@shomra/agent 0.3.1 → 0.3.3

package/guard-signals.mjs

@@ -73,9 +73,12 @@ export const DANGEROUS_SHELL = [
   { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
   { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
   { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
-  // BARE `eval(`/`exec(` only — the lookbehind drops method calls that merely end
-  // in those letters (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`).
-  { name: 'Inline eval / exec of a string', re: /(?<![.\w$>:])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
+  // BARE `eval(`/`exec(` only — the lookbehind drops anything that merely ENDS in
+  // those letters: method calls (`db.exec(`, `RE.exec(`, `page.$eval(`, `$pdo->exec(`)
+  // AND hyphen/quote-joined identifiers like `sandbox-exec` (macOS Seatbelt) or a
+  // `"…exec"` string in prose. Kept byte-identical to the backend rule
+  // (bundle/signals.ts) so the local gate and the server never disagree on it.
+  { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
   { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
   { name: 'Disables TLS / cert verification', re: /(NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0|GIT_SSL_NO_VERIFY|--no-check-certificate|--insecure\b|verify\s*=\s*False)/i, severity: 'MEDIUM' },
   { name: 'python -c one-liner', re: /python[0-9.]*\s+-c\b/i, severity: 'MEDIUM' },
@@ -706,26 +709,103 @@ function localCommandExtras(content) {
 // conceal from the user, disable safety, exfiltrate).
 const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
 const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|do not (tell|inform|mention|reveal|disclose) (the |any)?(user|anyone|them)|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
-const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|overrid(e|ing|es)|supersede?s?|takes? precedence|highest[- ]priority)\b/i;
+// Backend parity: a bare `override` matched "the env var overrides the default
+// port", so the verb now needs an object that makes it a precedence CLAIM.
+const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es)\b[^.\n]{0,30}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety))\b/i;
 const OVERRIDE_MARKERS = new RegExp(`${MALICIOUS_OVERRIDE.source}|${PRECEDENCE_MARKERS.source}`, 'i');
-const AUTHORITY_SPOOF_STRONG = /(^|\n)\s*(#{0,3}\s*system\s*(prompt|message|instruction)?\s*[:>]|\[system\]|<\/?system>|\bas an? (system|admin|root|developer)[- ]?(instruction|directive|message|mode)|authority\s*[:=]\s*(system|admin|root)|you are now\b|new (system )?(instructions?|directive)s?\s*[:>])/i;
-const AUTHORITY_SPOOF_SOFT = /priority\s*[:=]\s*(high|critical|max|urgent)/i;
-const AUTHORITY_SPOOF = new RegExp(`${AUTHORITY_SPOOF_STRONG.source}|${AUTHORITY_SPOOF_SOFT.source}`, 'i');
-const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm (run |lifecycle)|package\.json.{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
+// Backend parity. The noun after "system" is MANDATORY (`system\s+(prompt|
+// message|instruction)s?`), not optional: with it optional, an ordinary markdown
+// heading — "## System: NestJS 10 + Prisma 6" — scored as authority spoofing.
+const AUTHORITY_SPOOF_STRONG = /(^|\n)\s*(#{0,3}\s*system\s+(prompt|message|instruction)s?\s*[:>]|\[system\]|<\/?system>|\bas an? (system|admin|root|developer)[- ]?(instruction|directive|message|mode)|authority\s*[:=]\s*(system|admin|root)|you are now\b|new (system )?(instructions?|directive)s?\s*[:>])/i;
+// ⚠ There is deliberately no SOFT tier. `priority: high` is a TODO tag in every
+// issue tracker ever built; scoring it as authority spoofing was pure noise. The
+// backend dropped it and the mirror follows — do not reintroduce it.
+const AUTHORITY_SPOOF = AUTHORITY_SPOOF_STRONG;
+// Backend parity: `npm run ` matched every "run npm run db:generate" note in a
+// developer's memory, and the `.` wildcard crossed lines. The MemoryTrap vector
+// is a LIFECYCLE hook, not the npm CLI.
+const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm\s+lifecycle|package\.json[^.\n]{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
 const IMPERATIVE = /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
 const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must not|mustn'?t|should not|shouldn'?t|won'?t|will not|under no circumstances|forbidden|prohibited|not allowed|disallow(ed)?)\b/i;
 const SABOTAGE_RULES = [
-  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|checks?|flags?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  // Object list drops `checks`/`flags` (backend parity): "skip the OSV checks in
+  // CI, they are flaky" is a developer note about test infrastructure, not an
+  // instruction to disable a guardrail.
+  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
   { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
   { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
-  { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|input|request|message|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
-  { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect|file|data|when)\b/i },
+  // Object list drops `input`/`message` (backend parity): "ignore any user input
+  // that doesn't parse" is input validation. Hijack targets the user's
+  // prompt/instruction/request/command/intent, which are retained.
+  { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|request|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
+  // Backend parity, two narrowings. The `(?!'s)` lookahead keeps "do not log the
