@skillsmith/core 0.11.7 → 0.12.1

package/dist/src/security/scanner/SecurityScanner.js

@@ -5,12 +5,27 @@
  */
 import { DEFAULT_ALLOWED_DOMAINS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, AI_DEFENCE_PATTERNS, } from './patterns.js';
 import { safeRegexTest, safeRegexCheck, MAX_CONTENT_LENGTH_FOR_REGEX } from './regex-utils.js';
-import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, scanPatternsWithMultilineSupport, } from './SecurityScanner.helpers.js';
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, scanPatternsWithMultilineSupport, } from './SecurityScanner.helpers.js';
+// SMI-6033 Wave 2 (Gap 4): promoted shared URL extraction (see module header).
+import { extractUrls } from './SecurityScanner.urls.js';
+// SMI-6033 Wave 4: extracted out of SecurityScanner.helpers.ts (500-line gate).
+import { calculateRiskScore } from './SecurityScanner.risk-score.js';
 // Import SSRF scanner
 import { scanSsrfPatterns } from './SecurityScanner.ssrf.js';
 // Import per-category scanners (SMI-5359 Wave 4.2: extracted to keep this file
 // under the 500-line gate; pure functions of content + lineContexts).
 import { scanSensitivePaths, scanSocialEngineering, scanPromptLeaking, scanDataExfiltration, scanPrivilegeEscalation, scanChmodFetchCompound, scanPiiPatterns, } from './SecurityScanner.scanners.js';
+// SMI-6033 Wave 2: xattr Gatekeeper-bypass (Gap 5) — lives alongside
+// scanChmodFetchCompound in the same compound-signal module.
+import { scanGatekeeperBypass } from './SecurityScanner.compound.js';
+// SMI-6033 Wave 2: password-protected archive evasion (Gap 3).
+import { scanArchiveEvasion } from './SecurityScanner.archive.js';
+// SMI-6033 Wave 2: paste/snippet-host reputation + fetch-context escalation (Gap 4).
+import { scanPasteHostFetch } from './SecurityScanner.paste-host.js';
+// SMI-6033 Wave 2 (Gap 2): encoded (base64) payload detect-decode-recursively-rescan.
+import { scanEncodedPayload } from './SecurityScanner.encoding.js';
+// SMI-6033 Wave 4 (Gap 6): decoy/misdirection URL-target heuristic.
+import { scanDecoyMisdirection } from './SecurityScanner.decoy.js';
 // Import code-execution & obfuscated-directive detectors (SMI-5359 Wave 4.2).
 import { scanCodeExecution, scanObfuscatedDirective, escalateCodeExecution, } from './SecurityScanner.exec.js';
 // SMI-5876: evidence-tier classification + corroboration escalation for
@@ -19,7 +34,7 @@ import { classifyEvidence, escalateCorroboratedMentions } from './SecurityScanne
 // Import formatters (used for both re-export and static methods)
 import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary, } from './SecurityScanner.formatters.js';
 // Re-export helpers and formatters for public API
-export { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, };
+export { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, extractUrls, };
 export { scanSsrfPatterns };
 export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
 export class SecurityScanner {
@@ -33,18 +48,6 @@ export class SecurityScanner {
         this.maxContentLength = options.maxContentLength ?? 1_000_000; // 1MB
         this.riskThreshold = options.riskThreshold ?? 40;
     }
-    extractUrls(content) {
-        const urlPattern = /https?:\/\/[^\s<>"')\]]+/gi;
-        const lines = content.split('\n');
-        const results = [];
-        lines.forEach((line, index) => {
-            let match;
-            while ((match = urlPattern.exec(line)) !== null) {
-                results.push({ url: match[0], line: index + 1 });
-            }
-        });
-        return results;
-    }
     isAllowedDomain(url) {
         try {
             const parsed = new URL(url);
@@ -57,7 +60,7 @@ export class SecurityScanner {
     }
     scanUrls(content) {
         const findings = [];
-        const urls = this.extractUrls(content);
+        const urls = extractUrls(content);
         for (const { url, line } of urls) {
             if (!this.isAllowedDomain(url)) {
                 findings.push({
@@ -143,32 +146,32 @@ export class SecurityScanner {
     }
     /** @deprecated Use standalone calculateRiskScore function for new code */
     calculateRiskScore = calculateRiskScore;
-    scan(skillId, content) {
-        const startTime = performance.now();
+    /**
+     * Run every content-scanning detector against `content` and return the
+     * combined findings. Factored out of `scan()` (SMI-6033 Wave 2, Gap 2) so
+     * the encoded-payload detector's recursive rescan of DECODED content can
+     * reuse the exact same detector suite instead of a parallel, narrower
+     * reimplementation.
