@lmzhen/dsh-evolution-threat 0.32.4 → 0.32.6

package/README.md

@@ -1,28 +1,17 @@
 # @lmzhen/dsh-evolution-threat
 
-Write-time threat guard for evolution tools: one monotonic `tools.guard()` scans the payload of
-every evolution write tool and refuses the call on a pattern hit. It registers no prompt or tool
-schema — a denial is its only model-visible effect.
+Write-time threat guard for the family model-writing tools. It is enabled by default and runs even when ordinary write approval is disabled.
 
-## Model surface
+## Actual coverage
 
-- **Model-visible:** nothing of its own: a refused write is the only thing the model notices.
-- **Prompt prefix / KV cache:** unchanged by this package: family-level rules single-sourced in `packages/README.md` §"Model-visible prompt prefix and the KV cache".
-- **Mount it?** yes — the `evolution-threat` row, in `evolution-host`/`evolution-all`/one-click `evolution-preset`.
+The guard scans calls whose tool name belongs to the family `EVOLUTION_WRITE_TOOLS` set. Memory calls scan `facts` and `content`, including entries in `operations[]`; skill calls scan `content`, `file_content`, and `new_string`. A matching threat label denies the allowed execution through `tools.guard`.
 
-## Configuration
+This is not a scan of every internal write. Curator jobs, merge orchestration, direct provider calls, generic file tools, and other paths outside the guarded tool set are not covered by this package.
 
-- `enabled` (default `true`): master switch; off installs no guard.
-- `maxScanChars` — `65536` — the scan window size in normalized characters. Legal range is `>= 4097` — a smaller window cannot guarantee full-coverage scanning (the overlap floor is `PATTERN_OVERLAP + 1` in evolution-core), so the schema rejects it at load and the assembly clamp falls back to the default. The whole text is always scanned in overlapping windows; this value is not a total cap.
-- `threatExemptLabels` (default `[]`): pattern labels the deployment knows to be benign. The exemption surface is per config site: this guard row, the tool-skill-manage row, the evolution-commands row (its own SkillLibrary for the command write paths), the evolution-learning-graph row (its own SkillLibrary for the graph edit/delete write channel) and the memory store options each carry their OWN list and must be set separately. A label exempted only on the store side still blocks here.
+## Configuration and limits
 
-## Known limitations
+- `enabled`: mounts the guard; default `true`.
+- `maxScanChars`: normalized characters scanned per field; default 65,536. Values below the overlap-safe floor fall back to the default.
+- `threatExemptLabels`: deployment-declared benign labels; default empty. These labels affect the scan and must be treated as security configuration.
 
-- No known durable consumer gaps at this time. Runtime contracts are covered by package and boundary tests.
-
-**Runtime invariant:** No companion is published. The platform auto-assembles nothing and the family mounts no `<pkg>/invariant` cordis row, so a companion here would never execute (v37 S2.1 / I-3).
-
-## Notes and history
-
-- P2-4 (v14) closed the store-vs-guard asymmetry for the STORE gates (`SkillLibrary`/`MemoryStore` options)
-- (v17 audit: the evolution-commands site was missing from this enumeration; the evolution-learning-graph site was missing from it as well.)
+The rule set is manually maintained and is not exhaustive. It is one write-control layer, not a general sandbox or a guarantee that every secret, injection, or exfiltration attempt will be detected.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-threat",
   "description": "Write-time threat guard for evolution tools (community build)",
-  "version": "0.32.4",
+  "version": "0.32.6",
   "publishConfig": {
     "access": "public"
   },
@@ -27,7 +27,7 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.5",
-    "@lmzhen/dsh-evolution-core": "^0.32.4"
+    "@lmzhen/dsh-evolution-core": "^0.32.6"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.5",
@@ -36,7 +36,7 @@
   "devDependencies": {
     "@deepseek-ai/dsh-agent-loop-testkit": "^0.2.1-rc.2",
     "@deepseek-ai/dsh-tools": "^0.2.1-rc.2",
-    "@lmzhen/dsh-evolution-core": "^0.32.4"
+    "@lmzhen/dsh-evolution-core": "^0.32.6"
   },
   "engines": {
     "dsh": ">=0.2.1-rc.2 <0.2.2-0"