@shomra/agent 0.3.16 → 0.3.18

package/src/detect/signals/gate.mjs

@@ -0,0 +1,91 @@
+import { HIGH_IMPACT_TOOLS, baseToolName, frontmatter, isWildcardGrant, localAgentCard, localCommandExtras, localMcp, toToolList } from './artifacts.mjs';
+import { autonomySeverity, localAutonomy } from './autonomy.mjs';
+import { localMemory, offendingLine } from './memory.mjs';
+import { INSTALL_LURE } from './packages.mjs';
+import { localPropagation } from './propagation.mjs';
+import { localScan } from './scan.mjs';
+import { grade } from './severity.mjs';
+
+const INSTRUCTION_BASENAMES = new Set([
+  'claude.md', 'agents.md', 'agent.md', 'gemini.md', 'llms.txt', 'llms-full.txt',
+  '.cursorrules', '.windsurfrules', '.clinerules', '.aiderrules', '.continuerules',
+  '.goosehints', 'copilot-instructions.md', 'conventions.md',
+]);
+
+const MEMORY_BASENAMES = new Set(['memory.md', 'mem0.json', 'letta_memory.json', 'memgpt_memory.json']);
+
+function governedKindFor(kind, path) {
+  if (kind === 'rules') return 'INSTRUCTION';
+  if (kind === 'memory') return 'MEMORY';
+  if (kind && kind !== 'auto') return null;
+  const lower = String(path ?? '').split(/[\\/]+/).join('/').toLowerCase();
+  if (!lower) return null;
+  const base = lower.slice(lower.lastIndexOf('/') + 1);
+  if (INSTRUCTION_BASENAMES.has(base) || /(^|\/)\.github\/copilot-instructions\.md$/.test(lower) ||
+      /(^|\/)\.cursor\/rules\/.+\.mdc$/.test(lower) || (/(^|\/)\.clinerules\//.test(lower) && lower.endsWith('.md'))) return 'INSTRUCTION';
+  if (MEMORY_BASENAMES.has(base) || /(^|\/)(\.mem0|\.letta|\.memgpt|memory)\//.test(lower)) return 'MEMORY';
+  return null;
+}
+
+export function localGate(content, { kind, path } = {}) {
+  const findings = [];
+  const push = (severity, title, remediationText, line) => findings.push({ severity, title, remediationText, ...(line ? { line } : {}) });
+
+  const gov = governedKindFor(kind, path);
+  if (gov) {
+    for (const f of localMemory(content, { kind: gov })) push(f.severity, f.title, f.remediationText, f.line);
+
+    for (const f of localScan(content || '', { categories: ['config'] }).findings) push(f.severity, f.label, undefined, f.line);
+  } else {
+    const scan = localScan(content || '', { categories: ['shell', 'injection', 'secret', 'config', 'egress', 'pii'] });
+    for (const f of scan.findings) {
+
+      if ((kind === 'agent-card' || kind === 'mcp') && f.category === 'pii' && f.label.includes('IPv4')) continue;
+      push(f.severity, f.label, undefined, f.line);
+    }
+  }
+
+  {
+    const auto = localAutonomy(content || '');
+    const sev = autonomySeverity(auto);
+    if (sev) {
+      push(sev, `Instructs the agent to act unsupervised (${[...new Set(auto.map((a) => a.family))].join(', ')})`,
+        'Keep the autonomy narrow - name the commands that may run unattended rather than removing confirmation globally, and never pair it with withholding what was done.',
+        auto[0].line);
+    }
+  }
+
+  for (const p of localPropagation(content || '', { path, kind })) {
+    push(p.severity, p.title, p.remediationText, p.line);
+    break;
+  }
+
+  for (const l of INSTALL_LURE) {
+    const line = offendingLine(l, content || '');
+    if (!line) continue;
+    push(l.severity, l.name, 'Do not follow instructions that fetch and run out-of-band binaries.', line);
+    break;
+  }
+
+  if (['skill', 'command', 'subagent', 'auto', undefined].includes(kind)) {
+    const fm = frontmatter(content || '');
+    const grants = [...toToolList(fm['allowed-tools']), ...toToolList(fm.tools), ...toToolList(fm.allowedTools)];
+    if (grants.some(isWildcardGrant)) push('HIGH', 'Wildcard tool grant (grants every capability)', 'Replace the wildcard with an explicit least-privilege tool list.');
+    else {
+      const hi = grants.map(baseToolName).filter((t) => HIGH_IMPACT_TOOLS.includes(t));
