@skillsmith/core 0.12.2 → 0.12.4

package/dist/src/security/scanner/patterns.sensitive-path.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Security Scanner Patterns — the `sensitive_path` family
+ * @module @skillsmith/core/security/scanner/patterns.sensitive-path
+ *
+ * SMI-5207: extracted from patterns.ts, which sat 18 lines under the repo's
+ * 500-line pre-commit gate (scripts/check-file-length.mjs) before this wave —
+ * not enough headroom for the 12 hoisted pattern consts plus the two new
+ * severity-gate classification sets below (~42 lines). Same
+ * move-the-family-then-re-export convention already used twice in patterns.ts
+ * (patterns.jailbreak.ts, SMI-5876; patterns.exec.ts, SMI-6033 Wave 4).
+ *
+ * Every symbol here is re-exported unchanged from patterns.ts, so every
+ * existing import path keeps working AND reference identity is preserved —
+ * load-bearing, because scanSensitivePaths() classifies patterns by reference
+ * (`pattern === ENV_PATH_PATTERN`, `VALUE_GATED_KEYWORD_PATTERNS.has(pattern)`,
+ * and now `PATH_FORM_PATTERNS.has(pattern)` /
+ * `VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)`).
+ *
+ * NOTE: a change to SENSITIVE_PATH_PATTERNS or to the severity classification
+ * below requires bumping SCANNER_RULESET_VERSION in patterns.ts — see that
+ * constant's own doc comment.
+ */
+export declare const ENV_PATH_PATTERN: RegExp;
+export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
+export declare const VALUE_GATED_KEYWORD_PATTERNS: ReadonlySet<RegExp>;
+/**
+ * SMI-5207 (MF-3): the 9 path/filename-form entries. HIGH only when an action
+ * verb or shell operator appears within +/-1 line of the match; otherwise
+ * MEDIUM — a bare path *mention* is the common case, so evidence is required
+ * to escalate. See scanSensitivePaths' hasPathActionContext().
+ */
+export declare const PATH_FORM_PATTERNS: ReadonlySet<RegExp>;
+/**
+ * SMI-5207 (MF-4): the 3 keyword-assignment entries. HIGH BY DEFAULT —
+ * `keyword: value` is a syntactic credential-assignment shape, rare in
+ * innocent prose — downgraded to MEDIUM only on positive prose evidence about
+ * the assigned value. See scanSensitivePaths' assignmentHasRealValue().
+ *
+ * Partition check (guarded by a dedicated test): 1 (ENV) + 9 (PATH_FORM) +
+ * 3 (ASSIGNMENT) + 2 (VALUE_GATED_KEYWORD) + 1 (OBSERVE_ONLY_MEDIUM) = 16,
+ * total and disjoint. An unclassified future pattern falls through to
+ * scanSensitivePaths' fail-CLOSED `else` branch and stays HIGH.
+ */
+export declare const VALUE_GATED_ASSIGNMENT_PATTERNS: ReadonlySet<RegExp>;
+/**
+ * SMI-6508 (MF-5): always MEDIUM, never value-gated and never escalated.
+ *
+ * WHY A NEW CLASS RATHER THAN THE MF-4 SET. Adding the prefixed form to
+ * VALUE_GATED_ASSIGNMENT_PATTERNS would make it HIGH-by-default, which blocks
+ * installation — there is no allowlist in that path and undoing it costs a
+ * package publish. Measured against 66,495 real skill contents in prod: the
+ * prefixed form newly matches 259 skills / 418 lines, of which the MF-4 value
+ * gate would call 191 "real value" → HIGH, newly blocking 132 skills (0.20% of
+ * the corpus, ~975 extrapolated to the full population). Shape analysis put
+ * roughly 46% of those 191 in false-positive-looking shapes — multi-word prose,
+ * lowercase identifiers, paths — and left 104 genuinely ambiguous.
+ *
+ * So the detection ships at MEDIUM: the finding becomes visible without costing
+ * a single install, and the accumulated real-world findings become the evidence
+ * for whether HIGH is justified later. Promoting it is a one-line move into the
+ * MF-4 set once that evidence exists.
+ *
+ * DELIBERATE ASYMMETRY. `DB_PASSWORD=` and `AWS_CREDENTIALS=` already reach
+ * HIGH today, because CREDENTIALS_ASSIGN_PATTERN and PASSWORD_ASSIGN_PATTERN
+ * carry no `\b` and so have always matched their prefixed forms. Those are
+ * grandfathered, not endorsed: their prefixed-form FP rate has never been
+ * measured. This entry is MEDIUM because we measured it and the others are not
+ * because we have not — that asymmetry reflects the evidence, and levelling it
+ * in either direction without measuring first would be the wrong fix. See
+ * SMI-6508.
+ */
+export declare const OBSERVE_ONLY_MEDIUM_PATTERNS: ReadonlySet<RegExp>;
+//# sourceMappingURL=patterns.sensitive-path.d.ts.map

