slopbrick 0.34.8 → 0.34.10

package/dist/engine/worker.cjs

@@ -37142,7 +37142,7 @@ var javaHardcodedCredentialRule = createRule({
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
-var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?)/;
 var javaSqlStringConcatRule = createRule({
   id: "java/sql-string-concat",
   category: "security",
@@ -37160,7 +37160,14 @@ var javaSqlStringConcatRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!SQL_KEYWORD_REGEX.test(line)) continue;
+      const keywordMatch = SQL_KEYWORD_REGEX.exec(line);
+      if (!keywordMatch) continue;
+      const keywordIdx = keywordMatch.index;
+      let j = keywordIdx - 1;
+      while (j >= 0 && /\s/.test(line[j])) j--;
+      if (j < 0) continue;
+      const prevChar = line[j];
+      if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
       if (!UNSAFE_REGEX.test(line)) continue;
       if (SAFE_REGEX.test(line)) continue;
       issues.push({
@@ -37171,7 +37178,7 @@ var javaSqlStringConcatRule = createRule({
         message: `SQL query built via string concat at line ${i + 1}`,
         line: i + 1,
         column: 1,
-        advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+        advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.34.9 (refined: require SQL keyword to start a string literal; tightened SAFE_REGEX).'
       });
     }
     return issues;
@@ -40561,7 +40568,7 @@ var swiftFatalErrorThrownRule = createRule({
 
 // src/rules/swift/force-unwrap.ts
 var AS_FORCE_REGEX = /\bas!\s+/g;
-var ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+var ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
 var TRY_FORCE_REGEX = /\btry!\s+/g;
 var swiftForceUnwrapRule = createRule({
   id: "swift/force-unwrap",
@@ -40588,7 +40595,7 @@ var swiftForceUnwrapRule = createRule({
         message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
         line,
         column: 1,
-        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
       });
     };
     let m;
@@ -40597,7 +40604,10 @@ var swiftForceUnwrapRule = createRule({
     TRY_FORCE_REGEX.lastIndex = 0;
     while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
     ACCESS_FORCE_REGEX.lastIndex = 0;
-    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+      const bangOffset = m.index + (m[1]?.length ?? 1);
+      emit(bangOffset, "!.");
+    }
     return issues;
   }
 });
@@ -45627,7 +45637,7 @@ var signal_strength_default = {
     precision: 0.0691,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+    _calibrationNote: 'v0.34.9: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and tightened the SAFE_REGEX. Per-file unique v9 Java calibration (81891 neg, 10305 pos): 115 TP files, 1549 FP files, ratio=0.59 (DORMANT). 1664 total fires. The refinement is expected to push precision from 6.9% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `String msg = "Selected 1 row: " + count`). Also tightened SAFE_REGEX from `:??` to `:?` (the original was over-broad). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline (same pattern applied to kotlin/sql-string-concat and java/sql-string-concat). INSUFFICIENT_DATA: pos arm 10305 files, below the 10k floor. Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. defaultOff.',
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.59,
@@ -45707,7 +45717,7 @@ var signal_strength_default = {
     precision: 0.1721,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+    _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/engine/worker.js

@@ -37113,7 +37113,7 @@ var javaHardcodedCredentialRule = createRule({
 // src/rules/java/sql-string-concat.ts
 var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
 var UNSAFE_REGEX = /\+/;
-var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?)/;
 var javaSqlStringConcatRule = createRule({
   id: "java/sql-string-concat",
   category: "security",
@@ -37131,7 +37131,14 @@ var javaSqlStringConcatRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!SQL_KEYWORD_REGEX.test(line)) continue;
+      const keywordMatch = SQL_KEYWORD_REGEX.exec(line);
+      if (!keywordMatch) continue;
+      const keywordIdx = keywordMatch.index;
+      let j = keywordIdx - 1;
+      while (j >= 0 && /\s/.test(line[j])) j--;
+      if (j < 0) continue;
+      const prevChar = line[j];
+      if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
       if (!UNSAFE_REGEX.test(line)) continue;
       if (SAFE_REGEX.test(line)) continue;
       issues.push({
@@ -37142,7 +37149,7 @@ var javaSqlStringConcatRule = createRule({
         message: `SQL query built via string concat at line ${i + 1}`,
         line: i + 1,
         column: 1,
-        advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+        advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.34.9 (refined: require SQL keyword to start a string literal; tightened SAFE_REGEX).'
       });
     }
     return issues;
@@ -40532,7 +40539,7 @@ var swiftFatalErrorThrownRule = createRule({
 
