@remnic/core 9.69.61 → 9.69.63

package/dist/{chunk-K7S2IMGJ.js → chunk-ZDZJ2PG4.js}

@@ -210,7 +210,7 @@ import {
 import {
   EngramAccessHttpServer,
   MeetingsInputError
-} from "./chunk-DC5CTLCZ.js";
+} from "./chunk-FTNV5476.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -220,10 +220,10 @@ import {
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal
-} from "./chunk-2L5DIVDU.js";
+} from "./chunk-4EEDRKRT.js";
 import {
   EngramAccessService
-} from "./chunk-WD32KTVI.js";
+} from "./chunk-VXGB766B.js";
 import {
   WorkStorage
 } from "./chunk-MPC7TYTZ.js";
@@ -3075,10 +3075,282 @@ var RESPONSE_CONTROL_PATTERNS = [
   /\breplace[ \t]{1,8}(?:normal|default|your|the|its|all)?[ \t]{0,8}(?:behaviou?r|responses?|answers?|repl(?:y|ies)|output)\b/i,
   /\b(?:literal|exact|verbatim)[ \t]{1,8}(?:response|answer|reply|marker|string|output|phrase|token)\b/i
 ];
-function findResponseControlDirective(content) {
-  for (const pattern of RESPONSE_CONTROL_PATTERNS) {
-    const finding = findingFor("response-control-directive", content, pattern);
-    if (finding) return finding;
+var RESPONSE_CONTROL_CORROBORATORS = [
+  /\bCANARY\b/i,
+  /https?:\/\//i,
+  /\b[0-9a-f]{8,}\b/i,
+  /\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/,
+  // Naming the emission as a phrase/marker/token is a payload cue: ordinary
+  // prose names a field ("the request id"), not "the phrase".
+  /\b(?:the|this|that|following)[ \t]{1,8}(?:phrase|marker|token|string|sequence|literal|codeword|passphrase)\b/i,
+  // Verbatim control over the wording, not the content.
+  /\b(?:literal(?:ly)?|verbatim|word[- ]for[- ]word|exactly[ \t]{1,8}(?:this|that|as)|character[- ]for[- ]character)\b/i,
+  /\bno[ \t]{1,8}(?:explanation|commentary|preamble|deviation|other[ \t]{1,8}text)\b/i,
+  /\b(?:only|nothing[ \t]{1,8}else|and[ \t]{1,8}nothing)\b[^\n]{0,30}\b(?:answers?|responses?|repl(?:y|ies)|output|say|said)\b/i,
+  // Persistence across turns: an ordinary fact does not legislate later turns.
+  /\b(?:remember|persist|store[ \t]{1,8}this|retain[ \t]{1,8}this)\b/i,
+  /\bany[ \t]{1,8}(?:later|future|subsequent)\b/i,
+  /\b(?:future|later|subsequent|following|upcoming)[ \t]{1,8}(?:answers?|responses?|repl(?:y|ies)|output|turns?|messages?|conversations?|sessions?)\b/i,
+  /\b(?:across|between)[ \t]{1,8}(?:conversations|sessions|chats)\b/i,
+  /\b(?:from[ \t]{1,8}now[ \t]{1,8}on|going[ \t]{1,8}forward|in[ \t]{1,8}(?:all|every)[ \t]{1,8}(?:future|later)[ \t]{1,8}(?:turns?|answers?|responses?))\b/i,
+  /\b(?:whenever|every[ \t]{1,8}time|each[ \t]{1,8}time|any[ \t]{1,8}time)\b[^\n]{0,60}\b(?:asked|discussed|mentioned|queried|retrieved|recalled)\b/i,
+  // The subject is the agent, not a system under discussion.
+  /\byour[ \t]{1,8}(?:answers?|responses?|repl(?:y|ies)|output|behaviou?r|memory)\b/i,
+  /\b(?:assistant|agent|model)(?:'s)?[ \t]{1,8}(?:answers?|responses?|repl(?:y|ies)|output|behaviou?r)\b/i,
+  // A hidden activation phrase is itself the second signal.
