@skillsmith/core 0.9.0 → 0.11.0

package/dist/src/services/bundled-sibling-scan.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Bundled-sibling security scan for the local rescan path (SMI-5422 Phase 2).
+ * @module @skillsmith/core/services/bundled-sibling-scan
+ *
+ * Walks an installed skill's bundle directory and scans its sibling bundled
+ * files (`.mcp.json`, `.claude/settings*.json`, `package.json` lifecycle hooks,
+ * `config.json`, `scripts/*.sh` + top-level `*.sh`) so `skill_rescan` can
+ * quarantine a skill whose MALICIOUS sibling — not its `SKILL.md` — carries the
+ * threat (CVE-2025-59536 hook execution, `curl|bash` postinstall, a
+ * remote-fetch-execute install script).
+ *
+ * This is the local-FS rescan analogue of the Phase-1 install/validate helpers —
+ * NOT a duplicate. The three callers intentionally differ:
+ *   - install:  `skill-installation.io.ts` `fetchAndScanOptionalFiles` (fetch-by-path, no glob)
+ *   - validate: mcp-server `validate-bundled-scan.ts` `scanBundledSiblings` (returns ValidationError[])
+ *   - rescan (this): directory walk + symlink-safe reads + structured result.
+ *
+ * DELIBERATE FP-SAFE DIVERGENCE (Phase 2 review B1, verified empirically):
+ * install/validate reject via `isRejectableScan` (= `!report.passed` OR a
+ * `code_execution`/`obfuscated_directive` finding). The `!report.passed` clause
+ * fires on ANY high/critical finding, and sibling files are non-markdown so they
+ * get NO documentation-context downgrade — so routine, benign script idioms fire
+ * at full severity and would quarantine a working skill:
+ *   `chmod 755 ./bin/cli`     => privilege_escalation:critical => !passed
+ *   `cp .env.example .env`    => sensitive_path:high           => !passed
+ *   `source .env` / `export X=$1` / `cat ~/.ssh/...` => sensitive_path:high
+ * For an ALREADY-INSTALLED skill that false positive hides a working skill from
+ * local search. So this module drives the quarantine decision SOLELY from
+ * `code_execution`/`obfuscated_directive` presence (still catches `curl|bash`).
+ * The root cause — privilege_escalation/sensitive_path over-firing in
+ * non-markdown execution contexts (which is the SAME latent FP on the install
+ * path) — is tracked in SMI-5424; once those patterns are narrowed at the
+ * source, all three callers can safely share the broader criterion.
+ *
+ * INHERITED DETECTION GAPS (FN, tracked SMI-5424): bare-interpreter hook
+ * payloads (`node evil.js`, `python evil.py`, `bun`/`deno`), `&&`/`;`-chained
+ * fetch-then-exec, `npx`, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * structured files are NOT detected. `.js`/`.py`/`.mjs`/`.ts` payload files and
+ * nested/non-`scripts/` `.sh` are a Phase-3 follow-up (recursive bundle walk).
+ * COUNT-CAP DECOY-PADDING (FN): the fixed bundled files are cap-exempt, but the
+ * `.sh` glob is capped — an author can name the malicious script to sort last
+ * and pad `scripts/` with cap-many benign decoys so it lands in `droppedForCount`
+ * and is never scanned. This is surfaced (never a silent drop) but not blocked;
+ * a cumulative-resource bound is a Phase-3 follow-up.
+ *
+ * config.json IS scanned here (only doc-class siblings are skipped), whereas the
+ * Phase-1 validate helper (validate-bundled-scan.ts) also skips `config` — rescan
+ * is the deliberately stricter superset because it is a quarantine path.
+ */
+import type { SecurityFinding } from '../security/scanner/types.js';
+import type { SecurityScanner } from '../security/index.js';
+/** Max `.sh` glob files scanned per skill (fixed bundled files are exempt). */
+export declare const MAX_SIBLING_SH_FILES = 50;
+/** Per-file byte ceiling; larger siblings are skipped (recorded, never silent). */
+export declare const MAX_SIBLING_FILE_BYTES: number;
+/** Tunable caps for {@link scanLocalBundleSiblings}. */
+export interface BundledSiblingScanOptions {
+    /** Override {@link MAX_SIBLING_SH_FILES}. */
+    maxShFiles?: number;
+    /** Override {@link MAX_SIBLING_FILE_BYTES}. */
+    maxBytesPerFile?: number;
+}
+/**
+ * Result of scanning a skill bundle's sibling files. All path fields are
+ * relative to the skill directory. `findings` is the full (display) set;
+ * `rejectableFindings`/`rejectableFiles` are the quarantine-driving subset.