 // src/rules/swift/force-unwrap.ts
 var AS_FORCE_REGEX = /\bas!\s+/g;
-var ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+var ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
 var TRY_FORCE_REGEX = /\btry!\s+/g;
 var swiftForceUnwrapRule = createRule({
   id: "swift/force-unwrap",
@@ -40559,7 +40566,7 @@ var swiftForceUnwrapRule = createRule({
         message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
         line,
         column: 1,
-        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+        advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
       });
     };
     let m;
@@ -40568,7 +40575,10 @@ var swiftForceUnwrapRule = createRule({
     TRY_FORCE_REGEX.lastIndex = 0;
     while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
     ACCESS_FORCE_REGEX.lastIndex = 0;
-    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+    while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+      const bangOffset = m.index + (m[1]?.length ?? 1);
+      emit(bangOffset, "!.");
+    }
     return issues;
   }
 });
@@ -45598,7 +45608,7 @@ var signal_strength_default = {
     precision: 0.0691,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+    _calibrationNote: 'v0.34.9: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and tightened the SAFE_REGEX. Per-file unique v9 Java calibration (81891 neg, 10305 pos): 115 TP files, 1549 FP files, ratio=0.59 (DORMANT). 1664 total fires. The refinement is expected to push precision from 6.9% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `String msg = "Selected 1 row: " + count`). Also tightened SAFE_REGEX from `:??` to `:?` (the original was over-broad). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline (same pattern applied to kotlin/sql-string-concat and java/sql-string-concat). INSUFFICIENT_DATA: pos arm 10305 files, below the 10k floor. Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. defaultOff.',
     aiSpecific: false,
     _v9Verdict: "DORMANT",
     _v9Lift: 0.59,
@@ -45678,7 +45688,7 @@ var signal_strength_default = {
     precision: 0.1721,
     lastCalibratedAt: "2026-07-03T00:00:00Z",
     verdict: "DORMANT",
-    _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+    _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
     aiSpecific: true,
     _v7Verdict: "DORMANT",
     _v7Lift: 1,

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.8";
+    VERSION = "0.34.10";
   }
 });
 
