fix(analyzer): bound static pattern regex searches

docs/ANALYSIS_RESOURCE_BOUNDS.md

@@ -274,6 +274,7 @@ removes the rejected partial checkout.
 | Static findings | 10,000 | One artifact |
 | Static findings | 10,000 | One analyzer |
 | Static-analysis time | 300 seconds | One artifact, within the workflow deadline |
+| Timed static-pattern matching CPU | 0.25 seconds | One rule per content window, shared across paragraphs, within the artifact and workflow deadlines |
 | YARA rule-directory entries | 10,000 | Built-in and optional directories combined |
 | YARA rule files | 1,024 | One rule load |
 | YARA rule source bytes | 1 MiB | One rule file |
@@ -352,6 +353,47 @@ default. Set `SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT` to a positi
 finite number of seconds to change that allowance. Invalid, zero, negative,
 infinite, or NaN values log a warning and retain the 300-second default.
 
+The shared matcher has a fixed 0.25-second matching CPU limit per rule and content window.
+Paragraph-matched rules share this allowance across all their paragraphs.
+Ranges of eight characters or fewer use batched native searches. Longer ranges
+retain the interruptible engine; timer setup can make paragraph-dense windows
+roughly two to three times slower than untimed matching. This keeps their
+backtracking bounded rather than extending the native exception to larger inputs.
+Raising the artifact allowance does not raise this limit. It covers routed rules
+in prompt injection, tool misuse, data exfiltration, supply chain, agent snooping,
+excessive agency, memory poisoning, and rogue agents. Through paragraph matching,
+it also covers prose rules in harmful content, system prompt leakage, output
+handling, anti-refusal, privilege escalation, and SSRF. Output-handling and
+privilege-escalation code patterns also use the timed matcher. Other code rules (SSRF endpoint/request patterns,
+harmful-content substance names, and deserialization DS1–DS4) and helper-specific
+searches remain outside it. The anti-refusal schema-field helper uses a linear
+whitespace prefix so its benign-context check cannot backtrack quadratically.
+
+Audited command/option patterns use a linear, command-segment search that preserves
+unbounded command spans and the original greedy matches. The SC3 shell-decoder
+rules keep their native matcher: their literals, stages and options already have
+explicit length/count bounds and atomic or possessive ambiguous groups. Memory poisoning's
+2–20-character repetition rule uses Python's native engine: failed candidates
+examine at most 20 copies, and successful candidates consume the repeated run.
+The variable shell-flag rule also retains Python’s native backreference semantics.
+It checks assignment headers separately, considers every eligible call in the
+four-line assignment gap, and stops its native search 4,096 characters after
+the last eligible call head. This is a conservative bound: an unterminated tail
+reports `static_parse_limit` even if no later `shell=` exists. In-window matches
+are retained. Both variable-name passes share one accumulated matching allowance,
+and each analyzer window computes them once. Whole-artifact reconciliation gets
+0.25 seconds per 256,000 characters. A variable-shell limit is reported after the
+other lexical tool-misuse rules run, so it cannot hide their findings.
+The repetition rule is bounded by the 256,000-character inspection window and the
+artifact deadline, rather than the slower engine's per-search timer.
+
+Matching CPU accounting excludes caller work and other threads. The interruptible
+engine itself measures process CPU, however, so native work in competing threads
+can interrupt a search early. Retrying discards progress and can still exhaust the
+matching allowance under sustained contention. If a search expires, its ledger
+event keeps the observed time and limit, and that analyzer records partial coverage
+for the artifact while retaining findings already produced.
+
 ## Configuring the dependency-source deadline
 
 Dependency-source redirection analysis allows up to 5 seconds by default. Set

src/skillspector/nodes/analyzers/static_patterns_agent_snooping.py

@@ -154,7 +154,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in AS1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -176,7 +176,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in AS2_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -196,7 +196,9 @@ def ctx(start: int) -> str:
 
     for pattern, confidence in AS3_PATTERNS:
         is_prose = (pattern, confidence) in AS3_PROSE_PATTERNS
-        matches = static_runner.iter_paragraph_matches if is_prose else re.finditer
+        matches = (
+            static_runner.iter_paragraph_matches if is_prose else static_runner.iter_pattern_matches
+        )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             if is_prose and is_directly_prohibited(content, match.start(), match.end()):
                 continue

src/skillspector/nodes/analyzers/static_patterns_anti_refusal.py

@@ -40,7 +40,7 @@
 from skillspector.state import AnalyzerNodeResponse, SkillspectorState
 
