hackmyagent 0.11.2 → 0.11.4

package/dist/hardening/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AAkF3F,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8HD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAiBlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAMvB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAmSvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAeV,uBAAuB;YAmGvB,aAAa;YAgDb,cAAc;YA+Fd,oBAAoB;YAwDpB,gBAAgB;YA0IhB,oBAAoB;YAgFpB,gBAAgB;YA2IhB,mBAAmB;YA4EnB,iBAAiB;YAyCjB,iBAAiB;YA+DjB,wBAAwB;YA0FxB,wBAAwB;YAmExB,wBAAwB;YAqHxB,oBAAoB;YA+GpB,uBAAuB;YAwIvB,iBAAiB;YA8GjB,oBAAoB;YAsHpB,mBAAmB;YAiGnB,gBAAgB;YAmIhB,oBAAoB;YAoIpB,gBAAgB;YAyHhB,qBAAqB;YA+GrB,eAAe;IAiI7B;;OAEG;YACW,mBAAmB;IA8GjC;;OAEG;YACW,oBAAoB;IAiKlC;;OAEG;YACW,iBAAiB;IA4I/B;;OAEG;YACW,oBAAoB;IAwIlC;;OAEG;YACW,eAAe;IAqJ7B;;OAEG;YACW,eAAe;IAuI7B;;OAEG;YACW,eAAe;IAyG7B;;OAEG;YACW,mBAAmB;IAmHjC,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,YAAY;IAkD1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IAycjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IA2LpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAqVlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IA6VjC;;OAEG;YACW,wBAAwB;IA4OtC;;OAEG;YACW,gBAAgB;IA6J9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IA+JlC;;;OAGG;YACW,iBAAiB;IA6H/B;;;OAGG;YACW,kBAAkB;IA+EhC;;;OAGG;YACW,aAAa;IAuF3B;;OAEG;YACW,gBAAgB;IA+D9B;;;;OAIG;YACW,yBAAyB;CAuWxC"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AAkF3F,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoID,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAiBlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAMvB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAmSvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAeV,uBAAuB;YAmGvB,aAAa;YAgDb,cAAc;YA+Fd,oBAAoB;YAwDpB,gBAAgB;YA0IhB,oBAAoB;YAgFpB,gBAAgB;YA2IhB,mBAAmB;YA4EnB,iBAAiB;YAyCjB,iBAAiB;YA+DjB,wBAAwB;YA0FxB,wBAAwB;YAmExB,wBAAwB;YAqHxB,oBAAoB;YA+GpB,uBAAuB;YAwIvB,iBAAiB;YA8GjB,oBAAoB;YAsHpB,mBAAmB;YAiGnB,gBAAgB;YAmIhB,oBAAoB;YAoIpB,gBAAgB;YAyHhB,qBAAqB;YA+GrB,eAAe;IAiI7B;;OAEG;YACW,mBAAmB;IA8GjC;;OAEG;YACW,oBAAoB;IAiKlC;;OAEG;YACW,iBAAiB;IA4I/B;;OAEG;YACW,oBAAoB;IAwIlC;;OAEG;YACW,eAAe;IAqJ7B;;OAEG;YACW,eAAe;IAuI7B;;OAEG;YACW,eAAe;IAyG7B;;OAEG;YACW,mBAAmB;IAmHjC,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,YAAY;IAkD1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IAycjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IA2LpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAqVlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IA6VjC;;OAEG;YACW,wBAAwB;IA4OtC;;OAEG;YACW,gBAAgB;IA6J9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IA+JlC;;;OAGG;YACW,iBAAiB;IA6H/B;;;OAGG;YACW,kBAAkB;IA+EhC;;;OAGG;YACW,aAAa;IAuF3B;;OAEG;YACW,gBAAgB;IA+D9B;;;;OAIG;YACW,yBAAyB;CAoWxC"}

package/dist/hardening/scanner.js

@@ -218,6 +218,11 @@ const SEVERITY_WEIGHTS = {
 };
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB max file size to prevent memory exhaustion
 const MAX_LINE_LENGTH = 10000; // 10KB max line length for regex safety
+/** Shell-escape a string for safe interpolation into advisory fix commands. */
+function shellEscape(s) {
+    // Wrap in single quotes and escape embedded single quotes: ' -> '\''
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
 class HardeningScanner {
     constructor() {
         this.cliName = 'hackmyagent';
@@ -3756,7 +3761,7 @@ dist/
             await fs.access(backupBaseDir);
         }
         catch {
-            throw new Error('No backup found. Run hackmyagent harden --fix <dir> first to create a backup.');
+            throw new Error('No backup found. Run hackmyagent secure --fix <dir> first to create a backup.');
         }
         // Find the most recent backup
         const backups = await fs.readdir(backupBaseDir);
@@ -3765,7 +3770,7 @@ dist/
             .sort()
             .reverse();
         if (sortedBackups.length === 0) {
-            throw new Error('No backup found. Run hackmyagent harden --fix <dir> first to create a backup.');