+ */
+export interface BundledSiblingScanResult {
+    /** All non-doc sibling findings, each tagged with `location = relPath`. */
+    findings: SecurityFinding[];
+    /** True when any sibling carries a `code_execution`/`obfuscated_directive`. */
+    rejectable: boolean;
+    /** The execution-threat findings that drive quarantine. */
+    rejectableFindings: SecurityFinding[];
+    /** Relative paths that drove rejection. */
+    rejectableFiles: string[];
+    /** Relative paths actually scanned. */
+    scannedFiles: string[];
+    /**
+     * Max riskScore across REJECTING sibling reports only (display only; rejection
+     * is type-driven so this can be below the threshold). Non-rejecting siblings
+     * (e.g. a benign `chmod` that scores high) are excluded so they cannot
+     * mis-attribute a quarantine's surfaced score.
+     */
+    maxSiblingRiskScore: number;
+    /** `.sh` files beyond the count cap — surfaced, never silently dropped. */
+    droppedForCount: string[];
+    /** Files skipped for exceeding the byte cap. */
+    skippedOversize: string[];
+    /** Symlink siblings resolving outside the skill dir (SMI-4287 guard). */
+    skippedSymlinkEscape: string[];
+}
+/**
+ * Scan a skill bundle's sibling files and return the structured result.
+ *
+ * Fixed {@link BUNDLED_SCAN_FILES} are always scanned (exempt from the count
+ * cap, so a decoy-padding attack on `scripts/` cannot push the primary hook /
+ * postinstall surface out of the scan window). The `.sh` glob is capped and
+ * any overflow is reported in `droppedForCount`.
+ *
+ * Doc-class siblings (`README.md`, `examples.md`) are intentionally NOT scanned:
+ * prose routinely quotes attack strings, so they can never drive a quarantine
+ * (Phase-1 H6 control). Every read is symlink-safe via `resolveSafeRealpath`
+ * (containment to `skillDir`, SMI-4287) and reads the resolved realpath.
+ *
+ * @param skillDir absolute path to the installed skill's bundle directory
+ * @param scanner  a constructed SecurityScanner (injected to keep this module DB-free)
+ * @param opts     optional caps
+ */
+export declare function scanLocalBundleSiblings(skillDir: string, scanner: SecurityScanner, opts?: BundledSiblingScanOptions): Promise<BundledSiblingScanResult>;
+//# sourceMappingURL=bundled-sibling-scan.d.ts.map

package/dist/src/services/bundled-sibling-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-sibling-scan.d.ts","sourceRoot":"","sources":["../../../src/services/bundled-sibling-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAc,MAAM,8BAA8B,CAAA;AAI/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAQ3D,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,QAAa,CAAA;AAEhD,wDAAwD;AACxD,MAAM,WAAW,yBAAyB;IACxC,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,+EAA+E;IAC/E,UAAU,EAAE,OAAO,CAAA;IACnB,2DAA2D;IAC3D,kBAAkB,EAAE,eAAe,EAAE,CAAA;IACrC,2CAA2C;IAC3C,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAA;IAC3B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,gDAAgD;IAChD,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,EAAE,CAAA;CAC/B;AAgCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,eAAe,EACxB,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,wBAAwB,CAAC,CAuEnC"}

package/dist/src/services/bundled-sibling-scan.js

@@ -0,0 +1,170 @@
+/**
+ * @fileoverview Bundled-sibling security scan for the local rescan path (SMI-5422 Phase 2).
+ * @module @skillsmith/core/services/bundled-sibling-scan
+ *
+ * Walks an installed skill's bundle directory and scans its sibling bundled
+ * files (`.mcp.json`, `.claude/settings*.json`, `package.json` lifecycle hooks,
+ * `config.json`, `scripts/*.sh` + top-level `*.sh`) so `skill_rescan` can
+ * quarantine a skill whose MALICIOUS sibling — not its `SKILL.md` — carries the
+ * threat (CVE-2025-59536 hook execution, `curl|bash` postinstall, a
+ * remote-fetch-execute install script).