package/dist/src/security/scanner/patterns.sensitive-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.sensitive-path.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.sensitive-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAmCH,eAAO,MAAM,gBAAgB,QAAoE,CAAA;AA0CjG,eAAO,MAAM,uBAAuB,UA4BnC,CAAA;AAID,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAG3D,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAA;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CAAC,MAAM,CAI9D,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAE3D,CAAA"}

package/dist/src/security/scanner/patterns.sensitive-path.js

@@ -0,0 +1,192 @@
+/**
+ * Security Scanner Patterns — the `sensitive_path` family
+ * @module @skillsmith/core/security/scanner/patterns.sensitive-path
+ *
+ * SMI-5207: extracted from patterns.ts, which sat 18 lines under the repo's
+ * 500-line pre-commit gate (scripts/check-file-length.mjs) before this wave —
+ * not enough headroom for the 12 hoisted pattern consts plus the two new
+ * severity-gate classification sets below (~42 lines). Same
+ * move-the-family-then-re-export convention already used twice in patterns.ts
+ * (patterns.jailbreak.ts, SMI-5876; patterns.exec.ts, SMI-6033 Wave 4).
+ *
+ * Every symbol here is re-exported unchanged from patterns.ts, so every
+ * existing import path keeps working AND reference identity is preserved —
+ * load-bearing, because scanSensitivePaths() classifies patterns by reference
+ * (`pattern === ENV_PATH_PATTERN`, `VALUE_GATED_KEYWORD_PATTERNS.has(pattern)`,
+ * and now `PATH_FORM_PATTERNS.has(pattern)` /
+ * `VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)`).
+ *
+ * NOTE: a change to SENSITIVE_PATH_PATTERNS or to the severity classification
+ * below requires bumping SCANNER_RULESET_VERSION in patterns.ts — see that
+ * constant's own doc comment.
+ */
+// Sensitive file path patterns
+// SMI-4396 Wave 2: bare-keyword variants (credentials, secrets?, password) tightened
+// to require assignment/path/file-extension context. Without this tuning,
+// documentation keywords in SKILL.md frontmatter and prose (1Password integration
+// guides, security-research skill domain vocabulary) tripped HIGH severity.
+//
+// SMI-5359 Wave 4 — FP-narrowing for two over-firing entries (severity policy lives
+// in scanSensitivePaths so the array length / regression-guard baseline is unchanged):
+//   MF-1: bare /api[_-]?key/i & /auth[_-]?token/i fired HIGH on ANY substring —
+//     benign prose ("set your api_key in the dashboard"), `export API_KEY=$1`, and
+//     `apiKey: <YOUR_KEY>` placeholders. They are now VALUE-GATED: HIGH only when the
+//     line assigns a real (non-placeholder, sufficiently-entropic) secret. The
+//     value-BEARING leak is already caught at PII (PII_PATTERNS[0/2]); the
+//     credential-in-an-outbound-curl exfil is caught by DATA_EXFILTRATION_PATTERNS
+//     (the `$API_KEY`-in-a-fetched-URL pattern added there). See
+//     VALUE_GATED_KEYWORD_PATTERNS.
+//   MF-2: lone /\.env/i fired HIGH on every `.env` mention AND on the benign committed
+//     family (.envrc, .env.example/.sample/.template/.schema/.dist). ENV_PATH_PATTERN
+//     negative-lookaheads exclude that family; scanSensitivePaths downgrades a LONE
+//     `.env` to MEDIUM and keeps HIGH when it co-occurs with a read/exfil verb or
+//     shell pipe/redirect (`cat .env | curl ...`).
+//
+// SMI-5207 — the remaining 12 entries got the same treatment the two MF-1 keywords
+// and the MF-2 `.env` entry already had: severity is now context-gated rather than
+// unconditionally HIGH. MF-3 covers the 9 path-form entries (action verb or shell
+// operator within +/-1 line), MF-4 the 3 keyword-assignment entries (HIGH unless the
+// assigned value positively reads as prose). Both gates live in
+// SecurityScanner.scanners.ts; this module only supplies the classification.
+// MF-2: `.env` as a real env-file reference. Excludes `.envrc` (direnv config) and the
+// committed placeholder family (.env.example/.sample/.template/.schema/.dist). The
+// `(?![A-Za-z])` guard also drops the `.environment`/`.envision` English-word FP while
+// still matching real variants like `.env`, `.env.local`, `.env.production`.
+export const ENV_PATH_PATTERN = /\.env(?![A-Za-z])(?!\.(?:example|sample|template|schema|dist))/i;
+// MF-1: bare credential keywords — value-gated in scanSensitivePaths, never standalone HIGH.
+const API_KEY_KEYWORD = /api[_-]?key/i;
+const AUTH_TOKEN_KEYWORD = /auth[_-]?token/i;
+// SMI-5207: the 12 non-`.env` entries are hoisted from inline array literals to named
+// consts so scanSensitivePaths can classify each by severity gate BY REFERENCE. The
+// array's order is unchanged; its length grew 15 → 16 with SMI-6508's MF-5 entry — the regression-guard floor
+// (scanner-regression-guard.test.ts) still holds.
+// Contextual credentials: filename or assignment, not bare prose
+const CREDENTIALS_FILE_PATTERN = /credentials\.(?:json|ya?ml|env|toml|txt)/i;
+const CREDENTIALS_ASSIGN_PATTERN = /credentials\s*[:=]/i;
+// Contextual secrets: assignment or path, not bare word
+const SECRETS_ASSIGN_PATTERN = /\bsecrets?\s*[:=]/i;
+/**
+ * SMI-6508 (MF-5): the PREFIXED assignment form — `API_SECRETS=`, `app_secrets:`,
+ * `mySecrets=`, and the singular `API_SECRET=`. Exactly complementary to
+ * SECRETS_ASSIGN_PATTERN above: that one carries `\b`, and `_` is a word
+ * character, so it cannot match after an underscore or a camelCase hump. The
+ * lookbehind here matches precisely the cases its boundary excludes, so the two
+ * never both fire on one match. `MY-SECRETS=` and `my.secrets=` stay with the