+            throw new Error('No backup found. Run hackmyagent secure --fix <dir> first to create a backup.');
         }
         const latestBackup = sortedBackups[0];
         const backupDir = path.join(backupBaseDir, latestBackup);
@@ -4883,8 +4888,8 @@ dist/
                 if (!this.isPathWithinDirectory(fullPath, targetDir)) {
                     continue;
                 }
-                // Skip node_modules and .git directories
-                if (entryName === 'node_modules' || entryName === '.git') {
+                // Skip node_modules, .git, and backup directories
+                if (entryName === 'node_modules' || entryName === '.git' || entryName === '.hackmyagent-backup') {
                     continue;
                 }
                 let stat;
@@ -6224,11 +6229,8 @@ dist/
      */
     async checkUnicodeSteganography(targetDir, _autoFix) {
         const findings = [];
-        // Scan a broad set of file types for unicode stego -- not just JS/TS
-        const stegoExtensions = [
-            '.js', '.ts', '.mjs', '.cjs', '.tsx', '.jsx',
-            '.py', '.md', '.txt', '.yaml', '.yml', '.json', '.toml',
-        ];
+        // Scan expanded file types beyond JS/TS (configs, docs, and Python are attack surfaces too)
+        const stegoExtensions = ['.ts', '.js', '.mjs', '.cjs', '.tsx', '.jsx', '.py', '.md', '.txt', '.yaml', '.yml', '.json', '.toml'];
         const sourceFiles = await this.walkDirectory(targetDir, stegoExtensions);
         for (const filePath of sourceFiles) {
             const relativePath = path.relative(targetDir, filePath);
@@ -6244,16 +6246,19 @@ dist/
                 continue;
             // UNICODE-STEGO-001: Invisible Codepoint Detection
             // Scan for:
-            //   - Zero-width characters: U+200B (ZWSP), U+200C (ZWNJ), U+200D (ZWJ), U+FEFF (BOM mid-file)
-            //   - Variation selectors U+FE00-FE0F
-            //   - Tag characters U+E0100-E01EF
-            //   - Bidirectional override chars U+202A-U+202E and U+2066-U+2069
+            //   - Variation selectors U+FE00-FE0F (UTF-8: EF B8 80-8F)
+            //   - Tag characters U+E0100-E01EF (UTF-8: F3 A0 84 80 - F3 A0 87 AF)
+            //   - Zero-width chars: U+200B (E2 80 8B), U+200C (E2 80 8C), U+200D (E2 80 8D)
+            //   - Mid-file BOM: U+FEFF (EF BB BF) -- skip offset 0
+            //   - Bidi overrides: U+202A-202E (E2 80 AA-AE), U+2066-2069 (E2 81 A6-A9)
             let hasVariationSelectors = false;
             let variationSelectorLine = 1;
             let hasTagCharsIn001 = false;
             let tagCharLine001 = 1;
             let hasZeroWidth = false;
             let zeroWidthLine = 1;
+            let hasMidFileBom = false;
+            let midFileBomLine = 1;
             let hasBidiOverride = false;
             let bidiOverrideLine = 1;
             let currentLine = 1;
@@ -6262,7 +6267,29 @@ dist/
                     currentLine++;
                     continue;
                 }
-                // Zero-width characters: E2 80 8B (ZWSP), E2 80 8C (ZWNJ), E2 80 8D (ZWJ)
+                // Variation selectors: EF B8 80-8F
+                if (rawBuffer[i] === 0xEF &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xB8 &&
+                    rawBuffer[i + 2] >= 0x80 &&
+                    rawBuffer[i + 2] <= 0x8F) {
+                    if (!hasVariationSelectors) {
+                        hasVariationSelectors = true;
+                        variationSelectorLine = currentLine;
+                    }
+                }
+                // Tag characters in U+E0100-E01EF: F3 A0 84 80 through F3 A0 87 AF
+                if (rawBuffer[i] === 0xF3 &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xA0 &&
+                    rawBuffer[i + 2] >= 0x84 &&
+                    rawBuffer[i + 2] <= 0x87) {
+                    if (!hasTagCharsIn001) {
+                        hasTagCharsIn001 = true;
