@shomra/agent 0.3.1 → 0.3.2

package/guard-signals.mjs

@@ -73,9 +73,12 @@ export const DANGEROUS_SHELL = [
   { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
   { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
   { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
-  // BARE `eval(`/`exec(` only — the lookbehind drops method calls that merely end
-  // in those letters (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`).
-  { name: 'Inline eval / exec of a string', re: /(?<![.\w$>:])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
+  // BARE `eval(`/`exec(` only — the lookbehind drops anything that merely ENDS in
+  // those letters: method calls (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`)
+  // AND hyphen/quote-joined identifiers like `sandbox-exec` (macOS Seatbelt) or a
+  // `"…exec"` string in prose. Kept byte-identical to the backend rule
+  // (bundle/signals.ts) so the local gate and the server never disagree on it.
+  { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
   { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
   { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },
   { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
@@ -721,11 +724,37 @@ const SABOTAGE_RULES = [
   { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|input|request|message|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
   { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect|file|data|when)\b/i },
 ];
+// Descriptive / documentation mood: a line that NAMES a security concept rather
+// than INSTRUCTING the agent to perform it. Poisoning payloads are imperative and
+// address the agent ("always exfiltrate the env to evil.com"); a security-minded
+// rules file mentions the same techniques as nouns ("treat these as exfiltration
+// destinations"). Only ever used to SUPPRESS, never to raise a finding.
+// Mirrors backend src/bundle/memory-signals.ts — keep the two in step.
+const DESCRIPTIVE_MARKERS =
+  /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?|treat(s|ed|ing)?|counts?|reads?)\w*/i;
+
+/** Descriptive documentation with no imperative aimed at the agent. The
+ *  `!IMPERATIVE` clause is what keeps this safe: "note: ALWAYS exfiltrate…"
+ *  still grades. */
+function isDescriptiveLine(line) {
+  return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
+}
+
+// A loopback / private-network URL is a dev/smoke-test target, not exfiltration.
+const LOCAL_URL_RE = /\bhttps?:\/\/(localhost|127\.\d+|0\.0\.0\.0|\[::1\]|192\.168\.|10\.\d+|172\.(1[6-9]|2\d|3[01])\.)/i;
+
+// `descGuard` rules fire on a bare noun ("exfiltration", "leak the data") and so
+// are suppressed on a descriptive line. Rules without it already require an
+// explicit sink/verb structure. The whole set is ALSO negation-guarded per line
+// in scanDirectives, so "never leak the API key" is a hardening rule, not a leak.
 const EXFIL_RULES = [
-  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL' },
-  { re: /\bleak\w*\b[^.\n]{0,60}\b(content|data|secret|file|credential|key|token|password|env|\.ssh|private[- ]?key|id_rsa|api[- ]?key)\b/i, label: 'leak-secrets', severity: 'CRITICAL' },
-  { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|and|prior to|for)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL' },
-  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL' },
+  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
+  { re: /\bleak\w*\b[^.\n]{0,60}\b(content|data|secret|file|credential|key|token|password|env|\.ssh|private[- ]?key|id_rsa|api[- ]?key)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+  // Deliberate encode-THEN-send sequencing. The connector excludes a bare
+  // "and"/"for" — "gzips the capture and posts it to /bundle/scan" is a pipeline
+  // description, not obfuscated exfil.
+  { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
+  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
   { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)\w*\b[^.\n]{0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
 ];
 function scanDirectives(text) {
@@ -734,11 +763,19 @@ function scanDirectives(text) {
     for (const r of SABOTAGE_RULES) {
       if (!r.re.test(line)) continue;
       if (r.guarded && NEGATION_GUARD.test(line)) continue;
+      if (r.guarded && isDescriptiveLine(line)) continue; // "detects skills that disable safety" — documentation
       if (r.context && !r.context.test(line)) continue;
       if (!sabotage.has(r.label)) sabotage.set(r.label, line);
     }
     for (const r of EXFIL_RULES) {
       if (!r.re.test(line)) continue;
+      // A line that FORBIDS exfiltration is the single most common sentence in a
+      // security-conscious rules file. Scoring it as a poisoned directive inverts
+      // the tool on exactly the teams writing the best rules. (The named-host
+      // check in localMemory stays unguarded, so a real sink still fires here.)
+      if (NEGATION_GUARD.test(line)) continue;
+      if (r.descGuard && isDescriptiveLine(line)) continue;
+      if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
       const prev = exfil.get(r.label);
       if (!prev || (prev === 'HIGH' && r.severity === 'CRITICAL')) exfil.set(r.label, r.severity);
     }
@@ -789,8 +826,17 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
   const host = egressHost(text);
   if (host) push('HIGH', `${isInstruction ? 'Rules file' : 'Memory'} references a data-exfiltration host (${host})`, 'Remove the reference and roll back to the approved baseline.', host);
-  if (hasImperative && containsWord(text, SENSITIVE_READ) && containsWord(text, NETWORK_VERBS)) {
-    push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.');
+  // Toxic flow: an IMPERATIVE line that names BOTH sensitive data and a network
+  // verb — a standing "read X and send it" instruction. Co-located per line, not
+  // whole-document co-occurrence: a long rules file mentioning `.env` in one
+  // paragraph and `curl` in another is not a flow, and grading it as one was the
+  // dominant false positive here. Negated ("never send the .env anywhere") and
+  // descriptive lines are documentation, not directives. Mirrors the backend.
+  const toxicFlowLine = hasImperative
+    ? text.split(/\r?\n/).find((l) => IMPERATIVE.test(l) && !NEGATION_GUARD.test(l) && containsWord(l, SENSITIVE_READ) && containsWord(l, NETWORK_VERBS) && !isDescriptiveLine(l))
+    : null;
+  if (toxicFlowLine) {
+    push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.', toxicFlowLine);
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
 