+  /\b(?:activation|trigger)[ \t]{1,8}(?:phrase|key|word|code)\b/i,
+  /\b(?:approved|required|correct|canonical)[ \t]{1,8}(?:response|answer|reply)\b/i
+];
+var ORDINARY_CAPS_TOKENS = /* @__PURE__ */ new Set([
+  "API",
+  "HTTP",
+  "HTTPS",
+  "JSON",
+  "XML",
+  "HTML",
+  "CSS",
+  "CSV",
+  "TSV",
+  "YAML",
+  "TOML",
+  "SQL",
+  "URL",
+  "URI",
+  "UUID",
+  "ID",
+  "IDS",
+  "UTC",
+  "ISO",
+  "PDF",
+  "PNG",
+  "JPEG",
+  "SVG",
+  "TLS",
+  "SSL",
+  "SSH",
+  "DNS",
+  "TCP",
+  "UDP",
+  "IP",
+  "CDN",
+  "CORS",
+  "CSRF",
+  "JWT",
+  "OAUTH",
+  "REST",
+  "GRPC",
+  "RPC",
+  "SDK",
+  "CLI",
+  "GUI",
+  "OK",
+  "YES",
+  "NO",
+  "TODO",
+  "FAQ",
+  "PR",
+  "CI",
+  "CD",
+  "QA",
+  "UX",
+  "UI",
+  "MIT",
+  "GPL",
+  "EU",
+  "US",
+  "AM",
+  "PM",
+  "FYI",
+  "ETA",
+  // Crypto, encoding, and spec vocabulary (trailing digits are stripped
+  // before this lookup, so SHA256/SHA-256/UTF8/ISO8601/RFC3339 all reduce).
+  "SHA",
+  "MD",
+  "HMAC",
+  "AES",
+  "RSA",
+  "ECDSA",
+  "PBKDF",
+  "BCRYPT",
+  "SCRYPT",
+  "ARGON",
+  "UTF",
+  "ASCII",
+  "BASE",
+  "HEX",
+  "CRC",
+  "GZIP",
+  "ZSTD",
+  "RFC",
+  "ANSI",
+  "IEEE",
+  "SMTP",
+  "IMAP",
+  "LDAP",
+  "SAML",
+  "OIDC",
+  "SSO",
+  "MFA",
+  "TOTP",
+  "ACL",
+  "RBAC",
+  "AWS",
+  "GCP",
+  "GPU",
+  "CPU",
+  "RAM",
+  "SSD",
+  "OS",
+  "VM",
+  "K8S",
+  "NPM",
+  "SEMVER",
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "TRACE"
+]);
+var ORDINARY_CAPITALIZED_WORDS = /* @__PURE__ */ new Set([
+  "Dear",
+  "Hello",
+  "Hi",
+  "Greetings",
+  "Please",
+  "Thanks",
+  "Thank",
+  "Regards",
+  "Sincerely",
+  "Yes",
+  "No",
+  "True",
+  "False",
+  "Null",
+  "None",
+  "Error",
+  "Warning",
+  "Note",
+  "Summary",
+  "Subject",
+  "Re",
+  "Fwd",
+  "Attention",
+  "Notice",
+  "Draft",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday",
+  "Sunday",
+  "January",
+  "February",
+  "March",
+  "April",
+  "May",
+  "June",
+  "July",
+  "August",
+  "September",
+  "October",
+  "November",
+  "December"
+]);
+var EMISSION_VERB_PRESENT = /\b(?:begin|start|end|include|contain|say|state|output|return|emit|produce|reply|respond|answer|replace|becomes?|is|are|be)\b[ \t]/i;
+var OPAQUE_EMISSION_TARGET = /\b(?:begin|start|end|include|contain|say|state|output|return|emit|produce|reply|respond|answer|replace|becomes?|is|are|be)\b[ \t]{1,8}(?:(?:with|by|exactly)[ \t]{1,8})?(?:normal[ \t]{1,8}behaviou?r[ \t]{1,8}with[ \t]{1,8})?/gi;
+var EMISSION_SLOT_VALUE = /(?:"([^"\n]{2,40})"|'([^'\n]{2,40})'|([A-Za-z][A-Za-z0-9_-]{1,39})\b)/y;
+var MAX_WHITESPACE_RUN_SCAN = 64;
+function lowercaseFollowsWhitespace(content, from) {
+  const limit = Math.min(content.length, from + MAX_WHITESPACE_RUN_SCAN);
+  let index = from;
+  while (index < limit) {
+    const code = content.charCodeAt(index);
+    const whitespace = code === 32 || code >= 9 && code <= 13;
+    if (!whitespace) return code >= 97 && code <= 122;
+    index += 1;
+  }
+  return false;
+}
+function splitSentencesOutsideQuotes(content) {
+  const sentences = [];
+  const TOKEN = /["'.!?\n]/g;
+  let start = 0;
+  let quote;
+  let match;
+  while ((match = TOKEN.exec(content)) !== null) {
+    const char = match[0];
+    const index = match.index;