+                        tagCharLine001 = currentLine;
+                    }
+                }
+                // Zero-width chars: U+200B/200C/200D = E2 80 8B/8C/8D
                 if (rawBuffer[i] === 0xE2 &&
                     i + 2 < rawBuffer.length &&
                     rawBuffer[i + 1] === 0x80 &&
@@ -6273,18 +6300,18 @@ dist/
                         zeroWidthLine = currentLine;
                     }
                 }
-                // BOM / Zero-width no-break space U+FEFF: EF BB BF (only suspicious mid-file)
-                if (rawBuffer[i] === 0xEF &&
+                // Mid-file BOM: U+FEFF = EF BB BF (skip if at offset 0)
+                if (i > 0 &&
+                    rawBuffer[i] === 0xEF &&
                     i + 2 < rawBuffer.length &&
                     rawBuffer[i + 1] === 0xBB &&
-                    rawBuffer[i + 2] === 0xBF &&
-                    i > 0) {
-                    if (!hasZeroWidth) {
-                        hasZeroWidth = true;
-                        zeroWidthLine = currentLine;
+                    rawBuffer[i + 2] === 0xBF) {
+                    if (!hasMidFileBom) {
+                        hasMidFileBom = true;
+                        midFileBomLine = currentLine;
                     }
                 }
-                // Bidirectional override chars U+202A-U+202E: E2 80 AA-AE
+                // Bidi overrides: U+202A-202E = E2 80 AA-AE
                 if (rawBuffer[i] === 0xE2 &&
                     i + 2 < rawBuffer.length &&
                     rawBuffer[i + 1] === 0x80 &&
@@ -6295,7 +6322,7 @@ dist/
                         bidiOverrideLine = currentLine;
                     }
                 }
-                // Bidirectional isolate chars U+2066-U+2069: E2 81 A6-A9
+                // Bidi isolates: U+2066-2069 = E2 81 A6-A9
                 if (rawBuffer[i] === 0xE2 &&
                     i + 2 < rawBuffer.length &&
                     rawBuffer[i + 1] === 0x81 &&
@@ -6306,62 +6333,42 @@ dist/
                         bidiOverrideLine = currentLine;
                     }
                 }
-                // Variation selectors: EF B8 80-8F
-                if (rawBuffer[i] === 0xEF &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0xB8 &&
-                    rawBuffer[i + 2] >= 0x80 &&
-                    rawBuffer[i + 2] <= 0x8F) {
-                    if (!hasVariationSelectors) {
-                        hasVariationSelectors = true;
-                        variationSelectorLine = currentLine;
-                    }
-                }
-                // Tag characters in U+E0100-E01EF: F3 A0 84 80 through F3 A0 87 AF
-                if (rawBuffer[i] === 0xF3 &&
-                    i + 2 < rawBuffer.length &&
-                    rawBuffer[i + 1] === 0xA0 &&
-                    rawBuffer[i + 2] >= 0x84 &&
-                    rawBuffer[i + 2] <= 0x87) {
-                    if (!hasTagCharsIn001) {
-                        hasTagCharsIn001 = true;
-                        tagCharLine001 = currentLine;
-                    }
-                }
             }
-            if (hasZeroWidth || hasVariationSelectors || hasTagCharsIn001 || hasBidiOverride) {
+            // Bidi and variation/tag chars are critical; zero-width-only is high
+            const hasCriticalInvisible = hasVariationSelectors || hasTagCharsIn001 || hasBidiOverride;
+            const hasAnyInvisible = hasCriticalInvisible || hasZeroWidth || hasMidFileBom;
+            if (hasAnyInvisible) {
                 const detectedTypes = [];
-                if (hasZeroWidth)
-                    detectedTypes.push('zero-width characters (U+200B-U+200D, U+FEFF)');
-                if (hasBidiOverride)
-                    detectedTypes.push('bidirectional overrides (U+202A-U+202E, U+2066-U+2069)');
                 if (hasVariationSelectors)
                     detectedTypes.push('variation selectors (U+FE00-FE0F)');
                 if (hasTagCharsIn001)
                     detectedTypes.push('tag characters (U+E0100-E01EF)');
