fix: further reduce AS-006 false positives (round 2)

Apply safe prefix/substring gating to the regex phase (step 3), not
only the suffix phase. Add code_mode and policy_evaluate to safe
substrings. Remove bare "execute" from descriptionConfirmsExecution
to avoid false triggers on "execute scans" or "execute analysis".

Fixes: speclock_policy_evaluate, brave_web_search_code_mode,
code_mode_transform, analyze_code_security with non-execution descriptions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: brian93512

CHANGELOG.md

@@ -5,6 +5,21 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ---
 
+## [0.3.7] - 2026-04-07
+
+### Fixed
+- **AS-006 false positives (round 2)**: fixed remaining FPs on
+  `speclock_policy_evaluate`, `brave_web_search_code_mode`,
+  `code_mode_transform`, and `analyze_code_security` when description
+  contains non-execution "execute".
+  - Added `code_mode` and `policy_evaluate` to safe-name substrings.
+  - Safe prefix/substring checks now gate the regex phase (step 3), not
+    only the suffix phase (step 2).
+  - Removed bare `"execute"` from `descriptionConfirmsExecution` — kept
+    specific variants (`execute code`, `execute script`, `execute javascript`).
+
+---
+
 ## [0.3.6] - 2026-04-04
 
 ### Fixed

VERSION

@@ -1 +1 @@
-0.3.6
+0.3.7

pkg/analyzer/arbitrary_code.go

@@ -98,7 +98,9 @@ var arbitraryCodeSafeNameSubstrings = []string{
 	"code_review",
 	"code_snippet",
 	"code_completion",
+	"code_mode",
 	"component_snippet",
+	"policy_evaluate",
 }
 
 // ArbitraryCodeChecker detects tools that can execute arbitrary script or
@@ -121,8 +123,9 @@ func NewArbitraryCodeChecker() *ArbitraryCodeChecker { return &ArbitraryCodeChec
 // contains strong signals of actual code/script execution (not just analysis).
 func descriptionConfirmsExecution(desc string) bool {
 	executionSignals := []string{
-		"execute", "eval(", "eval (", "run script",
+		"eval(", "eval (", "run script",
 		"run code", "execute code", "execute script",
+		"execute javascript", "execute js",
 		"arbitrary code", "arbitrary script",
 		"javascript", "browser context",
 		"page.evaluate", "frame.evaluate",
@@ -213,15 +216,38 @@ func (c *ArbitraryCodeChecker) Check(tool model.UnifiedTool) ([]model.Issue, err
 	}
 
 	// 3. Regex patterns for natural language variants in description or name.
+	// Apply the same safe-prefix / safe-substring gating as step 2 so that
+	// tools like analyze_code_security or brave_web_search_code_mode are not
+	// falsely flagged when the description happens to contain "execute" in a
+	// non-code-execution context.
 	combined := nameLower + " " + descLower
 	for _, re := range arbitraryCodePatterns {
-		if re.MatchString(combined) {
-			matched := re.FindString(combined)
-			return emitArbitraryCodeFinding(tool.Name, []model.Evidence{
-				{Kind: "pattern", Value: re.String()},
-				{Kind: "match", Value: matched},
-			}), nil
+		if !re.MatchString(combined) {
+			continue
+		}
+		isSafe := false
+		for _, prefix := range arbitraryCodeSafeNamePrefixes {
+			if strings.HasPrefix(nameLower, prefix) {
+				isSafe = true
+				break
+			}
+		}
+		if !isSafe {
+			for _, safe := range arbitraryCodeSafeNameSubstrings {
+				if strings.Contains(nameLower, safe) {
+					isSafe = true
+					break
+				}
+			}
+		}
+		if isSafe && !descriptionConfirmsExecution(descLower) {
+			continue
 		}
+		matched := re.FindString(combined)
+		return emitArbitraryCodeFinding(tool.Name, []model.Evidence{
+			{Kind: "pattern", Value: re.String()},
+			{Kind: "match", Value: matched},
+		}), nil
 	}
 
 	return nil, nil

pkg/analyzer/arbitrary_code_test.go

@@ -401,3 +401,58 @@ func TestArbitraryCodeChecker_GetComponentSnippet_NoFalsePositive(t *testing.T)
 	assert.False(t, report.HasFinding("AS-006"),
 		"get_component_snippet must NOT trigger AS-006")
 }
+
+func TestArbitraryCodeChecker_SpecLockPolicyEvaluate_NoFalsePositive(t *testing.T) {
+	tool := model.UnifiedTool{
+		Name:        "speclock_policy_evaluate",
+		Description: "Evaluate a speclock policy against the current project state.",
+	}
+	eng, _ := NewEngine(false, "")
+	report := eng.Scan(tool)
+	assert.False(t, report.HasFinding("AS-006"),
+		"speclock_policy_evaluate must NOT trigger AS-006 — policy evaluation, not code execution")
+}
+
+func TestArbitraryCodeChecker_CodeMode_NoFalsePositive(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		desc string
+	}{
+		{"brave_web_search_code_mode", "Search the web using Brave with code-optimized results."},
+		{"brave_local_search_code_mode", "Search local results using Brave in code mode."},
+		{"code_mode_transform", "Transform search results into code-friendly format."},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			tool := model.UnifiedTool{Name: tc.name, Description: tc.desc}
+			eng, _ := NewEngine(false, "")
+			report := eng.Scan(tool)
+			assert.False(t, report.HasFinding("AS-006"),
+				"%s must NOT trigger AS-006 — code_mode is a search mode, not execution", tc.name)
+		})
+	}
+}
+
+func TestArbitraryCodeChecker_SafePrefixGatesRegex(t *testing.T) {
+	// analyze_code_security with a description containing "execute" should NOT
+	// trigger AS-006 because the safe prefix analyze_code gates the regex phase.
+	tool := model.UnifiedTool{
+		Name:        "analyze_code_security",
+		Description: "Analyze repository code and execute static analysis scans for vulnerabilities.",
+	}
+	eng, _ := NewEngine(false, "")
+	report := eng.Scan(tool)
+	assert.False(t, report.HasFinding("AS-006"),
+		"analyze_code_security must NOT trigger AS-006 even when description says 'execute'")
+}
+
+func TestArbitraryCodeChecker_SafePrefixOverriddenByRealExecution(t *testing.T) {
+	// If description genuinely confirms code execution, safe prefix should NOT suppress.
+	tool := model.UnifiedTool{
+		Name:        "analyze_code_eval",
+		Description: "Analyze code by running eval() on JavaScript expressions.",
+	}
+	eng, _ := NewEngine(false, "")
+	report := eng.Scan(tool)
+	assert.True(t, report.HasFinding("AS-006"),
+		"analyze_code with eval() in description must still trigger AS-006")
+}