@shomra/agent 0.2.4 → 0.2.7

package/code-sast.mjs

@@ -1,8 +1,8 @@
 /**
  * Local SAST rule engine for AI-artifact source code — a dependency-free port of
- * the platform's src/checks/code-sast.ts, so the CLI can catch the same
- * AI-vulnerability shapes ON-MACHINE (offline, pre-commit, in the IDE) that the
- * model scan and workspace scan catch server-side. Nothing here is executed.
+ * the server-side engine, so the CLI can catch the same AI-vulnerability shapes
+ * ON-MACHINE (offline, pre-commit, in the IDE) that the model scan and workspace
+ * scan catch server-side. Nothing here is executed.
  *
  * Three analysis tiers, worst-first, tuned for low false positives:
  *
@@ -21,11 +21,15 @@
  *      • config.json / tokenizer_config.json: auto_map / custom_pipeline / declared
  *        trust_remote_code → remote-code-under-load.
  *
- *   2. Lightweight taint tier — tracks variables assigned from an LLM call
- *      (`.generate` / `.invoke` / `.completions.create` / `.messages.create` …),
- *      propagates that taint across simple assignments, and raises a CRITICAL
- *      `*.llm_output_to_sink` when a tainted value reaches a code-execution sink.
- *      This is the prompt-injection → RCE shape that single-sink matching misses.
+ *   2. Heuristic LLM-output propagation tier (NOT true dataflow) — marks a
+ *      variable assigned from an LLM call (`.generate` / `.invoke` /
+ *      `.completions.create` …) as tainted, propagates by NAME SUBSTRING across
+ *      simple assignments, and raises an `*.llm_output_to_sink` finding when a
+ *      tainted name appears in a code-execution sink's arguments. Surfaces the
+ *      prompt-injection → RCE shape single-sink matching misses, but it is a
+ *      low-confidence heuristic, not analysis: no scope, no reassignment/kill, no
+ *      sanitizer awareness, no interprocedural tracking — it can over- and
+ *      under-report. Findings are HIGH at low confidence with hedged wording.
  *
  *   3. Cross-signal chain tier — synthesises a finding when two independently
  *      suspicious signals co-occur in one file: encoded-payload + code-exec
@@ -34,9 +38,9 @@
  *
  * Findings carry a stable dotted rule id, the matched SINK, an optional SOURCE, a
  * CWE, a category, a 0–1 confidence, the FILE + physical LINE and a context
- * SNIPPET — the exact shape the Risk Evaluation UI renders and shomra.mjs folds
- * into a gate result. Keep the rule bodies in sync with src/checks/code-sast.ts —
- * drift only costs recall on the local floor; the server remains the full check.
+ * SNIPPET — the exact shape shomra.mjs folds into a gate result. The rule bodies
+ * mirror the server engine; drift only costs recall on the local floor, and the
+ * server remains the full check.
  */
 
 const MAX_SNIPPET = 400;
@@ -73,7 +77,7 @@ const PY_RULES = [
     // jsonpickle, torch.load, joblib/skops, numpy allow_pickle, yaml.load without a
     // safe Loader, shelve, pandas.read_pickle, mlflow.*.load_model. All run
     // __reduce__ / arbitrary code on a crafted file the moment they load.
-    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\btorch\.(load|jit\.load)\s*\(|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*yaml\.(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
+    re: /\b(pickle|cpickle|dill|_pickle|cloudpickle)\.(loads?|Unpickler)\s*\(|\bjsonpickle\.(decode|loads)\s*\(|\bmarshal\.loads?\s*\(|\btorch\.(load|jit\.load)\s*\(|\byaml\.(unsafe_load|load\s*\((?![^)]*Loader\s*=\s*yaml\.(Safe|Full)Loader))|\bjoblib\.load\s*\(|\bskops\.io\.load\s*\(|\bshelve\.open\s*\(|\bnumpy\.load\s*\([^)]*allow_pickle\s*=\s*True|\b(pandas|pd)\.read_pickle\s*\(|\bmlflow\.[\w.]+\.load_model\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'weight / config file',
     message: 'Deserializes data with a pickle-backed loader. A crafted file runs arbitrary code via __reduce__ on load — the primary model-hub malware vector.',
@@ -86,6 +90,9 @@ const PY_RULES = [
     severity: 'CRITICAL',
     category: 'remote-code',
     confidence: 0.95,
+    // codeOnly: keyword appears in docstrings / log warnings / usage examples
+    // (e.g. Falcon's "load without the trust_remote_code=True argument").
+    codeOnly: true,
     re: /trust_remote_code\s*=\s*True/,
     sink: () => 'trust_remote_code=True',
     source: 'model repository',
@@ -93,6 +100,48 @@ const PY_RULES = [
     remediation: 'Remove trust_remote_code=True. Prefer a model with native transformers support, or pin revision= to a specific reviewed commit hash and read the custom modeling code first.',
     cwe: 'CWE-94',
   },
+  {
+    id: 'python.dataset_remote_code',
+    title: 'Dataset loaded with trust_remote_code',
+    severity: 'CRITICAL',
+    category: 'remote-code',
+    confidence: 0.9,
+    codeOnly: true,
+    // datasets.load_dataset(..., trust_remote_code=True) runs the dataset's own
+    // Python loading script — a DISTINCT RCE vector from model trust_remote_code.
+    re: /\bload_dataset\s*\((?=[^)]*trust_remote_code\s*=\s*True)/,
+    sink: () => 'load_dataset(trust_remote_code=True)',
+    source: 'dataset repository',
+    message: 'Loads a Hugging Face dataset with trust_remote_code=True, which imports and runs the dataset\'s Python loading script in the host process — arbitrary code execution from the dataset publisher.',
+    remediation: 'Remove trust_remote_code=True. Use a non-script dataset format (Parquet/Arrow/CSV/JSON), or pin revision= to a reviewed commit and read the loading script first.',
+    cwe: 'CWE-94',
+  },
+  {
+    id: 'python.native_code_load',
+    title: 'Loads a native library (ctypes)',
+    severity: 'HIGH',
+    category: 'code-exec',
+    confidence: 0.85,
+    re: /\bctypes\.(CDLL|WinDLL|OleDLL|PyDLL|cdll|windll|oledll)\b|\bcdll\.LoadLibrary\s*\(|\bwindll\.LoadLibrary\s*\(/,
+    sink: (m) => m[0].replace(/\s*\($/, '').trim(),
+    source: 'native library',
+    message: 'Loads a native/shared library via ctypes. Model code has no reason to dlopen libc or an arbitrary .so/.dll — it is an execution primitive (e.g. ctypes.CDLL("libc.so.6").system(cmd)).',
+    remediation: 'Remove the ctypes native-library load from model/loader code. Treat any model that dlopens libraries on load as hostile.',
+    cwe: 'CWE-94',
+  },
+  {
+    id: 'python.dynamic_file_exec',
+    title: 'Loads and executes a Python file at runtime',
+    severity: 'HIGH',
+    category: 'code-exec',
+    confidence: 0.85,
+    re: /\bSourceFileLoader\s*\(|\bspec_from_file_location\s*\(|\bimp\.load_source\s*\(|\bexec_module\s*\(/,
+    sink: (m) => m[0].replace(/\s*\($/, '').trim(),
+    source: 'file path',
+    message: 'Imports and executes a Python file from a path at runtime (SourceFileLoader / spec_from_file_location / imp.load_source). This runs code that is not statically visible as an import — a common way to hide an execution path.',
+    remediation: 'Remove runtime file-based module loading from model code. Import only reviewed, statically-visible modules.',
+    cwe: 'CWE-94',
+  },
   {
     id: 'python.torch_remote_code',
     title: 'Loads/executes remote or native code via torch',
@@ -235,14 +284,17 @@ const PY_RULES = [
   },
   {
     id: 'python.encoded_payload',
-    title: 'Encoded payload decode-and-run',
-    severity: 'HIGH',
+    title: 'Encoded blob decode',
+    // LOW on its own: base64/hex decode is ubiquitous & benign in ML (tokenizer
+    // vocabs, quant kernels). The dangerous decode→exec case is elevated to
+    // CRITICAL by chain.decode_exec. marshal.loads moved to pickle_deserialization.
+    severity: 'LOW',
     category: 'obfuscation',
-    confidence: 0.6,
-    re: /\b(base64|codecs|binascii|marshal)\.(b64decode|decode|unhexlify|loads)\s*\(|bytes\.fromhex\s*\(/,
+    confidence: 0.5,
+    re: /\b(base64|codecs|binascii)\.(b64decode|decode|unhexlify)\s*\(|bytes\.fromhex\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
-    message: 'Decodes an encoded blob. Combined with eval/exec this is the "decode a base64 string then run it" packer used to smuggle payloads past a skim.',
-    remediation: 'Decode the blob offline and inspect it. Never load model code that decodes-and-runs embedded strings.',
+    message: 'Decodes an encoded blob. Benign on its own (common in tokenizers/quantization), but the "decode then run it" packer combines this with eval/exec — see any decode-and-run chain finding on this file.',
+    remediation: 'If this decode feeds eval/exec/import, decode the blob offline and inspect it. A lone decode of vocab/kernel data is expected.',
     cwe: 'CWE-506',
   },
   {
@@ -371,14 +423,17 @@ const JS_RULES = [
 const CONFIG_RULES = [
   {
     id: 'json.automodel_usage',
-    title: 'AutoModel bound to remote code',
-    severity: 'HIGH',
+    // MEDIUM, not HIGH: capability/posture fact (ships trust_remote_code code) —
+    // true of every legit custom model, so HIGH is alert fatigue. A real sink in
+    // the routed module is elevated to CRITICAL by chain.config_module_rce.
+    title: 'AutoModel bound to repo-shipped code (trust_remote_code)',
+    severity: 'MEDIUM',
     category: 'remote-code',
     confidence: 0.8,
     re: /"(AutoModel[A-Za-z]*|AutoConfig)"\s*:\s*"([^"]+)"/,
     sink: (m) => `auto_map.${m[1]}`,
-    message: 'config.json maps an Auto* class to a class shipped in this repo. Loading the model with trust_remote_code imports and runs that code before any weights.',
-    remediation: 'Do not use the AutoModel path for this repo. Pin revision= to a reviewed commit, or load a model with native transformers support.',
+    message: 'config.json maps an Auto* class to code shipped in this repo. Loading with trust_remote_code imports and runs that code before any weights — review the publisher and the referenced module. (A dangerous sink in that module is reported separately at higher severity.)',
+    remediation: 'Review the referenced module before loading, pin revision= to a reviewed commit, or use a model with native transformers support.',
     cwe: 'CWE-829',
   },
   {
@@ -419,10 +474,11 @@ const CONFIG_RULES = [
   },
 ];
 
