@lmzhen/dsh-evolution-threat 0.3.61 → 0.3.63

package/README.md

@@ -27,6 +27,15 @@ Independent of request-prefix construction. This package does not alter the asse
   default. The whole text is always scanned in overlapping windows; this value
   is not a total cap.
 
+- `threatExemptLabels` (default `[]`): pattern labels the deployment knows to
+  be benign. P2-4 (v14) closed the store-vs-guard asymmetry for the STORE
+  gates (`SkillLibrary`/`MemoryStore` options) — but the exemption surface is
+  per config site: this guard row, the tool-skill-manage row, the
+  evolution-commands row (its own SkillLibrary for the command write paths),
+  and the memory store options each carry their OWN list and must be set
+  separately. A label exempted only on the store side still blocks here.
+  (v17 audit: the evolution-commands site was missing from this enumeration.)
+
 ## Known Limitations and Deferred Work
 
 

package/lib/index.js

@@ -9,25 +9,28 @@ const name = "evolution-threat";
 const inject = ["tools"];
 const Config = z.object({
 	enabled: z.boolean().default(true),
-	maxScanChars: z.number().min(PATTERN_OVERLAP + 1).default(65536)
+	maxScanChars: z.number().min(PATTERN_OVERLAP + 1).default(65536),
+	threatExemptLabels: z.array(z.string()).default([])
 });
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 /** Scan one tool invocation for threat-shaped payload text. Exported so the
-* guard contract is testable directly (0.3.17). */
-function scanToolArgs(toolName, args, maxScanChars) {
+* guard contract is testable directly (0.3.17). `options.excludeLabels` carries
+* the deployment's benign-label allowlist so this channel agrees with the
+* SkillLibrary/MemoryStore write gates (P2-4, v14). */
+function scanToolArgs(toolName, args, maxScanChars, options = {}) {
 	if (!EVOLUTION_WRITE_TOOLS.includes(toolName)) return null;
 	const record = asRecord(args);
 	if (toolName === "memory") {
 		for (const text of [record.facts, record.content]) if (typeof text === "string") {
-			const hit = scanMemoryThreats(text, maxScanChars);
+			const hit = scanMemoryThreats(text, maxScanChars, options);
 			if (hit) return hit;
 		}
 		if (Array.isArray(record.operations)) for (const op of record.operations) {
 			const inner = asRecord(op);
 			for (const text of [inner.facts, inner.content]) if (typeof text === "string") {
-				const hit = scanMemoryThreats(text, maxScanChars);
+				const hit = scanMemoryThreats(text, maxScanChars, options);
 				if (hit) return hit;
 			}
 		}
@@ -38,7 +41,7 @@ function scanToolArgs(toolName, args, maxScanChars) {
 		record.file_content,
 		record.new_string
 	]) if (typeof text === "string") {
-		const hit = scanContentThreats(text, maxScanChars);
+		const hit = scanContentThreats(text, maxScanChars, options);
 		if (hit) return hit;
 	}
 	return null;
@@ -55,10 +58,11 @@ function apply(ctx, rawConfig = {}) {
 	if (!(rawConfig.enabled ?? true)) return;
 	const maxScanChars = resolveMaxScanChars(rawConfig);
 	if (maxScanChars !== (rawConfig.maxScanChars ?? 65536)) ctx.logger.warn(`evolution-threat: maxScanChars=${String(rawConfig.maxScanChars)} is invalid; falling back to the default 65_536`);
+	const scanOptions = { excludeLabels: rawConfig.threatExemptLabels ?? [] };
 	ctx.inject(["tools"], (toolCtx) => {
 		const tools = toolCtx.get("tools");
 		toolCtx.effect(() => tools.guard((exec) => {
-			return scanToolArgs(exec.name, exec.arguments, maxScanChars) ?? void 0;
+			return scanToolArgs(exec.name, exec.arguments, maxScanChars, scanOptions) ?? void 0;
 		}), "evolution-threat.tools-guard");
 	});
 }

package/lib/types/index.d.ts

@@ -4,17 +4,25 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+import type { ScanOptions } from '@lmzhen/dsh-evolution-core';
 export declare const name = "evolution-threat";
 export declare const inject: string[];
 export interface Config {
     enabled?: boolean;
     /** Maximum normalized characters scanned per write field. */
     maxScanChars?: number;
+    /** Pattern labels the deployment knows to be benign. P2-4 (v14): without
+     * this the guard blocked payloads the SkillLibrary/MemoryStore gates already
+     * exempted, while its message advertised an exemption that did not exist on
+     * this channel. Same `excludeLabels` contract as the store gates. */
+    threatExemptLabels?: string[];
 }
 export declare const Config: z<Config>;
 /** Scan one tool invocation for threat-shaped payload text. Exported so the
- * guard contract is testable directly (0.3.17). */
-export declare function scanToolArgs(toolName: string, args: unknown, maxScanChars: number): string | null;
+ * guard contract is testable directly (0.3.17). `options.excludeLabels` carries
+ * the deployment's benign-label allowlist so this channel agrees with the
+ * SkillLibrary/MemoryStore write gates (P2-4, v14). */
+export declare function scanToolArgs(toolName: string, args: unknown, maxScanChars: number, options?: ScanOptions): string | null;
 /** Resolve the effective `maxScanChars`, clamping invalid values to the
  * default (G3.1: 0/negative/NaN/±Infinity → 65_536; V6-05: a value below
  * PATTERN_OVERLAP + 1 is out of the coverage-guarantee domain → default).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-threat",
   "description": "Write-time threat guard for evolution tools (community build)",
-  "version": "0.3.61",
+  "version": "0.3.63",
   "publishConfig": {
     "access": "public"
   },
@@ -31,7 +31,7 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-core": "^0.3.61"
+    "@lmzhen/dsh-evolution-core": "^0.3.63"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -42,6 +42,6 @@
     "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-core": "^0.3.61"
+    "@lmzhen/dsh-evolution-core": "^0.3.63"
   }
 }