+ * bare pattern, since `-` and `.` are non-word characters its `\b` already
+ * accepts.
+ *
+ * MEDIUM by classification, NOT value-gated — see OBSERVE_ONLY_MEDIUM_PATTERNS.
+ */
+const SECRETS_PREFIXED_ASSIGN_PATTERN = /(?<=[A-Za-z0-9_])secrets?\s*[:=]/i;
+const SECRETS_PATH_PATTERN = /\bsecrets?\/[a-z0-9_.-]+/i;
+const PEM_PATTERN = /\.pem$/i;
+const KEY_FILE_PATTERN = /\.key$/i;
+const CRT_PATTERN = /\.crt$/i;
+// Contextual password: assignment or URL (postgres://user:pass@host) only
+const PASSWORD_ASSIGN_PATTERN = /password\s*[:=]/i;
+const SSH_DIR_PATTERN = /~\/\.ssh/i;
+const AWS_DIR_PATTERN = /~\/\.aws/i;
+const CONFIG_DIR_PATTERN = /~\/\.config/i;
+// SMI-4396 Wave 2: explicit system-file paths. Added so that tightening
+// bare /credentials/i and /password/i into assignment-context variants
+// doesn't drop coverage of obvious sensitive references like /etc/passwd.
+const ETC_SYSTEM_FILE_PATTERN = /\/etc\/(?:passwd|shadow|sudoers|hosts)\b/i;
+export const SENSITIVE_PATH_PATTERNS = [
+    ENV_PATH_PATTERN,
+    CREDENTIALS_FILE_PATTERN,
+    CREDENTIALS_ASSIGN_PATTERN,
+    SECRETS_ASSIGN_PATTERN,
+    SECRETS_PATH_PATTERN,
+    PEM_PATTERN,
+    KEY_FILE_PATTERN,
+    CRT_PATTERN,
+    PASSWORD_ASSIGN_PATTERN,
+    API_KEY_KEYWORD,
+    AUTH_TOKEN_KEYWORD,
+    SSH_DIR_PATTERN,
+    AWS_DIR_PATTERN,
+    CONFIG_DIR_PATTERN,
+    ETC_SYSTEM_FILE_PATTERN,
+    // SMI-6508 follow-up — MUST STAY LAST. scanSensitivePaths `break`s on the
+    // FIRST entry that matches, in THIS array's order, so an always-MEDIUM entry
+    // placed ahead of a HIGH-capable one SUPPRESSES it. This shipped briefly at
+    // index 4 and was a live scanner-evasion primitive: appending the comment
+    // `# a_secrets:` flipped `cat ~/.ssh/id_rsa` and `curl -F f=@/etc/passwd …`
+    // from a blocking HIGH to a passing MEDIUM, because MF-5 won the race
+    // against SSH_DIR / ETC_SYSTEM_FILE. Any future always-MEDIUM entry belongs
+    // here too, after every HIGH-capable pattern. The cost is deliberate and the
+    // right way round: on a co-occurring line the other entry reports instead,
+    // which slightly undercounts MF-5's own observability — never losing
+    // severity dominates never losing a count.
+    SECRETS_PREFIXED_ASSIGN_PATTERN,
+];
+// MF-1: the two bare-keyword patterns above emit HIGH only when accompanied by a real
+// assigned secret value; scanSensitivePaths suppresses an otherwise-bare match.
+export const VALUE_GATED_KEYWORD_PATTERNS = new Set([
+    API_KEY_KEYWORD,
+    AUTH_TOKEN_KEYWORD,
+]);
+/**
+ * SMI-5207 (MF-3): the 9 path/filename-form entries. HIGH only when an action
+ * verb or shell operator appears within +/-1 line of the match; otherwise
+ * MEDIUM — a bare path *mention* is the common case, so evidence is required
+ * to escalate. See scanSensitivePaths' hasPathActionContext().
+ */
+export const PATH_FORM_PATTERNS = new Set([
+    CREDENTIALS_FILE_PATTERN,
+    SECRETS_PATH_PATTERN,
+    PEM_PATTERN,
+    KEY_FILE_PATTERN,
+    CRT_PATTERN,
+    SSH_DIR_PATTERN,
+    AWS_DIR_PATTERN,
+    CONFIG_DIR_PATTERN,
+    ETC_SYSTEM_FILE_PATTERN,
+]);
+/**
+ * SMI-5207 (MF-4): the 3 keyword-assignment entries. HIGH BY DEFAULT —
+ * `keyword: value` is a syntactic credential-assignment shape, rare in
+ * innocent prose — downgraded to MEDIUM only on positive prose evidence about
+ * the assigned value. See scanSensitivePaths' assignmentHasRealValue().
+ *
+ * Partition check (guarded by a dedicated test): 1 (ENV) + 9 (PATH_FORM) +
+ * 3 (ASSIGNMENT) + 2 (VALUE_GATED_KEYWORD) + 1 (OBSERVE_ONLY_MEDIUM) = 16,
+ * total and disjoint. An unclassified future pattern falls through to
+ * scanSensitivePaths' fail-CLOSED `else` branch and stays HIGH.
+ */
+export const VALUE_GATED_ASSIGNMENT_PATTERNS = new Set([
+    CREDENTIALS_ASSIGN_PATTERN,
+    SECRETS_ASSIGN_PATTERN,
+    PASSWORD_ASSIGN_PATTERN,
+]);
+/**
+ * SMI-6508 (MF-5): always MEDIUM, never value-gated and never escalated.
+ *
+ * WHY A NEW CLASS RATHER THAN THE MF-4 SET. Adding the prefixed form to
+ * VALUE_GATED_ASSIGNMENT_PATTERNS would make it HIGH-by-default, which blocks
+ * installation — there is no allowlist in that path and undoing it costs a
+ * package publish. Measured against 66,495 real skill contents in prod: the
+ * prefixed form newly matches 259 skills / 418 lines, of which the MF-4 value
+ * gate would call 191 "real value" → HIGH, newly blocking 132 skills (0.20% of
+ * the corpus, ~975 extrapolated to the full population). Shape analysis put
+ * roughly 46% of those 191 in false-positive-looking shapes — multi-word prose,
+ * lowercase identifiers, paths — and left 104 genuinely ambiguous.
+ *
+ * So the detection ships at MEDIUM: the finding becomes visible without costing
+ * a single install, and the accumulated real-world findings become the evidence
+ * for whether HIGH is justified later. Promoting it is a one-line move into the
+ * MF-4 set once that evidence exists.
+ *
+ * DELIBERATE ASYMMETRY. `DB_PASSWORD=` and `AWS_CREDENTIALS=` already reach
+ * HIGH today, because CREDENTIALS_ASSIGN_PATTERN and PASSWORD_ASSIGN_PATTERN
+ * carry no `\b` and so have always matched their prefixed forms. Those are
+ * grandfathered, not endorsed: their prefixed-form FP rate has never been
+ * measured. This entry is MEDIUM because we measured it and the others are not
+ * because we have not — that asymmetry reflects the evidence, and levelling it
+ * in either direction without measuring first would be the wrong fix. See
+ * SMI-6508.
+ */
+export const OBSERVE_ONLY_MEDIUM_PATTERNS = new Set([
+    SECRETS_PREFIXED_ASSIGN_PATTERN,
+]);
+//# sourceMappingURL=patterns.sensitive-path.js.map