-// ── Taint tier config: LLM output → code-execution sink ────────────
-// Per-language patterns for the dataflow pass. `aiCall` marks a variable tainted
-// when its RHS is an LLM/model call; `execSink` is the dangerous consumer. A
-// tainted value reaching a sink is prompt-injection → RCE.
+// ── LLM-output propagation config: LLM output → code-execution sink ─────────
+// Per-language patterns for the heuristic name-propagation pass (NOT dataflow).
+// `aiCall` marks a variable tainted when its RHS is an LLM/model call; `execSink`
+// is the dangerous consumer. A tainted name reaching a sink is the
+// prompt-injection → RCE shape — reported low-confidence, to be confirmed.
 const PY_TAINT = {
   lang: 'python',
   ruleId: 'python.llm_output_to_sink',
@@ -443,13 +499,13 @@ const CHAINS = [
     title: 'Decode-and-execute packer (multi-signal)',
     severity: 'CRITICAL',
     category: 'chain',
-    confidence: 0.8,
+    confidence: 0.6,
     // an encoded-blob decode AND a code-exec sink in the same file
     parts: ['python.encoded_payload', 'js.decode_and_run', 'python.dangerous_sinks', 'js.code_exec', 'python.dynamic_import'],
     needs: (ids) => (ids.has('python.encoded_payload') || ids.has('js.decode_and_run')) &&
       (ids.has('python.dangerous_sinks') || ids.has('js.code_exec') || ids.has('python.dynamic_import')),
     anchor: ['python.dangerous_sinks', 'js.code_exec', 'python.encoded_payload', 'js.decode_and_run'],
-    message: 'This file both decodes an encoded blob and contains a code-execution sink — the two halves of a decode-then-run packer. Even split across lines, together they smuggle and execute a hidden payload.',
+    message: 'This file BOTH decodes an encoded blob AND contains a code-execution sink — the two halves of a decode-then-run packer. Detected by co-occurrence in one file, not a proven decode→exec path, so confirm the decoded blob is what reaches the sink; when it is, this is how a hidden payload is smuggled and run.',
     remediation: 'Decode every embedded blob offline and inspect it, and remove the decode → eval/exec path entirely. Do not ship artifacts that assemble code at runtime.',
     cwe: 'CWE-506',
   },
@@ -458,14 +514,14 @@ const CHAINS = [
     title: 'Remote-code model that also phones out',
     severity: 'CRITICAL',
     category: 'chain',
-    confidence: 0.8,
+    confidence: 0.6,
     // remote-code loading AND network egress in the same file
     parts: ['python.trust_remote_code', 'python.torch_remote_code', 'json.automodel_usage', 'json.autotokenizer_usage', 'python.network_egress', 'js.network_egress'],
     needs: (ids) => (ids.has('python.trust_remote_code') || ids.has('python.torch_remote_code') ||
       ids.has('json.automodel_usage') || ids.has('json.autotokenizer_usage')) &&
       (ids.has('python.network_egress') || ids.has('js.network_egress')),
     anchor: ['python.network_egress', 'js.network_egress', 'python.trust_remote_code', 'python.torch_remote_code'],
-    message: 'This file loads code shipped in a model repo (trust_remote_code / auto_map / torch.hub) AND opens a network connection. Remote-code modeling that also phones out is the classic staged-download / exfiltration shape.',
+    message: 'This file loads code shipped in a model repo (trust_remote_code / auto_map / torch.hub) AND opens a network connection. Detected by co-occurrence in one file, not a proven load→egress path. Remote-code modeling that also phones out is the classic staged-download / exfiltration shape — confirm whether the network call is reachable from the model-code load.',
     remediation: 'Do not load remote model code; use a native-transformers model or a reviewed, pinned revision. Model code should never make outbound requests — treat this artifact as hostile.',
     cwe: 'CWE-494',
   },
@@ -538,6 +594,42 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * Whether byte `offset` in `text` falls inside a string literal — tracks single/
+ * double/backtick + triple quotes, honouring escapes. Drops `codeOnly` rule
+ * matches that land in a docstring / log message / usage example (the Falcon
+ * `trust_remote_code=True`-in-a-warning FP). Approximate and only ever more
+ * conservative (may skip a real hit, never invents one).
+ */
+function isInsideString(text, offset) {
+  let quote = null;
+  let triple = false;
+  for (let i = 0; i < offset && i < text.length; i++) {
+    const c = text[i];
+    if (quote) {
+      if (c === '\\') { i++; continue; }
+      if (triple) {
+        if (c === quote && text[i + 1] === quote && text[i + 2] === quote) { i += 2; quote = null; triple = false; }
+      } else if (c === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (c === '#') {
+      const nl = text.indexOf('\n', i);
+      if (nl === -1) return false;
+      i = nl;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === '`') {
+      quote = c;
+      triple = text[i + 1] === c && text[i + 2] === c;
+      if (triple) i += 2;
+    }
+  }
+  return quote !== null;
+}
+
 /** Map a match offset inside a logical unit back to a 0-based physical line. */
 function physicalIdx(unit, offset) {
   const newlines = unit.text.slice(0, offset).match(/\n/g);
@@ -557,10 +649,13 @@ function parseAssign(text) {
 }
 
 /**
- * Lightweight intra-file taint pass. Marks variables assigned from an LLM call as
- * tainted, propagates that across simple assignments (bounded fixed point), then
- * emits a CRITICAL finding wherever a tainted value flows into a code-exec sink —
- * the prompt-injection → RCE shape a single-sink regex can't see.
+ * Heuristic intra-file LLM-output propagation (NOT true taint analysis). Marks
+ * variables assigned from an LLM call as tainted, propagates by name-substring
+ * across simple assignments (bounded fixed point), then emits a finding wherever
+ * a tainted name appears in a code-exec sink's arguments — the prompt-injection →
+ * RCE shape a single-sink regex can't see. No scope, kill, sanitizer or
+ * interprocedural tracking, so it can over- and under-report; findings are HIGH
+ * at low confidence with hedged wording, i.e. leads to confirm, not proof.
  */
 function taintFindings(lines, units, file, cfg) {
   const tainted = new Set();
@@ -602,18 +697,19 @@ function taintFindings(lines, units, file, cfg) {
           const sink = m[0].replace(/\s*\($/, '').trim();
           out.push({
             ruleId: cfg.ruleId,
-            title: 'LLM output reaches a code-execution sink',
-            severity: 'CRITICAL',
-            category: 'taint',
-            confidence: 0.85,
+            title: 'LLM output may reach a code-execution sink (heuristic)',
+            // HIGH, not CRITICAL: name-propagation heuristic, not proven dataflow.
+            severity: 'HIGH',
+            category: 'taint-heuristic',
+            confidence: 0.5,
             file,
             line: idx + 1,
             sink: sink.slice(0, 120),
             source: 'LLM output',
-            taint: `${via} (LLM output) → ${sink}`,
+            taint: `${via} (LLM output) → ${sink} (heuristic name match — confirm)`,
             ...contextChunk(lines, idx),
-            message: `A value derived from an LLM call ("${via}") flows into ${sink}. A prompt-injected instruction the model emits becomes code execution in the host — the highest-severity agent vulnerability.`,
-            remediation: 'Never pass model output to eval/exec/subprocess. Constrain the model to structured output (a fixed schema / tool-call allowlist), validate it, and dispatch on named handlers — never execute it.',
+            message: `A variable that appears to derive from an LLM call ("${via}") is used in ${sink}. If that value really is model-controlled, a prompt-injected instruction becomes code execution in the host — a critical agent vulnerability. Flagged by a name-propagation heuristic (no dataflow proof), so confirm the value is actually the model output and not reassigned/sanitized before this line.`,
+            remediation: 'If confirmed, never pass model output to eval/exec/subprocess. Constrain the model to structured output (a fixed schema / tool-call allowlist), validate it, and dispatch on named handlers — never execute it.',
             cwe: 'CWE-94',
           });
         }
@@ -673,6 +769,9 @@ function scanLines(text, file, rules, taintCfg) {
       rule.re.lastIndex = 0;
       const m = rule.re.exec(unit.text);
       if (!m) continue;
+      // Drop code-construct rules whose match lands inside a string literal
+      // (docstring / log message / usage example) — the Falcon-class FP.
+      if (rule.codeOnly && isInsideString(unit.text, m.index)) continue;
       const idx = physicalIdx(unit, m.index);
       const trimmed = (lines[idx] ?? '').trim();
       if (!trimmed || isCommentLine(trimmed)) continue;