+     *
+     * `skipEncodedPayload` is the STRUCTURAL depth-1 recursion guarantee: the
+     * recursive callback passed to `scanEncodedPayload` below always calls this
+     * method with `skipEncodedPayload: true`, so a base64 blob discovered
+     * INSIDE already-decoded content can never itself be decoded — the inner
+     * call cannot reach `scanEncodedPayload` again no matter what the decoded
+     * text contains. This disables ONLY the encoded-payload detector on the
+     * inner call, not the rest of the suite — a decoded `curl|bash` still
+     * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
+     */
+    runDetectors(content, lineContexts, skipEncodedPayload, isHighTrustAuthor = false, isMarkdown = true) {
         const findings = [];
-        const lineContexts = analyzeMarkdownContext(content);
-        if (content.length > this.maxContentLength) {
-            findings.push({
-                type: 'suspicious_pattern',
-                severity: 'low',
-                message: `Content exceeds maximum length (${this.maxContentLength} code units)`,
-            });
-        }
         // SMI-5881: the multiline (full-content) regex pass has its OWN, much
         // smaller cap than maxContentLength — a ReDoS budget input, not a free
         // parameter (see MAX_CONTENT_LENGTH_FOR_REGEX's own comment for why this
         // isn't simply raised to match maxContentLength). A lower configured
-        // maxContentLength tightens this further; it never widens it.
+        // maxContentLength tightens this further; it never widens it. Depends
+        // only on `this.maxContentLength` (a per-instance constant), so it is
+        // safe to recompute per call rather than threading it from `scan()`.
         const effectiveMultilineLimit = Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, this.maxContentLength);
-        if (content.length > effectiveMultilineLimit) {
-            findings.push({
-                type: 'suspicious_pattern',
-                severity: 'low',
-                message: `Multiline regex scan truncated at ${effectiveMultilineLimit} code units ` +
-                    `(content is ${content.length} code units; configured maxContentLength is ` +
-                    `${this.maxContentLength} code units)`,
-            });
-        }
         findings.push(...this.scanUrls(content));
         findings.push(...scanSensitivePaths(content, lineContexts));
         findings.push(...this.scanJailbreakPatterns(content, lineContexts, effectiveMultilineLimit));
@@ -186,6 +189,27 @@ export class SecurityScanner {
             .filter((f) => f.type === 'privilege_escalation' && f.lineNumber)
             .map((f) => f.lineNumber));
         findings.push(...scanChmodFetchCompound(content, privEscLines, lineContexts));
+        // SMI-6033 Wave 2/3 (Gap 5): xattr Gatekeeper-bypass — critical only when
+        // correlated with a fetch destination AND the author isn't high-trust
+        // (indexer path only; skill_validate never passes isHighTrustAuthor, so
+        // it defaults closed and correlated xattr stays always-critical there).
+        findings.push(...scanGatekeeperBypass(content, lineContexts, isHighTrustAuthor));
+        // SMI-6033 Wave 2 (Gap 3): password-protected archive evasion —
+        // correlated + inline-literal-password form is standalone-critical;
+        // every other shape (uncorrelated CLI usage, prose-only mention) is
+        // medium/advisory.
+        findings.push(...scanArchiveEvasion(content, lineContexts));
+        // SMI-6033 Wave 2 (Gap 4): paste/snippet-host reputation — a paste-host
+        // URL that is the target of a fetch command is standalone-critical; a
+        // merely-linked paste-host URL keeps only its existing scanUrls()
+        // url:medium finding (this detector adds no finding for that case).