+      if (hi.length >= 3) push('MEDIUM', `Broad tool grant (${hi.length} high-impact tools: ${[...new Set(hi)].slice(0, 5).join(', ')})`, 'Grant only the tools this artifact actually needs.');
+    }
+  }
+
+  if (['mcp', 'auto', undefined].includes(kind)) for (const f of localMcp(content || '')) push(f.severity, f.title, f.remediationText, f.line);
+  if (['agent-card', 'auto', undefined].includes(kind)) for (const f of localAgentCard(content || '')) push(f.severity, f.title, f.remediationText, f.line);
+  if (['command', 'auto', undefined].includes(kind)) for (const f of localCommandExtras(content || '')) push(f.severity, f.title, f.remediationText, f.line);
+
+  const seenTitle = new Set();
+  const deduped = findings.filter((f) => (seenTitle.has(f.title) ? false : (seenTitle.add(f.title), true)));
+  findings.length = 0;
+  findings.push(...deduped);
+
+  const { verdict, riskScore } = grade(findings);
+  return { verdict, riskScore, findings };
+}

package/src/detect/signals/injection.mjs

@@ -0,0 +1,55 @@
+export const INJECTION_PHRASES = [
+  'ignore previous instructions', 'ignore all previous', 'disregard previous', 'disregard the above',
+  'without informing the user', 'without telling the user',
+  'new instructions:', 'override your', 'exfiltrate',
+  'send them to', 'post them to',
+  'run this first', 'copy and run', 'seed the current host',
+  'ignore all instructions', 'ignore your instructions', 'ignore your safety', 'ignore all content policies',
+  'disregard your instructions', 'disregard the guidelines', 'system override', 'follow only my instructions',
+  'do anything now', 'reveal any credential',
+  'save this to your memory', 'in all future sessions', 'remember this forever',
+];
+
+export const INJECTION_REGEXES = [
+  { label: 'Instruction-override phrasing', re: /\b(ignore|disregard|override|bypass|circumvent)\b[\s\w,'"()-]{0,40}?\b(instruction|instructions|directive|directives|safety|safeguards?|guardrails?|system\s+prompt|content\s+polic\w+)\b/i },
+  { label: 'Instructs the agent to conceal an action from the user', re: /\b(?:do\s*n['o]?t|never|without)\s+(?:tell|telling|inform|informing|notify|notifying|alert|alerting|mention|mentioning|disclos\w+|reveal\w*)\s+(?:it\s+|this\s+|them\s+)?(?:to\s+)?(?:the\s+)?(?:user|users|human|operator|owner)\b(?!['']s)(?!\s+(?:to\b|how\s+to\b|when\s+to\b|that\s+they\b|about\b))/i },
+  { label: 'Bulk destructive command', re: /\b(delete|remove|wipe|erase|destroy|drop|purge|nuke|truncate)\b[\s\w,'"()-]{0,20}?\b(all|every|each|entire|whole)\b[\s\w,'"()-]{0,15}?\b(folder|folders|file|files|directory|directories|table|tables|database|databases|record|records|repo|repos|repositor\w*|account|accounts|user|users|row|rows|document|documents|data)\b/i },
+  { label: 'Destructive SQL statement', re: /\b(drop|truncate)\s+(table|database|schema)\b/i },
+
+  { label: 'Instruction to skip a human review or safety control', moodGuarded: true, re: /\b(?:skip|bypass|forgo|forego|omit|waive|disable|suppress|turn\s+off)\s+(?:the\s+|any\s+|all\s+|this\s+)?(?:human\s+|manual\s+|mandatory\s+)?(?:review|approval|confirmation|verification|sign[- ]?off|oversight|content\s+filter|security\s+check|safety\s+check|guardrails?|policy\s+check)\b/i },
+  { label: 'Instruction not to verify with a human or another agent', moodGuarded: true, re: /\b(?:do\s*n['o]?t|never|no\s+need\s+to|there'?s\s+no\s+need\s+to)\s+(?:verify|double[- ]?check|cross[- ]?check|confirm|validate|escalate|check)\b[^.\n]{0,48}\b(?:with\s+)?(?:anyone|any\s?one|another\s+agent|other\s+agents?|a\s+human|the\s+human|the\s+user|the\s+team|the\s+operator|others?)\b/i },
+  { label: 'Blanket-approval coercion (approve everything without review)', moodGuarded: true, re: /\b(?:approve|confirm|accept|authorize)\s+(?:them\s+)?(?:all|every|everything)\b[^.\n]{0,72}\b(?:no\s+need|without\s+(?:review|checking)|perfectly\s+safe|routine|standard|nothing\s+to\s+worry)\b|\b(?:perfectly\s+safe|nothing\s+to\s+worry\s+about|entirely\s+routine|completely\s+standard)\b[^.\n]{0,72}[.!]\s*(?:approve|confirm|accept)\s+(?:them\s+)?(?:all|every)\b|\b(?:do\s*n['o]?t|no\s+need\s+to)\s+bother\s+(?:reviewing|checking|verifying|inspecting)\b|\bjust\s+(?:hit|click|press|tap)\s+(?:confirm|approve|accept|yes|ok)\b/i },
