From 5ef935b253bca0c86f5984328e08dd14639155b4 Mon Sep 17 00:00:00 2001
From: Todd Schiller <todd.schiller@gmail.com>
Date: Sun, 7 Jun 2026 15:36:22 -0400
Subject: [PATCH] Fix: scarcity/countdown synonym evasion (#203)

Addresses audit item #21. Adds precise synonym coverage so a malicious
page can't bypass scarcity- and countdown-redaction with common verbiage
swaps. Each addition is anchored on a number, a fixed retail idiom, or a
definite expiry verb to keep false-positive risk flat.

scarcity-redact:
- "Just N left/remaining/in stock/available" (synonym of "only N")
- "N items/units/pieces left/remaining"
- "While supplies last" / "while stocks last"
- "Selling/going quickly"
- "Flying off the shelves" / "going off shelves"
- "N added to cart/basket/bag/wishlist"

countdown-timer-redact:
- URGENCY_UNIT_PATTERN: "to claim" / "to save" alongside "left/remaining/to go/until"
- New EXPIRY_LEAD_PATTERN: "ends/expires/closes in N <unit>"
  Candidate-only; decrement gate still required, so a static
  "Expires in 30 days" badge is never replaced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../__tests__/countdown-timer-redact.test.ts  | 37 +++++++++++++++++++
 .../rules/__tests__/scarcity-redact.test.ts   | 20 ++++++++++
 extension/src/rules/countdown-timer-redact.ts | 11 +++++-
 extension/src/rules/scarcity-redact.ts        | 15 ++++++--
 4 files changed, 78 insertions(+), 5 deletions(-)

diff --git a/extension/src/rules/__tests__/countdown-timer-redact.test.ts b/extension/src/rules/__tests__/countdown-timer-redact.test.ts
index ee73cc7..1231969 100644
--- a/extension/src/rules/__tests__/countdown-timer-redact.test.ts
+++ b/extension/src/rules/__tests__/countdown-timer-redact.test.ts
@@ -50,6 +50,18 @@ describe("matchesTimerPattern", () => {
     expect(matchesTimerPattern("15 minutes remaining")).toBe(true);
   });
 
+  it("matches urgency suffix synonyms (#203 item 21)", () => {
+    expect(matchesTimerPattern("5 hours to claim")).toBe(true);
+    expect(matchesTimerPattern("45 minutes to save")).toBe(true);
+  });
+
+  it("matches expiry-lead phrasings (#203 item 21)", () => {
+    expect(matchesTimerPattern("Sale ends in 3h")).toBe(true);
+    expect(matchesTimerPattern("Offer expires in 45 minutes")).toBe(true);
+    expect(matchesTimerPattern("Closes in 2d")).toBe(true);
+    expect(matchesTimerPattern("Ends in 30 seconds")).toBe(true);
+  });
+
   it("does not match arbitrary numbers", () => {
     expect(matchesTimerPattern("Item #123456")).toBe(false);
     expect(matchesTimerPattern("Save 30%")).toBe(false);
@@ -125,6 +137,31 @@ describe("countdownTimerRedactRule", () => {
     expect(document.querySelector(`.${PLACEHOLDER_CLASS}`)).not.toBeNull();
   });
 
+  it("hides an expiry-lead countdown that decreased (#203 item 21)", () => {
+    document.body.innerHTML = `<div id="t">Sale ends in 2h 15m</div>`;
+    countdownTimerRedactRule.apply(document.body);
+
+    const timer = document.querySelector("#t");
+    if (timer) {
+      timer.textContent = "Sale ends in 2h 14m";
+    }
+
+    jest.advanceTimersByTime(SNAPSHOT_DELAY_MS);
+
+    expect(document.querySelector("#t")).toBeNull();
+    expect(document.querySelector(`.${PLACEHOLDER_CLASS}`)).not.toBeNull();
+  });
+
+  it("leaves a static expiry-lead badge alone (decrement gate)", () => {
+    document.body.innerHTML = `<div id="t">Expires in 30 days</div>`;
+    countdownTimerRedactRule.apply(document.body);
+
+    jest.advanceTimersByTime(SNAPSHOT_DELAY_MS);
+
+    expect(document.querySelector("#t")).not.toBeNull();
+    expect(document.querySelector(`.${PLACEHOLDER_CLASS}`)).toBeNull();
+  });
+
   it("leaves static clock-shaped text alone", () => {
     document.body.innerHTML = `<span>Posted at 12:34</span>`;
     countdownTimerRedactRule.apply(document.body);
diff --git a/extension/src/rules/__tests__/scarcity-redact.test.ts b/extension/src/rules/__tests__/scarcity-redact.test.ts
index efd7f55..2bcb365 100644
--- a/extension/src/rules/__tests__/scarcity-redact.test.ts
+++ b/extension/src/rules/__tests__/scarcity-redact.test.ts
@@ -46,6 +46,21 @@ describe("matchesScarcityPattern", () => {
     "8 purchased in the past day",
     "5 have it in their cart",
     "3 in carts",
+    // Synonym evasion bypasses (#203 item 21).
+    "Just 3 left",
+    "Just 2 in stock",
+    "3 items left",
+    "5 units remaining",
+    "2 pieces left",
+    "While supplies last",
+    "While stocks last",
+    "Selling quickly",
+    "Going quickly",
+    "Flying off the shelves",
+    "Going off shelves",
+    "12 added to cart in the last hour",
+    "8 shoppers added this to their bag",
+    "5 others added to wishlist",
   ])("matches urgency phrasing: %s", (text) => {
     expect(matchesScarcityPattern(text)).toBe(true);
   });
@@ -67,6 +82,11 @@ describe("matchesScarcityPattern", () => {
     "Ships in 2 days",
     "Save 30%",
     "Free shipping",
+    // "Just" alone is not an urgency signal.
+    "Just released",
+    "Just for you",
+    // Bare "added to cart" without a count is a UI confirmation, not scarcity.
+    "Added to cart",
   ])("leaves non-urgency text alone: %s", (text) => {
     expect(matchesScarcityPattern(text)).toBe(false);
   });
diff --git a/extension/src/rules/countdown-timer-redact.ts b/extension/src/rules/countdown-timer-redact.ts
index d733ece..a77fcfd 100644
--- a/extension/src/rules/countdown-timer-redact.ts
+++ b/extension/src/rules/countdown-timer-redact.ts
@@ -36,13 +36,20 @@ const COLON_PATTERN = /(?<!\d)\d{1,3}:[0-5]\d(?::[0-5]\d)?(?!\d)/;
 const MULTI_UNIT_PATTERN =
   /\b\d+\s*(?:d(?:ays?)?|h(?:ours?|rs?)?|m(?:in(?:utes?)?)?|s(?:ec(?:onds?)?)?)\b[\s,:]*\b\d+\s*(?:d(?:ays?)?|h(?:ours?|rs?)?|m(?:in(?:utes?)?)?|s(?:ec(?:onds?)?)?)\b/i;
 const URGENCY_UNIT_PATTERN =
-  /\b\d+\s*(?:hours?|hrs?|minutes?|mins?|seconds?|secs?)\s+(?:left|remaining|to\s+go|until)\b/i;
+  /\b\d+\s*(?:hours?|hrs?|minutes?|mins?|seconds?|secs?)\s+(?:left|remaining|to\s+go|to\s+claim|to\s+save|until)\b/i;
+// "Sale ends in 3h", "Offer expires in 45 minutes", "Closes in 2d" — common
+// countdown lead-ins where the urgency word precedes the value. Candidate
+// only; redaction still requires the decrement check in reconcileCandidates,
+// so a static "Expires in 30 days" badge is never replaced.
+const EXPIRY_LEAD_PATTERN =
+  /\b(?:ends?|expires?|closes?)\s+in\s+\d+\s*(?:d(?:ays?)?|h(?:ours?|rs?)?|m(?:in(?:utes?)?)?|s(?:ec(?:onds?)?)?)\b/i;
 