+ *
+ * This is the local-FS rescan analogue of the Phase-1 install/validate helpers —
+ * NOT a duplicate. The three callers intentionally differ:
+ *   - install:  `skill-installation.io.ts` `fetchAndScanOptionalFiles` (fetch-by-path, no glob)
+ *   - validate: mcp-server `validate-bundled-scan.ts` `scanBundledSiblings` (returns ValidationError[])
+ *   - rescan (this): directory walk + symlink-safe reads + structured result.
+ *
+ * DELIBERATE FP-SAFE DIVERGENCE (Phase 2 review B1, verified empirically):
+ * install/validate reject via `isRejectableScan` (= `!report.passed` OR a
+ * `code_execution`/`obfuscated_directive` finding). The `!report.passed` clause
+ * fires on ANY high/critical finding, and sibling files are non-markdown so they
+ * get NO documentation-context downgrade — so routine, benign script idioms fire
+ * at full severity and would quarantine a working skill:
+ *   `chmod 755 ./bin/cli`     => privilege_escalation:critical => !passed
+ *   `cp .env.example .env`    => sensitive_path:high           => !passed
+ *   `source .env` / `export X=$1` / `cat ~/.ssh/...` => sensitive_path:high
+ * For an ALREADY-INSTALLED skill that false positive hides a working skill from
+ * local search. So this module drives the quarantine decision SOLELY from
+ * `code_execution`/`obfuscated_directive` presence (still catches `curl|bash`).
+ * The root cause — privilege_escalation/sensitive_path over-firing in
+ * non-markdown execution contexts (which is the SAME latent FP on the install
+ * path) — is tracked in SMI-5424; once those patterns are narrowed at the
+ * source, all three callers can safely share the broader criterion.
+ *
+ * INHERITED DETECTION GAPS (FN, tracked SMI-5424): bare-interpreter hook
+ * payloads (`node evil.js`, `python evil.py`, `bun`/`deno`), `&&`/`;`-chained
+ * fetch-then-exec, `npx`, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * structured files are NOT detected. `.js`/`.py`/`.mjs`/`.ts` payload files and
+ * nested/non-`scripts/` `.sh` are a Phase-3 follow-up (recursive bundle walk).
+ * COUNT-CAP DECOY-PADDING (FN): the fixed bundled files are cap-exempt, but the
+ * `.sh` glob is capped — an author can name the malicious script to sort last
+ * and pad `scripts/` with cap-many benign decoys so it lands in `droppedForCount`
+ * and is never scanned. This is surfaced (never a silent drop) but not blocked;
+ * a cumulative-resource bound is a Phase-3 follow-up.
+ *
+ * config.json IS scanned here (only doc-class siblings are skipped), whereas the
+ * Phase-1 validate helper (validate-bundled-scan.ts) also skips `config` — rescan
+ * is the deliberately stricter superset because it is a quarantine path.
+ */
+import { join } from 'path';
+import { safeFs, resolveSafeRealpath } from '../sources/LocalFilesystemAdapter.helpers.js';
+import { BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts, } from './skill-installation.policy.js';
+/** Max `.sh` glob files scanned per skill (fixed bundled files are exempt). */
+export const MAX_SIBLING_SH_FILES = 50;
+/** Per-file byte ceiling; larger siblings are skipped (recorded, never silent). */
+export const MAX_SIBLING_FILE_BYTES = 512 * 1024;
+/** A finding is a quarantine driver only if it is a direct execution threat. */
+function isExecutionThreat(finding) {
+    return finding.type === 'code_execution' || finding.type === 'obfuscated_directive';
+}
+/**
+ * Collect `*.sh` candidates: top-level then `scripts/`, regular files only
+ * (symlinked scripts are not followed by the glob — Phase 3). Sorted so the cap
+ * and `droppedForCount` are reproducible rather than dependent on readdir order.
