@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/security/scanner/patterns.sensitive-path.js

@@ -0,0 +1,137 @@
+/**
+ * Security Scanner Patterns — the `sensitive_path` family
+ * @module @skillsmith/core/security/scanner/patterns.sensitive-path
+ *
+ * SMI-5207: extracted from patterns.ts, which sat 18 lines under the repo's
+ * 500-line pre-commit gate (scripts/check-file-length.mjs) before this wave —
+ * not enough headroom for the 12 hoisted pattern consts plus the two new
+ * severity-gate classification sets below (~42 lines). Same
+ * move-the-family-then-re-export convention already used twice in patterns.ts
+ * (patterns.jailbreak.ts, SMI-5876; patterns.exec.ts, SMI-6033 Wave 4).
+ *
+ * Every symbol here is re-exported unchanged from patterns.ts, so every
+ * existing import path keeps working AND reference identity is preserved —
+ * load-bearing, because scanSensitivePaths() classifies patterns by reference
+ * (`pattern === ENV_PATH_PATTERN`, `VALUE_GATED_KEYWORD_PATTERNS.has(pattern)`,
+ * and now `PATH_FORM_PATTERNS.has(pattern)` /
+ * `VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)`).
+ *
+ * NOTE: a change to SENSITIVE_PATH_PATTERNS or to the severity classification
+ * below requires bumping SCANNER_RULESET_VERSION in patterns.ts — see that
+ * constant's own doc comment.
+ */
+// Sensitive file path patterns
+// SMI-4396 Wave 2: bare-keyword variants (credentials, secrets?, password) tightened
+// to require assignment/path/file-extension context. Without this tuning,
+// documentation keywords in SKILL.md frontmatter and prose (1Password integration
+// guides, security-research skill domain vocabulary) tripped HIGH severity.
+//
+// SMI-5359 Wave 4 — FP-narrowing for two over-firing entries (severity policy lives
+// in scanSensitivePaths so the array length / regression-guard baseline is unchanged):
+//   MF-1: bare /api[_-]?key/i & /auth[_-]?token/i fired HIGH on ANY substring —
+//     benign prose ("set your api_key in the dashboard"), `export API_KEY=$1`, and
+//     `apiKey: <YOUR_KEY>` placeholders. They are now VALUE-GATED: HIGH only when the
+//     line assigns a real (non-placeholder, sufficiently-entropic) secret. The
+//     value-BEARING leak is already caught at PII (PII_PATTERNS[0/2]); the
+//     credential-in-an-outbound-curl exfil is caught by DATA_EXFILTRATION_PATTERNS
+//     (the `$API_KEY`-in-a-fetched-URL pattern added there). See
+//     VALUE_GATED_KEYWORD_PATTERNS.
+//   MF-2: lone /\.env/i fired HIGH on every `.env` mention AND on the benign committed
+//     family (.envrc, .env.example/.sample/.template/.schema/.dist). ENV_PATH_PATTERN
+//     negative-lookaheads exclude that family; scanSensitivePaths downgrades a LONE
+//     `.env` to MEDIUM and keeps HIGH when it co-occurs with a read/exfil verb or
+//     shell pipe/redirect (`cat .env | curl ...`).
+//
+// SMI-5207 — the remaining 12 entries got the same treatment the two MF-1 keywords
+// and the MF-2 `.env` entry already had: severity is now context-gated rather than
+// unconditionally HIGH. MF-3 covers the 9 path-form entries (action verb or shell
+// operator within +/-1 line), MF-4 the 3 keyword-assignment entries (HIGH unless the
+// assigned value positively reads as prose). Both gates live in
+// SecurityScanner.scanners.ts; this module only supplies the classification.
+// MF-2: `.env` as a real env-file reference. Excludes `.envrc` (direnv config) and the
+// committed placeholder family (.env.example/.sample/.template/.schema/.dist). The
+// `(?![A-Za-z])` guard also drops the `.environment`/`.envision` English-word FP while
+// still matching real variants like `.env`, `.env.local`, `.env.production`.
+export const ENV_PATH_PATTERN = /\.env(?![A-Za-z])(?!\.(?:example|sample|template|schema|dist))/i;
+// MF-1: bare credential keywords — value-gated in scanSensitivePaths, never standalone HIGH.
+const API_KEY_KEYWORD = /api[_-]?key/i;
+const AUTH_TOKEN_KEYWORD = /auth[_-]?token/i;
+// SMI-5207: the 12 non-`.env` entries are hoisted from inline array literals to named
+// consts so scanSensitivePaths can classify each by severity gate BY REFERENCE. The
+// array's contents, order, and length (15) are unchanged — the regression-guard floor
+// (scanner-regression-guard.test.ts) still holds.