 export function matchesTimerPattern(text: string): boolean {
   return (
     COLON_PATTERN.test(text) ||
     MULTI_UNIT_PATTERN.test(text) ||
-    URGENCY_UNIT_PATTERN.test(text)
+    URGENCY_UNIT_PATTERN.test(text) ||
+    EXPIRY_LEAD_PATTERN.test(text)
   );
 }
 
diff --git a/extension/src/rules/scarcity-redact.ts b/extension/src/rules/scarcity-redact.ts
index 69a1928..90c0a6a 100644
--- a/extension/src/rules/scarcity-redact.ts
+++ b/extension/src/rules/scarcity-redact.ts
@@ -28,24 +28,33 @@ const MAX_CANDIDATE_LENGTH = 80;
 const MAX_CANDIDATE_DESCENDANTS = 20;
 
 const SCARCITY_PATTERNS: RegExp[] = [
-  /\bonly\s+\d+\s+(?:left|remaining|in\s+stock|available)\b/i,
+  /\b(?:only|just)\s+\d+\s+(?:left|remaining|in\s+stock|available)\b/i,
   /\b\d+\s+(?:left|remaining)\s+in\s+stock\b/i,
+  /\b\d+\s+(?:items?|units?|pieces?)\s+(?:left|remaining)\b/i,
   /\b(?:low|limited)\s+(?:stock|inventory|availability|quantit(?:y|ies)|supply)\b/i,
   /\bstock(?:\s+is)?\s+running\s+low\b/i,
   /\b\d+\s+(?:in\s+stock|available)\b/i,
+  // "While supplies last" / "while stocks last" — fixed phrase, no FP risk.
+  /\bwhile\s+(?:supplies|stocks?)\s+last\b/i,
 ];
 
 const DEMAND_PATTERNS: RegExp[] = [
   /\b(?:almost|nearly)\s+(?:gone|out|sold(?:\s+out)?)\b/i,
-  /\bselling\s+(?:fast|out)\b/i,
-  /\bgoing\s+fast\b/i,
+  /\bselling\s+(?:fast|out|quickly)\b/i,
+  /\bgoing\s+(?:fast|quickly)\b/i,
   /\bhigh\s+demand\b/i,
+  // "Flying off the shelves" / "going off shelves" — retail-only idiom; 80-char
+  // leaf-candidate gate makes prose mentions (e.g. news copy) unreachable.
+  /\b(?:flying|going)\s+off\s+(?:the\s+)?shelves\b/i,
 ];
 
 const ACTIVITY_PATTERNS: RegExp[] = [
   /\b\d+\s+(?:people|users|shoppers|customers|others?)\s+(?:are\s+)?(?:viewing|looking|watching)\b/i,
   /\b\d+\s+(?:sold|bought|purchased)\s+(?:in\s+the\s+)?(?:last|past)\s+\w+/i,
   /\b\d+\s+(?:in|have\s+(?:this\s+|it\s+)?in)\s+(?:their\s+)?carts?\b/i,
+  // "12 added to cart in the last hour" / "8 added to bag" — covers the
+  // verb-swap from "viewing/watching" to "added".
+  /\b\d+\s+(?:people\s+|shoppers\s+|others\s+)?added\s+(?:this\s+)?to\s+(?:their\s+)?(?:carts?|baskets?|bags?|wishlists?)\b/i,
 ];
 
 const ALL_PATTERNS: RegExp[] = [