@shomra/agent 0.3.2 → 0.3.3

package/design.mjs

@@ -46,11 +46,16 @@ export const CAP_LABEL = {
  * the attack story, so a path reads as a sentence about the system rather than a
  * list of flags.
  *
- * Rules are matched per line so the evidence can cite one, and so a document
- * that mentions a capability in a "we will not do X" sentence is still surfaced
- * — unlike the runtime detectors, a design doc's negations are DESIGN DECISIONS
- * worth showing the reader, not false positives to suppress. The reader decides.
+ * Rules are matched per line so the evidence can cite one.
+ *
+ * ⚠ A line that DISCLAIMS a capability must not grant it. This originally said
+ * the opposite — that a "we will not do X" sentence was a design decision worth
+ * surfacing — and that was wrong: granting the flag from a disclaimer invents a
+ * phantom attack path out of the one sentence that rules it out, which is the
+ * most misleading output this tool can produce. "The tool has no access to
+ * customer data" is the designer telling you the source does not exist.
  */
+const DISCLAIMER_RE = /\b(no|never|not|without|excludes?|excluding|neither|nor)\b[^.\n]{0,30}\b(access|read|write|permission|abilit|able|connection|integration)\w*|\b(does |do |will |can |must )(not|n't)\b|\bout of scope\b|\bnon-goals?\b|\bis not (able|permitted|allowed)\b/i;
 const CAP_RULES = [
   // ── SOURCES ────────────────────────────────────────────────────────────────
   { cap: 'injection', what: 'end-user or customer text', re: /\b(user|customer|client|end[- ]user)[- ]?(input|message|text|query|prompt|request|content|submission)\b/i },
@@ -79,12 +84,15 @@ const CAP_RULES = [
   { cap: 'readsSensitive', what: 'private source code', re: /\bprivate (repo|repositor\w+|source|code)\b|\bproprietary (code|source)\b|\binternal (repo|codebase|wiki|docs?)\b/i },
   { cap: 'readsSensitive', what: 'object storage', re: /\bS3 bucket\b|\b(blob|object) storage\b|\bGCS bucket\b|\bdata lake\b/i },
 
-  { cap: 'filesystem', what: 'file writes', re: /\bwrit\w+\b.{0,25}\b(file|disk|filesystem|directory|folder|repo)\b|\b(file ?system|local files?) (access|write)\b|\bcommits? (code|files?|changes?)\b/i },
+  // Plurals throughout: "writes the generated files to the repo" is the normal
+  // phrasing, and `\bfile\b` cannot match it. Same blind spot as `\bpdf\b` vs
+  // "PDFs" — assume every noun here arrives plural at least half the time.
+  { cap: 'filesystem', what: 'file writes', re: /\bwrit\w+\b[^.\n]{0,25}\b(files?|disks?|filesystems?|director(y|ies)|folders?|repos?|repositor(y|ies))\b|\b(file ?system|local files?) (access|write)\b|\bcommits? (code|files?|changes?)\b/i },
   { cap: 'filesystem', what: 'workspace or repo checkout', re: /\b(clones?|checks? out|checkout)\b.{0,25}\b(repo|repositor\w+)\b|\bworkspace (access|mount|volume)\b/i },
 