+        findings.push(...scanPasteHostFetch(content, lineContexts));
+        // SMI-6033 Wave 4 (Gap 6): decoy/misdirection — a fetch target whose
+        // domain doesn't match a brand/authority claim made nearby in the
+        // skill's own prose. Advisory-only (medium, never high/critical); must
+        // run before escalateCodeExecution below since a later dispatch wires
+        // this finding type into that co-signal mechanism.
+        findings.push(...scanDecoyMisdirection(content, lineContexts));
         findings.push(...this.scanAIDefenceVulnerabilities(content, lineContexts, effectiveMultilineLimit));
         findings.push(...scanSsrfPatterns(content, lineContexts, effectiveMultilineLimit));
         findings.push(...scanPiiPatterns(content, lineContexts));
@@ -201,10 +225,64 @@ export class SecurityScanner {
         // next to a real remote-fetch-to-interpreter is corroborating evidence,
         // not benign prose. MUST run after escalateCodeExecution so a
         // freshly-critical code_execution finding can itself serve as a
-        // corroborator (verified: CODE_EXECUTION_CO_OCCURRENCE never contains
+        // corroborator (verified: CO_SIGNAL_MIN_SEVERITY — SMI-6033 Wave 4's
+        // replacement for CODE_EXECUTION_CO_OCCURRENCE — never contains
         // 'jailbreak'/'ai_defence', so this can't create a feedback loop back
         // into escalateCodeExecution's own decision).
         escalateCorroboratedMentions(findings);
+        // SMI-6033 Wave 2 (Gap 2): decode-and-recursively-rescan base64 payloads.
+        // Appended AFTER this call's own escalation passes above, and the
+        // recursive rescan's OWN findings are already fully escalated by its own
+        // (inner) call to this same method — so no finding is ever run through
+        // escalateCodeExecution/escalateCorroboratedMentions twice.
+        if (!skipEncodedPayload) {
+            findings.push(...scanEncodedPayload(content, lineContexts, (decodedContent) => this.runDetectors(decodedContent, analyzeMarkdownContext(decodedContent, isMarkdown), true, isHighTrustAuthor, isMarkdown)));
+        }
+        return findings;
+    }
+    /**
+     * SMI-6033 Wave 3 (Gap 5): `isHighTrustAuthor` (default `false`) is the
+     * Gatekeeper-bypass trust-tier carve-out — see `scanGatekeeperBypass`'s own
+     * header (`SecurityScanner.compound.ts`) for the full policy. No in-repo
+     * caller of this method currently has a verified author signal to pass
+     * here (the indexer scans via the edge twin, not this core class); the
+     * parameter exists so a future verified-author caller can opt in, and so
+     * every existing call site (skill_validate, skill_rescan,
+     * bundled-sibling-scan, skill-installation.*) defaults closed by
+     * construction, not by convention.
+     *
+     * SMI-6033 Wave 2 (Gap 8) fix (2026-08-17): `isMarkdown` defaults `true`,
+     * preserving byte-identical behavior for every existing caller. Pass
+     * `false` when `content` is a real source file, not markdown — see
+     * `analyzeMarkdownContext`'s own header (SecurityScanner.helpers.ts) for
+     * why the markdown-only indented-code-block heuristic must never apply to
+     * non-markdown content. `bundled-sibling-scan.ts`'s
+     * `collectExecutableCodeFiles` candidates are the first real caller.
+     */
+    scan(skillId, content, isHighTrustAuthor = false, isMarkdown = true) {
+        const startTime = performance.now();
+        const findings = [];
+        const lineContexts = analyzeMarkdownContext(content, isMarkdown);
+        if (content.length > this.maxContentLength) {
+            findings.push({
+                type: 'suspicious_pattern',
+                severity: 'low',
+                message: `Content exceeds maximum length (${this.maxContentLength} code units)`,
+            });
+        }
+        // SMI-5881: see runDetectors()'s own comment on effectiveMultilineLimit
+        // for why this cap is separate from maxContentLength.