package/discovery.mjs

@@ -66,9 +66,9 @@ function firstExisting(paths) {
 }
 
 // ── workspace root discovery ─────────────────────────────────────
-// The old scanner only looked at cwd. Real AI assets live scattered across a
-// developer's project folders, so we discover those folders instead of hoping
-// the agent was launched from inside one.
+// Real AI assets live scattered across a developer's project folders, so
+// discovery walks those folders rather than assuming the CLI was launched from
+// inside one.
 
 const IGNORE_DIRS = new Set([
   'node_modules', '.git', '.hg', '.svn', 'dist', 'build', 'out', '.next', '.nuxt',

package/guard-signals.mjs

@@ -1,8 +1,7 @@
 /**
  * Tier-0 local guard signals — a dependency-free, high-confidence subset of the
- * backend detection engine (src/bundle/signals.ts + src/checks/patterns.ts),
- * ported so the runtime firewall can decide the DANGEROUS majority of tool calls
- * ON-BOX, with zero network round-trip.
+ * server-side detection engine, ported so the runtime firewall can decide the
+ * DANGEROUS majority of tool calls ON-BOX, with zero network round-trip.
  *
  * Why this exists: the pre-tool-call hook fires on every action. Routing every
  * call through the backend put a network dependency on the hot path — slow when
@@ -19,11 +18,50 @@
  *     escalates policy-relevant calls to it; the local tier is the floor, not a
  *     replacement.
  *
- * Keep the pattern lists roughly in sync with the server modules named above.
- * Drift only costs recall on the local floor — the server remains the full check.
+ * The pattern lists below mirror the server engine. Drift only costs recall on
+ * the local floor — the server remains the full check.
  */
 
-// ── dangerous shell (mirror of DANGEROUS_SHELL in src/bundle/signals.ts) ──
+// ── precision guards ──
+
+/** Build output every README tells you to wipe — regenerable, not real data. */
+const EPHEMERAL_RM_TARGET_RE =
+  /^(\.\/)?(node_modules|dist|build|out|coverage|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+
+/** True when an `rm -rf` line deletes something other than build output. */
+function rmTargetsRealData(line) {
+  const m = /\brm\s+((?:-[a-zA-Z]+\s+)+)(.*)$/.exec(line);
+  if (!m) return true; // unparsed shape → keep the finding (fail open)
+  const targets = m[2]
+    .split(/&&|\|\||[;|>&]/)[0]
+    .split(/\s+/)
+    .filter((t) => t && !t.startsWith('-'));
+  if (!targets.length) return true;
+  return !targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t.replace(/^["']|["']$/g, '')));
+}
+
+/**
+ * The TEXT of the line `index` falls on — the unit a `refine` guard reasons
+ * about. Distinct from lineAt() (line NUMBER) and lineOf() (locate a needle).
+ */
+function lineTextAt(text, index) {
+  const start = text.lastIndexOf('\n', index - 1) + 1;
+  const end = text.indexOf('\n', index);
+  return text.slice(start, end === -1 ? undefined : end);
+}
+
+/** True when `sig` fires AND at least one hit survives its precision guard. */
+export function matchesShellSignal(sig, text) {
+  if (!sig.refine) return sig.re.test(text);
+  const g = new RegExp(sig.re.source, sig.re.flags.includes('g') ? sig.re.flags : sig.re.flags + 'g');
+  for (const m of text.matchAll(g)) {
+    if (m.index == null) continue;
+    if (sig.refine(lineTextAt(text, m.index))) return true;
+  }
+  return false;
+}
+
+// ── dangerous shell ──
 export const DANGEROUS_SHELL = [
   { name: 'Pipe-to-shell installer (curl … | sh)', re: /\b(curl|wget)\b[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z|k)?sh\b/i, severity: 'CRITICAL' },
   { name: 'PowerShell download-and-run (iwr/curl … | iex)', re: /\b(iwr|curl|wget|invoke-webrequest|invoke-restmethod|irm)\b[^\n|]{0,200}\|\s*(iex|invoke-expression)\b/i, severity: 'CRITICAL' },
@@ -34,8 +72,10 @@ export const DANGEROUS_SHELL = [
   { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },
   { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
   { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
-  { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH' },
-  { name: 'Inline eval / exec of a string', re: /\b(eval|exec)\s*[("`']/i, severity: 'HIGH' },
+  { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
+  // BARE `eval(`/`exec(` only — the lookbehind drops method calls that merely end
+  // in those letters (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`).
+  { name: 'Inline eval / exec of a string', re: /(?<![.\w$>:])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
   { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
   { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },
   { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
@@ -43,35 +83,46 @@ export const DANGEROUS_SHELL = [
   { name: 'Netcat / socket exfil', re: /\bnc\s+-[a-z]*\b|\bncat\b/i, severity: 'MEDIUM' },
 ];
 
-// ── injection (mirror of INJECTION_PHRASES / INJECTION_REGEXES) ──
+// ── injection ──
+// Broad phrases that dominate benign dev prose ("system prompt", "run the
+// following command", "do not tell the user", "never mention") are deliberately
+// excluded — their real-attack shapes are caught by scanShell and the tightened
+// regexes below. The injection loop also applies PRECEDING_NEGATION, so "never
+// ignore previous instructions" reads as legitimate.
 export const INJECTION_PHRASES = [
   'ignore previous instructions', 'ignore all previous', 'disregard previous', 'disregard the above',
-  'do not tell the user', "don't tell the user", 'without informing the user', 'without telling the user',
-  'do not mention', "don't mention", 'never mention',
-  'system prompt', 'you are now', 'new instructions:', 'override your', 'exfiltrate',
-  'send them to', 'post them to', 'forward the',
-  'run this first', 'run the following command', 'run the following commands', 'copy this command',
-  'copy and run', 'execute the following', 'seed the current host',
+  'without informing the user', 'without telling the user',
+  'new instructions:', 'override your', 'exfiltrate',
+  'send them to', 'post them to',
+  'run this first', 'copy and run', 'seed the current host',
   'ignore all instructions', 'ignore your instructions', 'ignore your safety', 'ignore all content policies',
   'disregard your instructions', 'disregard the guidelines', 'system override', 'follow only my instructions',
   'do anything now', 'reveal any credential',
   'save this to your memory', 'in all future sessions', 'remember this forever',
 ];
 export const INJECTION_REGEXES = [
-  { label: 'Instruction-override phrasing', re: /\b(ignore|disregard|forget|discard|override|bypass|skip)\b[\s\w,'"()-]{0,40}?\b(instruction|instructions|rule|rules|guideline|guidelines|prompt|prompts|directive|directives|context|constraint|constraints)\b/i },
-  { label: 'Reference to overriding earlier context', re: /\b(previous|prior|above|earlier|preceding|former|the last|that (?:were |was )?given)\b[\s\w,'"()-]{0,25}?\b(instruction|instructions|rule|rules|prompt|prompts|message|messages|guidance)\b/i },
-  { label: 'Bulk destructive command', re: /\b(delete|remove|wipe|erase|destroy|drop|purge|clear|nuke|truncate)\b[\s\w,'"()-]{0,20}?\b(all|every|each|entire|whole)\b[\s\w,'"()-]{0,15}?\b(folder|folders|file|files|directory|directories|table|tables|database|databases|record|records|repo|repos|repositor\w*|account|accounts|user|users|row|rows|document|documents|data)\b/i },
-  { label: 'Recursive force-delete command', re: /\brm\s+-[a-z]*[rf][a-z]*\b|\brmdir\b|\bdel\s+\/[sqf]|remove-item\b[\s\S]{0,40}?-recurse/i },
-  { label: 'Destructive SQL statement', re: /\b(drop|truncate)\s+(table|database|schema|index)\b/i },
+  { label: 'Instruction-override phrasing', re: /\b(ignore|disregard|override|bypass|circumvent)\b[\s\w,'"()-]{0,40}?\b(instruction|instructions|directive|directives|safety|safeguards?|guardrails?|system\s+prompt|content\s+polic\w+)\b/i },
+  { label: 'Instructs the agent to conceal an action from the user', re: /\b(?:do\s*n['o]?t|never|without)\s+(?:tell|telling|inform|informing|notify|notifying|alert|alerting|mention|mentioning|disclos\w+|reveal\w*)\s+(?:it\s+|this\s+|them\s+)?(?:to\s+)?(?:the\s+)?(?:user|users|human|operator|owner)\b(?!['']s)(?!\s+(?:to\b|how\s+to\b|when\s+to\b|that\s+they\b|about\b))/i },
+  { label: 'Bulk destructive command', re: /\b(delete|remove|wipe|erase|destroy|drop|purge|nuke|truncate)\b[\s\w,'"()-]{0,20}?\b(all|every|each|entire|whole)\b[\s\w,'"()-]{0,15}?\b(folder|folders|file|files|directory|directories|table|tables|database|databases|record|records|repo|repos|repositor\w*|account|accounts|user|users|row|rows|document|documents|data)\b/i },
+  { label: 'Destructive SQL statement', re: /\b(drop|truncate)\s+(table|database|schema)\b/i },
 ];
+// Negation flips an override phrase into a hardening rule; a bulk-destructive hit
+// on a build/test artifact is a clean step, not an attack. Applied in localScan.
+const PRECEDING_NEGATION = /\b(never|not|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|refuse to|forbidden to|prohibited from|without)\s*$/i;
+const BUILD_ARTIFACT = /\b(node_modules|dist|build|out|coverage|target|cache|generated|tmp|temp|__pycache__|artifacts?|logs?|tests?|test|fixtures?|staging|scratch|migrations?)\b/i;
 // zero-width / bidi / tag-block chars used to smuggle instructions (ASCII smuggling).
-export const INVISIBLE_CHARS_RE = /[​-‏‪-‮⁠-⁤︀-️]|[\u{E0000}-\u{E007F}]|[\u{E0100}-\u{E01EF}]/u;
+// Excludes U+200D ZWJ and U+FE00–FE0F variation selectors — those render ordinary
+// emoji ("⚠️", "👨‍💻") and are not a smuggling channel.
+export const INVISIBLE_CHARS_RE = /[؜ᅟᅠ᠎​‌‎‏‪-‮⁠-⁤⁦-⁩ㅤﾠ-]|[\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}]/u;
 