package/dist/src/security/scanner/patterns.sensitive-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.sensitive-path.js","sourceRoot":"","sources":["../../../../src/security/scanner/patterns.sensitive-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,+BAA+B;AAC/B,qFAAqF;AACrF,0EAA0E;AAC1E,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,oFAAoF;AACpF,uFAAuF;AACvF,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,iEAAiE;AACjE,oCAAoC;AACpC,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,kFAAkF;AAClF,mDAAmD;AACnD,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,qFAAqF;AACrF,gEAAgE;AAChE,6EAA6E;AAE7E,uFAAuF;AACvF,mFAAmF;AACnF,uFAAuF;AACvF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,iEAAiE,CAAA;AAEjG,6FAA6F;AAC7F,MAAM,eAAe,GAAG,cAAc,CAAA;AACtC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAE5C,sFAAsF;AACtF,oFAAoF;AACpF,8GAA8G;AAC9G,kDAAkD;AAClD,iEAAiE;AACjE,MAAM,wBAAwB,GAAG,2CAA2C,CAAA;AAC5E,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AACxD,wDAAwD;AACxD,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AACnD;;;;;;;;;;;GAWG;AACH,MAAM,+BAA+B,GAAG,mCAAmC,CAAA;AAC3E,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AACxD,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAClC,MAAM,WAAW,GAAG,SAAS,CAAA;AAC7B,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAClD,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AACzC,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,2CAA2C,CAAA;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB;IAChB,wBAAwB;IACxB,0BAA0B;IAC1B,sBAAsB;IACtB,oBAAoB;IACpB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,uBAAuB;IACvB,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,uBAAuB;IACvB,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,qEAAqE;IACrE,2CAA2C;IAC3C,+BAA+B;CAChC,CAAA;AAED,sFAAsF;AACtF,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,eAAe;IACf,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,wBAAwB;IACxB,oBAAoB;IACpB,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,uBAAuB;CACxB,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC;IAC1E,0BAA0B;IAC1B,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,+BAA+B;CAChC,CAAC,CAAA"}