+ * NOTE: sorting does NOT defeat decoy-padding — an author can name the malicious
+ * file to sort last; that residual FN is documented in the module header and the
+ * dropped names are always surfaced in `droppedForCount` (no silent drop).
+ */
+async function collectShFiles(skillDir) {
+    const out = [];
+    const top = await safeFs.readdir(skillDir);
+    if (top.ok) {
+        for (const e of top.value) {
+            if (e.isFile() && e.name.endsWith('.sh'))
+                out.push(e.name);
+        }
+    }
+    const scripts = await safeFs.readdir(join(skillDir, 'scripts'));
+    if (scripts.ok) {
+        for (const e of scripts.value) {
+            if (e.isFile() && e.name.endsWith('.sh'))
+                out.push(join('scripts', e.name));
+        }
+    }
+    return out.sort();
+}
+/**
+ * Scan a skill bundle's sibling files and return the structured result.
+ *
+ * Fixed {@link BUNDLED_SCAN_FILES} are always scanned (exempt from the count
+ * cap, so a decoy-padding attack on `scripts/` cannot push the primary hook /
+ * postinstall surface out of the scan window). The `.sh` glob is capped and
+ * any overflow is reported in `droppedForCount`.
+ *
+ * Doc-class siblings (`README.md`, `examples.md`) are intentionally NOT scanned:
+ * prose routinely quotes attack strings, so they can never drive a quarantine
+ * (Phase-1 H6 control). Every read is symlink-safe via `resolveSafeRealpath`
+ * (containment to `skillDir`, SMI-4287) and reads the resolved realpath.
+ *
+ * @param skillDir absolute path to the installed skill's bundle directory
+ * @param scanner  a constructed SecurityScanner (injected to keep this module DB-free)
+ * @param opts     optional caps
+ */
+export async function scanLocalBundleSiblings(skillDir, scanner, opts = {}) {
+    const maxShFiles = opts.maxShFiles ?? MAX_SIBLING_SH_FILES;
+    const maxBytes = opts.maxBytesPerFile ?? MAX_SIBLING_FILE_BYTES;
+    const result = {
+        findings: [],
+        rejectable: false,
+        rejectableFindings: [],
+        rejectableFiles: [],
+        scannedFiles: [],
+        maxSiblingRiskScore: 0,
+        droppedForCount: [],
+        skippedOversize: [],
+        skippedSymlinkEscape: [],
+    };
+    const shFiles = await collectShFiles(skillDir);
+    result.droppedForCount = shFiles.slice(maxShFiles);
+    // Fixed files first (cap-exempt), then the capped, sorted .sh glob.
+    const candidates = [...BUNDLED_SCAN_FILES, ...shFiles.slice(0, maxShFiles)];
+    for (const rel of candidates) {
+        const fileClass = classifyBundledFile(rel);
+        if (fileClass === 'doc')
+            continue; // prose quotes attack strings (H6) — never scanned
+        const abs = join(skillDir, rel);
+        const resolved = await resolveSafeRealpath(abs, skillDir, {});
+        if (!resolved.ok) {
+            // not-found = sibling absent (silent skip). symlink-escape = SMI-4287 guard.
+            // loop/permission/io = unreadable; skip (the file contributes no signal).
+            if (resolved.error.code === 'symlink-escape')
+                result.skippedSymlinkEscape.push(rel);
+            continue;
+        }
+        const realPath = resolved.value;
+        const st = await safeFs.stat(realPath);
+        if (!st.ok)
+            continue;
+        if (st.value.size > maxBytes) {
+            result.skippedOversize.push(rel);
+            continue;
+        }
+        const read = await safeFs.readFile(realPath);
+        if (!read.ok)
+            continue;
+        let textToScan = read.value;
+        if (fileClass === 'package-json') {
+            const lifecycle = extractPackageJsonLifecycleScripts(read.value);
+            if (lifecycle.length === 0)
+                continue; // no install-time hooks — nothing risky
+            textToScan = lifecycle;
+        }
+        const report = scanner.scan(`${skillDir}/${rel}`, textToScan);
+        result.scannedFiles.push(rel);
+        // Fresh objects (no mutation of the report's findings array) tagged with the file.