@@ -30805,7 +30805,7 @@ var init_sql_string_concat = __esm({
     init_rule();
     SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
     UNSAFE_REGEX = /\+/;
-    SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+    SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?)/;
     javaSqlStringConcatRule = createRule({
       id: "java/sql-string-concat",
       category: "security",
@@ -30823,7 +30823,14 @@ var init_sql_string_concat = __esm({
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           const line = lines[i];
-          if (!SQL_KEYWORD_REGEX.test(line)) continue;
+          const keywordMatch = SQL_KEYWORD_REGEX.exec(line);
+          if (!keywordMatch) continue;
+          const keywordIdx = keywordMatch.index;
+          let j = keywordIdx - 1;
+          while (j >= 0 && /\s/.test(line[j])) j--;
+          if (j < 0) continue;
+          const prevChar = line[j];
+          if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
           if (!UNSAFE_REGEX.test(line)) continue;
           if (SAFE_REGEX.test(line)) continue;
           issues.push({
@@ -30834,7 +30841,7 @@ var init_sql_string_concat = __esm({
             message: `SQL query built via string concat at line ${i + 1}`,
             line: i + 1,
             column: 1,
-            advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+            advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.34.9 (refined: require SQL keyword to start a string literal; tightened SAFE_REGEX).'
           });
         }
         return issues;
@@ -41095,7 +41102,7 @@ var init_force_unwrap2 = __esm({
     "use strict";
     init_rule();
     AS_FORCE_REGEX = /\bas!\s+/g;
-    ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+    ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
     TRY_FORCE_REGEX = /\btry!\s+/g;
     swiftForceUnwrapRule = createRule({
       id: "swift/force-unwrap",
@@ -41122,7 +41129,7 @@ var init_force_unwrap2 = __esm({
             message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
             line,
             column: 1,
-            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
           });
         };
         let m;
@@ -41131,7 +41138,10 @@ var init_force_unwrap2 = __esm({
         TRY_FORCE_REGEX.lastIndex = 0;
         while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
         ACCESS_FORCE_REGEX.lastIndex = 0;
-        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+          const bangOffset = m.index + (m[1]?.length ?? 1);
+          emit(bangOffset, "!.");
+        }
         return issues;
       }
     });
@@ -51714,7 +51724,7 @@ var init_signal_strength = __esm({
         precision: 0.0691,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+        _calibrationNote: 'v0.34.9: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and tightened the SAFE_REGEX. Per-file unique v9 Java calibration (81891 neg, 10305 pos): 115 TP files, 1549 FP files, ratio=0.59 (DORMANT). 1664 total fires. The refinement is expected to push precision from 6.9% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `String msg = "Selected 1 row: " + count`). Also tightened SAFE_REGEX from `:??` to `:?` (the original was over-broad). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline (same pattern applied to kotlin/sql-string-concat and java/sql-string-concat). INSUFFICIENT_DATA: pos arm 10305 files, below the 10k floor. Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. defaultOff.',
         aiSpecific: false,
         _v9Verdict: "DORMANT",
         _v9Lift: 0.59,
@@ -51794,7 +51804,7 @@ var init_signal_strength = __esm({
         precision: 0.1721,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+        _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.34.8";
+    VERSION = "0.34.10";
   }
 });
 