-                const lineNumbers = [];
                 if (hasZeroWidth)
-                    lineNumbers.push(zeroWidthLine);
+                    detectedTypes.push('zero-width characters (U+200B-200D)');
+                if (hasMidFileBom)
+                    detectedTypes.push('mid-file BOM (U+FEFF)');
                 if (hasBidiOverride)
-                    lineNumbers.push(bidiOverrideLine);
-                if (hasVariationSelectors)
-                    lineNumbers.push(variationSelectorLine);
-                if (hasTagCharsIn001)
-                    lineNumbers.push(tagCharLine001);
-                const earliestLine = Math.min(...lineNumbers);
-                const severity = hasBidiOverride || hasVariationSelectors || hasTagCharsIn001 ? 'critical' : 'high';
+                    detectedTypes.push('bidi overrides (U+202A-202E, U+2066-2069)');
+                // Determine first line hit for reporting
+                const firstLine = Math.min(...[
+                    hasVariationSelectors ? variationSelectorLine : Infinity,
+                    hasTagCharsIn001 ? tagCharLine001 : Infinity,
+                    hasZeroWidth ? zeroWidthLine : Infinity,
+                    hasMidFileBom ? midFileBomLine : Infinity,
+                    hasBidiOverride ? bidiOverrideLine : Infinity,
+                ]);
                 findings.push({
                     checkId: 'UNICODE-STEGO-001',
                     name: 'Invisible Unicode Codepoints Detected',
-                    description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (zero-width characters, bidirectional overrides, variation selectors, or tag characters)',
-                    category: 'supply-chain',
-                    severity,
+                    description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (GlassWorm attack vector)',
+                    category: 'unicode-stego',
+                    severity: hasCriticalInvisible ? 'critical' : 'high',
                     passed: false,
                     message: `Found ${detectedTypes.join(' and ')} in ${relativePath}`,
                     file: relativePath,
-                    line: earliestLine,
+                    line: firstLine,
                     fixable: false,
-                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + relativePath + ' | grep -iE "e280 8[bcd]|efbb bf|e280 a[a-e]|e281 a[6-9]|efb8 8|f3a0"',
+                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + shellEscape(relativePath) + ' | grep -iE "e280[8-9a-e]|efbb|efb8|f3a0"',
                 });
             }
             // UNICODE-STEGO-002: GlassWorm Decoder Pattern
@@ -6390,7 +6397,7 @@ dist/
                     checkId: 'UNICODE-STEGO-002',
                     name: 'GlassWorm Decoder Pattern Detected',
                     description: 'Source file contains .codePointAt() usage combined with Unicode variation selector or tag character hex literals - this is the decoder half of a GlassWorm attack',
-                    category: 'supply-chain',
+                    category: 'unicode-stego',
                     severity: 'critical',
                     passed: false,
                     message: `Found GlassWorm decoder pattern (.codePointAt + hex range literals) in ${relativePath}`,
@@ -6444,14 +6451,14 @@ dist/
                         checkId: 'UNICODE-STEGO-003',
                         name: 'Eval on String with Hidden Payload',
                         description: 'eval() or Function() is called with a string that has very few visible characters but a large byte footprint - indicates invisible Unicode payload',
-                        category: 'supply-chain',
+                        category: 'unicode-stego',
                         severity: 'critical',
                         passed: false,
                         message: `Found eval/Function with ${visibleChars} visible chars but ${byteLength} bytes in ${relativePath}`,