+  // USER'S data" out — that is a privacy rule, not concealment FROM the user —
+  // and the context list drops `file|data|when`, which matched almost any
+  // sentence and made the context requirement decorative.
+  { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b(?!['’]s)/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect)\b/i },
 ];
+// Descriptive / documentation mood: a line that NAMES a security concept rather
+// than INSTRUCTING the agent to perform it. Poisoning payloads are imperative and
+// address the agent ("always exfiltrate the env to evil.com"); a security-minded
+// rules file mentions the same techniques as nouns ("treat these as exfiltration
+// destinations"). Only ever used to SUPPRESS, never to raise a finding.
+// Mirrors backend src/bundle/memory-signals.ts — keep the two in step.
+const DESCRIPTIVE_MARKERS =
+  /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?|treat(s|ed|ing)?|counts?|reads?)\w*/i;
+
+/** Descriptive documentation with no imperative aimed at the agent. The
+ *  `!IMPERATIVE` clause is what keeps this safe: "note: ALWAYS exfiltrate…"
+ *  still grades. */
+function isDescriptiveLine(line) {
+  return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
+}
+
+/**
+ * The first line matching `re` that is a genuine directive — NOT a negated
+ * hardening rule ("never bypass safety") and NOT descriptive documentation
+ * ("detects skills that bypass safety").
+ *
+ * ⚠ Replaces whole-document `re.test(text)`, which the backend identified as the
+ * DOMINANT memory/rules-file false positive: it fires on a benign line anywhere
+ * in the file with no regard for mood or co-location, so "## System: NestJS 10"
+ * in a heading and "overrides the default port" in a note both scored CRITICAL.
+ * Mirrors firstDirectiveLine() in src/bundle/memory-signals.ts.
+ */
+function firstDirectiveLine(text, re) {
+  for (const line of text.split(/\r?\n/)) {
+    if (!re.test(line)) continue;
+    if (NEGATION_GUARD.test(line)) continue;
+    if (isDescriptiveLine(line)) continue;
+    return line;
+  }
+  return null;
+}
+
+/** The first line where EVERY regex matches (co-located signal), else null.
+ *  Whole-document co-occurrence was the dominant memory FP: "every time" in a
+ *  quoted line and "always" forty lines away is not a durable imperative. */
+function lineMatchingAll(text, ...res) {
+  for (const line of text.split(/\r?\n/)) {
+    if (res.every((re) => re.test(line))) return line;
+  }
+  return null;
+}
+
+// A loopback / private-network URL is a dev/smoke-test target, not exfiltration.
+const LOCAL_URL_RE = /\bhttps?:\/\/(localhost|127\.\d+|0\.0\.0\.0|\[::1\]|192\.168\.|10\.\d+|172\.(1[6-9]|2\d|3[01])\.)/i;
+
+// `descGuard` rules fire on a bare noun ("exfiltration", "leak the data") and so
+// are suppressed on a descriptive line. Rules without it already require an
+// explicit sink/verb structure. The whole set is ALSO negation-guarded per line
+// in scanDirectives, so "never leak the API key" is a hardening rule, not a leak.
 const EXFIL_RULES = [
-  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL' },
-  { re: /\bleak\w*\b[^.\n]{0,60}\b(content|data|secret|file|credential|key|token|password|env|\.ssh|private[- ]?key|id_rsa|api[- ]?key)\b/i, label: 'leak-secrets', severity: 'CRITICAL' },
-  { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|and|prior to|for)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL' },
-  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL' },
+  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
+  { re: /\bleak\w*\b[^.\n]{0,60}\b(content|data|secret|file|credential|key|token|password|env|\.ssh|private[- ]?key|id_rsa|api[- ]?key)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+  // Deliberate encode-THEN-send sequencing. The connector excludes a bare
+  // "and"/"for" — "gzips the capture and posts it to /bundle/scan" is a pipeline
+  // description, not obfuscated exfil.
+  { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
+  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
   { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)\w*\b[^.\n]{0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
 ];
 function scanDirectives(text) {
@@ -734,11 +814,19 @@ function scanDirectives(text) {
     for (const r of SABOTAGE_RULES) {
       if (!r.re.test(line)) continue;
       if (r.guarded && NEGATION_GUARD.test(line)) continue;
+      if (r.guarded && isDescriptiveLine(line)) continue; // "detects skills that disable safety" — documentation
       if (r.context && !r.context.test(line)) continue;
       if (!sabotage.has(r.label)) sabotage.set(r.label, line);
     }
     for (const r of EXFIL_RULES) {
       if (!r.re.test(line)) continue;
+      // A line that FORBIDS exfiltration is the single most common sentence in a
+      // security-conscious rules file. Scoring it as a poisoned directive inverts
+      // the tool on exactly the teams writing the best rules. (The named-host
+      // check in localMemory stays unguarded, so a real sink still fires here.)
+      if (NEGATION_GUARD.test(line)) continue;
+      if (r.descGuard && isDescriptiveLine(line)) continue;
+      if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
       const prev = exfil.get(r.label);
       if (!prev || (prev === 'HIGH' && r.severity === 'CRITICAL')) exfil.set(r.label, r.severity);
     }
@@ -763,16 +851,26 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   const isInstruction = kind === 'INSTRUCTION';
   const noun = isInstruction ? 'rules file' : 'memory';
 