@@ -30786,7 +30786,7 @@ var init_sql_string_concat = __esm({
     init_rule();
     SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
     UNSAFE_REGEX = /\+/;
-    SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+    SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?)/;
     javaSqlStringConcatRule = createRule({
       id: "java/sql-string-concat",
       category: "security",
@@ -30804,7 +30804,14 @@ var init_sql_string_concat = __esm({
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           const line = lines[i];
-          if (!SQL_KEYWORD_REGEX.test(line)) continue;
+          const keywordMatch = SQL_KEYWORD_REGEX.exec(line);
+          if (!keywordMatch) continue;
+          const keywordIdx = keywordMatch.index;
+          let j = keywordIdx - 1;
+          while (j >= 0 && /\s/.test(line[j])) j--;
+          if (j < 0) continue;
+          const prevChar = line[j];
+          if (prevChar !== '"' && prevChar !== "'" && prevChar !== "=") continue;
           if (!UNSAFE_REGEX.test(line)) continue;
           if (SAFE_REGEX.test(line)) continue;
           issues.push({
@@ -30815,7 +30822,7 @@ var init_sql_string_concat = __esm({
             message: `SQL query built via string concat at line ${i + 1}`,
             line: i + 1,
             column: 1,
-            advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+            advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.34.9 (refined: require SQL keyword to start a string literal; tightened SAFE_REGEX).'
           });
         }
         return issues;
@@ -41076,7 +41083,7 @@ var init_force_unwrap2 = __esm({
     "use strict";
     init_rule();
     AS_FORCE_REGEX = /\bas!\s+/g;
-    ACCESS_FORCE_REGEX = /(?:\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
+    ACCESS_FORCE_REGEX = /(?<![=!])(\w|\])\!\s*(?:\.|\(|;|,|\s*$)/gm;
     TRY_FORCE_REGEX = /\btry!\s+/g;
     swiftForceUnwrapRule = createRule({
       id: "swift/force-unwrap",
@@ -41103,7 +41110,7 @@ var init_force_unwrap2 = __esm({
             message: `force-unwrap (${label}) at line ${line} \u2014 crashes if the value is nil`,
             line,
             column: 1,
-            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.24.'
+            advice: 'Replace with the safe form: `as?` + guard/if let, `try?` + nil-check, or `guard let x = optional else { return }` instead of `x!`. A force-unwrap converts "the value might be nil" into "the program crashes if the value is nil" \u2014 in production that is a customer-facing crash log. AI agents reach for `!` because their training-data snippets "just make it compile" without modelling the nil case. Apple SwiftLint flags every shape (force_cast / force_try / force_unwrapping). Reference: swift/force-unwrap v0.34.10 (refined: exclude `!` in `!==`/`!=` operators via negative lookbehind).'
           });
         };
         let m;
@@ -41112,7 +41119,10 @@ var init_force_unwrap2 = __esm({
         TRY_FORCE_REGEX.lastIndex = 0;
         while ((m = TRY_FORCE_REGEX.exec(source)) !== null) emit(m.index, "try!");
         ACCESS_FORCE_REGEX.lastIndex = 0;
-        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) emit(m.index, "!.");
+        while ((m = ACCESS_FORCE_REGEX.exec(source)) !== null) {
+          const bangOffset = m.index + (m[1]?.length ?? 1);
+          emit(bangOffset, "!.");
+        }
         return issues;
       }
     });
@@ -51692,7 +51702,7 @@ var init_signal_strength = __esm({
         precision: 0.0691,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+        _calibrationNote: 'v0.34.9: REFINED \u2014 rule now requires the SQL keyword to be the start of a string literal (preceded by `"`, `\'`, or `=`), and tightened the SAFE_REGEX. Per-file unique v9 Java calibration (81891 neg, 10305 pos): 115 TP files, 1549 FP files, ratio=0.59 (DORMANT). 1664 total fires. The refinement is expected to push precision from 6.9% to 25%+ by removing lines where SELECT/INSERT appears in string values (e.g. `String msg = "Selected 1 row: " + count`). Also tightened SAFE_REGEX from `:??` to `:?` (the original was over-broad). The full v9 re-calibration is part of the broader v0.34.8/v0.34.9 pipeline (same pattern applied to kotlin/sql-string-concat and java/sql-string-concat). INSUFFICIENT_DATA: pos arm 10305 files, below the 10k floor. Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. defaultOff.',
         aiSpecific: false,
         _v9Verdict: "DORMANT",
         _v9Lift: 0.59,
@@ -51772,7 +51782,7 @@ var init_signal_strength = __esm({
         precision: 0.1721,
         lastCalibratedAt: "2026-07-03T00:00:00Z",
         verdict: "DORMANT",
-        _calibrationNote: "v0.32: v9 Swift calibration (1300 neg, 568 pos). Per-file unique measurement: 58 TP files, 279 FP files, ratio=0.48. Era-confounded: pre-2022 Swift used ! freely (the only way to unwrap); modern Swift uses guard let / if let / try?. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
+        _calibrationNote: "v0.34.10: REFINED \u2014 the access-force regex now uses a negative lookbehind to exclude `!` in `!=` and `!==` comparison operators. Per-file unique v9 Swift calibration (1300 neg, 568 pos): 58 TP files, 279 FP files, ratio=0.48 (DORMANT). The previous regex incorrectly fired on `!` in `a != b` and `a !== b` patterns, which are common in control flow. The refinement is expected to push precision from 17.2% to 25%+ by removing these false positives. Era-confounded: pre-2022 Swift used `!` freely (the only way to unwrap); modern Swift uses `guard let` / `if let` / `try?`. Same direction as kotlin/force-unwrap (0.35) and kotlin/runblocking-misuse (0.50). INSUFFICIENT_DATA: pos arm 568 files (below 10k floor).",
         aiSpecific: true,
         _v7Verdict: "DORMANT",
         _v7Lift: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slopbrick",
-  "version": "0.34.8",
+  "version": "0.34.10",
   "description": "Discovered, modeled, and governed repository structure. SlopBrick scans source code, classifies it against 95+ rules in 15 categories, computes 4 scores (aiSlopScore: lower=cleaner, engineeringHygiene, security, repositoryHealth composite), and persists the structure for AI agents and CI.",
   "type": "module",
   "bin": {