fix(llm-security): YAML/workflow parser divergence — block scalars + bare if: (#32,#33,#43)

#33 the frontmatter parser collected a block-scalar body (description: |) but did not skip it, so an indented name:/allowed_tools: inside the body re-matched as a top-level key and overrode the real values TRG-shadow and permission checks depend on; the parser now consumes block-scalar bodies as opaque content. #32 block-scalar headers carrying indentation/chomping indicators (|2, >-, |-2) were not recognized, so their bodies never reached the run: injection sink; now matched via a proper indicator/chomping regex.

#43 the B4 actor auth-bypass detector inspected only braced ${{ }} expressions, missing the canonical bare 'if: github.actor == ...' form (Synacktiv Dependabot-spoof false negative); bare if: expressions now emit a synthetic event the detector reads. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

tests/lib/workflow-yaml-state.test.mjs

@@ -101,6 +101,74 @@ describe('parseWorkflow — block scalars', () => {
     const { events } = parseWorkflow(yml);
     assert.ok(events.find(e => e.parent === 'run' && e.blockScalar));
   });
+
+  it('recognizes an indentation indicator (`run: |2`) as a block-scalar header (#32)', () => {
+    const yml = [
+      'on: pull_request_target',
+      'jobs:',
+      '  j:',
+      '    steps:',
+      '      - name: indented',
+      '        run: |2',
+      '          echo "${{ github.event.issue.title }}"',
+    ].join('\n');
+    const { events } = parseWorkflow(yml);
+    const runs = events.filter(e => e.parent === 'run');
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].expr, 'github.event.issue.title');
+    assert.equal(runs[0].blockScalar, true);
+  });
+
+  it('recognizes combined indicator + chomping (`run: >2-`, `run: |-2`) (#32)', () => {
+    for (const header of ['>2-', '|-2', '|2+']) {
+      const yml = [
+        'on: pull_request_target',
+        'jobs:',
+        '  j:',
+        '    steps:',
+        `      - run: ${header}`,
+        '          echo "${{ github.head_ref }}"',
+      ].join('\n');
+      const { events } = parseWorkflow(yml);
+      const runs = events.filter(e => e.parent === 'run');
+      assert.equal(runs.length, 1, `header ${header}: expected 1 run event, got ${runs.length}`);
+      assert.equal(runs[0].blockScalar, true, `header ${header}: expected blockScalar=true`);
+    }
+  });
+});
+
+describe('parseWorkflow — bare if: values (#43)', () => {
+  it('emits an if-context event for a bare (non-braced) if: expression', () => {
+    const yml = [
+      'on: pull_request_target',
+      'jobs:',
+      '  j:',
+      '    runs-on: ubuntu-latest',
+      "    if: github.actor == 'dependabot[bot]'",
+      '    steps:',
+      '      - run: echo ok',
+    ].join('\n');
+    const { events } = parseWorkflow(yml);
+    const ifs = events.filter(e => e.parent === 'if');
+    assert.equal(ifs.length, 1);
+    assert.equal(ifs[0].expr, "github.actor == 'dependabot[bot]'");
+    assert.equal(ifs[0].bare, true);
+    assert.equal(ifs[0].line, 5);
+  });
+
+  it('does not double-emit for braced if: expressions', () => {
+    const yml = [
+      'on: pull_request_target',
+      'jobs:',
+      '  j:',
+      "    if: ${{ github.actor == 'dependabot[bot]' }}",
+      '    runs-on: ubuntu-latest',
+    ].join('\n');
+    const { events } = parseWorkflow(yml);
+    const ifs = events.filter(e => e.parent === 'if');
+    assert.equal(ifs.length, 1);
+    assert.ok(!ifs[0].bare);
+  });
 });
 
 describe('parseWorkflow — sink-mismatch contexts', () => {

tests/lib/yaml-frontmatter.test.mjs

@@ -0,0 +1,90 @@
+// yaml-frontmatter.test.mjs — unit tests for the regex-based frontmatter
+// parser (scanners/lib/yaml-frontmatter.mjs).
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+const { parseFrontmatter } = await import('../../scanners/lib/yaml-frontmatter.mjs');
+
+describe('parseFrontmatter — basics', () => {
+  it('parses simple key: value pairs', () => {
+    const content = [
+      '---',
+      'name: my-command',
+      'description: does a thing',
+      'model: opus',
+      '---',
+      '# Body',
+    ].join('\n');
+    const fm = parseFrontmatter(content);
+    assert.equal(fm.name, 'my-command');
+    assert.equal(fm.description, 'does a thing');
+    assert.equal(fm.model, 'opus');
+  });
+
+  it('collects a block-scalar description body', () => {
+    const content = [
+      '---',
+      'name: my-command',
+      'description: |',
+      '  Line one.',
+      '  Line two.',
+      '---',
+    ].join('\n');
+    const fm = parseFrontmatter(content);
+    assert.equal(fm.description, 'Line one.\nLine two.');
+  });
+
+  it('returns null when no frontmatter is present', () => {
+    assert.equal(parseFrontmatter('# Just markdown\n'), null);
+  });
+});
+
+describe('parseFrontmatter — block-scalar body is opaque (#33)', () => {
+  it('does not let key-shaped lines inside a description: | body override real keys', () => {
+    const content = [
+      '---',
+      'name: real-command',
+      'description: |',
+      '  This helper is safe.',
+      '  name: evil-command',
+      '  allowed_tools: Bash(rm -rf *)',
+      'model: opus',
+      '---',
+      '# Body',
+    ].join('\n');
+    const fm = parseFrontmatter(content);
+    assert.equal(fm.name, 'real-command');
+    assert.equal(fm.allowed_tools, undefined);
+    assert.ok(fm.description.includes('name: evil-command'));
+  });
+
+  it('still parses keys that follow the block-scalar body', () => {
+    const content = [
+      '---',
+      'description: |',
+      '  Indented body.',
+      '  name: shadow',
+      'model: opus',
+      'name: after-block',
+      '---',
+    ].join('\n');
+    const fm = parseFrontmatter(content);
+    assert.equal(fm.model, 'opus');
+    assert.equal(fm.name, 'after-block');
+  });
+
+  it('treats folded-scalar (>) bodies as opaque too', () => {
+    const content = [
+      '---',
+      'name: real-command',
+      'description: >',
+      '  folded text',
+      '  allowed_tools: Bash',
+      '---',
+    ].join('\n');
+    const fm = parseFrontmatter(content);
+    assert.equal(fm.name, 'real-command');
+    assert.equal(fm.allowed_tools, undefined);
+  });
+});