,2}`. Deliberately EXCLUDES `-`/`_` (base64url), so
+ * a JWT never becomes a candidate at all — that is the intentional mechanism
+ * keeping JWTs out, not a separate check. Bounded/ReDoS-safe: a single
+ * character-class quantifier has no catastrophic-backtracking surface, so
+ * this intentionally does NOT route through `safeRegexTest`'s 10,000-char
+ * truncation — a legitimate base64 blob routinely runs past that on one long
+ * line, and truncating it would silently defeat detection.
+ *
+ * The wrapper finding (`encoded_payload`) is advisory-tier ONLY (weight 1.2 /
+ * coefficient 0.04 — the sensitive_path/typosquat tier, NOT the 2.0/0.40 tier
+ * the other three Wave 2 detectors use, see weights.ts): this detector is
+ * pure observability/provenance-marking, not itself a strong signal. Every
+ * finding folded in from the decoded content carries a NEW `decodedFrom`
+ * field (types.ts) set to the OUTER document line the blob was found on —
+ * the same provenance-marker role `filePath` already plays for a
+ * sibling-file finding, just for a decoded-blob origin instead of a
+ * different file.
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+/**
+ * Callback the caller (`SecurityScanner`) supplies to run its OWN full
+ * detector suite against decoded text, with the encoded-payload detector
+ * itself disabled — the structural depth-1 guarantee (see module header).
+ */
+export type EncodedPayloadRescanner = (decodedContent: string) => SecurityFinding[];
+export declare function scanEncodedPayload(content: string, lineContexts: LineContext[] | undefined, rescan: EncodedPayloadRescanner): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.encoding.d.ts.map

package/dist/src/security/scanner/SecurityScanner.encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.encoding.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AA2I/D;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,cAAc,EAAE,MAAM,KAAK,eAAe,EAAE,CAAA;AAEnF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,MAAM,EAAE,uBAAuB,GAC9B,eAAe,EAAE,CAsGnB"}