+// Contextual credentials: filename or assignment, not bare prose
+const CREDENTIALS_FILE_PATTERN = /credentials\.(?:json|ya?ml|env|toml|txt)/i;
+const CREDENTIALS_ASSIGN_PATTERN = /credentials\s*[:=]/i;
+// Contextual secrets: assignment or path, not bare word
+const SECRETS_ASSIGN_PATTERN = /\bsecrets?\s*[:=]/i;
+const SECRETS_PATH_PATTERN = /\bsecrets?\/[a-z0-9_.-]+/i;
+const PEM_PATTERN = /\.pem$/i;
+const KEY_FILE_PATTERN = /\.key$/i;
+const CRT_PATTERN = /\.crt$/i;
+// Contextual password: assignment or URL (postgres://user:pass@host) only
+const PASSWORD_ASSIGN_PATTERN = /password\s*[:=]/i;
+const SSH_DIR_PATTERN = /~\/\.ssh/i;
+const AWS_DIR_PATTERN = /~\/\.aws/i;
+const CONFIG_DIR_PATTERN = /~\/\.config/i;
+// SMI-4396 Wave 2: explicit system-file paths. Added so that tightening
+// bare /credentials/i and /password/i into assignment-context variants
+// doesn't drop coverage of obvious sensitive references like /etc/passwd.
+const ETC_SYSTEM_FILE_PATTERN = /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i;
+export const SENSITIVE_PATH_PATTERNS = [
+    ENV_PATH_PATTERN,
+    CREDENTIALS_FILE_PATTERN,
+    CREDENTIALS_ASSIGN_PATTERN,
+    SECRETS_ASSIGN_PATTERN,
+    SECRETS_PATH_PATTERN,
+    PEM_PATTERN,
+    KEY_FILE_PATTERN,
+    CRT_PATTERN,
+    PASSWORD_ASSIGN_PATTERN,
+    API_KEY_KEYWORD,
+    AUTH_TOKEN_KEYWORD,
+    SSH_DIR_PATTERN,
+    AWS_DIR_PATTERN,
+    CONFIG_DIR_PATTERN,
+    ETC_SYSTEM_FILE_PATTERN,
+];
+// MF-1: the two bare-keyword patterns above emit HIGH only when accompanied by a real
+// assigned secret value; scanSensitivePaths suppresses an otherwise-bare match.
+export const VALUE_GATED_KEYWORD_PATTERNS = new Set([
+    API_KEY_KEYWORD,
+    AUTH_TOKEN_KEYWORD,
+]);
+/**
+ * SMI-5207 (MF-3): the 9 path/filename-form entries. HIGH only when an action
+ * verb or shell operator appears within +/-1 line of the match; otherwise
+ * MEDIUM — a bare path *mention* is the common case, so evidence is required
+ * to escalate. See scanSensitivePaths' hasPathActionContext().
+ */
+export const PATH_FORM_PATTERNS = new Set([
+    CREDENTIALS_FILE_PATTERN,
+    SECRETS_PATH_PATTERN,
+    PEM_PATTERN,
+    KEY_FILE_PATTERN,
+    CRT_PATTERN,
+    SSH_DIR_PATTERN,
+    AWS_DIR_PATTERN,
+    CONFIG_DIR_PATTERN,
+    ETC_SYSTEM_FILE_PATTERN,
+]);
+/**
+ * SMI-5207 (MF-4): the 3 keyword-assignment entries. HIGH BY DEFAULT —
+ * `keyword: value` is a syntactic credential-assignment shape, rare in
+ * innocent prose — downgraded to MEDIUM only on positive prose evidence about
+ * the assigned value. See scanSensitivePaths' assignmentHasRealValue().
+ *
+ * Partition check (guarded by a dedicated test): 1 (ENV) + 9 (PATH_FORM) +
+ * 3 (ASSIGNMENT) + 2 (VALUE_GATED_KEYWORD) = 15, total and disjoint. An
+ * unclassified future pattern falls through to scanSensitivePaths' fail-CLOSED
+ * `else` branch and stays HIGH.