 from . import static_runner
-from .common import SourceLocationIndex, get_context, get_line_number, is_code_example
+from .common import SourceLocationIndex, get_context_from_lines, is_code_example
 from .pattern_defaults import PatternCategory
 
 logger = get_logger(__name__)
@@ -188,14 +188,14 @@
 )
 _BENIGN_AR_SCHEMA_FIELD_PATTERN = re.compile(
     r"""
-    ^\s*(?:\[\])?\s+(?:field|key|property|array|list|entry)\b
+    ^(?:\s*\[\])?\s+(?:field|key|property|array|list|entry)\b
     |
-    ^\s*(?:\[\])?\s+(?:in|of)\s+(?:the\s+)?(?:json(?:\s+output)?|output|response)\s+schema\b
+    ^(?:\s*\[\])?\s+(?:in|of)\s+(?:the\s+)?(?:json(?:\s+output)?|output|response)\s+schema\b
     |
-    ^\s*(?:\[\])?\s+(?:in|of)\s+(?:the\s+)?(?:warnings?|disclaimers?|caveats?)\b(?:\[\])?\s+
+    ^(?:\s*\[\])?\s+(?:in|of)\s+(?:the\s+)?(?:warnings?|disclaimers?|caveats?)\b(?:\[\])?\s+
     (?:field|key|property|array|list|entry)\b
     |
-    ^\s*(?:\[\])?\s+in\s+(?:the\s+)?errors\[\]\s+array\b
+    ^(?:\s*\[\])?\s+in\s+(?:the\s+)?errors\[\]\s+array\b
     """,
     re.IGNORECASE | re.VERBOSE,
 )
@@ -566,6 +566,7 @@ def analyze(
     """Analyze content for anti-refusal statements (AR1-AR3)."""
     findings: list[AnalyzerFinding] = []
     locations = SourceLocationIndex(content, file_path)
+    lines = content.splitlines()
     tag = [PatternCategory.ANTI_REFUSAL.value]
     python_comments = (
         _PythonComments(content, check_runtime or _no_runtime_check)
@@ -584,11 +585,10 @@ def analyze(
                     and _is_descriptive_python_comment(python_comments, match)
                 ):
                     continue
-                lines = content.splitlines()
-                line_num = get_line_number(content, match.start())
+                line_num, column = locations.line_and_column(match.start())
                 match_line = lines[line_num - 1] if lines else content
                 previous_line = lines[line_num - 2] if line_num > 1 else None
-                context = get_context(content, match.start(), context_lines=3)
+                context = get_context_from_lines(lines, line_num, window=3, column=column)
                 security_review_context = bool(
                     _MODE_ENABLED_RE.fullmatch(match.group(0))
                     and _SECURITY_REVIEW_CONTEXT_RE.search(context)

src/skillspector/nodes/analyzers/static_patterns_data_exfiltration.py

@@ -302,7 +302,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in E1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -337,7 +337,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in E2_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -358,7 +358,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in E3_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -395,7 +395,9 @@ def ctx(start: int) -> str:
             )
     # E5: cloud-storage exfiltration. Example filtering is delegated to the runner.
     for pattern, confidence in E5_PATTERNS:
-        for match in re.finditer(pattern, content, re.IGNORECASE | re.MULTILINE):
+        for match in static_runner.iter_pattern_matches(
+            pattern, content, re.IGNORECASE | re.MULTILINE
+        ):
             line_num = get_line_number(content, match.start())
             findings.append(
                 AnalyzerFinding(

src/skillspector/nodes/analyzers/static_patterns_excessive_agency.py

@@ -424,7 +424,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in EA1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())
@@ -445,7 +445,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in EA2_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             if (pattern, confidence) in EA2_PROSE_PATTERNS and (
@@ -495,7 +495,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in EA4_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())

src/skillspector/nodes/analyzers/static_patterns_memory_poisoning.py

@@ -80,8 +80,9 @@
 ]
 