-// ── secrets (mirror of SECRET_PATTERNS) ──
+// ── secrets ──
 export const SECRET_PATTERNS = [
-  { name: 'Stripe live key', re: /sk_live_[0-9a-zA-Z]{16,}/ },
-  { name: 'OpenAI key', re: /sk-[A-Za-z0-9]{20,}/ },
-  { name: 'AWS access key id', re: /AKIA[0-9A-Z]{16}/ },
+  // Prefix-style keys are \b-anchored (backend parity, checks/patterns.ts): a
+  // slug that merely CONTAINS the prefix ("task-0123456789abcdefghij",
+  // "disk-…") must not read as a live credential — these are CRITICAL and BLOCK.
+  { name: 'Stripe live key', re: /\bsk_live_[0-9a-zA-Z]{16,}/ },
+  { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
+  { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
   { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
   { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
   { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
@@ -84,7 +135,7 @@ export const RISKY_CONFIG_MARKERS = [
   'disable safety', 'bypass approval', 'full access', 'unrestricted',
 ];
 
-// ── PII (mirror of PII_PATTERNS + Luhn gate in checks/text-inspector.ts) ──
+// ── PII (patterns + Luhn gate) ──
 export const PII_PATTERNS = [
   { name: 'Email address', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
   { name: 'US SSN', re: /\b\d{3}-\d{2}-\d{4}\b/ },
@@ -92,6 +143,10 @@ export const PII_PATTERNS = [
   { name: 'Phone number', re: /\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/ },
   { name: 'IPv4 address', re: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/ },
 ];
+// Reserved / RFC-1918 / doc / public-DNS IPs (not personal data), and a version
+// context ("v1.0.0.0") that merely looks like an IP.
+const RESERVED_IPV4 = /^(0\.|255\.255\.255\.255|127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.|8\.8\.(8\.8|4\.4)|1\.1\.1\.1|1\.0\.0\.1|224\.)/;
+const VERSION_CONTEXT = /\b(v|ver|version|release|rev|build|semver|tag)\.?\s*$/i;
 
 // Luhn check keeps the loose credit-card regex from firing on any digit run.
 function luhnValid(value) {
@@ -123,8 +178,67 @@ export function containsAny(haystack, needles) {
   return null;
 }
 
-// Attacker-controlled data sinks (subset of SUSPICIOUS_EGRESS_HOSTS) — a tool
-// call/result referencing one is an exfiltration endpoint.
+// Like containsAny, but the needle must START at a word boundary — 'aws' must
+// not fire inside "flaws", 'cat ' inside "concat ", 'token' is fine ("tokens"
+// still hits: only the START is guarded, because these lists match prose where
+// words inflect at the end). Mirrors the backend's containsWord.
+const WORD_RE_CACHE = new Map();
+function leadingBoundaryRe(needle) {
+  let re = WORD_RE_CACHE.get(needle);
+  if (!re) {
+    const esc = needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    re = new RegExp(/^\w/.test(needle) ? `(?<!\\w)${esc}` : esc, 'i');
+    WORD_RE_CACHE.set(needle, re);
+  }
+  return re;
+}
+export function containsWord(haystack, needles) {
+  const h = String(haystack ?? '');
+  for (const n of needles) if (leadingBoundaryRe(n).test(h)) return n;
+  return null;
+}
+
+// ── risky-config: mention vs configuration ──
+// `\w`-only boundaries, NOT `[\w-]`: markers legitimately butt against dashes
+// (--dangerously-skip-permissions), so excluding '-' would suppress the flag
+// form; excluding `\w` is what stops 'dangerously' firing on
+// dangerouslySetInnerHTML. Mirrors the backend (checks/text-inspector.ts).
+const MARKER_RE_CACHE = new Map();
+function markerRe(marker) {
+  let re = MARKER_RE_CACHE.get(marker);
+  if (!re) {
+    re = new RegExp(`(?<!\\w)${marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?!\\w)`, 'gi');
+    MARKER_RE_CACHE.set(marker, re);
+  }
+  re.lastIndex = 0; // shared instance: an early return leaves lastIndex dirty
+  return re;
+}
+const FLAG_BEFORE = /(?:^|\s)--?[\w-]*$/; // --yolo, --dangerously-skip-permissions
+const ENABLE_AFTER = /^["'`\]]?\s*[:=]/; // "yolo": true, AUTO_APPROVE=1
+const ENABLE_BEFORE = /[:=]\s*["'`\[]?\s*$/; // "mode": "unrestricted" — one delimiter; two (`= ['`) is a definition LIST
+function isEnablement(text, at, len) {
+  const before = text.slice(Math.max(0, at - 24), at);
+  const after = text.slice(at + len, at + len + 12);
+  return FLAG_BEFORE.test(before) || ENABLE_AFTER.test(after) || ENABLE_BEFORE.test(before);
+}
+/**
+ * First occurrence of a risky-config marker that reads as a setting being
+ * ENABLED (word-bounded + enablement-shaped), or null. Unlike the backend twin
+ * this does NOT suppress on the mask: the CLI mask is binary (string ≡ comment),
+ * and JSON config keys ARE string literals — the hooks' codeContext downrank
+ * handles the literal/comment case instead.
+ */
+function riskyConfigHit(text, marker) {
+  const re = markerRe(marker);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (isEnablement(text, m.index, m[0].length)) return { start: m.index, end: m.index + m[0].length };
+  }
+  return null;
+}
+
+// Attacker-controlled data sinks — a tool call/result referencing one is an
+// exfiltration endpoint.
 export const SUSPICIOUS_EGRESS_HOSTS = [
   'webhook.site', 'requestbin', 'pipedream.net', 'ngrok.io', 'ngrok-free.app', 'ngrok.app',
   'trycloudflare.com', 'serveo.net', 'localhost.run', 'interact.sh', 'oastify.com', 'oast.pro',
@@ -138,7 +252,7 @@ export const SUSPICIOUS_EGRESS_HOSTS = [
 const SEV_RANK = { INFO: 1, LOW: 2, MEDIUM: 3, HIGH: 4, CRITICAL: 5 };
 
 // Decode suspicious base64 blobs so payloads hidden in an "echo <blob>|base64 -d|sh"
-// trick are inspected too. We decode purely to READ the bytes; nothing runs.
+// trick are inspected too. Decoding is purely to READ the bytes; nothing runs.
 const BASE64_BLOB_RE = /\b[A-Za-z0-9+/]{32,}={0,2}/g;
 const DECODED_PAYLOAD_RE = /(\/bin\/(ba|z|k)?sh|\b(ba|z|k)?sh\s+-c|\bcurl\b|\bwget\b|\beval\b|\bexec\b|https?:\/\/|invoke-expression|\biex\b|powershell|\bnc\b|\bncat\b|\bchmod\b|\bbase64\b)/i;
 function deobfuscate(text) {
@@ -154,11 +268,26 @@ function deobfuscate(text) {
   return { text: decoded.length ? `${text}\n${decoded.join('\n')}` : text, decodedPayload: decoded.length > 0 };
 }
 