package/dist/src/security/scanner/regex-utils.d.ts

@@ -11,25 +11,39 @@
  */
 export declare const MAX_LINE_LENGTH_FOR_REGEX = 10000;
 /**
- * SMI-5881: Cap for the FULL-CONTENT (multiline "pass 1") regex scan, in
- * UTF-16 code units (JavaScript `string.length` — NOT bytes/code points; see
- * SecurityScanner.ts's content-length finding message).
+ * SMI-5879 (design §3.4): Cap for the FULL-CONTENT (multiline "pass 1") regex
+ * scan, in UTF-16 code units (JavaScript `string.length` — NOT bytes/code
+ * points; see SecurityScanner.ts's content-length finding message).
  *
- * Equal to MAX_LINE_LENGTH_FOR_REGEX today (both 10_000) but declared
- * separately because the two caps protect different scan passes (per-line vs
- * whole-document) and may need to diverge later. This is a ReDoS budget
- * input, not a free parameter — raising it requires first proving
- * AD_CRLF_INJECTION-class patterns stay linear at the new size. Measured
- * (SMI-5881): the fixed AD_CRLF_INJECTION pattern is already ~4x slower per
- * doubling of input size on some adversarial inputs at sizes past this cap,
- * extrapolating to unacceptable latency well before 1,000,000 — so this cap
- * is NOT raised as part of SMI-5881 even though larger trust tiers allow a
- * much bigger `maxContentLength`. See SecurityScanner.ts's
- * `effectiveMultilineLimit` (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX,
- * maxContentLength)`) for how this interacts with the per-tier content-length
- * ceiling.
+ * SMI-5881 set this equal to MAX_LINE_LENGTH_FOR_REGEX (10,000) and declined
+ * to raise it, citing a doubling-based extrapolation from smaller inputs that
+ * projected "unacceptable latency well before 1,000,000" for
+ * AD_CRLF_INJECTION-class patterns. SMI-5879 independently re-measured
+ * directly at 1,000,000 (not extrapolated) across the 7 ported multiline
+ * patterns (AD_CRLF_INJECTION, AD_ROLE_MARKER_BARE, AD_HTML_COMMENT_VERB/NOUN,
+ * AD_DELIMITER_BARE, AD_AN2_ROLE_BODY_NEXT_LINE, JB_JS3A/JS3B) against
+ * per-pattern adversarial near-miss shapes (not just the CRLF-pair shape
+ * SMI-5881 used) and found linear scaling with a worst case of ~56ms at
+ * 1,000,000 chars (AD_HTML_COMMENT_NOUN, "repeated HTML-comment-open"
+ * near-miss) — confirmed still linear (not superlinear) up to 4,000,000
+ * chars (~145ms), comfortably under the section 7.3 250ms per-case budget.
+ * The prior extrapolation does not hold empirically at this exact size; the
+ * measured worst case has real headroom, just less than the ~78x this
+ * design doc's own (unverified) claim asserted. Raising this cap closes the
+ * 10 KB pass-1 truncation blind spot (design §3.4) — the edge's own
+ * MAX_SKILL_CONTENT_SIZE is 1,000,000 bytes, so pass 1 previously saw only
+ * the first 1% of a large SKILL.md.
+ *
+ * Still declared separately from MAX_LINE_LENGTH_FOR_REGEX because the two
+ * caps protect different scan passes (per-line vs whole-document) and may
+ * need to diverge again. See SecurityScanner.ts's `effectiveMultilineLimit`
+ * (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`) for how this
+ * interacts with the per-tier content-length ceiling — a trust tier with a
+ * SMALLER configured `maxContentLength` still tightens the effective limit
+ * below this cap; none currently need MORE than this cap for the multiline
+ * pass specifically.
  */
-export declare const MAX_CONTENT_LENGTH_FOR_REGEX = 10000;
+export declare const MAX_CONTENT_LENGTH_FOR_REGEX = 1000000;
 /**
  * SMI-882: Safe regex test with length limit
  * Applies input length limit before regex matching to prevent ReDoS attacks.