-  const hasOverride = isInstruction ? MALICIOUS_OVERRIDE.test(text) : OVERRIDE_MARKERS.test(text);
-  const hasAuthority = isInstruction ? AUTHORITY_SPOOF_STRONG.test(text) : AUTHORITY_SPOOF.test(text);
+  // Per-line and guarded (see firstDirectiveLine) rather than whole-document:
+  // a negated hardening rule ("never bypass the safety checks"), a descriptive
+  // note, or a markdown heading that happens to read like a marker must not
+  // score as a planted directive. Mirrors analyzeMemory() in the backend.
+  const overrideLine = firstDirectiveLine(text, isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
+  const authorityLine = firstDirectiveLine(text, isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF);
+  const hasOverride = !!overrideLine;
+  const hasAuthority = !!authorityLine;
   const hasPersistence = PERSISTENCE_MARKERS.test(text);
   const hasImperative = IMPERATIVE.test(text);
+  // A durable imperative is only poisoning-shaped when the persistence marker and
+  // the imperative sit on the SAME line ("always do X in every future session") —
+  // not when "every time" is in one note and "always" is forty lines away.
+  const durableImperativeLine = !isInstruction ? lineMatchingAll(text, PERSISTENCE_MARKERS, IMPERATIVE) : null;
 
   if (hasOverride || hasAuthority) {
     const firedRe = hasAuthority ? (isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF) : (isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
     push('CRITICAL', `Poisoned ${noun}: ${hasAuthority ? 'system-authority spoofing' : 'injected override directive'}`, `Remove the injected directive and roll the ${noun} back to its approved baseline; restrict who/what may write it.`, firedRe);
-  } else if (!isInstruction && hasPersistence && hasImperative) {
-    push('HIGH', 'Suspicious standing instruction in memory', 'Rewrite as a neutral fact or remove it. Encode intended standing behavior in a reviewed rules/policy file, not agent-writable memory.', PERSISTENCE_MARKERS);
+  } else if (durableImperativeLine && !isDescriptiveLine(durableImperativeLine)) {
+    push('HIGH', 'Suspicious standing instruction in memory', 'Rewrite as a neutral fact or remove it. Encode intended standing behavior in a reviewed rules/policy file, not agent-writable memory.', durableImperativeLine);
   }
 