                         file: relativePath,
                         line: evalLine,
                         fixable: false,
-                        fix: 'Remove the eval/Function call and inspect the string argument with a hex editor. The string likely contains invisible Unicode characters encoding a malicious payload. Run: node -e "const fs=require(\'fs\'); const s=fs.readFileSync(\'' + relativePath + '\',\'utf8\'); console.log([...s].filter(c=>c.codePointAt(0)>0x200).map(c=>c.codePointAt(0).toString(16)))"',
+                        fix: 'Remove the eval/Function call and inspect the string argument with a hex editor. The string likely contains invisible Unicode characters encoding a malicious payload. Run: node -e "const fs=require(\'fs\'); const s=fs.readFileSync(' + JSON.stringify(relativePath) + ',\'utf8\'); console.log([...s].filter(c=>c.codePointAt(0)>0x200).map(c=>c.codePointAt(0).toString(16)))"',
                     });
                     break; // One finding per file
                 }
@@ -6486,78 +6493,66 @@ dist/
                         checkId: 'UNICODE-STEGO-004',
                         name: 'Unicode Tag Character Block Detected',
                         description: 'Source file contains characters from the Unicode Tag block (U+E0000-U+E01EF) which have no visible rendering and can be used to hide data',
-                        category: 'supply-chain',
+                        category: 'unicode-stego',
                         severity: 'high',
                         passed: false,
                         message: `Found Unicode tag block characters in ${relativePath}`,
                         file: relativePath,
                         line: tagBlockLine,
                         fixable: false,
-                        fix: 'Inspect the file with a hex editor to identify tag block characters (byte sequence starting with F3 A0). These characters are invisible and have no legitimate use in source code. Run: xxd ' + relativePath + ' | grep "f3a0"',
+                        fix: 'Inspect the file with a hex editor to identify tag block characters (byte sequence starting with F3 A0). These characters are invisible and have no legitimate use in source code. Run: xxd ' + shellEscape(relativePath) + ' | grep "f3a0"',
                     });
                 }
             }
-        }
-        // UNICODE-STEGO-005: Homoglyph Substitution Detection
-        // Detect Cyrillic/Greek/fullwidth letters that look identical to Latin letters.
-        // Only scan code files where identifiers matter.
-        const codeExtensions = new Set(['.js', '.ts', '.mjs', '.cjs', '.tsx', '.jsx', '.py']);
-        const codeFiles = sourceFiles.filter((f) => codeExtensions.has(path.extname(f).toLowerCase()));
-        const HOMOGLYPHS = {
-            0x0430: 'a', 0x0435: 'e', 0x043E: 'o', 0x0440: 'p',
-            0x0441: 'c', 0x0443: 'y', 0x0445: 'x', 0x0456: 'i',
-            0x0455: 's', 0x04BB: 'h', 0x0501: 'd', 0x051B: 'q',
-            0x03B1: 'a', 0x03BF: 'o', 0x03C1: 'p',
-            0xFF41: 'a', 0xFF45: 'e', 0xFF4F: 'o',
-        };
-        const homoglyphCodes = new Set(Object.keys(HOMOGLYPHS).map(Number));
-        for (const filePath of codeFiles) {
-            const relativePath = path.relative(targetDir, filePath);
-            let content;
-            try {
-                content = await fs.readFile(filePath, 'utf-8');
-            }
-            catch {
-                continue;
-            }
-            if (content.length > MAX_FILE_SIZE)
-                continue;
-            const lines = content.split('\n');
-            const foundHomoglyphs = [];
-            for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
-                const line = lines[lineIdx];
+            // UNICODE-STEGO-005: Homoglyph Confusable Detection
+            // Detect Cyrillic/Greek characters that look identical to Latin but have different codepoints.
+            // These can be used to bypass code review and hide malicious identifiers.