package/dist/src/security/scanner/regex-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,4BAA4B,QAA4B,CAAA;AAErE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}
+{"version":3,"file":"regex-utils.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAQ,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAA;AAErD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,gBAAgB,GAAG,IAAI,CAIzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAIT"}

package/dist/src/security/scanner/regex-utils.js

@@ -11,25 +11,39 @@
  */
 export const MAX_LINE_LENGTH_FOR_REGEX = 10000;
 /**
- * SMI-5881: Cap for the FULL-CONTENT (multiline "pass 1") regex scan, in
- * UTF-16 code units (JavaScript `string.length` — NOT bytes/code points; see
- * SecurityScanner.ts's content-length finding message).
+ * SMI-5879 (design §3.4): Cap for the FULL-CONTENT (multiline "pass 1") regex
+ * scan, in UTF-16 code units (JavaScript `string.length` — NOT bytes/code
+ * points; see SecurityScanner.ts's content-length finding message).
  *
- * Equal to MAX_LINE_LENGTH_FOR_REGEX today (both 10_000) but declared
- * separately because the two caps protect different scan passes (per-line vs
- * whole-document) and may need to diverge later. This is a ReDoS budget
- * input, not a free parameter — raising it requires first proving
- * AD_CRLF_INJECTION-class patterns stay linear at the new size. Measured
- * (SMI-5881): the fixed AD_CRLF_INJECTION pattern is already ~4x slower per
- * doubling of input size on some adversarial inputs at sizes past this cap,
- * extrapolating to unacceptable latency well before 1,000,000 — so this cap
- * is NOT raised as part of SMI-5881 even though larger trust tiers allow a
- * much bigger `maxContentLength`. See SecurityScanner.ts's
- * `effectiveMultilineLimit` (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX,
- * maxContentLength)`) for how this interacts with the per-tier content-length
- * ceiling.
+ * SMI-5881 set this equal to MAX_LINE_LENGTH_FOR_REGEX (10,000) and declined
+ * to raise it, citing a doubling-based extrapolation from smaller inputs that
+ * projected "unacceptable latency well before 1,000,000" for
+ * AD_CRLF_INJECTION-class patterns. SMI-5879 independently re-measured
+ * directly at 1,000,000 (not extrapolated) across the 7 ported multiline
+ * patterns (AD_CRLF_INJECTION, AD_ROLE_MARKER_BARE, AD_HTML_COMMENT_VERB/NOUN,
+ * AD_DELIMITER_BARE, AD_AN2_ROLE_BODY_NEXT_LINE, JB_JS3A/JS3B) against
+ * per-pattern adversarial near-miss shapes (not just the CRLF-pair shape
+ * SMI-5881 used) and found linear scaling with a worst case of ~56ms at
+ * 1,000,000 chars (AD_HTML_COMMENT_NOUN, "repeated HTML-comment-open"
+ * near-miss) — confirmed still linear (not superlinear) up to 4,000,000
+ * chars (~145ms), comfortably under the section 7.3 250ms per-case budget.
+ * The prior extrapolation does not hold empirically at this exact size; the
+ * measured worst case has real headroom, just less than the ~78x this
+ * design doc's own (unverified) claim asserted. Raising this cap closes the
+ * 10 KB pass-1 truncation blind spot (design §3.4) — the edge's own
+ * MAX_SKILL_CONTENT_SIZE is 1,000,000 bytes, so pass 1 previously saw only
+ * the first 1% of a large SKILL.md.
+ *
+ * Still declared separately from MAX_LINE_LENGTH_FOR_REGEX because the two
+ * caps protect different scan passes (per-line vs whole-document) and may
+ * need to diverge again. See SecurityScanner.ts's `effectiveMultilineLimit`
+ * (`Math.min(MAX_CONTENT_LENGTH_FOR_REGEX, maxContentLength)`) for how this
+ * interacts with the per-tier content-length ceiling — a trust tier with a
+ * SMALLER configured `maxContentLength` still tightens the effective limit
+ * below this cap; none currently need MORE than this cap for the multiline
+ * pass specifically.
  */
-export const MAX_CONTENT_LENGTH_FOR_REGEX = MAX_LINE_LENGTH_FOR_REGEX;
+export const MAX_CONTENT_LENGTH_FOR_REGEX = 1_000_000;
 /**
  * SMI-882: Safe regex test with length limit
  * Applies input length limit before regex matching to prevent ReDoS attacks.

package/dist/src/security/scanner/regex-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAyB,CAAA;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}
+{"version":3,"file":"regex-utils.js","sourceRoot":"","sources":["../../../../src/security/scanner/regex-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,YAAoB,yBAAyB;IAE7C,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/src/security/scanner/types.d.ts