+    if (quote !== void 0) {
+      if (char === quote) quote = void 0;
+      continue;
+    }
+    if (char === '"' || char === "'" && !/[A-Za-z0-9]/.test(content[index - 1] ?? " ")) {
+      quote = char;
+      continue;
+    }
+    const next = content[index + 1];
+    const insideToken = char !== "\n" && next !== void 0 && !/\s/.test(next);
+    const terminalUrlPunctuation = (char === "?" || char === "!") && lowercaseFollowsWhitespace(content, index + 1) && /:\/\/[^\s]*$/.test(content.slice(Math.max(0, index - 300), index));
+    const newlineContinues = char === "\n" && /[:\-][ \t]*$/.test(content.slice(Math.max(0, index - 4), index));
+    const endsUnit = !insideToken && !terminalUrlPunctuation && !newlineContinues && (char === "." || char === "!" || char === "?" || char === "\n");
+    if (endsUnit) {
+      if (index > start) sentences.push(content.slice(start, index));
+      start = index + 1;
+    }
+  }
+  if (start < content.length) sentences.push(content.slice(start));
+  return sentences;
+}
+function reduceToken(token) {
+  return token.replace(/[0-9]+$/, "");
+}
+function isOrdinaryToken(token) {
+  const segments = token.split(/[-_]+/).filter((segment) => segment.length > 0);
+  if (segments.length === 0) return true;
+  if (segments.length > 1 && segments.every((segment) => /^[A-Z][a-z]+$/.test(segment))) return true;
+  return segments.every((segment) => {
+    if (/^[0-9]+$/.test(segment)) return true;
+    const reduced = reduceToken(segment);
+    if (ORDINARY_CAPS_TOKENS.has(segment) || ORDINARY_CAPS_TOKENS.has(reduced)) return true;
+    return ORDINARY_CAPITALIZED_WORDS.has(segment);
+  });
+}
+function hasOpaqueEmissionTarget(sentence) {
+  OPAQUE_EMISSION_TARGET.lastIndex = 0;
+  for (let verb = OPAQUE_EMISSION_TARGET.exec(sentence); verb !== null; verb = OPAQUE_EMISSION_TARGET.exec(sentence)) {
+    EMISSION_SLOT_VALUE.lastIndex = verb.index + verb[0].length;
+    const match = EMISSION_SLOT_VALUE.exec(sentence);
+    if (!match) continue;
+    const quoted = match[1] ?? match[2];
+    if (quoted !== void 0) {
+      const inner = quoted.trim();
+      if (!/\s/.test(inner) && isOrdinaryToken(inner)) continue;
+      return true;
+    }
+    const token = match[3];
+    if (token === void 0) continue;
+    if (/^[a-z]/.test(token)) continue;
+    if (!isOrdinaryToken(token)) return true;
+  }
+  return false;
+}
+function findResponseControlDirective(content, profile = "default") {
+  const directive = RESPONSE_CONTROL_PATTERNS.map(
+    (pattern) => findingFor("response-control-directive", content, pattern)
+  ).find((finding) => finding !== void 0);
+  if (!directive) return void 0;
+  if (profile === "hardened") return directive;
+  const anyCorroborator = RESPONSE_CONTROL_CORROBORATORS.some((pattern) => pattern.test(content));
+  const anyEmissionVerb = !anyCorroborator ? EMISSION_VERB_PRESENT.test(content) : true;
+  if (!anyCorroborator && !anyEmissionVerb) return void 0;
+  for (const sentence of splitSentencesOutsideQuotes(content)) {
+    if (!RESPONSE_CONTROL_PATTERNS.some((pattern) => pattern.test(sentence))) continue;
+    if (anyCorroborator && RESPONSE_CONTROL_CORROBORATORS.some((pattern) => pattern.test(sentence))) return directive;
+    if (hasOpaqueEmissionTarget(sentence)) return directive;