 # MP2: Context Window Stuffing — filling context to displace content
+_BOUNDED_REPETITION_PATTERN = r"(.{2,20}?)\1{20,}"
 MP2_CONTENT_PATTERNS = [
-    (r"(.{2,20}?)\1{20,}", 0.8),
+    (_BOUNDED_REPETITION_PATTERN, 0.8),
 ]
 MP2_PROSE_PATTERNS = [
     (
@@ -541,10 +542,16 @@ def ctx(start: int) -> str:
                 )
             )
     for pattern, confidence in MP2_PATTERNS:
+        # For each start there are only 19 candidate lengths. A failed candidate
+        # checks at most 20 copies; a success consumes its entire repeated run.
+        # There is no trailing condition to force it to backtrack over that run.
+        # Keep this linear, window-bounded rule on Python's faster native engine.
         matches = (
-            static_runner.iter_paragraph_matches
+            re.finditer
+            if pattern == _BOUNDED_REPETITION_PATTERN
+            else static_runner.iter_paragraph_matches
             if (pattern, confidence) in MP2_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             span = match.group(0)

src/skillspector/nodes/analyzers/static_patterns_output_handling.py

@@ -634,7 +634,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in OH1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             if pattern == _EXEC_OUTPUT_PATTERN and _is_javascript_regexp_literal_exec(
@@ -690,7 +690,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in OH3_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = get_line_number(content, match.start())

src/skillspector/nodes/analyzers/static_patterns_privilege_escalation.py

@@ -107,7 +107,7 @@
     # unmatched `-- ` tokens that made the match exponential.  `[\w=-]*` already
     # absorbs the second dash of a long option, so `-` alone covers both.
     (
-        r"chmod\s+(?:-[\w=-]*[ \t]+)*[\"']?[+=]?0*[2-7][0-7]{3}[\"']?(?![0-9\w])",
+        r"chmod\s+(?>(?:-[\w=-]*[ \t]+)*)[\"']?[+=]?0*[2-7][0-7]{3}[\"']?(?![0-9\w])",
         0.8,
     ),
 ]
@@ -1046,7 +1046,7 @@ def context_at(offset: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in PE1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = line_number(match.start())
@@ -1068,7 +1068,7 @@ def context_at(offset: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in PE2_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = line_number(match.start())
@@ -1093,7 +1093,7 @@ def context_at(offset: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in PE3_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             if _is_bare_credential_store_noun(
@@ -1212,7 +1212,9 @@ def context_at(offset: int) -> str:
     # that match multiple patterns (e.g. DockerClient(base_url=".../docker.sock")).
     pe4_best: dict[int, AnalyzerFinding] = {}
     for pattern, confidence in PE4_PATTERNS:
-        for match in re.finditer(pattern, content, re.IGNORECASE | re.MULTILINE):
+        for match in static_runner.iter_pattern_matches(
+            pattern, content, re.IGNORECASE | re.MULTILINE
+        ):
             line_num = line_number(match.start())
             context = context_at(match.start())
             finding_tags = list(tag)
@@ -1236,7 +1238,9 @@ def context_at(offset: int) -> str:
     # often matches multiple flags (e.g. --privileged + --cap-add=SYS_ADMIN).
     pe5_best: dict[int, AnalyzerFinding] = {}
     for pattern, confidence in PE5_PATTERNS:
-        for match in re.finditer(pattern, content, re.IGNORECASE | re.MULTILINE):
+        for match in static_runner.iter_pattern_matches(
+            pattern, content, re.IGNORECASE | re.MULTILINE
+        ):
             line_num = line_number(match.start())
             context = context_at(match.start())
             finding_tags = list(tag)

src/skillspector/nodes/analyzers/static_patterns_prompt_injection.py

@@ -261,7 +261,7 @@ def _p2_pattern_matches(
         check_runtime()
     compiled = re.compile(pattern, re.IGNORECASE | re.DOTALL)
     if pattern not in _SINGLE_CHARACTER_P2_PATTERNS:
-        for match in compiled.finditer(content):
+        for match in static_runner.iter_pattern_matches(compiled, content):
             if check_runtime is not None:
                 check_runtime()
             yield match

src/skillspector/nodes/analyzers/static_patterns_rogue_agent.py

@@ -273,7 +273,7 @@ def ctx(start: int) -> str:
         matches = (
             static_runner.iter_paragraph_matches
             if (pattern, confidence) in RA1_PROSE_PATTERNS
-            else re.finditer
+            else static_runner.iter_pattern_matches
         )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             line_num = bisect_right(line_starts, match.start())
@@ -323,7 +323,9 @@ def ctx(start: int) -> str:
             )
     for pattern, confidence in RA2_PATTERNS:
         is_prose = (pattern, confidence) in RA2_PROSE_PATTERNS
-        matches = static_runner.iter_paragraph_matches if is_prose else re.finditer
+        matches = (
+            static_runner.iter_paragraph_matches if is_prose else static_runner.iter_pattern_matches
+        )
         for match in matches(pattern, content, re.IGNORECASE | re.MULTILINE):
             if is_prose and is_directly_prohibited(content, match.start(), match.end()):
                 continue