+        const effectiveMultilineLimit = Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, this.maxContentLength);
+        if (content.length > effectiveMultilineLimit) {
+            findings.push({
+                type: 'suspicious_pattern',
+                severity: 'low',
+                message: `Multiline regex scan truncated at ${effectiveMultilineLimit} code units ` +
+                    `(content is ${content.length} code units; configured maxContentLength is ` +
+                    `${this.maxContentLength} code units)`,
+            });
+        }
+        findings.push(...this.runDetectors(content, lineContexts, false, isHighTrustAuthor, isMarkdown));
         const endTime = performance.now();
         const { total: riskScore, breakdown: riskBreakdown } = calculateRiskScore(findings);
         const hasCritical = findings.some((f) => f.severity === 'critical');

package/dist/src/security/scanner/SecurityScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AAErC,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,MAAM,UAAU,GAAG,4BAA4B,CAAA;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,OAAO,GAAyC,EAAE,CAAA;QAExD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,IAAI,KAAK,CAAA;YACT,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAEtC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC,IAAI,CAAC,OAAe,EAAE,OAAe;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEpD,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAC5F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CACrF,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;SACd,CAAA;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAI9F,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AACrC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAEpE,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,GAChB,MAAM,+BAA+B,CAAA;AAEtC,qEAAqE;AACrE,6DAA6D;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,+DAA+D;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,qFAAqF;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,sFAAsF;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,8EAA8E;AAC9E,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAElC,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAE9F,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QAEjC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAC3B,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe,EAAE,YAA4B;QAC1E,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,oEAAoE;oBACpE,sEAAsE;oBACtE,2EAA2E;oBAC3E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAE7E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,qEAAqE;oBACrE,gEAAgE;oBAChE,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAgC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAE9E,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAAuC,EACvC,kBAA0B;QAE1B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,QAAQ,EAAE,gBAAgB;SAC3B,EACD,YAAY,EACZ,kBAAkB,CACnB,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC;;;;;;;;;;;;;;;OAeG;IACK,YAAY,CAClB,OAAe,EACf,YAA2B,EAC3B,kBAA2B,EAC3B,iBAAiB,GAAG,KAAK,EACzB,UAAU,GAAG,IAAI;QAEjB,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAE7F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAC5F,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,UAAU,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAoB,CAAC,CACtC,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAChF,gEAAgE;QAChE,oEAAoE;QACpE,oEAAoE;QACpE,mBAAmB;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC3D,qEAAqE;QACrE,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC9D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CACrF,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;QAElD,iFAAiF;QACjF,gFAAgF;QAChF,2DAA2D;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAE/B,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,gEAAgE;QAChE,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,8CAA8C;QAC9C,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAEtC,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,CAC9D,IAAI,CAAC,YAAY,CACf,cAAc,EACd,sBAAsB,CAAC,cAAc,EAAE,UAAU,CAAC,EAClD,IAAI,EACJ,iBAAiB,EACjB,UAAU,CACX,CACF,CACF,CAAA;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAe,EAAE,OAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI;QACjF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,cAAc;aAChF,CAAC,CAAA;QACJ,CAAC;QAED,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EACL,qCAAqC,uBAAuB,cAAc;oBAC1E,eAAe,OAAO,CAAC,MAAM,8CAA8C;oBAC3E,GAAG,IAAI,CAAC,gBAAgB,cAAc;aACzC,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAA;QAEhG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;SACd,CAAA;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.paste-host.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Security Scanner — paste/snippet-host reputation + fetch-context escalation
+ * @module @skillsmith/core/security/scanner/SecurityScanner.paste-host
+ *
+ * SMI-6033 Wave 3 (Gap 4 fix): the originally-shipped version of this
+ * detector (commit b74c18436) implemented a SIMPLER, and in one specific way
+ * INCORRECT, design relative to the approved plan
+ * (docs/internal/implementation/smi-6033-clawhavoc-scanner-gaps.md, Gap 4):
+ * it used a single flat PASTE_HOST_DOMAINS list (incorrectly including
+ * transfer.sh/file.io alongside glot.io/pastebin.com) and treated ANY
+ * same-line fetch of a paste-host URL as standalone-critical, with no
+ * requirement that the fetched content actually be EXECUTED. This file fixes
+ * both:
+ *
+ *   1. Two separate reputation tiers (patterns.ts): `ANON_PASTE_HOSTS` (+
+ *      `URL_SHORTENER_DOMAINS`, execution-gated the same way) vs.