+        const tagged = report.findings.map((f) => ({ ...f, location: rel }));
+        result.findings.push(...tagged);
+        const drivers = tagged.filter(isExecutionThreat);
+        if (drivers.length > 0) {
+            result.rejectable = true;
+            result.rejectableFindings.push(...drivers);
+            result.rejectableFiles.push(rel);
+            // Only a REJECTING sibling contributes to the surfaced score, so a benign
+            // high-scoring sibling cannot mis-attribute the quarantine's riskScore.
+            result.maxSiblingRiskScore = Math.max(result.maxSiblingRiskScore, report.riskScore);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=bundled-sibling-scan.js.map

package/dist/src/services/bundled-sibling-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-sibling-scan.js","sourceRoot":"","sources":["../../../src/services/bundled-sibling-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAC1F,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,GACnC,MAAM,gCAAgC,CAAA;AAEvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAA;AAyChD,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,OAAwB;IACjD,OAAO,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAA;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAC/D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,OAAwB,EACxB,OAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAA;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAA;IAE/D,MAAM,MAAM,GAA6B;QACvC,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,EAAE;QACtB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,CAAC;QACtB,eAAe,EAAE,EAAE;QACnB,eAAe,EAAE,EAAE;QACnB,oBAAoB,EAAE,EAAE;KACzB,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAClD,oEAAoE;IACpE,MAAM,UAAU,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;IAE3E,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,SAAS,KAAK,KAAK;YAAE,SAAQ,CAAC,mDAAmD;QAErF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,6EAA6E;YAC7E,0EAA0E;YAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnF,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAA;QAE/B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,SAAQ;QACpB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAQ;QAEtB,IAAI,UAAU,GAAW,IAAI,CAAC,KAAK,CAAA;QACnC,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ,CAAC,wCAAwC;YAC7E,UAAU,GAAG,SAAS,CAAA;QACxB,CAAC;QAED,MAAM,MAAM,GAAe,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;QACzE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7B,mFAAmF;QACnF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACpE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;QAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;YACxB,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;YAC1C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/services/skill-installation.io.d.ts

@@ -33,11 +33,22 @@ export interface OptionalInstallFilesResult {
     }>;
 }
 /**
- * SMI-5359 Gap-1: fetch + scan the optional install files WITHOUT writing them.
- * The caller runs this BEFORE writeInstallFiles, rejects on any `failedScans`,
- * and only then writes `filesToWrite` (so a malicious optional file can never
- * leave a partially-installed skill on disk). A fetch/404 error is a silent
- * skip (NOT a scan failure); a config.json that fails scanning IS a rejection.
+ * SMI-5359 Gap-1 / SMI-5422 Phase 1: fetch + scan the optional install files
+ * WITHOUT writing them. The caller runs this BEFORE writeInstallFiles, rejects
+ * on any `failedScans`, and only then writes `filesToWrite` (so a malicious
+ * optional file can never leave a partially-installed skill on disk).
+ *
+ * Per-file policy (see skill-installation.policy.ts for the authoritative spec):
+ *   doc          – scan failure is a silent skip (FP control H6).
+ *   config       – hard-reject on scan failure (pre-existing behaviour).
+ *   structured   – hard-reject on scan failure, all trust tiers.
+ *   package-json – KEY-LEVEL: only lifecycle-hook script values are scanned.
+ *                  A package.json with no lifecycle hooks is never rejected.
+ *
+ * A fetch/404 error is always a silent skip (NOT a scan failure).
+ *
+ * Phase 3 follow-up: directory-glob scanning (e.g. scripts/*.sh) is out of
+ * scope here — fetchFromGitHub fetches by exact path only.
  */
 export declare function fetchAndScanOptionalFiles(owner: string, repo: string, basePath: string, branch: string, skillId: string, scannerOptions: ScannerOptions | null): Promise<OptionalInstallFilesResult>;
 //# sourceMappingURL=skill-installation.io.d.ts.map

package/dist/src/services/skill-installation.io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGtE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AASD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CA+BrC"}
+{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAStE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAkBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC"}

package/dist/src/services/skill-installation.io.js

@@ -9,6 +9,7 @@ import * as os from 'os';
 import { safeWriteFile } from '../utils/safe-fs.js';
 import { SecurityScanner } from '../security/index.js';
 import { validateOptionalConfig } from './skill-installation.validate.js';
+import { BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts, isRejectableScan, } from './skill-installation.policy.js';
 export function assertNotEncrypted(content, filePath) {
     if (content.startsWith('\x00GITCRYPT')) {
         throw new Error('File "' +
@@ -16,13 +17,30 @@ export function assertNotEncrypted(content, filePath) {
             '" is git-crypt encrypted. The repository uses git-crypt and this file cannot be fetched from GitHub.');
     }
 }
+/**
+ * SMI-5582: per-request timeout for raw.githubusercontent.com fetches.