-/** Reference to a known exfiltration sink host, or null. */
+/**
+ * Reference to a known exfiltration sink host, or null. Host-boundary matched,
+ * NOT a raw substring — `includes('ix.io')` fired inside "matrix.io" and
+ * `includes('file.io')` inside "profile.io", and this feeds a HIGH/FLAG on live
+ * tool calls. The char before must not be a host label char (a leading '.' IS
+ * allowed so "paste.c-net.org" still hits); the char after must end the host.
+ */
+const EGRESS_RE_CACHE = new Map();
+function egressHostRe(host) {
+  let re = EGRESS_RE_CACHE.get(host);
+  if (!re) {
+    re = new RegExp(`(^|[^a-z0-9-])${host.replace(/[.]/g, '\\.')}($|[^a-z0-9.-])`, 'i');
+    EGRESS_RE_CACHE.set(host, re);
+  }
+  return re;
+}
 export function egressHost(text) {
   if (!text) return null;
   const low = text.toLowerCase();
-  return SUSPICIOUS_EGRESS_HOSTS.find((h) => low.includes(h)) ?? null;
+  return SUSPICIOUS_EGRESS_HOSTS.find((h) => egressHostRe(h).test(low)) ?? null;
 }
 
 /** 1-based line number of a character offset inside `text`. */
@@ -215,13 +344,8 @@ function codeMask(text) {
   while (i < n) {
     const c = text[i], c2 = text[i + 1];
     if (state === 0) {
-      if (c === "'") { state = 1; mask[i++] = 1; continue; }
-      if (c === '"') { state = 2; mask[i++] = 1; continue; }
-      if (c === '`') { state = 3; mask[i++] = 1; continue; }
-      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
-      if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
-      if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
-      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
+      // The fence test MUST precede the backtick-string test, or ``` is consumed
+      // as a template-literal opener and the fence handler below never runs.
       if (text.startsWith('```', i) || text.startsWith('~~~', i)) { // fenced block → mask the whole span, delimiters included
         const fence = text.slice(i, i + 3);
         const nl = text.indexOf('\n', i);
@@ -234,6 +358,13 @@ function codeMask(text) {
         for (let k = i; k < end; k++) mask[k] = 1;
         prevSig = ''; i = end; continue;
       }
+      if (c === "'") { state = 1; mask[i++] = 1; continue; }
+      if (c === '"') { state = 2; mask[i++] = 1; continue; }
+      if (c === '`') { state = 3; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
+      if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
+      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
       if (c === '/' && REGEX_START.has(prevSig)) { state = 7; inClass = false; mask[i++] = 1; continue; }
       if (!/\s/.test(c)) prevSig = c;
       i++;
@@ -305,12 +436,27 @@ export function localScan(text, opts = {}) {
   if (cats.includes('shell')) {
     const aug = deobfuscate(t);
     if (aug.decodedPayload) findings.push({ label: 'Base64-encoded shell / RCE payload', severity: 'CRITICAL', category: 'shell' });
-    for (const sig of DANGEROUS_SHELL) if (sig.re.test(aug.text)) findings.push({ label: sig.name, severity: sig.severity, category: 'shell', ...locate(t, sig.re, mask) });
+    for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, aug.text)) findings.push({ label: sig.name, severity: sig.severity, category: 'shell', ...locate(t, sig.re, mask) });
   }
   if (cats.includes('injection')) {
     const low = t.toLowerCase();
-    for (const p of INJECTION_PHRASES) if (low.includes(p)) { findings.push({ label: `Injected instruction: "${p}"`, severity: 'HIGH', category: 'injection', ...locate(t, p, mask) }); break; }
-    for (const { label, re } of INJECTION_REGEXES) if (re.test(t)) findings.push({ label, severity: 'HIGH', category: 'injection', ...locate(t, re, mask) });
+    // First NON-NEGATED phrase (a negation right before flips it into a hardening
+    // rule — "never ignore previous instructions").
+    for (const p of INJECTION_PHRASES) {
+      const at = low.indexOf(p);
+      if (at < 0) continue;
+      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      findings.push({ label: `Injected instruction: "${p}"`, severity: 'HIGH', category: 'injection', ...locate(t, p, mask) });
+      break;
+    }
+    for (const { label, re } of INJECTION_REGEXES) {
+      const m = t.match(re);
+      if (!m) continue;
+      const at = m.index ?? 0;
+      if (PRECEDING_NEGATION.test(t.slice(Math.max(0, at - 20), at))) continue;
+      if (label === 'Bulk destructive command' && BUILD_ARTIFACT.test(m[0])) continue; // build/test cleanup
+      findings.push({ label, severity: 'HIGH', category: 'injection', ...locate(t, re, mask) });
+    }
     if (INVISIBLE_CHARS_RE.test(t)) findings.push({ label: 'Invisible / zero-width characters', severity: 'MEDIUM', category: 'injection', ...locate(t, INVISIBLE_CHARS_RE, mask) });
   }
   if (cats.includes('secret')) {
@@ -321,12 +467,30 @@ export function localScan(text, opts = {}) {
       const m = t.match(re);
       if (!m) continue;
       if (name === 'Credit card number' && !luhnValid(m[0])) continue; // gate the loose CC regex
+      // Infra / reserved / doc / public-DNS IPs and version strings ("v1.0.0.0")
+      // are not personal data.
+      if (name === 'IPv4 address') {
+        if (RESERVED_IPV4.test(m[0])) continue;
+        if (VERSION_CONTEXT.test(t.slice(Math.max(0, (m.index ?? 0) - 12), m.index ?? 0))) continue;
+      }
+      // A separator-less digit run is an ID / Unix timestamp, not a phone number.
+      if (name === 'Phone number' && /^\d+$/.test(m[0])) continue;
       findings.push({ label: `Personal data: ${name}`, severity: 'MEDIUM', category: 'pii', ...locate(t, re, mask) });
     }
   }
   if (cats.includes('config')) {
-    const low = t.toLowerCase();
-    for (const m of RISKY_CONFIG_MARKERS) if (low.includes(m)) { findings.push({ label: `Risky setting: "${m}"`, severity: 'MEDIUM', category: 'config', ...locate(t, m, mask) }); break; }
+    // A marker counts only where a setting is being TURNED ON — `"yolo": true`,
+    // AUTO_APPROVE=1, --dangerously-skip-permissions — not merely named:
+    // 'dangerously' inside dangerouslySetInnerHTML, a marker-definition array
+    // (this very file), "yolo mode" in prose. Word-bounded + enablement-gated,
+    // skipping comment/fence mentions; mirrors the backend's riskyConfigHit.
+    for (const m of RISKY_CONFIG_MARKERS) {
+      const hit = riskyConfigHit(t, m);
+      if (hit) {
+        findings.push({ label: `Risky setting: "${m}"`, severity: 'MEDIUM', category: 'config', line: lineAt(t, hit.start), codeContext: mask[hit.start] === 1 });
+        break;
+      }
+    }
   }
   if (cats.includes('egress')) {
     const h = egressHost(t);
@@ -352,7 +516,7 @@ export function downrankCodeContext(findings) {
 }
 
 // ── local artifact gate (offline `shomra gate`) ──
-// Social-engineering "install-lure" prose (mirror of INSTALL_LURE server-side).
+// Social-engineering "install-lure" prose.
 const INSTALL_LURE = [
   { name: 'Instructs downloading an executable/archive to run', re: /\b(download|install|fetch|grab|extract)\b[^\n]{0,180}\.(zip|exe|dmg|pkg|msi|bin|appimage|jar|scr|apk|deb|rpm|tar\.gz|tgz)\b/i, severity: 'MEDIUM' },
   { name: 'Password-protected archive (evades AV / scanners)', re: /\b(extract|unzip|decompress|archive|zip|password)\b[^\n]{0,50}\b(pass(word|phrase)?|pwd)\s*[:=]\s*\S/i, severity: 'HIGH' },
@@ -360,7 +524,7 @@ const INSTALL_LURE = [
   { name: 'Coercion: re-run / retry until it succeeds', re: /\b(re-?run (if needed|until|the command)|run (it |the command )?again|try again after)/i, severity: 'LOW' },
 ];
 
-// ── typosquat / malicious-package intel (mirror of checks/patterns.ts) ──
+// ── typosquat / malicious-package intel ──
 const MALICIOUS_PACKAGE_SEED = new Set([
   'event-stream', 'eslint-scope-malware', 'electron-native-notify', 'rc-malware',
   'crossenv', 'mongose', 'expresss',
@@ -447,7 +611,7 @@ function frontmatter(text) {
   return data;
 }
 
-// ── structured MCP-config checks (mirror of ArtifactAnalyzerService.checkMcpConfig) ──
+// ── structured MCP-config checks ──
 // Parses the JSON and inspects each server: plaintext HTTP (weak auth), a
 // hard-coded secret in the env block / launch line, and a typosquat / known-
 // malicious launch package — structural findings a raw-text scan can't produce.
@@ -486,7 +650,7 @@ function localMcp(content) {
   return out;
 }
 