+ */
+export const VALUE_GATED_ASSIGNMENT_PATTERNS = new Set([
+    CREDENTIALS_ASSIGN_PATTERN,
+    SECRETS_ASSIGN_PATTERN,
+    PASSWORD_ASSIGN_PATTERN,
+]);
+//# sourceMappingURL=patterns.sensitive-path.js.map

package/dist/src/security/scanner/patterns.sensitive-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.sensitive-path.js","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.sensitive-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,+BAA+B;AAC/B,qFAAqF;AACrF,0EAA0E;AAC1E,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,oFAAoF;AACpF,uFAAuF;AACvF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,iEAAiE;AACjE,oCAAoC;AACpC,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,kFAAkF;AAClF,mDAAmD;AACnD,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,qFAAqF;AACrF,gEAAgE;AAChE,6EAA6E;AAE7E,uFAAuF;AACvF,mFAAmF;AACnF,uFAAuF;AACvF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,iEAAiE,CAAA;AAEjG,6FAA6F;AAC7F,MAAM,eAAe,GAAG,cAAc,CAAA;AACtC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAE5C,sFAAsF;AACtF,oFAAoF;AACpF,sFAAsF;AACtF,kDAAkD;AAClD,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,2CAA2C,CAAA;AAC5E,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,wDAAwD;AACxD,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AACnD,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AACxD,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAClC,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAClD,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AACzC,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,2CAA2C,CAAA;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB;IAChB,wBAAwB;IACxB,0BAA0B;IAC1B,sBAAsB;IACtB,oBAAoB;IACpB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,uBAAuB;IACvB,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,uBAAuB;CACxB,CAAA;AAED,sFAAsF;AACtF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,eAAe;IACf,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,wBAAwB;IACxB,oBAAoB;IACpB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,uBAAuB;CACxB,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC;IAC1E,0BAA0B;IAC1B,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAA"}

package/dist/src/security/scanner/regex-utils.d.ts

@@ -11,25 +11,39 @@
  */
 export declare const MAX_LINE_LENGTH_FOR_REGEX = 10000;
 /**
- * SMI-5881: Cap for the FULL-CONTENT (multiline "pass 1") regex scan, in
- * UTF-16 code units (JavaScript `string.length` — NOT bytes/code points; see
- * SecurityScanner.ts's content-length finding message).
+ * SMI-5879 (design §3.4): Cap for the FULL-CONTENT (multiline "pass 1") regex
+ * scan, in UTF-16 code units (JavaScript `string.length` — NOT bytes/code
+ * points; see SecurityScanner.ts's content-length finding message).
  *
- * Equal to MAX_LINE_LENGTH_FOR_REGEX today (both 10_000) but declared
- * separately because the two caps protect different scan passes (per-line vs
- * whole-document) and may need to diverge later. This is a ReDoS budget
- * input, not a free parameter — raising it requires first proving
- * AD_CRLF_INJECTION-class patterns stay linear at the new size. Measured
- * (SMI-5881): the fixed AD_CRLF_INJECTION pattern is already ~4x slower per
- * doubling of input size on some adversarial inputs at sizes past this cap,
- * extrapolating to unacceptable latency well before 1,000,000 — so this cap
- * is NOT raised as part of SMI-5881 even though larger trust tiers allow a
- * much bigger `maxContentLength`. See SecurityScanner.ts's
- * `effectiveMultilineLimit` (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX,
- * maxContentLength)`) for how this interacts with the per-tier content-length
- * ceiling.
+ * SMI-5881 set this equal to MAX_LINE_LENGTH_FOR_REGEX (10,000) and declined
+ * to raise it, citing a doubling-based extrapolation from smaller inputs that
+ * projected "unacceptable latency well before 1,000,000" for
+ * AD_CRLF_INJECTION-class patterns. SMI-5879 independently re-measured
+ * directly at 1,000,000 (not extrapolated) across the 7 ported multiline
+ * patterns (AD_CRLF_INJECTION, AD_ROLE_MARKER_BARE, AD_HTML_COMMENT_VERB/NOUN,
+ * AD_DELIMITER_BARE, AD_AN2_ROLE_BODY_NEXT_LINE, JB_JS3A/JS3B) against
+ * per-pattern adversarial near-miss shapes (not just the CRLF-pair shape
+ * SMI-5881 used) and found linear scaling with a worst case of ~56ms at
+ * 1,000,000 chars (AD_HTML_COMMENT_NOUN, "repeated HTML-comment-open"
+ * near-miss) — confirmed still linear (not superlinear) up to 4,000,000
+ * chars (~145ms), comfortably under the section 7.3 250ms per-case budget.
+ * The prior extrapolation does not hold empirically at this exact size; the
+ * measured worst case has real headroom, just less than the ~78x this
+ * design doc's own (unverified) claim asserted. Raising this cap closes the
+ * 10 KB pass-1 truncation blind spot (design §3.4) — the edge's own
+ * MAX_SKILL_CONTENT_SIZE is 1,000,000 bytes, so pass 1 previously saw only
+ * the first 1% of a large SKILL.md.
+ *
+ * Still declared separately from MAX_LINE_LENGTH_FOR_REGEX because the two
+ * caps protect different scan passes (per-line vs whole-document) and may
+ * need to diverge again. See SecurityScanner.ts's `effectiveMultilineLimit`
+ * (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`) for how this
+ * interacts with the per-tier content-length ceiling — a trust tier with a
+ * SMALLER configured `maxContentLength` still tightens the effective limit
+ * below this cap; none currently need MORE than this cap for the multiline
+ * pass specifically.