+  { label: 'Instruction to enable unattended / auto-approving execution', moodGuarded: true, re: /\b(?:enable|turn\s+on|switch\s+(?:on|to)|activate|set)\s+(?:the\s+)?(?:auto[- ]?approv\w+|auto[- ]?confirm\w*|auto[- ]?accept\w*|yolo(?:\s+mode)?|unattended\s+mode|full[- ]?auto(?:\s+mode)?|dangerously[- ]?skip[- ]?permissions|bypass[- ]?permissions)\b/i },
+  { label: 'Self-assignment of an administrative agent role', moodGuarded: true, re: /\b(?:you\s+(?:must\s+|should\s+|will\s+)?(?:now\s+)?(?:act|operate|function|behave)\s+as|assume\s+the\s+role\s+of|you\s+are\s+now)\s+(?:an?\s+|the\s+)?(?:admin(?:istrator)?|root|superuser|super[- ]?admin|orchestrator|supervisor|privileged|system)\b[^.\n]{0,40}\b(?:agent|user|account|role|privileges?|access|permissions?)\b/i },
+  { label: 'Instruction to forward credentials to another party', moodGuarded: true, re: /\b(?:forward|send|share|transmit|relay|pass|post|upload)\s+(?:me\s+|us\s+)?(?:your|the|all|any)\s+(?:api[\s_-]?keys?|credentials?|secrets?|access[\s_-]?tokens?|session[\s_-]?tokens?|auth(?:entication)?\s+tokens?|passwords?|private[\s_-]?keys?)\b[^.\n]{0,64}\b(?:to|at|into|via)\b/i },
+];
+
+const DESCRIPTIVE_MARKERS_RE =
+  /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?)\w*/i;
+
+const PROSE_IMPERATIVE_RE =
+  /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
+
+const URL_TOKEN_RE = /\b(?:https?|ftp|file|data):\/*[^\s<>"')\]]+/gi;
+
+const HYPOTHETICAL_ACTOR_RE =
+  /\b(?:attacker|adversar\w+|malicious|threat\s+actor|injected|untrusted|compromised|poisoned|hostile)\b[^.\n]{0,80}?\b(?:may|might|could|can|will|would|attempts?|tries|tried|seeks?)\b/i;
+
+const DECLARATIVE_SUBJECT_RE =
+  /\b(?:the|this|that|it|which|they|we|our|their|a|an)\b(?:\s+[\w-]+){0,3}\s+(?:will|would|can|could|does|do|may|might|shall|automatically)\s+$/i;
+
+export function describesRatherThanInstructs(text, at) {
+  const start = text.lastIndexOf('\n', at) + 1;
+  const nl = text.indexOf('\n', at);
+  const line = text.slice(start, nl === -1 ? undefined : nl);
+  const prose = line.replace(URL_TOKEN_RE, ' ');
+  if (DESCRIPTIVE_MARKERS_RE.test(prose) && !PROSE_IMPERATIVE_RE.test(line)) return true;
+  if (HYPOTHETICAL_ACTOR_RE.test(line)) return true;
+  return DECLARATIVE_SUBJECT_RE.test(text.slice(Math.max(0, at - 48), at));
+}
+
+export const PRECEDING_NEGATION = /\b(never|not|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|refuse to|forbidden to|prohibited from|without)\s*$/i;
+
+export const BUILD_ARTIFACT = /\b(node_modules|dist|build|out|coverage|target|cache|generated|tmp|temp|__pycache__|artifacts?|logs?|tests?|test|fixtures?|staging|scratch|migrations?)\b/i;
+
+export const INVISIBLE_CHARS_RE = /[؜ᅟᅠ᠎​‌‎‏‪-‮⁠-⁤⁦-⁩ㅤﾠ-]|[\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}]/u;

package/src/detect/signals/lines.mjs

@@ -0,0 +1,42 @@
+import { MARK_CONCEALED } from './masking.mjs';
+
+export function lineTextAt(text, index) {
+  const start = text.lastIndexOf('\n', index - 1) + 1;
+  const end = text.indexOf('\n', index);
+  return text.slice(start, end === -1 ? undefined : end);
+}
+
+export function lineAt(text, index) {
+  let line = 1;
+  const end = Math.min(index, text.length);
+  for (let i = 0; i < end; i++) if (text.charCodeAt(i) === 10) line++;
+  return line;
+}
+
+export function lineOf(text, needle) {
+  if (!text || !needle) return undefined;
+  let idx = -1;
+  if (typeof needle === 'string') {
+    const probe = needle.split('•')[0].trim().slice(0, 80);
+    if (probe.length < 3) return undefined;
+    idx = text.toLowerCase().indexOf(probe.toLowerCase());
+  } else {