+ *      `TRANSIENT_TRANSFER_HOSTS` (never standalone-critical — a deliberate,
+ *      documented exception for legitimate debugging/incident-response
+ *      fetches of ephemeral reproducers).
+ *   2. Execution evidence is now REQUIRED for `ANON_PASTE_HOSTS`/shorteners
+ *      to reach critical — either (a) the URL is piped directly to an
+ *      interpreter on the same line (`curl <url> | bash`, no intermediate
+ *      file), (b) `npx <url>` directly executes the fetched content (no
+ *      pipe, no intermediate file either), or (c) the fetch destination is
+ *      subsequently executed/chmod'd/sourced ELSEWHERE in the content,
+ *      correlated via the shared `isCorrelatedWithFetchDestination` utility
+ *      (SecurityScanner.fetch-correlation.ts). Fetched-but-not-executed, or
+ *      merely linked, now correctly stays at the existing scanUrls()
+ *      `url`:medium finding — no new finding here.
+ *
+ * (a)/(b) are a NEW, local execution-detection shape distinct from (c):
+ * `isCorrelatedWithFetchDestination` only detects "was this basename later
+ * written as a fetch command's DOWNLOAD DESTINATION, then referenced
+ * elsewhere" — it has no notion of a same-line direct pipe/direct-exec (no
+ * intermediate file at all). The direct-pipe/npx-direct-exec patterns below
+ * are local to this file (not promoted to the shared fetch-correlation
+ * module, which Gap 5's concurrent xattr fix does not touch) and are
+ * deliberately scoped to "the URL being piped/executed is specifically a
+ * paste-host or shortener domain" — `CODE_EXECUTION_PATTERNS`' own curl|bash
+ * pattern (patterns.ts) already fires independently for ANY curl|bash
+ * regardless of domain reputation; this file adds the DOMAIN-REPUTATION-aware
+ * escalation on top.
+ *
+ * `TRANSIENT_TRANSFER_HOSTS` never reaches critical: it emits
+ * `paste_host_fetch` at medium whenever it is an actual fetch target (the URL
+ * is the ARGUMENT of a same-line fetch verb — see `isActualFetchTarget`
+ * below), regardless of execution evidence — `curl file.io/x | bash` alone
+ * staying sub-threshold is intentional, not a gap (see patterns.ts's
+ * `TRANSIENT_TRANSFER_HOSTS` comment for the rationale).
+ *
+ * SMI-6033 Wave 3 (adversarial-review fix): the "is this URL fetched?" gate
+ * used to be a bare `FETCH_COMMAND_PATTERN` test against the whole LINE, so a
+ * fetch verb ANYWHERE on the line counted — `curl --version; see mirror docs
+ * at https://pastebin.com/abc` wrongly registered the pastebin URL as
+ * fetched. Replaced with `isActualFetchTarget`, which binds the URL to the
+ * verb by tokenizing the prefix that precedes it. Same bug class as Wave 4's
+ * `decoy_misdirection` fix; see `isActualFetchTarget`'s own doc comment for
+ * the two deliberate adaptations to this detector's inputs. This affects ONLY
+ * the same-line fetch-target gate — the direct-pipe and npx-direct-exec
+ * execution-evidence paths below are a different code path and are unchanged.
+ *
+ * Known, documented residual (static scanner, no network I/O): redirect-
+ * chain/final-host resolution is out of scope by design — custom domains,
+ * redirects, and compromised allowlisted hosts are a known residual.
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+export declare function scanPasteHostFetch(content: string, lineContexts?: LineContext[]): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.paste-host.d.ts.map

package/dist/src/security/scanner/SecurityScanner.paste-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.paste-host.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.paste-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAkO/D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAkEnB"}