  */
-export declare const MAX_CONTENT_LENGTH_FOR_REGEX = 10000;
+export declare const MAX_CONTENT_LENGTH_FOR_REGEX = 1000000;
 /**
  * SMI-882: Safe regex test with length limit
  * Applies input length limit before regex matching to prevent ReDoS attacks.

package/dist/src/security/scanner/regex-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4BAA4B,QAA4B,CAAA;AAErE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}
+{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAA;AAErD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}

package/dist/src/security/scanner/regex-utils.js

@@ -11,25 +11,39 @@
  */
 export const MAX_LINE_LENGTH_FOR_REGEX = 10000;
 /**
- * SMI-5881: Cap for the FULL-CONTENT (multiline "pass 1") regex scan, in
- * UTF-16 code units (JavaScript `string.length` — NOT bytes/code points; see
- * SecurityScanner.ts's content-length finding message).
+ * SMI-5879 (design §3.4): Cap for the FULL-CONTENT (multiline "pass 1") regex
+ * scan, in UTF-16 code units (JavaScript `string.length` — NOT bytes/code
+ * points; see SecurityScanner.ts's content-length finding message).
  *
- * Equal to MAX_LINE_LENGTH_FOR_REGEX today (both 10_000) but declared
- * separately because the two caps protect different scan passes (per-line vs
- * whole-document) and may need to diverge later. This is a ReDoS budget
- * input, not a free parameter — raising it requires first proving
- * AD_CRLF_INJECTION-class patterns stay linear at the new size. Measured
- * (SMI-5881): the fixed AD_CRLF_INJECTION pattern is already ~4x slower per
- * doubling of input size on some adversarial inputs at sizes past this cap,
- * extrapolating to unacceptable latency well before 1,000,000 — so this cap
- * is NOT raised as part of SMI-5881 even though larger trust tiers allow a
- * much bigger `maxContentLength`. See SecurityScanner.ts's
- * `effectiveMultilineLimit` (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX,
- * maxContentLength)`) for how this interacts with the per-tier content-length
- * ceiling.
+ * SMI-5881 set this equal to MAX_LINE_LENGTH_FOR_REGEX (10,000) and declined
+ * to raise it, citing a doubling-based extrapolation from smaller inputs that
+ * projected "unacceptable latency well before 1,000,000" for
+ * AD_CRLF_INJECTION-class patterns. SMI-5879 independently re-measured
+ * directly at 1,000,000 (not extrapolated) across the 7 ported multiline
+ * patterns (AD_CRLF_INJECTION, AD_ROLE_MARKER_BARE, AD_HTML_COMMENT_VERB/NOUN,
+ * AD_DELIMITER_BARE, AD_AN2_ROLE_BODY_NEXT_LINE, JB_JS3A/JS3B) against
+ * per-pattern adversarial near-miss shapes (not just the CRLF-pair shape
+ * SMI-5881 used) and found linear scaling with a worst case of ~56ms at
+ * 1,000,000 chars (AD_HTML_COMMENT_NOUN, "repeated HTML-comment-open"
+ * near-miss) — confirmed still linear (not superlinear) up to 4,000,000
+ * chars (~145ms), comfortably under the section 7.3 250ms per-case budget.
+ * The prior extrapolation does not hold empirically at this exact size; the
+ * measured worst case has real headroom, just less than the ~78x this
+ * design doc's own (unverified) claim asserted. Raising this cap closes the
+ * 10 KB pass-1 truncation blind spot (design §3.4) — the edge's own
+ * MAX_SKILL_CONTENT_SIZE is 1,000,000 bytes, so pass 1 previously saw only
+ * the first 1% of a large SKILL.md.
+ *
+ * Still declared separately from MAX_LINE_LENGTH_FOR_REGEX because the two
+ * caps protect different scan passes (per-line vs whole-document) and may
+ * need to diverge again. See SecurityScanner.ts's `effectiveMultilineLimit`
+ * (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`) for how this
+ * interacts with the per-tier content-length ceiling — a trust tier with a
+ * SMALLER configured `maxContentLength` still tightens the effective limit
+ * below this cap; none currently need MORE than this cap for the multiline
+ * pass specifically.
  */
-export const MAX_CONTENT_LENGTH_FOR_REGEX = MAX_LINE_LENGTH_FOR_REGEX;
+export const MAX_CONTENT_LENGTH_FOR_REGEX = 1_000_000;
 /**
  * SMI-882: Safe regex test with length limit
  * Applies input length limit before regex matching to prevent ReDoS attacks.

package/dist/src/security/scanner/regex-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAyB,CAAA;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}
+{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/src/security/scanner/types.d.ts

@@ -117,6 +117,15 @@ export interface ScanReport {
     riskScore: number;
     /** Breakdown of risk score by category */
     riskBreakdown: RiskScoreBreakdown;
+    /**
+     * SMI-5879 (design §3.3.6): true when the jailbreak or ai_defence multiline
+     * pass hit its per-pattern iteration ceiling before exhausting matches on a
+     * pathological same-line-repetition input. NOT provably score-neutral — the
+     * write path must treat this scan as authoritative for RAISING a verdict
+     * only, never for lowering an existing quarantine. Absent/undefined is
+     * equivalent to `false` (not truncated) for gating purposes.