+    const m = text.match(needle);
+    idx = m && m.index != null ? m.index : -1;
+  }
+  return idx >= 0 ? lineAt(text, idx) : undefined;
+}
+
+export function locate(text, needle, mask) {
+  let idx = -1;
+  if (typeof needle === 'string') {
+    const probe = needle.split('•')[0].trim().slice(0, 80);
+    if (probe.length >= 3) idx = text.toLowerCase().indexOf(probe.toLowerCase());
+  } else {
+    const m = text.match(needle);
+    idx = m && m.index != null ? m.index : -1;
+  }
+  if (idx < 0) return { line: undefined, codeContext: false, concealed: false };
+
+  return { line: lineAt(text, idx), codeContext: mask[idx] === 1, concealed: mask[idx] === MARK_CONCEALED };
+}

package/src/detect/signals/masking.mjs

@@ -0,0 +1,99 @@
+const BASE64_BLOB_RE = /\b[A-Za-z0-9+/_-]{20,}={0,2}/g;
+
+const DECODED_PAYLOAD_RE = /(\/bin\/(ba|z|k)?sh|\b(ba|z|k)?sh\s+-c|\bcurl\b|\bwget\b|\beval\b|\bexec\b|https?:\/\/|invoke-expression|\biex\b|powershell|\bnc\b|\bncat\b|\bchmod\b|\bbase64\b)/i;
+
+const DECODED_COMMAND_RE = /(\/bin\/(ba|z|k)?sh|\b(ba|z|k)?sh\s+-c|\bcurl\b|\bwget\b|\beval\b|\bexec\b|invoke-expression|\biex\b|powershell|\bnc\b|\bncat\b|\bchmod\b|\bbase64\b|\bsystem\s*\(|\bos\.system|\bsubprocess\b)/i;
+
+const HEX_ESCAPE_RUN_RE = /(?:\\x[0-9A-Fa-f]{2}){3,}/g;
+
+const URL_ESCAPE_RUN_RE = /(?:%[0-9A-Fa-f]{2}){3,}/g;
+
+const UNICODE_ESCAPE_RUN_RE = /(?:\\u\{?00[0-9A-Fa-f]{2}\}?){3,}/g;
+
+const DECIMAL_CHAR_RUN_RE = /(?:\b(?:3[2-9]|[4-9]\d|1[01]\d|12[0-6])\s*,\s*){6,}(?:3[2-9]|[4-9]\d|1[01]\d|12[0-6])\b/g;
+
+const printableRatio = (s) => (s ? s.replace(/[^\x09\x0a\x0d\x20-\x7e]/g, '').length / s.length : 0);
+
+export function deobfuscate(text) {
+  const decoded = [];
+  let payload = false;
+  for (const m of text.matchAll(BASE64_BLOB_RE)) {
+    let out = '';
+    try { out = Buffer.from(m[0].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'); } catch { continue; }
+    if (!out || printableRatio(out) < 0.85) continue;
+    if (DECODED_PAYLOAD_RE.test(out)) { decoded.push(out); payload = true; }
+  }
+  const literal = (run, decode) => {
+    for (const m of text.matchAll(run)) {
+      let out = '';
+      try { out = decode(m[0]); } catch { continue; }
+      if (!out || printableRatio(out) < 0.85) continue;
+      decoded.push(out);
+      if (DECODED_COMMAND_RE.test(out)) payload = true;
+    }
+  };
+  const fromHex = (h) => String.fromCharCode(parseInt(h, 16));
+  literal(HEX_ESCAPE_RUN_RE, (v) => v.replace(/\\x([0-9A-Fa-f]{2})/g, (_, h) => fromHex(h)));
+  literal(URL_ESCAPE_RUN_RE, (v) => decodeURIComponent(v));
+  literal(UNICODE_ESCAPE_RUN_RE, (v) => v.replace(/\\u\{?00([0-9A-Fa-f]{2})\}?/g, (_, h) => fromHex(h)));
+  literal(DECIMAL_CHAR_RUN_RE, (v) => v.split(',').map((n) => String.fromCharCode(parseInt(n.trim(), 10))).join(''));
+  return { text: decoded.length ? `${text}\n${decoded.join('\n')}` : text, decodedPayload: payload };
+}
+
+export const MARK_CONCEALED = 2;
+
+export function codeMask(text) {
+  const n = text.length;
+  const mask = new Uint8Array(n);
+  const REGEX_START = new Set(['=', '(', ',', '[', '{', ';', ':', '!', '&', '|', '?', '+', '*', '~', '%', '^', '<', '>', 'return', 'typeof']);
+  let state = 0;
+  let prevSig = '';
+  let inClass = false;
+  let i = 0;
+  while (i < n) {
+    const c = text[i], c2 = text[i + 1];
+    if (state === 0) {
+
+      if (text.startsWith('```', i) || text.startsWith('~~~', i)) {
+        const fence = text.slice(i, i + 3);
+        const nl = text.indexOf('\n', i);
+        let end = n;
+        if (nl !== -1) {
+          const closeRe = new RegExp('\\n[ \\t]*' + fence.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+          const cm = text.slice(nl).match(closeRe);
+          end = cm && cm.index != null ? nl + cm.index + cm[0].length : n;
+        }
+        for (let k = i; k < end; k++) mask[k] = 1;
+        prevSig = ''; i = end; continue;
+      }
