fix(llm-security): normalization/discovery evasion + SIG embedded-base64 & custom rules (#21,#23,#30,#36,#42,#52,#55)

#21 the bash normalizer decoded only \xHH, leaving ANSI-C octal/\u/\U forms literal so canonical rm/curl never surfaced; now decodes all three. #23 file-discovery keyed on extname so .env.local/.env.example (extname .local/.example) were silently skipped; now matches multi-part suffixes. #42 a legitimate leading UTF-8 BOM was flagged HIGH (and the tool's own auto-cleaner refused to strip it); pos-0 BOM now excepted. #52 collapseLetterSpacing used a literal space, letting multi-space/tab spacing evade; now [ \t]+. #55 redact(_,60,0) did slice(-0) and leaked the whole unredacted URL; showEnd===0 now means no tail.

#30 embedded base64 (const x = "<base64>") never satisfied the whole-string decode, so the SIG identity engine never saw it; added decodeEmbeddedBase64 as an OPT-IN param on normalizeForScan (default off — appending a decoded copy would double-count per-match findings, e.g. content-extractor's injection scan) and enabled it only in signature-scanner, which dedups variants. #36 signature-scanner ignored the documented sig.custom_rules_path policy option; now loads+merges custom rules through the same family filter. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

scanners/lib/string-utils.mjs

@@ -150,7 +150,10 @@ export function isHexBlob(s) {
  */
 export function redact(s, showStart = 8, showEnd = 4) {
   if (s.length <= showStart + showEnd + 3) return s;
-  return `${s.slice(0, showStart)}...${s.slice(-showEnd)}`;
+  // showEnd === 0 means "no tail" — slice(-0) would return the WHOLE string
+  // and leak the unredacted input (#55, v7.8.3).
+  const tail = showEnd ? s.slice(-showEnd) : '';
+  return `${s.slice(0, showStart)}...${tail}`;
 }
 
 /**
@@ -238,6 +241,45 @@ export function tryDecodeBase64(s) {
   }
 }
 
+/** Embedded base64 caps (#30, v7.8.3) — bound work on hostile inputs. */
+const EMBEDDED_B64_MAX_BLOBS = 20;
+const EMBEDDED_B64_MAX_TOTAL = 256 * 1024;
+
+/**
+ * Locate base64 runs EMBEDDED in surrounding text and decode them.
+ *
+ * `isBase64Like` (and therefore `tryDecodeBase64`) requires the ENTIRE
+ * trimmed string to be base64, so a payload embedded in code — the common
+ * `const x = "<base64>"` webshell shape — was never fed to the decode
+ * pipeline (#30, v7.8.3).
+ *
+ * Runs must be >= 24 chars of the base64 charset (stricter than the
+ * whole-string 20-char threshold, to bound false positives on ordinary
+ * identifiers). Each candidate goes through `tryDecodeBase64`, so only
+ * blobs decoding to mostly-printable text are returned. Bounded to the
+ * first 20 blobs / 256KB decoded total.
+ *
+ * Exported for direct regression testing.
+ *
+ * @param {string} s
+ * @returns {string[]}  Decoded texts (possibly empty)
+ */
+export function decodeEmbeddedBase64(s) {
+  const decoded = [];
+  let total = 0;
+  const re = /[A-Za-z0-9+/]{24,}={0,3}/g;
+  let match;
+  while ((match = re.exec(s)) !== null) {
+    if (decoded.length >= EMBEDDED_B64_MAX_BLOBS || total >= EMBEDDED_B64_MAX_TOTAL) break;
+    const text = tryDecodeBase64(match[0]);
+    if (text) {
+      decoded.push(text);
+      total += text.length;
+    }
+  }
+  return decoded;
+}
+
 /**
  * Decode HTML entities: named (&lt; &gt; &amp; &quot; &apos;),
  * decimal (&#105;), and hex (&#x69;).
@@ -277,9 +319,11 @@ export function decodeHtmlEntities(s) {
  * @returns {string}
  */
 export function collapseLetterSpacing(s) {
-  // Match 4+ single-letter tokens separated by 1+ spaces/tabs
-  return s.replace(/\b([a-zA-Z]) (?:[a-zA-Z] ){2,}[a-zA-Z]\b/g, (match) =>
-    match.replace(/ /g, '')
+  // Match 4+ single-letter tokens separated by 1+ spaces/tabs.
+  // Separators are [ \t]+ — a literal single space let multi-space and tab
+  // separators evade despite the docstring (#52, v7.8.3).
+  return s.replace(/\b([a-zA-Z])[ \t]+(?:[a-zA-Z][ \t]+){2,}[a-zA-Z]\b/g, (match) =>
+    match.replace(/[ \t]+/g, '')
   );
 }
 
@@ -505,11 +549,12 @@ export function foldHomoglyphs(s) {
  * Runs up to 3 iterations to catch multi-layered encoding (e.g., base64 of URL-encoded).
  * Order per iteration: Unicode Tags -> BIDI strip -> HTML entities -> unicode escapes ->
  *   hex escapes -> URL encoding -> base64.
- * After decoding: collapse letter-spaced text.
+ * After decoding: append decoded embedded base64 blobs (#30, v7.8.3),
+ * then collapse letter-spaced text.
  * @param {string} s
  * @returns {string}
  */
-export function normalizeForScan(s) {
+export function normalizeForScan(s, { decodeEmbedded = false } = {}) {
   let result = s;
   const MAX_ITERATIONS = 3;
 
@@ -529,6 +574,24 @@ export function normalizeForScan(s) {
     if (result === prev) break;
   }
 
+  // Embedded base64 (#30, v7.8.3): a payload inside surrounding code
+  // (const x = "<base64>") never satisfies the whole-string isBase64Like
+  // check in the loop above. Locate embedded base64 runs and APPEND their
+  // decoded text so downstream matchers see the payload — originals are
+  // preserved so line/offset attribution still works.
+  //
+  // Opt-in (decodeEmbedded) because appending a decoded copy double-counts
+  // for callers that report per-match findings over the same corpus (e.g.
+  // content-extractor's injection scan would emit two findings for content
+  // present in both plain and base64 form). Only the SIG identity engine,
+  // which dedups its variants, requests it.
+  if (decodeEmbedded) {
+    const embedded = decodeEmbeddedBase64(result);
+    if (embedded.length > 0) {
+      result = `${result}\n${embedded.join('\n')}`;
+    }
+  }
+
   // Post-decode: collapse letter-spaced evasion
   result = collapseLetterSpacing(result);