+ *
+ * This is THE critical-path GitHub fetch for a registry install: it is reached
+ * from `SkillInstallationService.install()` (SKILL.md) and from
+ * `fetchAndScanOptionalFiles` (up to 7 optional files), each with a possible
+ * `main`→`master` fallback — i.e. up to ~16 sequential network calls per
+ * skill. Before SMI-5582 none of them were bounded, so a single hung GitHub
+ * socket could stall the caller indefinitely. Since Tier-1 auto-install now
+ * runs this chain at server startup, an unbounded fetch here is what would
+ * have hung MCP startup. 10s matches the "generous but finite" budget of the
+ * other startup network paths (`version-check.ts` uses 3s for a single npm
+ * ping; this is a heavier raw-content fetch, hence the larger bound).
+ */
+const GITHUB_FETCH_TIMEOUT_MS = 10_000;
 export async function fetchFromGitHub(owner, repo, filePath, branch = 'main') {
     const url = 'https://raw.githubusercontent.com/' + owner + '/' + repo + '/' + branch + '/' + filePath;
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS) });
     if (!response.ok) {
         if (branch === 'main') {
             const masterUrl = 'https://raw.githubusercontent.com/' + owner + '/' + repo + '/master/' + filePath;
-            const masterResponse = await fetch(masterUrl);
+            const masterResponse = await fetch(masterUrl, {
+                signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
+            });
             if (!masterResponse.ok) {
                 throw new Error('Failed to fetch ' + filePath + ': ' + response.status);
             }
@@ -126,41 +144,64 @@ export async function writeInstallFiles(installPath, skillsDir, skillName, final
     return { writtenFiles, subagentPath };
 }
 /**
- * Prose-documentation optional files: they routinely quote attack strings as
- * examples, so a scan failure on these is skipped (FP control, H6) rather than
- * rejecting the install. Non-doc optional files (config.json) DO hard-reject.
- */
-const DOC_OPTIONAL_FILES = new Set(['README.md', 'examples.md']);
-/**
- * SMI-5359 Gap-1: fetch + scan the optional install files WITHOUT writing them.
- * The caller runs this BEFORE writeInstallFiles, rejects on any `failedScans`,
- * and only then writes `filesToWrite` (so a malicious optional file can never
- * leave a partially-installed skill on disk). A fetch/404 error is a silent
- * skip (NOT a scan failure); a config.json that fails scanning IS a rejection.
+ * SMI-5359 Gap-1 / SMI-5422 Phase 1: fetch + scan the optional install files
+ * WITHOUT writing them. The caller runs this BEFORE writeInstallFiles, rejects
+ * on any `failedScans`, and only then writes `filesToWrite` (so a malicious
+ * optional file can never leave a partially-installed skill on disk).
+ *
+ * Per-file policy (see skill-installation.policy.ts for the authoritative spec):
+ *   doc          – scan failure is a silent skip (FP control H6).
+ *   config       – hard-reject on scan failure (pre-existing behaviour).
+ *   structured   – hard-reject on scan failure, all trust tiers.
+ *   package-json – KEY-LEVEL: only lifecycle-hook script values are scanned.
+ *                  A package.json with no lifecycle hooks is never rejected.
+ *
+ * A fetch/404 error is always a silent skip (NOT a scan failure).
+ *
+ * Phase 3 follow-up: directory-glob scanning (e.g. scripts/*.sh) is out of
+ * scope here — fetchFromGitHub fetches by exact path only.