+     */
+    multilineTruncated?: boolean;
 }
 /**
  * Verdict returned by comparing two scans of the SAME skill to detect a

package/dist/src/security/scanner/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,GACtB,WAAW,GACX,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,CAAA;AAExB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,iBAAiB,CAAA;AAErB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,GACtB,WAAW,GACX,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,CAAA;AAExB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,iBAAiB,CAAA;AAErB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;IACjC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD"}

package/dist/src/services/SubagentGenerator.client-profiles.d.ts

@@ -0,0 +1,258 @@
+/**
+ * SMI-6276 (Wave 6 Step 1): per-client generation profile for companion
+ * subagent files (`SubagentGenerator.ts`).
+ *
+ * `SubagentGenerator.generateSubagentContent()` predates multi-client support
+ * entirely — it always emitted Claude-native tool names (`Read, Write, Bash,
+ * WebFetch, Grep, Glob, WebSearch`) plus a `model: <haiku|sonnet|opus>`
+ * frontmatter field, for every client `COMPANION_AGENT_TARGETS`
+ * (`../install/paths.ts`) writes a companion-agent file for — including
+ * clients whose own agent-definition format doesn't have a `tools:` or
+ * `model:` concept, has one with entirely different value semantics, or (a
+ * real, spec-documented failure mode for AntiGravity specifically — see
+ * below) can HANG the subagent process on an unmapped tool name.
+ *
+ * This module is the exhaustive per-client answer, keyed on `ClientId`
+ * (matching `COMPANION_AGENT_TARGETS`'s own key set, not the narrower
+ * `HarnessId` — every `ClientId` gets a companion-agent file written
+ * somewhere per `COMPANION_AGENT_TARGETS`, so every one needs a content
+ * decision here too). For each client:
+ *
+ * 1. Which frontmatter fields it accepts (`includeSkillsField`,
+ *    `toolsPolicy`, `modelPolicy`, `extraFrontmatterLines`).
+ * 2. Its tool-identifier vocabulary and value SHAPE — `'claude-native'`
+ *    (Skillsmith's internal tool names ARE that client's own names, emitted
+ *    as a comma-separated scalar, no translation needed), `'mapped-array'`
+ *    (the client has its OWN, confirmed-different tool vocabulary AND
+ *    expects a YAML array rather than a scalar — translate through
+ *    `toolNameMap`, silently drop any internal name with no confirmed
+ *    mapping, and omit the field entirely if nothing maps), or `'omit'`
+ *    (vocabulary not independently verified at all — never emit the field
+ *    rather than guess a wrong value).
+ * 3. Its model-selection policy — `'claude-enum'` (accepts Claude's
+ *    `haiku|sonnet|opus` values directly) or `'omit'` (either no `model:`
+ *    concept at all, or one with value semantics that don't line up with
+ *    Skillsmith's internal enum — including a DIFFERENT PROVIDER's own
+ *    model-tier vocabulary, which is a family swap, not just a renaming).
+ *
+ * Confidence levels (style follows `../install/agent-harness-targets.ts`'s
+ * own header — HIGH/MEDIUM/LOW per client, dated citation, never asserted
+ * past what the citation actually supports):
+ *
+ * - **claude-code** — HIGH. Claude Code's own native subagent format
+ *   (`.claude/agents/*.md`): `name`, `description`, `tools` (comma-separated
+ *   Claude tool names), `model`. This is this repo's pre-existing behavior
+ *   (unchanged by this wave) and matches `renderClaudeShim()`
+ *   (`agent-pack/shims.ts`), which uses the identical `name`/`description`/
+ *   `tools` frontmatter shape for the fixed named-agent shim.
+ * - **cursor** — HIGH, verified live against cursor.com/docs/subagents
+ *   (fetched 2026-08-30): "Cursor recognizes subagent files across multiple
+ *   directory formats: `.cursor/agents/` (Cursor format), `.claude/agents/`
+ *   (Claude compatibility), `.codex/agents/` (Codex compatibility)."