@@ -117,6 +117,15 @@ export interface ScanReport {
     riskScore: number;
     /** Breakdown of risk score by category */
     riskBreakdown: RiskScoreBreakdown;
+    /**
+     * SMI-5879 (design §3.3.6): true when the jailbreak or ai_defence multiline
+     * pass hit its per-pattern iteration ceiling before exhausting matches on a
+     * pathological same-line-repetition input. NOT provably score-neutral — the
+     * write path must treat this scan as authoritative for RAISING a verdict
+     * only, never for lowering an existing quarantine. Absent/undefined is
+     * equivalent to `false` (not truncated) for gating purposes.
+     */
+    multilineTruncated?: boolean;
 }
 /**
  * Verdict returned by comparing two scans of the SAME skill to detect a

package/dist/src/security/scanner/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,GACtB,WAAW,GACX,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,CAAA;AAExB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,iBAAiB,CAAA;AAErB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,GACtB,WAAW,GACX,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,CAAA;AAExB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,iBAAiB,CAAA;AAErB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,wGAAwG;IACxG,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;IACjC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,wBAAwB,CAAC,EAAE,wBAAwB,CAAA;CACpD"}

package/dist/src/services/agent-pack/prompt-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-source.d.ts","sourceRoot":"","sources":["../../../../src/services/agent-pack/prompt-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAI7C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAIjD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA+B/C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,aAAa,EA0ExC,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAI/C,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAgBrD,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAI5C,CAAA;AAED,wDAAwD;AACxD,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAMrC,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAEpD,CAAA;AAED,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,4NAC6L,CAAA;AAE3N,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,+bACuZ,CAAA"}
+{"version":3,"file":"prompt-source.d.ts","sourceRoot":"","sources":["../../../../src/services/agent-pack/prompt-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAI7C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAIjD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA+B/C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,aAAa,EA0ExC,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAI/C,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAgBrD,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAI5C,CAAA;AAED,wDAAwD;AACxD,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAMrC,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAEpD,CAAA;AAED,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAelD,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,4NAC6L,CAAA;AAE3N,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,+bACuZ,CAAA"}

package/dist/src/services/agent-pack/prompt-source.js

@@ -200,8 +200,9 @@ export const CLI_FALLBACK_PARAGRAPHS = [
 /** Command lines for the CLI Fallback fenced code block, one per line. */
 export const CLI_FALLBACK_COMMANDS = [
     '# Keep skills current',
-    'skillsmith diff <skill>       # what changed since your installed version',
-    'skillsmith update <skill>     # or: skillsmith update --all',
+    'skillsmith diff <skill>             # what changed since your installed version',
+    'skillsmith update --all --dry-run   # review updates first',
+    'skillsmith update <skill>           # then update one skill at a time',
     '',
     '# Audit and clean up inventory',
     'skillsmith audit collisions',