-// ── structured agent-card checks (mirror of checkAgentCard endpoint analysis) ──
+// ── structured agent-card checks ──
 // Grades every URL the card declares (assessUrl: metadata SSRF, private-network
 // pivot, plaintext, raw IP) and flags a public card with no auth scheme.
 function localAgentCard(content) {
@@ -518,7 +682,7 @@ function localAgentCard(content) {
   return out;
 }
 
-// ── slash-command extras (mirror of checkCommand: `!`-bang + `@`-file) ──
+// ── slash-command extras (`!`-bang + `@`-file) ──
 function localCommandExtras(content) {
   const out = [];
   const body = content || '';
@@ -533,7 +697,7 @@ function localCommandExtras(content) {
   return out;
 }
 
-// ── memory / rules poisoning (mirror of bundle/memory-signals.ts analyzeMemory) ──
+// ── memory / rules poisoning ──
 // A persistent memory note or an AI rules file (CLAUDE.md, .cursorrules, …) is
 // re-injected as high-authority context every session. This grades the two by a
 // different baseline: MEMORY should record facts (any standing directive is
@@ -587,7 +751,7 @@ function scanDirectives(text) {
  * 'MEMORY' (agent-writable scratchpad — any standing directive is anomalous) or
  * 'INSTRUCTION' (curated rules file — only universally-malicious signals count).
  * Returns findings shaped like localGate's ({ severity, title, remediationText,
- * line }). Faithful to bundle/memory-signals.ts analyzeMemory.
+ * line }).
  */
 export function localMemory(content, { kind = 'MEMORY' } = {}) {
   const text = content || '';
@@ -622,10 +786,10 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
 
   // Executable payload / egress sink / lifecycle-hook references have no business
   // in a note or rules file.
-  for (const sig of DANGEROUS_SHELL) if (sig.re.test(text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
+  for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
   const host = egressHost(text);
   if (host) push('HIGH', `${isInstruction ? 'Rules file' : 'Memory'} references a data-exfiltration host (${host})`, 'Remove the reference and roll back to the approved baseline.', host);
-  if (hasImperative && containsAny(text, SENSITIVE_READ) && containsAny(text, NETWORK_VERBS)) {
+  if (hasImperative && containsWord(text, SENSITIVE_READ) && containsWord(text, NETWORK_VERBS)) {
     push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.');
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
@@ -645,7 +809,7 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   return findings.filter((f) => (seen.has(f.title) ? false : (seen.add(f.title), true)));
 }
 
-// Basenames of AI rules / instruction files (mirror of INSTRUCTION_BASENAMES).
+// Basenames of AI rules / instruction files.
 const INSTRUCTION_BASENAMES = new Set([
   'claude.md', 'agents.md', 'agent.md', 'gemini.md', 'llms.txt', 'llms-full.txt',
   '.cursorrules', '.windsurfrules', '.clinerules', '.aiderrules', '.continuerules',
@@ -734,8 +898,8 @@ export function localGate(content, { kind, path } = {}) {
 }
 
 // Deterministic verdict + 0–100 risk score for a set of findings, aligned with
-// the server default policy (any CRITICAL → BLOCK, any HIGH → FLAG) and the
-// SEVERITY_WEIGHT scale. Exported so callers that fold in extra findings (e.g.
+// the server default policy: any CRITICAL → BLOCK, any HIGH → FLAG.
+// Exported so callers that fold in extra findings (e.g.
 // the CLI merging bundled-script SAST hits) re-grade the same way.
 export function grade(findings) {
   const WEIGHT = { INFO: 2, LOW: 8, MEDIUM: 20, HIGH: 40, CRITICAL: 70 };

package/model-refs.mjs

@@ -43,12 +43,20 @@ const TORCH_HUB = /torch\.hub\.load\s*\(\s*['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][
 
 // Reject ids that are really file paths, packages, or non-model strings.
 const ASSET_EXT = /\.(py|pyc|ipynb|[mc]?[jt]sx?|json|ya?ml|toml|txt|md|lock|cfg|ini|sh|env|png|jpg|svg|css|html?|csv|tsv|parquet)$/i;
+// First path segment on huggingface.co that is a SITE section, not an org — so
+// huggingface.co/docs/datasets isn't mistaken for the model "docs/datasets".
+const NONMODEL_ORGS = new Set([
+  'docs', 'blog', 'spaces', 'datasets', 'models', 'join', 'login', 'settings',
+  'pricing', 'tasks', 'learn', 'papers', 'collections', 'organizations', 'new',
+  'search', 'chat', 'posts', 'enterprise', 'inference-endpoints',
+]);
 function looksLikeModelId(id) {
   if (!id || id.startsWith('@') || id.startsWith('.') || id.startsWith('/')) return false;
   if (id.includes('..') || id.split('/').length !== 2) return false;
   if (ASSET_EXT.test(id)) return false; // a model id never ends in a code/asset ext
   const [a, b] = id.split('/');
   if (!/[A-Za-z]/.test(a) || !/[A-Za-z]/.test(b)) return false; // kills "123/456"
+  if (NONMODEL_ORGS.has(a.toLowerCase())) return false; // site path, not an org
   return true;
 }
 // A bare id (no org) from a high-confidence position — accept unless it's clearly

package/package.json

@@ -1,51 +1,51 @@
-{
-  "name": "@shomra/agent",
-  "version": "0.2.4",
-  "description": "Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.",
-  "type": "module",
-  "bin": {
-    "shomra": "./shomra.mjs"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "scripts": {
-    "test": "node --test \"tests/**/*.test.mjs\""
-  },
-  "files": [
-    "shomra.mjs",
-    "discovery.mjs",
-    "guard-signals.mjs",
-    "code-sast.mjs",
-    "model-refs.mjs",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ],
-  "keywords": [
-    "ai-security",
-    "mcp",
-    "prompt-injection",
-    "sast",
-    "static-analysis",
-    "supply-chain",
-    "ci",
-    "sarif",
-    "llm",
-    "agent-security",
-    "devsecops"
-  ],
-  "homepage": "https://shomra.ai",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/shomra-org/agent.git"
-  },
-  "bugs": {
-    "url": "https://github.com/shomra-org/agent/issues"
-  },
-  "author": "Shomra",
-  "license": "Apache-2.0",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@shomra/agent",
+  "version": "0.2.7",
+  "description": "Shomra — a local-first security scanner and runtime firewall for AI agents, MCP servers, prompts, and models. Gates AI artifacts in your editor and CI.",
+  "type": "module",
+  "bin": {
+    "shomra": "./shomra.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
+  "files": [
+    "shomra.mjs",
+    "discovery.mjs",
+    "guard-signals.mjs",
+    "code-sast.mjs",
+    "model-refs.mjs",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "keywords": [
+    "ai-security",
+    "mcp",
+    "prompt-injection",
+    "sast",
+    "static-analysis",
+    "supply-chain",
+    "ci",
+    "sarif",
+    "llm",
+    "agent-security",
+    "devsecops"
+  ],
+  "homepage": "https://shomra.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shomra-org/agent.git"
+  },
+  "bugs": {
+    "url": "https://github.com/shomra-org/agent/issues"
+  },
+  "author": "Shomra",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/shomra.mjs

@@ -15,12 +15,25 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import { discoverAll } from './discovery.mjs';
 import { localScan, localGate, grade, downrankCodeContext, SECRET_PATTERNS } from './guard-signals.mjs';
 import { scanSourceFile, isScannableSource, isModelConfig } from './code-sast.mjs';
 import { scanModelRefs, isModelRefScannable } from './model-refs.mjs';
 
-const VERSION = '0.2.0';
+// Read from package.json rather than hardcoding: the two spellings drifted (this
+// const said 0.2.0 while the package was already 0.2.4), so `shomra --version`
+// and the `x-shomra-agent` header both under-reported the running build — which
+// is exactly the value you need to trust when triaging a bad scan in the field.
+// Falls back to the package version being unreadable rather than crashing the CLI.
+const VERSION = (() => {
+  try {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return JSON.parse(fs.readFileSync(path.join(here, 'package.json'), 'utf8')).version ?? '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+})();
 const CONFIG_DIR = path.join(os.homedir(), '.shomra');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 
@@ -310,7 +323,7 @@ async function sendReport(cfg, assets, flags) {
 }
 
 // Human name for a key scope, inferred from its prefix. Accepts the current
-// `shm_` prefix and the legacy pre-rebrand `dgx_` (older keys keep working).
+// `shm_` prefix and the legacy `dgx_` one, so older keys keep working.
 function keyScope(key) {
   if (!key) return null;
   if (/^(shm|dgx)_gw_/.test(key)) return 'gateway';
@@ -324,7 +337,7 @@ function cmdStatus() {
   const enrolled = !!apiKey;
   console.log(bold(cyan('\n  Shomra agent')) + dim(` v${VERSION}`));
 
-  // Mode banner — the whole point: what works right now, and what a key adds.
+  // Mode banner — what works right now, and what a key adds.
   if (enrolled) {
     console.log(`  ${dim('Mode     ')} ${green('● Enrolled')} ${dim(`(${keyScope(apiKey)} key)`)} — org policy, platform AI & dashboard telemetry active`);
   } else {
@@ -473,7 +486,7 @@ async function cmdGate(flags, positional) {
   const cfg = loadConfig();
   const { apiKey, url } = resolveSettings(cfg);
 
-  // Batch mode: gate every AI artifact under a directory (the CI story).
+  // Batch mode: gate every AI artifact under a directory.
   if (flags.all) {
     return cmdGateAll(flags, positional, { apiKey, url });
   }
@@ -576,7 +589,7 @@ async function cmdGate(flags, positional) {
 // usual env var (the SDK sends it; Shomra passes it through) — or set the org
 // key on the backend and use your shm_ key as the provider key.
 //
-// Providers mirror the backend registry (UPSTREAM in llm-proxy.service.ts):
+// Providers mirror the backend registry:
 // openai + every OpenAI-compatible API (groq/mistral/xai/deepseek/openrouter/
 // together) speak the OpenAI wire format; anthropic and gemini have their own.
 