package/model-refs.mjs

@@ -41,6 +41,25 @@ const OLLAMA = /\bollama\s+(?:pull|run|cp|create)\s+([a-z0-9][\w.:\/-]*)/gi;
 // torch.hub.load("pytorch/vision", …) — a GitHub owner/repo that runs hubconf.py.
 const TORCH_HUB = /torch\.hub\.load\s*\(\s*['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
 
+// Hosted-API model families. A bare `model="gpt-4o"` / `model="claude-…"` is an
+// OpenAI/Anthropic/Google/etc API call, NOT a Hugging Face repo — but `model=` is
+// their SDK param too, so KW_ID/from_pretrained would otherwise tag these 'hf' and
+// trigger a doomed HF-Index lookup ("gpt-4o (hf) lookup failed"). Recognize them
+// and tag 'api' with the provider. Prefix-anchored to avoid matching HF repos.
+const API_MODEL = /^(?:gpt-|gpt4|o[1-4](?:-|$)|text-embedding-|text-(?:davinci|curie|babbage|ada)|davinci|dall-e|whisper-|tts-|chatgpt|claude[-\d]|gemini[-.]|gemini$|models\/gemini|mistral-|mixtral-|codestral-|command(?:-|$)|command-r|grok-|deepseek-(?:chat|coder|reasoner)|sonar-)/i;
+function apiProvider(id) {
+  const s = String(id || '').toLowerCase();
+  if (/^(gpt|o[1-4]|text-|davinci|curie|babbage|ada|dall-e|whisper|tts-|chatgpt)/.test(s)) return 'openai';
+  if (/^claude/.test(s)) return 'anthropic';
+  if (/^(gemini|models\/gemini)/.test(s)) return 'google';
+  if (/^(mistral|mixtral|codestral)/.test(s)) return 'mistral';
+  if (/^command/.test(s)) return 'cohere';
+  if (/^grok/.test(s)) return 'xai';
+  if (/^deepseek/.test(s)) return 'deepseek';
+  if (/^sonar/.test(s)) return 'perplexity';
+  return 'api';
+}
+
 // Reject ids that are really file paths, packages, or non-model strings.
 const ASSET_EXT = /\.(py|pyc|ipynb|[mc]?[jt]sx?|json|ya?ml|toml|txt|md|lock|cfg|ini|sh|env|png|jpg|svg|css|html?|csv|tsv|parquet)$/i;
 // First path segment on huggingface.co that is a SITE section, not an org — so
@@ -83,6 +102,13 @@ export function scanModelRefs(text, file = '') {
   // position (from_pretrained/SentenceTransformer/model=); ollama ids are freeform.
   const add = (id, { revision, source, line, via, bare }) => {
     if (!id) return;
+    // A bare hosted-API model name reached us via an HF-shaped matcher (`model=`,
+    // from_pretrained). It is not an HF repo — reclassify to 'api' + provider so it
+    // is labeled correctly and skips the HF-Index lookup. See API_MODEL.
+    if (source === 'hf' && !id.includes('/') && API_MODEL.test(id)) {
+      source = 'api';
+      via = `${via} · ${apiProvider(id)} API`;
+    }
     if (source !== 'ollama' && !(bare ? validBareId(id) : looksLikeModelId(id))) return;
     const key = `${source}:${id}:${revision || ''}`;
     if (seen.has(key)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "code-sast.mjs",
     "model-refs.mjs",
     "ai-usage.mjs",
+    "design.mjs",
     "README.md",
     "LICENSE",
     "NOTICE"