package/dist/src/services/agent-pack/prompt-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-source.js","sourceRoot":"","sources":["../../../../src/services/agent-pack/prompt-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,gMAAgM;IAChM,kYAAkY;IAClY,qUAAqU;CACtU,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,kYAAkY;IAClY,wMAAwM;IACxM,2JAA2J;CAC5J,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,sUAAsU;KAC7U;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,wDAAwD;QAC/D,IAAI,EAAE,qRAAqR;KAC5R;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,wPAAwP;KAC/P;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,sTAAsT;KAC7T;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE,4PAA4P;KACnQ;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,ieAAie;KACxe;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAA6B;IAC5C;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE;YACJ,uFAAuF;YACvF,oIAAoI;YACpI,sNAAsN;YACtN,6GAA6G;YAC7G,8bAA8b;YAC9b,+JAA+J;SAChK,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,gBAAgB;YAChB,eAAe;YACf,YAAY;YACZ,kBAAkB;YAClB,0BAA0B;SAC3B;KACF;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE;YACJ,2GAA2G;YAC3G,kKAAkK;YAClK,uNAAuN;YACvN,qGAAqG;YACrG,mIAAmI;SACpI,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,uBAAuB;YACvB,wBAAwB;YACxB,wBAAwB;YACxB,YAAY;SACb;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE;YACJ,oDAAoD;YACpD,2GAA2G;YAC3G,8HAA8H;YAC9H,yJAAyJ;YACzJ,oIAAoI;SACrI,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,aAAa;YACb,eAAe;SAChB;KACF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,qTAAqT;QAC3T,KAAK,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC;KACrC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,+SAA+S;QACrT,KAAK,EAAE,EAAE;KACV;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,6YAA6Y;QACnZ,KAAK,EAAE,EAAE;KACV;CACF,CAAA;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,qOAAqO;IACrO,iQAAiQ;IACjQ,6QAA6Q;CAC9Q,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,sTAAsT;KAC7T;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,wOAAwO;KAC/O;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,uQAAuQ;KAC9Q;CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,mTAAmT;IACnT,sJAAsJ;IACtJ,sZAAsZ;CACvZ,CAAA;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,QAAQ,GAAsB;IACzC,2EAA2E;IAC3E,0HAA0H;IAC1H,wGAAwG;IACxG,iFAAiF;IACjF,qFAAqF;CACtF,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,8PAA8P;CAC/P,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,uBAAuB;IACvB,2EAA2E;IAC3E,6DAA6D;IAC7D,EAAE;IACF,gCAAgC;IAChC,6BAA6B;IAC7B,EAAE;IACF,iCAAiC;IACjC,6CAA6C;IAC7C,uCAAuC;IACvC,mDAAmD;IACnD,uCAAuC;IACvC,0CAA0C;CAC3C,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yNAAyN,CAAA;AAE3N,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAC3B,kbAAkb,CAAA"}
+{"version":3,"file":"prompt-source.js","sourceRoot":"","sources":["../../../../src/services/agent-pack/prompt-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,gMAAgM;IAChM,kYAAkY;IAClY,qUAAqU;CACtU,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,kYAAkY;IAClY,wMAAwM;IACxM,2JAA2J;CAC5J,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,sUAAsU;KAC7U;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,wDAAwD;QAC/D,IAAI,EAAE,qRAAqR;KAC5R;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,wPAAwP;KAC/P;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,sTAAsT;KAC7T;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE,4PAA4P;KACnQ;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,KAAK,EAAE,2CAA2C;QAClD,IAAI,EAAE,ieAAie;KACxe;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAA6B;IAC5C;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE;YACJ,uFAAuF;YACvF,oIAAoI;YACpI,sNAAsN;YACtN,6GAA6G;YAC7G,8bAA8b;YAC9b,+JAA+J;SAChK,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,gBAAgB;YAChB,eAAe;YACf,YAAY;YACZ,kBAAkB;YAClB,0BAA0B;SAC3B;KACF;IACD;QACE,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE;YACJ,2GAA2G;YAC3G,kKAAkK;YAClK,uNAAuN;YACvN,qGAAqG;YACrG,mIAAmI;SACpI,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,uBAAuB;YACvB,wBAAwB;YACxB,wBAAwB;YACxB,YAAY;SACb;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,iCAAiC;QACxC,IAAI,EAAE;YACJ,oDAAoD;YACpD,2GAA2G;YAC3G,8HAA8H;YAC9H,yJAAyJ;YACzJ,oIAAoI;SACrI,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE;YACL,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,aAAa;YACb,eAAe;SAChB;KACF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,qTAAqT;QAC3T,KAAK,EAAE,CAAC,iBAAiB,EAAE,QAAQ,CAAC;KACrC;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,+SAA+S;QACrT,KAAK,EAAE,EAAE;KACV;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,6YAA6Y;QACnZ,KAAK,EAAE,EAAE;KACV;CACF,CAAA;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,qOAAqO;IACrO,iQAAiQ;IACjQ,6QAA6Q;CAC9Q,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,uCAAuC;QAC9C,IAAI,EAAE,sTAAsT;KAC7T;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,wOAAwO;KAC/O;IACD;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,+BAA+B;QACtC,IAAI,EAAE,uQAAuQ;KAC9Q;CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,mTAAmT;IACnT,sJAAsJ;IACtJ,sZAAsZ;CACvZ,CAAA;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,QAAQ,GAAsB;IACzC,2EAA2E;IAC3E,0HAA0H;IAC1H,wGAAwG;IACxG,iFAAiF;IACjF,qFAAqF;CACtF,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,8PAA8P;CAC/P,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,uBAAuB;IACvB,iFAAiF;IACjF,4DAA4D;IAC5D,uEAAuE;IACvE,EAAE;IACF,gCAAgC;IAChC,6BAA6B;IAC7B,EAAE;IACF,iCAAiC;IACjC,6CAA6C;IAC7C,uCAAuC;IACvC,mDAAmD;IACnD,uCAAuC;IACvC,0CAA0C;CAC3C,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yNAAyN,CAAA;AAE3N,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAC3B,kbAAkb,CAAA"}

package/dist/src/services/skill-installation.content.d.ts

@@ -60,8 +60,13 @@ import type { ManifestManager } from './skill-manifest.js';
  *   - any key that, after `path.resolve()` against `installPath`, resolves
  *     outside `installPath` (a lexical backstop behind the checks above,
  *     matching `writeInstallFiles()`'s own lexical escape check);
- *   - two keys that `path.normalize()` to the same on-disk path (a
- *     collision — e.g. "SKILL.md" and "./SKILL.md").
+ *   - two keys that `path.normalize()` to the same on-disk path CASE
+ *     -INSENSITIVELY (SMI-6529 M4/M9) — a collision on any filesystem, but
+ *     specifically catches a case-insensitive alias (e.g. "SKILL.md" and
+ *     "skill.md" — literally the same inode on default APFS) that a
+ *     case-sensitive string comparison would miss, in addition to the
+ *     exact-string collision it already caught (e.g. "SKILL.md" and
+ *     "./SKILL.md").
  */
 export declare function validateContentKeys(content: Record<string, string>, installPath: string): {
     valid: true;

package/dist/src/services/skill-installation.content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.content.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACd,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AA8C1D;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgCnD;AA8DD;;yCAEyC;AACzC,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,EAAE,EAAE,QAAQ,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CA0KjG"}
+{"version":3,"file":"skill-installation.content.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACd,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAuD1D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAqCnD;AA8DD;;yCAEyC;AACzC,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,EAAE,EAAE,QAAQ,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,UAAU,EAAE,gBAAgB,CAAA;IAC5B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAuMjG"}