+ *   `COMPANION_AGENT_TARGETS.cursor` resolves to the SAME path as
+ *   `claude-code` (`~/.claude/agents/<name>-specialist.md` — see that
+ *   table's own comment: "Cursor 2.4+ reads `.claude/agents/` natively — no
+ *   separate shim file"), so the file this generator actually writes for
+ *   `--client cursor` is read by Cursor through that Claude-compatibility
+ *   path and must carry genuine Claude-format frontmatter — this profile
+ *   mirrors `claude-code`'s exactly (same object, not a coincidental
+ *   duplicate). Cursor's OWN native `.cursor/agents/*.md` format is verified
+ *   DIFFERENT (fields: `name`, `description`, `model` — values `inherit`,
+ *   `fast`, or a hardcoded model ID, NOT Claude's `haiku|sonnet|opus` enum —
+ *   `readonly`, `is_background`; explicitly NO `tools` field: "Subagents
+ *   inherit all tools from the parent, including MCP tools from configured
+ *   servers") but Skillsmith never writes to that native directory (no
+ *   `.cursor/agents/` entry exists in `COMPANION_AGENT_TARGETS`), so that
+ *   narrower native schema does not govern the file this generator produces.
+ * - **antigravity** — HIGH for the schema itself, verified live against
+ *   `antigravity.google/docs/subagents/` (fetched 2026-08-30, cross-checked
+ *   by an independent WebSearch and by Wayback snapshots bracketing
+ *   2026-08-06 through 2026-08-16 — see
+ *   `docs/internal/implementation/smi-6276-subagent-true-antigravity-repro.md`
+ *   for the full investigation, filed for the separate `subagent: true`
+ *   question but covering this same schema). **Correction of SMI-5982's
+ *   original sourcing**: that wave cited
+ *   `antigravity.google/docs/cli/commands/agents` (the CLI `/agents` TUI
+ *   command reference, whose example happens to show only `name`+
+ *   `description`) as if it were the full schema. The real, richer schema
+ *   lives at `/docs/subagents`: `name`, `description` (both required),
+ *   `tools` (`string[]`, default `[]` — a YAML ARRAY, not a scalar, of
+ *   AntiGravity's OWN tool names, e.g. `view_file`, `replace_file_content`,
+ *   `grep_search`, `run_command` — confirmed DIFFERENT from Skillsmith's
+ *   Claude-style names), `mainAgent`/`subagent` (booleans, both default
+ *   `true` — the `subagent: true` question is Step 2's separate scope, not
+ *   touched here), `model` (`inherit|flash|pro`, default `inherit` — NOT
+ *   Claude's `haiku|sonnet|opus`), `commandExecutionPolicy`, `mcpServers`,
+ *   `skills`/`plugins` (skill PATHS like `skills/my-helper-skill` — a
+ *   DIFFERENT concept from Skillsmith's own `skills: <bare-name>` extension
+ *   field below, not reused here for that reason).
+ *
+ *   MEDIUM for the specific tool-name MAPPING used here: the docs page only
+ *   gives 4 example tool names (not a complete enumeration), so
+ *   `toolNameMap` below covers only those 4, mapped by clear name
+ *   correspondence (`view_file`→Read, `replace_file_content`→Write/Edit,
+ *   `grep_search`→Grep, `run_command`→Bash); Skillsmith's `Glob`, `WebFetch`,
+ *   and `WebSearch` have no confirmed AntiGravity equivalent and are
+ *   silently dropped, never guessed. This is deliberately a `'mapped-array'`
+ *   policy rather than `'omit'`, unlike every other unverified-vocabulary
+ *   client in this table: AntiGravity's own schema documents `tools`
+ *   defaulting to `[]` (empty) when omitted — the OPPOSITE of Cursor's
+ *   "inherits from parent" or Copilot's "all tools available" defaults — so
+ *   omitting the field here would ship a companion subagent with literally
+ *   ZERO tool access, not a harmlessly-permissive default. A confidently-cited
+ *   partial mapping is more correct than that, and strictly safer than
+ *   guessing at unconfirmed names: the same docs page's own "Known Issue
+ *   (Tool Validation)" warns that "specifying an unmapped or misspelled tool
+ *   name in the `tools` list may cause the subagent process to hang during
+ *   execution" — every name emitted here is a name AntiGravity's own docs
+ *   use as a worked example, never an invented one.
+ *
+ *   `model:` is OMITTED for AntiGravity, not mapped — deliberately, not for
+ *   lack of trying. AntiGravity's `flash`/`pro` are Gemini model tiers;
+ *   Skillsmith's `haiku`/`sonnet`/`opus` are Claude model tiers. These are
+ *   two DIFFERENT model families from two different vendors, not two
+ *   spellings of the same capability scale — `haiku→flash` and `opus→pro`
+ *   are plausible analogies, but `sonnet` (Skillsmith's own default "for
+ *   balanced workloads", `determineModel()`) has no principled third rung to
+ *   land on in a 2-tier scale, and no official source equates any Claude
+ *   tier to any Gemini tier. Omitting the field uses AntiGravity's own
+ *   documented default (`inherit` — defer to whatever tier the invoking
+ *   session already uses), which is a real, working, spec-sanctioned value,
+ *   not an absence of a decision.