   }
   return void 0;
 }
@@ -3100,7 +3372,16 @@ function findAuthorityEscalation(content) {
     AUTHORITY_MANDATORY_DIRECTIVE_PATTERN
   );
 }
-function screenCandidateFact(content, profile = "default") {
+var INVISIBLE_FORMATTING = /[\u00ad\u200b-\u200f\u2060\u2028\u2029\ufeff]/g;
+var NON_ASCII_SPACE_LIKE = /[\f\v\u0085\u1680\u00a0\u2000-\u200a\u202f\u205f\u3000]/g;
+var ASCII_SPACE_RUN = /[ \t]{2,}/g;
+function normalizeForScreening(content) {
+  const spaced = content.replace(NON_ASCII_SPACE_LIKE, " ").replace(INVISIBLE_FORMATTING, " ").replace(ASCII_SPACE_RUN, " ");
+  const deleted = content.replace(INVISIBLE_FORMATTING, "").replace(NON_ASCII_SPACE_LIKE, " ").replace(ASCII_SPACE_RUN, " ");
+  return spaced === deleted ? [spaced] : [spaced, deleted];
+}
+function screenCandidateFact(rawContent, profile = "default") {
+  const variants = normalizeForScreening(rawContent);
   const findings = [];
   const rules = [
     ["imperative-to-agent", findImperativeToAgent],
@@ -3113,8 +3394,13 @@ function screenCandidateFact(content, profile = "default") {
     ["tool-routing-directive", findToolRoutingDirective]
   ];
   for (const [rule, find] of rules) {
-    const finding = find(content);
-    if (finding) findings.push({ rule, excerpt: finding.excerpt });
+    for (const content of variants) {
+      const finding = find(content, profile);
+      if (finding) {
+        findings.push({ rule, excerpt: finding.excerpt });
+        break;
+      }
+    }
   }
   const score = findings.reduce((sum, finding) => sum + ruleWeight(finding.rule, profile), 0);
   return { score, findings, quarantine: score >= INJECTION_SCREEN_THRESHOLD };
@@ -3231,6 +3517,10 @@ function writeBurstStats(groups) {
     anomalousGroups
   };
 }
+function auditScreenProfile(config) {
+  const capabilities = resolveSecurityCapabilities(config);
+  return capabilities.injectionScreen ? capabilities.injectionScreenProfile : "default";
+}
 async function auditMemoryStore(options) {
   const since = parseSince(options.since);
   const storage = options.storage;
@@ -3347,7 +3637,13 @@ function registerSecurityCommands(cmd, orchestrator) {
       memoryDir: orchestrator.config.memoryDir,
       storage: orchestrator.storage,
       since: typeof options.since === "string" && options.since.trim().length > 0 ? options.since.trim() : void 0,
-      quarantine: options.quarantine === true
+      quarantine: options.quarantine === true,
+      // Screen with the profile live ingestion uses, or a memory this
+      // deployment would quarantine on write stays active once stored
+      // (#3078). A deployment with the screen DISABLED keeps the previous
+      // `default` weighting: the sweep must not be stricter than the
+      // write path the operator configured.
+      profile: auditScreenProfile(orchestrator.config)
     });
     if (options.json === true) {
       console.log(JSON.stringify(report, null, 2));
@@ -9709,6 +10005,7 @@ export {
   exportSkillBundles,
   readSkillBundlesFromDir,
   persistImportedSkills,
+  auditScreenProfile,
   auditMemoryStore,
   formatAuditMemoryReport,
   registerWearableConnector,
@@ -9834,4 +10131,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-K7S2IMGJ.js.map
+//# sourceMappingURL=chunk-ZDZJ2PG4.js.map