@@ -1041,9 +1054,8 @@ async function gateArtifactList(artifacts, { apiKey, url, env, flags, root }) {
     prepared.push({ a, content, local, sast });
   }
 
-  // ── Phase 2: backend enrich, BOUNDED-PARALLEL (was one sequential round-trip
-  //    per artifact). Order-preserving; on the first outage stop starting new
-  //    calls (a down backend never costs N timeouts).
+  // ── Phase 2: backend enrich, BOUNDED-PARALLEL. Order-preserving; on the first
+  //    outage stop starting new calls (a down backend never costs N timeouts).
   const server = new Array(prepared.length).fill(null);
   if (apiKey) {
     const conc = clampInt(process.env.SHOMRA_GATE_CONCURRENCY, 8, 1, 32);
@@ -1348,7 +1360,6 @@ function gitChangedVsBase(root, base) {
 const GH_LEVEL = { CRITICAL: 'failure', HIGH: 'failure', MEDIUM: 'warning', LOW: 'notice', INFO: 'notice' };
 
 async function cmdPr(flags, positional) {
-  // Scaffold the workflow and exit.
   if (flags.init) {
     const wf = path.resolve('.github/workflows/shomra.yml');
     if (fs.existsSync(wf) && !flags.force) { console.error(red('✗') + ` ${path.relative(process.cwd(), wf)} exists. Use ${bold('--force')}.`); process.exit(1); }
@@ -2106,8 +2117,8 @@ async function cmdMemoryScan(flags, positional) {
 //
 // Replays the adversarial scenario library against your OWN LLM Guard (probe
 // mode — nothing is persisted as a real attack) or model, scores resilience,
-// and flags regressions vs the previous run. Great in CI: gate a merge/deploy
-// on `--min <resilience>` and/or `--fail-on-regression`. Exit: 0 = pass,
+// and flags regressions vs the previous run. In CI, gate a merge/deploy on
+// `--min <resilience>` and/or `--fail-on-regression`. Exit: 0 = pass,
 // 2 = below the resilience floor or a regression appeared.
 
 async function cmdRedteam(flags) {
@@ -2241,7 +2252,7 @@ async function cmdCampaign(flags) {
 // signatures for whatever breached, verifies each against a benign corpus (must
 // catch the attack AND cause zero false positives), and — with --apply — pushes
 // the survivors live as a SignaturePack (no redeploy) and re-runs to prove the
-// resilience lift. Great as a scheduled CI step after `shomra redteam`.
+// resilience lift. Suited to a scheduled CI step after `shomra redteam`.
 async function cmdHarden(flags) {
   const cfg = loadConfig();
   const { apiKey, url } = resolveSettings(cfg);
@@ -2303,8 +2314,8 @@ async function cmdHarden(flags) {
 // distinct principal and authorize every call against its capability policy.
 // Present the handle via SHOMRA_AGENT (or --agent-id); govern its capabilities,
 // approve break-glass requests and revoke it (a live kill-switch) in the
-// dashboard. Listing/governing is JWT-only (server.approve) — not exposed to a
-// machine key — so the CLI only self-registers.
+// dashboard. Listing/governing is JWT-only — not exposed to a machine key — so
+// the CLI only self-registers.
 async function cmdAgentIdentity(flags, positional) {
   const sub = (positional[0] || 'register').toLowerCase();
   const cfg = loadConfig();
@@ -2375,14 +2386,13 @@ function resolveAgentIdentityHandle(flags) {
 //              Shomra LLM Guard proxy instead of a tool hook (.aider.conf.yml).
 // `shomra install-hook --agent <name>` writes the right shape; the installed
 // hook command carries `--agent <name>` so tool-guard/result-guard know which
-// contract to speak at runtime. Default agent is `claude` (unqualified hooks
-// installed before multi-agent support existed still work unchanged).
+// contract to speak at runtime. Default agent is `claude`, so an unqualified
+// hook invocation keeps working.
 //
-// These hook systems are new and still moving fast — if a hook silently stops
-// firing after a CLI/extension update, check that agent's current docs before
-// assuming Shomra is broken; each adapter is isolated below so a schema tweak
-// is a small, local edit. Fail-OPEN by default (never break the session if
-// the backend is down) — set SHOMRA_GUARD_STRICT=1 to fail closed.
+// Vendor hook schemas change often, and a drifted schema shows up as a hook that
+// silently stops firing. Each adapter below is isolated so tracking a change is a
+// local edit. Fail-OPEN by default (never break the session if the backend is
+// down) — set SHOMRA_GUARD_STRICT=1 to fail closed.
 
 const AGENT_LABELS = {
   claude: 'Claude Code',
@@ -2563,7 +2573,7 @@ const AGENT_INSTALLERS = {
   // Cline (VS Code) is tool-dispatching like Claude Code, so it gets a real
   // blocking pre/post hook in the same grouped shape. Matcher covers Cline's
   // tool vocabulary (execute_command/write_to_file/replace_in_file/use_mcp_tool),
-  // all of which ToolGuardService already recognises.
+  // all of which the server-side guard already recognises.
   cline(global) {
     const dir = global ? path.join(os.homedir(), '.cline') : path.join(process.cwd(), '.cline');
     const file = path.join(dir, 'hooks.json');
@@ -2610,9 +2620,9 @@ const AGENT_INSTALLERS = {
 };
 
 // Normalize each agent's own hook payload into the {tool_name, tool_input,
-// tool_response, cwd, session_id} shape ToolGuardService/ToolResultGuardService
-// already understand (they already recognize Cursor/Cline/Aider-style tool
-// names like run_terminal_cmd/create_file — see tool-guard.service.ts).
+// tool_response, cwd, session_id} shape the server-side guards already
+// understand — including Cursor/Cline/Aider-style tool names like
+// run_terminal_cmd/create_file.
 function normalizeGuardInput(agent, payload) {
   switch (agent) {
     case 'cursor': {
@@ -2665,7 +2675,7 @@ function normalizeGuardInput(agent, payload) {
 
 // ── tiered-guard classification (Tier 0 local vs Tier 2 escalate) ──
 // Paths that ARE an AI artifact — a write here is install-time behaviour the
-// server's full gate must vet against org policy (mirror of PATH_KIND server-side).
+// server's full gate must vet against org policy.
 const ARTIFACT_PATH_RE = /(^|\/)(\.?mcp\.json|SKILL\.md|CLAUDE\.md|AGENTS\.md|GEMINI\.md|\.cursorrules|\.windsurfrules|\.aider\.conf\.yml|agent[-_]card\.json)$|(^|\/)\.claude\/(commands|agents)\/[^/]+\.md$|(^|\/)\.claude\/settings(\.local)?\.json$|(^|\/)\.well-known\/agent(-card)?\.json$|(^|\/)\.clinerules|(^|\/)\.github\/copilot-instructions\.md$/i;
 const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'create_file', 'str_replace_editor', 'str_replace_based_edit_tool', 'write_to_file', 'replace_in_file', 'new_rule']);
 const SHELL_TOOLS_RE = /^(bash|shell|sh|run_command|run_terminal_cmd|execute_command|terminal|exec)$/i;
@@ -2689,7 +2699,7 @@ function guardText(tool, input) {
 }
 