+ * - **copilot** — MEDIUM, verified live against GitHub's own docs
+ *   (docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/create-custom-agents,
+ *   fetched 2026-08-30): `.agent.md` frontmatter DOES support a `tools` list
+ *   (documented examples: `"read"`, `"edit"`, `"search"`) and a `model`
+ *   field. NOT verified: a full mapping from Skillsmith's own 8-tool
+ *   vocabulary (`Read`/`Write`/`Edit`/`Bash`/`Grep`/`Glob`/`WebFetch`/
+ *   `WebSearch`) onto Copilot's identifier set — only 2-3 of the 8 have a
+ *   plausible lowercase counterpart in the documented examples, with no
+ *   confirmed equivalents for `Bash`/`Grep`/`Glob`/`WebFetch` specifically.
+ *   Unlike AntiGravity, Copilot's own docs confirm omission is SAFE here —
+ *   "Omitting tools grants access to all available tools — the default is
+ *   permissive" — so, per this wave's fallback rule, omit `tools:` rather
+ *   than emit a guessed-wrong partial mapping; the omission doesn't cripple
+ *   the subagent the way it would for AntiGravity. `model:` is likewise
+ *   omitted — its value format (Copilot's own model catalog IDs) has no
+ *   confirmed correspondence to Skillsmith's internal `haiku|sonnet|opus`
+ *   abstraction.
+ * - **opencode** — MEDIUM, verified live against opencode.ai/v2/docs/agents/
+ *   (fetched 2026-08-30): confirmed frontmatter fields `description`, `mode`
+ *   (`primary|subagent|all`), `model` (`provider/model#variant` format — NOT
+ *   Claude's `haiku|sonnet|opus` enum), `color`, `steps`, `permissions`. This
+ *   repo's own `renderOpenCodeShim()` (`agent-pack/shims.ts`) already
+ *   documents the load-bearing fact this profile reuses: "OpenCode's
+ *   frontmatter `tools` field is a permission map, not a plain list; setting
+ *   it wrong would restrict tools rather than reference them" — same
+ *   precedent applied here, omitting `tools:` rather than writing a
+ *   Claude-shaped value into a boolean-permission-map field (a different,
+ *   harder mapping problem than AntiGravity's plain array — not attempted in
+ *   this wave). `mode: subagent` IS included (HIGH confidence for this one
+ *   line specifically — mirrors the already-shipped `renderOpenCodeShim()`
+ *   verbatim). `model:` omitted — no confirmed mapping from Skillsmith's
+ *   internal enum to OpenCode's `provider/model` format.
+ * - **windsurf** — LOW. No independently confirmed per-subagent-file
+ *   frontmatter schema for tool/model restriction was found; Windsurf's
+ *   Cascade agent runtime is additionally documented as being retired (EOL
+ *   2026-07-01, superseded by Devin Local). Omit `tools:` and `model:`,
+ *   matching this table's existing conservative default for windsurf
+ *   (`COMPANION_AGENT_TARGETS.windsurf`'s own comment: "No
+ *   `AGENT_SHIM_TARGETS` entry exists for windsurf ... defaults to today's
+ *   actual behavior" — that comment covers the file PATH only; this module
+ *   makes the equivalent conservative call for the file's CONTENT).
+ * - **agents** — LOW. This `ClientId` is the generic cross-agent /
+ *   `AGENTS.md` convention (also Codex's install target — "Codex: reads
+ *   ONLY `~/.agents/skills`", `../install/paths.ts`'s own header comment).
+ *   The `AGENTS.md` standard itself has no required fields and no YAML
+ *   frontmatter for its single project-instructions file (openai/codex's own
+ *   `AGENTS.md`; agents.md spec) — there is no confirmed per-agent-definition
+ *   file schema with tool/model fields for this identifier at all. Omit
+ *   `tools:` and `model:`.
+ * - **hermes** — LOW. Hermes's own documented frontmatter
+ *   (hermes-agent.nousresearch.com/docs/) is for SKILL files (`name`,
+ *   `description`, `version`, `author`, `platforms`), not a separate
+ *   subagent-definition schema with tool/model restriction fields. Omit
+ *   `tools:` and `model:`.
+ * - **grok** — LOW. Grok Build (docs.x.ai/build/overview,
+ *   github.com/xai-org/grok-build) confirms agent frontmatter EXISTS
+ *   ("Subagents can declare their own `mcpServers` in agent frontmatter") but
+ *   no built-in tool-identifier vocabulary or Claude-comparable model enum is
+ *   documented. Omit `tools:` and `model:`.
+ *
+ * @see docs/internal/implementation/cursor-antigravity-tier-parity-plan.md (Wave 6 Step 1)
+ * @see docs/internal/implementation/smi-6276-subagent-true-antigravity-repro.md (AntiGravity schema source-of-truth)
+ */
+import { type ClientId } from '../install/paths.js';
+/**
+ * `'claude-native'` — Skillsmith's internal tool names (`Read`, `Write`,
+ * `Edit`, `Bash`, `Grep`, `Glob`, `WebFetch`, `WebSearch`) ARE this client's
+ * own tool-identifier vocabulary; emit `tools:` as a plain comma-separated
+ * scalar list, no translation needed.