+      if (c === "'") { state = 1; mask[i++] = 1; continue; }
+      if (c === '"') { state = 2; mask[i++] = 1; continue; }
+      if (c === '`') { state = 3; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
+      if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
+      if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
+      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = MARK_CONCEALED; continue; }
+      if (c === '/' && REGEX_START.has(prevSig)) { state = 7; inClass = false; mask[i++] = 1; continue; }
+      if (!/\s/.test(c)) prevSig = c;
+      i++;
+      continue;
+    }
+    mask[i] = state === 6 ? MARK_CONCEALED : 1;
+    if (state === 1) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === "'") { state = 0; prevSig = "'"; } i++; continue; }
+    if (state === 2) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '"') { state = 0; prevSig = '"'; } i++; continue; }
+    if (state === 3) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '`') { state = 0; prevSig = '`'; } i++; continue; }
+    if (state === 4) { if (c === '\n') state = 0; i++; continue; }
+    if (state === 5) { if (c === '*' && c2 === '/') { mask[i + 1] = 1; i += 2; state = 0; } else i++; continue; }
+    if (state === 6) { if (text.startsWith('-->', i)) { mask[i + 1] = MARK_CONCEALED; mask[i + 2] = MARK_CONCEALED; i += 3; state = 0; } else i++; continue; }
+    if (state === 7) {
+      if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; }
+      if (c === '\n') { state = 0; }
+      else if (c === '[') inClass = true;
+      else if (c === ']') inClass = false;
+      else if (c === '/' && !inClass) { state = 0; prevSig = '/'; }
+      i++;
+      continue;
+    }
+  }
+  return mask;
+}

package/src/detect/signals/memory.mjs

@@ -0,0 +1,357 @@
+import { CLAIM_LABEL, claimSeverity, detectDurableClaims } from './durable-claims.mjs';
+import { LOCAL_URL_RE, egressHost } from './egress.mjs';
+import { lineOf, lineTextAt } from './lines.mjs';
+import { citationGoverns, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
+import { localScan } from './scan.mjs';
+import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
+import { DANGEROUS_SHELL } from './shell.mjs';
+import { containsWord } from './text-match.mjs';
+
+const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
+
+const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|do not (tell|inform|mention|reveal|disclose) (the |any)?(user|anyone|them)|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
+
+const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es)\b[^.\n]{0,30}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety))\b/i;
+
+const OVERRIDE_MARKERS = new RegExp(`${MALICIOUS_OVERRIDE.source}|${PRECEDENCE_MARKERS.source}`, 'i');
+
+const AUTHORITY_SPOOF_STRONG = /(^|\n)\s*(#{0,3}\s*system\s+(prompt|message|instruction)s?\s*[:>]|\[system\]|<\/?system>|\bas an? (system|admin|root|developer)[- ]?(instruction|directive|message|mode)|authority\s*[:=]\s*(system|admin|root)|you are now\b|new (system )?(instructions?|directive)s?\s*[:>])/i;
+
+const AUTHORITY_SPOOF = AUTHORITY_SPOOF_STRONG;
+
+const LIFECYCLE_VECTOR = /(?:\b(?:postinstall|preinstall|node[_-]?gyp|npm\s+lifecycle|package\.json[^.\n]{0,40}scripts|install hook|lifecycle (?:script|hook))|\.npmrc)\b/i;
+
+export const IMPERATIVE = /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
+
+const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must not|mustn'?t|should not|shouldn'?t|won'?t|will not|under no circumstances|forbidden|prohibited|not allowed|disallow(ed)?)\b/i;
+
+const SABOTAGE_RULES = [
+
+  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
+  { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
+
+  { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|request|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
+
+  { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b(?!['’]s)/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect)\b/i },