  */
 export async function fetchAndScanOptionalFiles(owner, repo, basePath, branch, skillId, scannerOptions) {
     const optionalFileScanner = scannerOptions ? new SecurityScanner(scannerOptions) : null;
-    const optionalFiles = ['README.md', 'examples.md', 'config.json'];
     const configWarnings = [];
     const failedScans = [];
     const filesToWrite = [];
-    for (const file of optionalFiles) {
+    for (const file of BUNDLED_SCAN_FILES) {
         let content;
         try {
             content = await fetchFromGitHub(owner, repo, basePath + file, branch);
         }
         catch {
-            // Optional file absent / fetch failed — fine to skip (NOT a scan failure).
+            // Optional file absent / fetch failed — silent skip (NOT a scan failure).
             continue;
         }
         if (optionalFileScanner) {
-            const fileScan = optionalFileScanner.scan(skillId + '/' + file, content);
-            if (!fileScan.passed) {
-                // H6: prose docs quote attack strings — skip, never reject the install.
-                if (DOC_OPTIONAL_FILES.has(file))
+            const fileClass = classifyBundledFile(file);
+            // Determine the text to scan. For package-json, only lifecycle hook values;
+            // for everything else, the full file content.
+            let textToScan;
+            if (fileClass === 'package-json') {
+                const lifecycle = extractPackageJsonLifecycleScripts(content);
+                // Empty string means no install-time hooks — nothing risky to scan.
+                textToScan = lifecycle.length > 0 ? lifecycle : null;
+            }
+            else {
+                textToScan = content;
+            }
+            if (textToScan !== null) {
+                const fileScan = optionalFileScanner.scan(skillId + '/' + file, textToScan);
+                // Hard-reject classes also reject on a lone code_execution / obfuscated_
+                // directive finding (medium severity), which `passed` alone would miss —
+                // remote-fetch-execute / concealed directives have no place in a hook
+                // or config file (SMI-5422 Phase 1; isRejectableScan is FP-safe).
+                if (isRejectableScan(fileScan)) {
+                    // H6 FP control: prose docs quote attack strings — never hard-reject.
+                    if (fileClass === 'doc')
+                        continue;
+                    // config, structured, and package-json all hard-reject on failure.
+                    failedScans.push({ file, report: fileScan });
                     continue;
-                failedScans.push({ file, report: fileScan });
-                continue;
+                }
             }
         }
         if (file === 'config.json') {

package/dist/src/services/skill-installation.io.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAEzE,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;IACjE,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;YACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC5C,SAAQ;YACV,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}
+{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,EAClC,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAA;IAE3F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;aACrD,CAAC,CAAA;YACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAC3C,4EAA4E;YAC5E,8CAA8C;YAC9C,IAAI,UAAyB,CAAA;YAC7B,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAA;gBAC7D,oEAAoE;gBACpE,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,OAAO,CAAA;YACtB,CAAC;YACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,UAAU,CAAC,CAAA;gBAC3E,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,kEAAkE;gBAClE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ;oBACjC,mEAAmE;oBACnE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC5C,SAAQ;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}

package/dist/src/services/skill-installation.policy.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview Scan policy for bundled optional files in the skill install path.
+ * @module @skillsmith/core/services/skill-installation.policy
+ * @see SMI-5422 Phase 1: widen the bundled-file scan corpus
+ *
+ * Kept in its own module so io.ts and mcp-server/validate.ts can share the
+ * policy without coupling to the full install service. The three exports —
+ * BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts —
+ * are the contract; everything else is implementation detail.
+ */
+/**
+ * Per-file scan policy classes for bundled optional install files.
+ *
+ *   doc          - Routine prose docs that routinely quote attack strings as
+ *                  examples (FP control H6). A scan failure is a SILENT SKIP —
+ *                  never a hard reject.
+ *   config       - Pre-existing skill config (config.json). Hard-reject on scan
+ *                  failure (pre-existing behaviour, no change in Phase 1).
+ *   structured   - Execution-environment files (.mcp.json, .claude/settings*).
+ *                  Hard-reject on scan failure, uniform across ALL trust tiers.
+ *   package-json - Only lifecycle-hook script VALUES are scanned, not the whole
+ *                  file. Hard-reject if that extracted text fails. A package.json
+ *                  with only test/lint scripts or dep ranges is never rejected.
+ */
+export type BundledFileClass = 'doc' | 'config' | 'structured' | 'package-json';
+/**
+ * Widened fixed-name file list for the install corpus (SMI-5422 Phase 1).