+            const homoglyphCodepoints = new Set([
+                // Cyrillic uppercase that look like Latin: A, B, C, E, H, K, M, O, P, T, X
+                0x0410, 0x0412, 0x0421, 0x0415, 0x041D, 0x041A, 0x041C, 0x041E, 0x0420, 0x0422, 0x0425,
+                // Cyrillic lowercase that look like Latin: a, e, o, p, c, x
+                0x0430, 0x0435, 0x043E, 0x0440, 0x0441, 0x0445,
+                // Fullwidth Latin (U+FF21-FF3A, U+FF41-FF5A) -- spot-check common ones
+                0xFF21, 0xFF22, 0xFF41, 0xFF42,
+            ]);
+            let homoglyphFound = false;
+            let homoglyphLine = 1;
+            let homoglyphChar = '';
+            const contentForHomoglyph = content || rawBuffer.toString('utf-8');
+            const homoglyphLines = contentForHomoglyph.split('\n');
+            for (let lineIdx = 0; lineIdx < homoglyphLines.length; lineIdx++) {
+                const line = homoglyphLines[lineIdx];
                 if (line.length > MAX_LINE_LENGTH)
                     continue;
+                // Skip comment lines
                 const trimmed = line.trimStart();
                 if (trimmed.startsWith('//') || trimmed.startsWith('#') || trimmed.startsWith('*'))
                     continue;
                 for (const ch of line) {
                     const cp = ch.codePointAt(0);
-                    if (homoglyphCodes.has(cp)) {
-                        foundHomoglyphs.push({ line: lineIdx + 1, lookalike: HOMOGLYPHS[cp], cp });
+                    if (homoglyphCodepoints.has(cp)) {
+                        homoglyphFound = true;
+                        homoglyphLine = lineIdx + 1;
+                        homoglyphChar = `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`;
                         break;
                     }
                 }
-                if (foundHomoglyphs.length >= 5)
+                if (homoglyphFound)
                     break;
             }
-            if (foundHomoglyphs.length > 0) {
-                const examples = foundHomoglyphs
-                    .slice(0, 3)
-                    .map((h) => `U+${h.cp.toString(16).toUpperCase().padStart(4, '0')} (looks like '${h.lookalike}') at line ${h.line}`)
-                    .join(', ');
+            if (homoglyphFound) {
                 findings.push({
                     checkId: 'UNICODE-STEGO-005',
-                    name: 'Homoglyph Character Substitution Detected',
-                    description: 'Source file contains non-Latin characters (Cyrillic, Greek, or fullwidth) that visually mimic Latin letters. This can disguise malicious identifiers or imports.',
-                    category: 'supply-chain',
+                    name: 'Homoglyph Confusable Characters Detected',
+                    description: 'Source file contains characters from non-Latin scripts (Cyrillic, Greek, Fullwidth) that visually resemble Latin letters. These can be used to create identifiers that look identical in code review but behave differently at runtime.',
+                    category: 'unicode-stego',
                     severity: 'high',
                     passed: false,
-                    message: `Found ${foundHomoglyphs.length} homoglyph substitution(s) in ${relativePath}: ${examples}`,
+                    message: `Found homoglyph confusable character (${homoglyphChar}) in ${relativePath} at line ${homoglyphLine}`,
                     file: relativePath,
-                    line: foundHomoglyphs[0].line,
+                    line: homoglyphLine,
                     fixable: false,
-                    fix: 'Replace non-Latin lookalike characters with their ASCII equivalents. Run: node -e "const s=require(\'fs\').readFileSync(\'' + relativePath + '\',\'utf8\');[...s].forEach((c,i)=>{const cp=c.codePointAt(0);if(cp>0x7F&&cp<0xFFFF)console.log(\'offset\',i,\'U+\'+cp.toString(16),JSON.stringify(c))})"',
+                    fix: 'Inspect the file for characters that look like Latin letters but are actually Cyrillic, Greek, or Fullwidth. Replace them with their ASCII equivalents. Run: node -e "const fs=require(\'fs\'); [...fs.readFileSync(' + JSON.stringify(relativePath) + ',\'utf8\')].forEach((c,i)=>{const cp=c.codePointAt(0); if(cp>0x7F && cp<0xFFFF) console.log(i, cp.toString(16), c)})"',
                 });
             }
         }