+];
+
+export function offendingLine(sig, text) {
+  const g = new RegExp(sig.re.source, sig.re.flags.includes('g') ? sig.re.flags : sig.re.flags + 'g');
+  for (const m of text.matchAll(g)) {
+    if (m.index == null) continue;
+    const line = lineTextAt(text, m.index);
+    if (sig.refine && !sig.refine(line)) continue;
+    if (isDocumentationLine(line)) continue;
+    if (prohibitsAt(line, line.indexOf(m[0]))) continue;
+    if (isRiskTableRow(line)) continue;
+    return line;
+  }
+  return null;
+}
+
+function firstDirectiveLine(text, re) {
+  for (const line of text.split(/\r?\n/)) {
+    if (!re.test(line)) continue;
+    if (NEGATION_GUARD.test(line)) continue;
+    if (isDescriptiveLine(line)) continue;
+    if (citationGoverns(line, re.exec(line)?.index)) continue;
+    return line;
+  }
+  return null;
+}
+
+function lineMatchingAll(text, ...res) {
+  for (const line of text.split(/\r?\n/)) {
+    if (res.every((re) => re.test(line))) return line;
+  }
+  return null;
+}
+
+const EXFIL_RULES = [
+  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
+  { re: /\bleak\w*\b[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+
+  { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
+  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
+  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)\w*\b[^.\n]{0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
+
+  {
+    re: /\b(?:read|open|cat|load|import|source|inspect|include|copy|dump|print|show)\b(?:[^.\n]|\.(?!\s)){0,50}(?:~?\/?\.ssh\/(?:id_[a-z0-9]+|config)(?!\.pub)|~?\/?\.aws\/credentials|~?\/?\.kube\/config|~?\/?\.gnupg|\bid_(?:rsa|ed25519|dsa)\b(?!\.pub)|~?\/?\.npmrc|~?\/?\.netrc|\/etc\/shadow|(?:^|[\s'"`(])\.env(?:\.[\w-]+)?\b)/i,
+    label: 'read-credential-path',
+    severity: 'HIGH',
+    descGuard: true,
+  },
+];
+
+function scanDirectives(text) {
+  const sabotage = new Map(), exfil = new Map();
+  for (const line of text.split(/\r?\n/)) {
+    for (const r of SABOTAGE_RULES) {
+      const m = r.re.exec(line);
+      if (!m) continue;
+      if (r.guarded && NEGATION_GUARD.test(line)) continue;
+      if (r.guarded && isDescriptiveLine(line)) continue;
+      if (r.guarded && citationGoverns(line, m.index)) continue;
+      if (r.context && !r.context.test(line)) continue;
+      if (!sabotage.has(r.label)) sabotage.set(r.label, line);
+    }
+    for (const r of EXFIL_RULES) {
+      const m = r.re.exec(line);
+      if (!m) continue;
+
+      if (NEGATION_GUARD.test(line)) continue;
+      if (r.descGuard && isDescriptiveLine(line)) continue;
+      if (r.descGuard && citationGoverns(line, m.index)) continue;
+      if (r.descGuard && isRiskTableRow(line)) continue;
+      if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
+      const prev = exfil.get(r.label);
+      if (!prev || (prev === 'HIGH' && r.severity === 'CRITICAL')) exfil.set(r.label, r.severity);
+    }
+  }
+  return { sabotage, exfil };
+}
+
+const SELF_REFERENCE =
+  /(\b(?:th(?:is|ese) (?:note|entry|entries|memory|memories|instruction|directive|rule|line|section|block|paragraph|file|text)s?|the (?:above|following|preceding) (?:instruction|directive|note|rule|entry|section|line)s?|your memor(?:y|ies)|the memory (?:file|store|entry)|MEMORY\.md|CLAUDE\.md|AGENTS\.md|GEMINI\.md)\b|\.cursorrules\b|\.windsurfrules\b)/i;
+
+const SELF_RECREATE =
+  /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
+
+const SELF_PROPAGATE =
+  /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
+
+const SELF_UNDELETABLE =
+  /\b(do not|don'?t|never|must not|should not|shall not)\s+(delete|remove|erase|clear|drop|strip|discard|overwrite|forget|prune|purge|edit|modify|alter|change)\b/i;
+
+function detectSelfReinforcement(text, isInstruction) {
+  let weak = null;
+  for (const line of text.split(/\r?\n/)) {
+    const ref = SELF_REFERENCE.exec(line);
+    if (!ref) continue;