+ *
+ * `'mapped-array'` — this client has its OWN, confirmed-different tool
+ * vocabulary AND expects `tools:` as a YAML array (not a scalar). Translate
+ * through the profile's `toolNameMap`; any internal name with no confirmed
+ * entry is silently dropped (never guessed), and the field is omitted
+ * entirely if the mapped result is empty.
+ *
+ * `'omit'` — this client's tool vocabulary (or its `tools:` field's VALUE
+ * shape) has not been independently verified to accept Skillsmith's internal
+ * names as-is, and omitting the field is either safe (permissive default,
+ * e.g. Copilot) or the only defensible choice given no evidence at all.
+ * Never emit a guessed-wrong value.
+ */
+export type SubagentToolsPolicy = 'claude-native' | 'mapped-array' | 'omit';
+/**
+ * `'claude-enum'` — this client accepts a `model:` field whose values are
+ * (or are compatible with) Skillsmith's internal `haiku|sonnet|opus` enum.
+ *
+ * `'omit'` — either no `model:` concept exists for this client, or its
+ * value semantics (a hardcoded model ID, a `provider/model` string, a
+ * different vendor's own model-tier vocabulary, an `inherit`/`fast`
+ * keyword, etc.) don't correspond to Skillsmith's internal enum. Omit the
+ * field rather than emit a value the client would reject, silently ignore,
+ * or (worse) apply as a real but wrong model selection.
+ */
+export type SubagentModelPolicy = 'claude-enum' | 'omit';
+/** Per-client shape of the generated companion-subagent file's frontmatter. */
+export interface SubagentGenerationProfile {
+    /** How well-evidenced this profile's fields are (see module header). */
+    confidence: 'HIGH' | 'MEDIUM' | 'LOW';
+    /** One-line pointer to the citation backing this profile (see module header for the full text). */
+    citation: string;
+    /**
+     * Whether to emit Skillsmith's own `skills: <skill-name>` extension field
+     * (a Skillsmith convention — a bare skill name — not any external
+     * harness's own field of the same name, e.g. AntiGravity's `skills:`
+     * expects PATHS and is a different concept) — kept true only for clients
+     * this generator has always emitted it for.
+     */
+    includeSkillsField: boolean;
+    toolsPolicy: SubagentToolsPolicy;
+    /**
+     * Skillsmith-internal tool name -> this client's own tool identifier.
+     * Only present (and only meaningful) when `toolsPolicy === 'mapped-array'`.
+     * An internal name with no entry here is silently dropped, never guessed.
+     */
+    toolNameMap?: Readonly<Record<string, string>>;
+    modelPolicy: SubagentModelPolicy;
+    /**
+     * Static frontmatter lines specific to this client, appended after
+     * `tools:` (when present) and before `model:` (when present). Empty for
+     * every client except OpenCode's `mode: subagent`.
+     */
+    extraFrontmatterLines: readonly string[];
+}
+export declare const SUBAGENT_CLIENT_PROFILES: Readonly<Record<ClientId, SubagentGenerationProfile>>;
+/** Resolve the per-client generation profile for `client` (default: canonical / claude-code). */
+export declare function getSubagentGenerationProfile(client?: ClientId): SubagentGenerationProfile;
+/**
+ * Translate Skillsmith-internal tool names through `profile.toolNameMap`,
+ * dropping any name with no confirmed entry and de-duplicating the result
+ * (two internal names can map to the same client tool, e.g. AntiGravity's
+ * `Write`/`Edit` -> `replace_file_content`). Returns `[]` when nothing maps
+ * — callers must omit the `tools:` field entirely in that case, not emit an
+ * empty array, per this module's own fallback philosophy.
+ */
+export declare function mapToolNames(tools: readonly string[], profile: SubagentGenerationProfile): string[];
+//# sourceMappingURL=SubagentGenerator.client-profiles.d.ts.map

package/dist/src/services/SubagentGenerator.client-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubagentGenerator.client-profiles.d.ts","sourceRoot":"","sources":["../../../src/services/SubagentGenerator.client-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuLG;AAEH,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,cAAc,GAAG,MAAM,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,MAAM,CAAA;AAExD,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;IACrC,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAA;IAC3B,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;OAIG;IACH,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AA4CD,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CA0C1F,CAAA;AAED,iGAAiG;AACjG,wBAAgB,4BAA4B,CAC1C,MAAM,GAAE,QAA2B,GAClC,yBAAyB,CAE3B;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,yBAAyB,GACjC,MAAM,EAAE,CAIV"}