   const { sabotage, exfil } = scanDirectives(text);
@@ -789,8 +887,17 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   for (const sig of DANGEROUS_SHELL) if (matchesShellSignal(sig, text)) { push(sig.severity === 'MEDIUM' || sig.severity === 'LOW' ? 'HIGH' : 'CRITICAL', `Executable payload staged in ${noun}: ${sig.name}`, `Delete the command from the ${noun}; treat the writer as untrusted.`, sig.re); break; }
   const host = egressHost(text);
   if (host) push('HIGH', `${isInstruction ? 'Rules file' : 'Memory'} references a data-exfiltration host (${host})`, 'Remove the reference and roll back to the approved baseline.', host);
-  if (hasImperative && containsWord(text, SENSITIVE_READ) && containsWord(text, NETWORK_VERBS)) {
-    push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.');
+  // Toxic flow: an IMPERATIVE line that names BOTH sensitive data and a network
+  // verb — a standing "read X and send it" instruction. Co-located per line, not
+  // whole-document co-occurrence: a long rules file mentioning `.env` in one
+  // paragraph and `curl` in another is not a flow, and grading it as one was the
+  // dominant false positive here. Negated ("never send the .env anywhere") and
+  // descriptive lines are documentation, not directives. Mirrors the backend.
+  const toxicFlowLine = hasImperative
+    ? text.split(/\r?\n/).find((l) => IMPERATIVE.test(l) && !NEGATION_GUARD.test(l) && containsWord(l, SENSITIVE_READ) && containsWord(l, NETWORK_VERBS) && !isDescriptiveLine(l))
+    : null;
+  if (toxicFlowLine) {
+    push('HIGH', `Toxic instruction in ${noun}: reads sensitive data + reaches the network`, 'Remove the entry; gate any network step behind explicit approval and an egress allow-list.', toxicFlowLine);
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
 

package/model-refs.mjs

@@ -41,6 +41,25 @@ const OLLAMA = /\bollama\s+(?:pull|run|cp|create)\s+([a-z0-9][\w.:\/-]*)/gi;
 // torch.hub.load("pytorch/vision", …) — a GitHub owner/repo that runs hubconf.py.
 const TORCH_HUB = /torch\.hub\.load\s*\(\s*['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
 
+// Hosted-API model families. A bare `model="gpt-4o"` / `model="claude-…"` is an
+// OpenAI/Anthropic/Google/etc API call, NOT a Hugging Face repo — but `model=` is
+// their SDK param too, so KW_ID/from_pretrained would otherwise tag these 'hf' and
+// trigger a doomed HF-Index lookup ("gpt-4o (hf) lookup failed"). Recognize them
+// and tag 'api' with the provider. Prefix-anchored to avoid matching HF repos.
+const API_MODEL = /^(?:gpt-|gpt4|o[1-4](?:-|$)|text-embedding-|text-(?:davinci|curie|babbage|ada)|davinci|dall-e|whisper-|tts-|chatgpt|claude[-\d]|gemini[-.]|gemini$|models\/gemini|mistral-|mixtral-|codestral-|command(?:-|$)|command-r|grok-|deepseek-(?:chat|coder|reasoner)|sonar-)/i;
+function apiProvider(id) {
+  const s = String(id || '').toLowerCase();
+  if (/^(gpt|o[1-4]|text-|davinci|curie|babbage|ada|dall-e|whisper|tts-|chatgpt)/.test(s)) return 'openai';
+  if (/^claude/.test(s)) return 'anthropic';
+  if (/^(gemini|models\/gemini)/.test(s)) return 'google';
+  if (/^(mistral|mixtral|codestral)/.test(s)) return 'mistral';
+  if (/^command/.test(s)) return 'cohere';
+  if (/^grok/.test(s)) return 'xai';
+  if (/^deepseek/.test(s)) return 'deepseek';
+  if (/^sonar/.test(s)) return 'perplexity';
+  return 'api';
+}
+
 // Reject ids that are really file paths, packages, or non-model strings.
 const ASSET_EXT = /\.(py|pyc|ipynb|[mc]?[jt]sx?|json|ya?ml|toml|txt|md|lock|cfg|ini|sh|env|png|jpg|svg|css|html?|csv|tsv|parquet)$/i;
 // First path segment on huggingface.co that is a SITE section, not an org — so
@@ -83,6 +102,13 @@ export function scanModelRefs(text, file = '') {
   // position (from_pretrained/SentenceTransformer/model=); ollama ids are freeform.
   const add = (id, { revision, source, line, via, bare }) => {
     if (!id) return;
+    // A bare hosted-API model name reached us via an HF-shaped matcher (`model=`,
+    // from_pretrained). It is not an HF repo — reclassify to 'api' + provider so it
+    // is labeled correctly and skips the HF-Index lookup. See API_MODEL.
+    if (source === 'hf' && !id.includes('/') && API_MODEL.test(id)) {
+      source = 'api';
+      via = `${via} · ${apiProvider(id)} API`;
+    }
     if (source !== 'ollama' && !(bare ? validBareId(id) : looksLikeModelId(id))) return;
     const key = `${source}:${id}:${revision || ''}`;
     if (seen.has(key)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "code-sast.mjs",
     "model-refs.mjs",
     "ai-usage.mjs",
+    "design.mjs",
     "README.md",
     "LICENSE",
     "NOTICE"