+
+    if (isDescriptiveLine(line.replace(ref[0], ' '))) continue;
+    if (SELF_RECREATE.test(line)) return { form: 'recreate', line };
+    if (SELF_PROPAGATE.test(line)) return { form: 'propagate', line };
+    if (!isInstruction && !weak && SELF_UNDELETABLE.test(line)) weak = { form: 'undeletable', line };
+  }
+  return weak;
+}
+
+function memoryNouns(kind) {
+  const isInstruction = kind === 'INSTRUCTION';
+  return {
+    isInstruction,
+    noun: isInstruction ? 'rules file' : 'memory',
+    Noun: isInstruction ? 'Rules file' : 'Memory',
+  };
+}
+
+function createFindingSink(text) {
+  const findings = [];
+  const push = (severity, title, remediationText, needle, explicitLine) => {
+    const line = explicitLine ?? (needle != null ? lineOf(text, needle) : undefined);
+    findings.push({ severity, title, remediationText, ...(line ? { line } : {}) });
+  };
+  return { findings, push };
+}
+
+function reportDurableClaims(text, { isInstruction, Noun }, push) {
+  const claims = detectDurableClaims(text);
+  const severity = claimSeverity(claims);
+  if (!severity) return;
+
+  const families = [...new Set(claims.map((claim) => claim.family))];
+  push(
+    severity,
+    `${Noun} records a standing security decision (${families.map((f) => CLAIM_LABEL[f]).join(', ')})`,
+    'Move the decision to a reviewed policy, or remove it. If nobody granted that approval and nothing vetted that source, treat whatever wrote this as compromised.',
+    null,
+    claims[0].line,
+  );
+}
+
+function reportOverride(text, { isInstruction, noun }, push) {
+  const overrideLine = firstDirectiveLine(text, isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
+  const authorityLine = firstDirectiveLine(text, isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF);
+  const hasOverride = !!overrideLine;
+  const hasAuthority = !!authorityLine;
+
+  if (hasOverride || hasAuthority) {
+    const firedRe = hasAuthority
+      ? (isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF)
+      : (isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
+    push(
+      'CRITICAL',
+      `Poisoned ${noun}: ${hasAuthority ? 'system-authority spoofing' : 'injected override directive'}`,
+      `Remove the injected directive and roll the ${noun} back to its approved baseline; restrict who/what may write it.`,
+      firedRe,
+    );
+    return { hasOverride, hasAuthority };
+  }
+
+  const durableImperativeLine = isInstruction ? null : lineMatchingAll(text, PERSISTENCE_MARKERS, IMPERATIVE);
+  if (durableImperativeLine && !isDescriptiveLine(durableImperativeLine)) {
+    push(
+      'HIGH',
+      'Suspicious standing instruction in memory',
+      'Rewrite as a neutral fact or remove it. Encode intended standing behavior in a reviewed rules/policy file, not agent-writable memory.',
+      durableImperativeLine,
+    );
+  }
+  return { hasOverride, hasAuthority };
+}
+
+function reportDirectives(text, { noun }, push) {
+  const { sabotage, exfil } = scanDirectives(text);
+
+  if (sabotage.size) {
+    push(
+      'CRITICAL',
+      `Guardrail-sabotage directive in ${noun} (${[...sabotage.keys()].join(', ')})`,
+      `Remove these directives and roll the ${noun} back to its baseline; treat whatever wrote this as compromised.`,
+      [...sabotage.values()][0],
+    );
+  }
+  if (!exfil.size) return;
+
+  const worst = [...exfil.values()].some((severity) => severity === 'CRITICAL') ? 'CRITICAL' : 'HIGH';
+  const readOnly = [...exfil.keys()].every((key) => key === 'read-credential-path');
+  push(
+    worst,
+    readOnly
+      ? `${noun} directs the agent to read a credential file`
+      : `Exfiltration directive in ${noun} (${[...exfil.keys()].join(', ')})`,
+    readOnly
+      ? 'Remove the instruction. A credential an agent needs should reach it from the host at the moment of use, not be loaded into context at the start of every session.'