+ *
+ * The install path fetches each file by exact path via fetchFromGitHub — there
+ * is NO directory globbing. Files like scripts/*.sh are OUT of scope for Phase 1
+ * and are noted as a Phase 3 follow-up (directory-glob scanning).
+ */
+export declare const BUNDLED_SCAN_FILES: readonly ["README.md", "examples.md", "config.json", ".claude/settings.json", ".claude/settings.local.json", ".mcp.json", "package.json"];
+/** Union type of every file name in the bundled scan corpus. */
+export type BundledScanFile = (typeof BUNDLED_SCAN_FILES)[number];
+/**
+ * Return the scan-policy class for a bundled optional file.
+ *
+ * Unknown names fall back to 'structured' (hard-reject) so that a file added
+ * to BUNDLED_SCAN_FILES without a corresponding FILE_CLASS_MAP entry defaults
+ * to the conservative posture rather than silently skipped.
+ */
+export declare function classifyBundledFile(filename: string): BundledFileClass;
+/**
+ * Extract lifecycle-hook script values from raw package.json content.
+ *
+ * Returns a newline-joined string of all present lifecycle hook values, or ''
+ * when the file is malformed JSON or contains no lifecycle keys at all.
+ *
+ * An empty return means "no install-time execution risk" — the caller should
+ * write the file without scanning it. A package.json with only `scripts.test`,
+ * `scripts.lint`, dependency version ranges, or metadata fields will always
+ * produce '' here and is NEVER rejected.
+ *
+ * On JSON parse error: returns '' (silent skip). It is not the scanner's job
+ * to reject a malformed package.json — the npm toolchain handles that. A
+ * corrupt or non-JSON file simply contributes no risky text to scan.
+ */
+export declare function extractPackageJsonLifecycleScripts(content: string): string;
+/**
+ * SMI-5422 Phase 1: should a hard-reject-class file (config/structured/package-
+ * json) reject given its scan report?
+ *
+ * Rejects when the scan fails the standard gate (a high/critical finding OR
+ * score ≥ threshold) OR contains ANY `code_execution` / `obfuscated_directive`
+ * finding regardless of severity. Those two top-tier categories mean "remote
+ * fetch-and-execute" / "concealed directive". A lone such match scores only
+ * MEDIUM under the scanner's deliberate SKILL.md prose-FP-avoidance model — but
+ * inside a config / hook / lifecycle file there is no documentation-context
+ * excuse, so it must reject (this is the CVE-2025-59536 hook-execution threat).
+ *
+ * FP-safe: legit build commands (tsc, vitest, node-gyp rebuild, `rm -rf` of a
+ * cache dir) and the canonical `.mcp.json` shape (`{command:"node",args:[…]}`)
+ * do NOT match `code_execution` — it requires curl|wget piped to a shell with a
+ * real URL/domain target — so normal lifecycle scripts and server specs pass.
+ *
+ * KNOWN DETECTION GAPS (inherited from the scanner patterns, tracked in SMI-5424
+ * — these are scanner-pattern + edge-twin changes, out of scope for Phase 1's
+ * install plumbing): `&&`/`;`-chained or redirect-then-exec download+execute
+ * (`curl URL -o /tmp/s && bash /tmp/s`), `npx --yes <pkg>`, `fish`/`bun`/`deno`
+ * interpreter sinks, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * STRUCTURED files (.mcp.json / .claude/settings.json are scanned as raw text;
+ * package.json lifecycle values are JSON-parsed first, so they are escape-safe).
+ * Phase 1 catches what the scanner patterns detect across MORE files; it does
+ * not change the patterns.
+ *
+ * Typed structurally (not against ScanReport) to keep this policy module free of
+ * the scanner type graph.
+ */
+export declare function isRejectableScan(report: {
+    passed: boolean;
+    findings: ReadonlyArray<{
+        type: string;
+    }>;
+}): boolean;
+//# sourceMappingURL=skill-installation.policy.d.ts.map

package/dist/src/services/skill-installation.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.policy.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,2IAQrB,CAAA;AAEV,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAoBjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAEtE;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1C,GAAG,OAAO,CAKV"}