 // ── false-positive control: path allowlist for the runtime hooks ──────────────
-// The static `shomra check` honors .shomraignore; the runtime firewall didn't.
+// Both the static `shomra check` and the runtime firewall honor .shomraignore.
 // A dev needs a friction-free way to mark files known-safe (the security tool's
 // own detection source, test fixtures, generated code) so a benign pattern in
 // source isn't withheld. Two layers, both keyed on the target file path: a repo
@@ -2833,9 +2843,17 @@ async function screenModelLoad(agent, tool, input, url) {
   if (!refs.length) return; // modelLookup is cache-first + breaker-aware, so don't bail here
 
   const flagged = [];
+  // ONE budget for the whole screen, not one per ref. This runs inside the
+  // PreToolUse hook, so its cost is added to a tool call the dev is watching: a
+  // file citing five uncached models must not be able to spend 5× the guard
+  // timeout. Cache hits and a tripped breaker short-circuit before any network,
+  // so the common path never touches this.
+  const deadline = Date.now() + guardTimeoutMs();
   for (const r of refs) {
+    const left = deadline - Date.now();
+    if (left <= 0) break; // budget spent — flag what we screened, never stall the call
     let lk;
-    try { lk = await modelLookup(url, r.id, r.revision); } catch { return; } // uncached + backend down → can't judge, stay silent
+    try { lk = await modelLookup(url, r.id, r.revision, left); } catch { return; } // uncached + backend down → can't judge, stay silent
     const findings = (lk && lk.findings) || [];
     const worst = findings.reduce((m, f) => Math.max(m, MODEL_SEV_RANK[f.severity] || 0), 0);
     const bad = lk && lk.found && (lk.verdict === 'FAIL' || lk.verdict === 'REVIEW' || worst >= MODEL_SEV_RANK.HIGH);
@@ -3006,6 +3024,26 @@ async function cmdToolGuard(flags) {
       signal: ctrl.signal,
     });
     clearTimeout(timer);
+    // fetch() does NOT reject on 4xx/5xx. Without this check a rejected key
+    // returned its error body, r.json() parsed it happily, breakerReset() marked
+    // the backend healthy, res.decision came back undefined — and every
+    // escalated call silently ALLOWed. Org policy off, no error, no breaker, no
+    // signal, indefinitely. Non-2xx must reach the failure path below.
+    if (!r.ok) {
+      // An auth failure is a misconfiguration, not an outage: it will not heal
+      // on its own, so it gets a visible line rather than a 30s breaker cooldown
+      // that would hide it (and skip even this warning on the calls after it).
+      if (r.status === 401 || r.status === 403) {
+        process.stderr.write(
+          `[shomra] guard NOT enforced: the backend rejected this API key (HTTP ${r.status}). ` +
+            `Local Tier-0 screening still ran; org policy, agent identity and flow control did not. ` +
+            `Re-enroll with \`shomra init --key <key>\`.\n`,
+        );
+        if (strict) emitGuardDeny(agent, `Shomra guard could not authenticate (HTTP ${r.status}); blocked by fail-closed policy.`);
+        process.exit(0);
+      }
+      throw new Error(`HTTP ${r.status}`); // 5xx / 429 → a real outage, trip the breaker
+    }
     res = await r.json();
     breakerReset(); // healthy response — clear any tripped breaker
   } catch (e) {
@@ -3098,6 +3136,20 @@ async function cmdResultGuard(flags) {
       signal: ctrl.signal,
     });
     clearTimeout(timer);
+    // See cmdToolGuard: fetch() does not reject on 4xx, so an error body would
+    // parse cleanly and `res.decision` would be undefined → silent fail-open.
+    if (!r.ok) {
+      if (r.status === 401 || r.status === 403) {
+        process.stderr.write(
+          `[shomra] result-guard NOT enforced: the backend rejected this API key (HTTP ${r.status}). ` +
+            `Local Tier-0 screening still ran; server-side flow taint did not. ` +
+            `Re-enroll with \`shomra init --key <key>\`.\n`,
+        );
+        if (strict) emitResultBlock(agent, `Shomra result-guard could not authenticate (HTTP ${r.status}); blocked by fail-closed policy.`);
+        process.exit(0);
+      }
+      throw new Error(`HTTP ${r.status}`); // 5xx / 429 → a real outage, trip the breaker
+    }
     res = await r.json();
     breakerReset();
   } catch (e) {
@@ -3115,9 +3167,8 @@ async function cmdResultGuard(flags) {
 }
 
 // Wire the runtime firewall into one or more coding agents' hook systems.
-// Default (no --agent) targets Claude Code only, unchanged from before
-// multi-agent support existed. `--agent cursor,windsurf` or `--agent all`
-// installs into others too.
+// Default (no --agent) targets Claude Code only. `--agent cursor,windsurf` or
+// `--agent all` installs into others too.
 function cmdInstallHook(flags) {
   const global = !!flags.global;
   const requested = flags.agent
@@ -3163,8 +3214,8 @@ function cmdInstallHook(flags) {
 //
 // Discovers the AI tooling on this box (coding agents, MCP servers, rules files,
 // model keys, AI tools), locally scans the scannable ones, and prints a posture
-// score + the top fixes. Zero backend needed — the fastest "show a colleague"
-// first-run. Pairs with `shomra protect` (unguarded agents) and `shomra check`.
+// score + the top fixes. Runs fully offline. Pairs with `shomra protect`
+// (unguarded agents) and `shomra check`.
 function cmdDoctor(flags) {
   const assets = discoverAll();
   const by = (t) => assets.filter((a) => a.type === t);
@@ -3240,9 +3291,8 @@ function cmdDoctor(flags) {
 //   shomra protect [--local] [--force]
 //
 // `install-hook` protects one named agent; this discovers every supported coding
-// agent on the machine and wires the Pre/Post firewall for each unguarded one —
-// the zero-friction "seatbelt on everything" button. Global (machine-wide) by
-// default; --local scopes to this repo's .<agent> dirs.
+// agent on the machine and wires the Pre/Post firewall for each unguarded one.
+// Global (machine-wide) by default; --local scopes to this repo's .<agent> dirs.
 function cmdProtect(flags) {
   const assets = discoverAll();
   const labelToKey = Object.fromEntries(Object.entries(AGENT_LABELS).map(([k, v]) => [v, k]));
@@ -3280,7 +3330,7 @@ function cmdProtect(flags) {
 //
 // Generates the artifact from a least-privilege template (explicit narrow tool
 // grants, env-referenced secrets, https + auth on cards) and gates it to prove
-// it starts clean — "the right thing is the default thing."
+// it starts clean.
 const NEW_TEMPLATES = {
   skill: (name) => ({
     file: path.join(name, 'SKILL.md'),
@@ -3331,7 +3381,6 @@ function cmdNew(flags, positional) {
   }
   fs.mkdirSync(path.dirname(target), { recursive: true });
   fs.writeFileSync(target, content);
-  // Prove it starts clean.
   const g = localGate(content, { kind: kind === 'agent-card' ? 'agent-card' : kind === 'mcp' ? 'mcp' : kind === 'rules' ? 'rules' : kind, path: file });
   if (flags.json) { console.log(JSON.stringify({ created: file, kind, verdict: g.verdict }, null, 2)); return; }
   console.log(`\n  ${green('✓ Created')} ${bold(file)} ${dim(`(${kind})`)}`);
@@ -3409,7 +3458,7 @@ function worstMcpVerdict(local, idxAlert) {
  * the LLM can call Shomra's checks as native tools in its own loop: after it
  * edits files it can `shomra_check` / `shomra_scan_models`, then `shomra_fix`.
  * Each tool is a thin bridge to the corresponding CLI verb with `--json`, so it
- * reuses the exact same engine as the CLI and editor — one engine, another face.
+ * reuses the same engine as the CLI and editor.
  */
 async function cmdMcpServe(flags) {
   const { createInterface } = await import('node:readline');
@@ -3550,7 +3599,6 @@ async function cmdMcp(flags, positional) {
     return;
   }
 
-  // Merge into the target config.
   let cfg = {};
   if (fs.existsSync(configFile)) { try { cfg = JSON.parse(fs.readFileSync(configFile, 'utf8')); } catch { console.error(red('✗') + ` ${configFile} is not valid JSON.`); process.exit(1); } }
   cfg.mcpServers = cfg.mcpServers || {};
@@ -3685,7 +3733,11 @@ function modelCacheOff() { return process.env.SHOMRA_MODEL_CACHE === '0' || Stri
 function loadModelCache() { try { return JSON.parse(fs.readFileSync(MODEL_CACHE_FILE, 'utf8')) || {}; } catch { return {}; } }
 function saveModelCache(c) { try { fs.mkdirSync(CONFIG_DIR, { recursive: true }); fs.writeFileSync(MODEL_CACHE_FILE, JSON.stringify(c)); } catch { /* cache is best-effort */ } }
 
-async function modelLookup(url, id, sha) {
+// `timeoutMs` overrides the interactive API budget. The PreToolUse hook MUST
+// pass the guard budget: this function's default is sized for a human waiting on
+// `shomra models`, and inheriting it on the hot path froze a dev's terminal for
+// 15s per uncached ref against a cold backend.
+async function modelLookup(url, id, sha, timeoutMs) {
   const key = `${id}@${sha || 'latest'}`;
   const ttl = clampInt(process.env.SHOMRA_MODEL_CACHE_TTL_MS, 7 * 24 * 3600 * 1000, 0, 365 * 24 * 3600 * 1000);
   const cache = modelCacheOff() ? {} : loadModelCache();
@@ -3706,7 +3758,7 @@ async function modelLookup(url, id, sha) {
 
   const q = `id=${encodeURIComponent(id)}${sha ? `&sha=${encodeURIComponent(sha)}` : ''}`;
   const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), clampInt(process.env.SHOMRA_API_TIMEOUT_MS, 15000, 1000, 60000));
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs ?? clampInt(process.env.SHOMRA_API_TIMEOUT_MS, 15000, 1000, 60000));
   try {
     const res = await fetch(`${url}/models/lookup?${q}`, { signal: ctrl.signal, headers: { Accept: 'application/json', 'User-Agent': 'shomra-agent' } });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);