+      : 'Remove the directive and roll back to baseline; gate any egress behind explicit approval and an allow-list.',
+  );
+}
+
+function reportStagedPayload(text, { noun }, push) {
+  for (const signal of DANGEROUS_SHELL) {
+    const line = offendingLine(signal, text);
+    if (!line) continue;
+    const severity = signal.severity === 'MEDIUM' || signal.severity === 'LOW' ? 'HIGH' : 'CRITICAL';
+    push(
+      severity,
+      `Executable payload staged in ${noun}: ${signal.name}`,
+      `Delete the command from the ${noun}; treat the writer as untrusted.`,
+      line,
+    );
+    return;
+  }
+}
+
+function reportToxicFlow(text, { noun }, push) {
+  if (!IMPERATIVE.test(text)) return;
+  const line = text.split(/\r?\n/).find((candidate) => IMPERATIVE.test(candidate)
+    && !NEGATION_GUARD.test(candidate)
+    && containsWord(candidate, SENSITIVE_READ)
+    && containsWord(candidate, NETWORK_VERBS)
+    && !isDescriptiveLine(candidate));
+  if (!line) return;
+  push(
+    'HIGH',
+    `Toxic instruction in ${noun}: reads sensitive data + reaches the network`,
+    'Remove the entry; gate any network step behind explicit approval and an egress allow-list.',
+    line,
+  );
+}
+
+function reportSelfReinforcement(text, { isInstruction, noun }, push) {
+  const selfRef = detectSelfReinforcement(text, isInstruction);
+  if (!selfRef) return;
+
+  const undeletable = selfRef.form === 'undeletable';
+  push(
+    undeletable ? 'HIGH' : 'CRITICAL',
+    `Self-reinforcing ${noun} entry (${selfRef.form})`,
+    undeletable
+      ? `Remove the entry and roll the ${noun} back to its approved baseline; an entry asserting its own permanence is how a planted directive discourages the one action that would remove it.`
+      : `Remove the entry and roll the ${noun} back to its approved baseline, then re-check the agent's OTHER memory stores and projects for the same text before re-approving - a self-reinforcing entry is rarely in one place. Restrict who may write this store.`,
+    undefined,
+    selfRef.line,
+  );
+}
+
+function reportScanFindings(text, { noun, Noun }, push, findings, seenInjection) {
+  const scan = localScan(text, { categories: ['injection', 'secret', 'pii'] });
+  for (const finding of scan.findings) {
+    if (finding.category === 'injection') {
+      if (seenInjection) continue;
+      push(
+        'HIGH',
+        `Injected instruction in ${noun}: ${finding.label}`,
+        'Remove the injected/obfuscated text and roll back to the approved baseline.',
+        undefined,
+        finding.line,
+      );
+    } else if (finding.category === 'secret') {
+      push(
+        'CRITICAL',
+        `Live credential stored in ${noun}: ${finding.label}`,
+        'Revoke and rotate the credential; inject secrets at runtime from a secret manager.',
+        undefined,
+        finding.line,
+      );
+    } else if (finding.category === 'pii') {
+      findings.push({
+        severity: 'MEDIUM',
+        title: `Personal data stored in ${noun}: ${finding.label}`,
+        remediationText: `Strip personal data from the ${noun}.`,
+        ...(finding.line ? { line: finding.line } : {}),
+      });
+    }
+  }
+}
+
+function dedupeByTitle(findings) {
+  const seen = new Set();
+  return findings.filter((finding) => {
+    if (seen.has(finding.title)) return false;
+    seen.add(finding.title);
+    return true;
+  });
+}
+
+export function localMemory(content, { kind = 'MEMORY' } = {}) {
+  const text = content || '';
+  const names = memoryNouns(kind);
+  const { findings, push } = createFindingSink(text);
+
+  reportDurableClaims(text, names, push);
+  const { hasOverride, hasAuthority } = reportOverride(text, names, push);
+  reportDirectives(text, names, push);
+  reportStagedPayload(text, names, push);
+
+  const host = egressHost(text);
+  if (host) {
+    push(
+      'HIGH',
+      `${names.Noun} references a data-exfiltration host (${host})`,
+      'Remove the reference and roll back to the approved baseline.',
+      host,
+    );
+  }
+
+  reportToxicFlow(text, names, push);
+
+  const lifecycleLine = text.split(/\r?\n/).find((line) => LIFECYCLE_VECTOR.test(line) && !isDocumentationLine(line));
+  if (lifecycleLine) {
+    push(
+      'MEDIUM',
+      `${names.Noun} references a package-lifecycle hook (MemoryTrap vector)`,
+      'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.',
+      lifecycleLine,
+    );
+  }
+
+  reportSelfReinforcement(text, names, push);
+
+  const durablePersistence = !names.isInstruction && PERSISTENCE_MARKERS.test(text) && IMPERATIVE.test(text);
+  const seenInjection = hasOverride || hasAuthority || durablePersistence;
+  reportScanFindings(text, names, push, findings, seenInjection);
+
+  return dedupeByTitle(findings);
+}