   // ── SINKS ──────────────────────────────────────────────────────────────────
   { cap: 'network', what: 'outbound API calls', re: /\bcalls?\b.{0,30}\b(external|third[- ]party|public|remote|partner)\b.{0,20}\bapi\b|\boutbound (request|call|http|traffic)\b|\begress\b/i },
-  { cap: 'network', what: 'webhooks', re: /\bwebhooks?\b|\bpost(s|ing)?\b.{0,25}\b(to an? )?(endpoint|url|callback)\b/i },
+  { cap: 'network', what: 'webhooks', re: /\bwebhooks?\b|\bpost(s|ing|ed)?\b[^.\n]{0,30}\bto\b[^.\n]{0,25}\b(endpoints?|urls?|callbacks?|apis?|services?|partners?|systems?)\b/i },
   { cap: 'network', what: 'sending email or messages', re: /\bsends?\b.{0,25}\b(e-?mail|message|notification|sms|slack|dm)\b|\bnotif(y|ies|ication)\b.{0,25}\b(user|customer|channel|slack|teams|email)\b|\bsmtp\b/i },
   { cap: 'network', what: 'publishing or uploading data', re: /\b(publish|upload|export|sync|push)\w*\b.{0,30}\b(to|into)\b.{0,25}\b(external|third[- ]party|cloud|bucket|service|partner|crm|warehouse)\b/i },
   { cap: 'network', what: 'a model provider call', re: /\b(openai|anthropic|gemini|bedrock|azure openai|mistral|cohere|hugging ?face)\b|\bLLM (api|provider|call)\b|\bmodel (provider|endpoint|api)\b/i },
@@ -95,7 +103,10 @@ const CAP_RULES = [
   { cap: 'exec', what: 'agent tool calls', re: /\b(tool[- ]call|function[- ]call|tool use|agentic loop|autonomous(ly)?)\b|\bagent (executes?|acts?|takes? actions?)\b/i },
 
   { cap: 'destructive', what: 'deleting data', re: /\bdelet\w+|\bremov\w+\b.{0,20}\b(record|row|file|user|account|data)\b|\bpurge\b|\bdrop (table|database)\b|\btruncat\w+/i },
-  { cap: 'destructive', what: 'moving money', re: /\b(refund|payment|charge|invoice|payout|transfer|billing|subscription|purchase|order)s?\b|\bstripe\b|\bmoves? money\b/i },
+  // A money NOUN alone is not a capability — "the dashboard displays the refund
+  // history" is a read. The line has to name an act that MOVES the money, so the
+  // verb is required and read-only verbs are not on the list.
+  { cap: 'destructive', what: 'moving money', re: /\b(issues?|issuing|processes|processing|triggers?|initiates?|creates?|approves?|grants?|sends?|makes?|charges?|refunds?|voids?|cancels?)\b[^.\n]{0,30}\b(refunds?|payments?|charges?|invoices?|payouts?|transfers?|subscriptions?|purchases?|orders?)\b|\bmoves? money\b|\bthrough stripe\b|\bvia stripe\b/i },
   { cap: 'destructive', what: 'changing access or state', re: /\b(revok\w+|disabl\w+|suspend\w+|deactivat\w+|cancel\w*|ban\w*)\b.{0,25}\b(user|account|access|key|token|subscription|service)\b|\bgrants? (access|permission|role)\b/i },
   { cap: 'destructive', what: 'writing to production', re: /\bwrit\w+\b.{0,25}\bprod(uction)?\b|\bprod(uction)?\b.{0,20}\bwrite (access|path)\b|\bmutat\w+\b.{0,25}\b(prod|live|customer) (data|state)\b/i },
 ];
@@ -123,6 +134,9 @@ export function capsFromProse(text) {
     // Code blocks in a design doc are illustrative snippets, not statements of
     // intent — and they are exactly where a scanner's vocabulary produces noise.
     if (inFence || isSkippableLine(line)) continue;
+    // A disclaimer names the capability in order to rule it out. Granting the
+    // flag here would invent an attack path from the sentence that removes it.
+    if (DISCLAIMER_RE.test(line)) continue;
 
     for (const r of CAP_RULES) {
       const m = r.re.exec(line);

package/guard-signals.mjs

@@ -709,20 +709,40 @@ function localCommandExtras(content) {
 // conceal from the user, disable safety, exfiltrate).
 const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
 const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|do not (tell|inform|mention|reveal|disclose) (the |any)?(user|anyone|them)|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
-const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|overrid(e|ing|es)|supersede?s?|takes? precedence|highest[- ]priority)\b/i;
+// Backend parity: a bare `override` matched "the env var overrides the default
+// port", so the verb now needs an object that makes it a precedence CLAIM.
+const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es)\b[^.\n]{0,30}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety))\b/i;
 const OVERRIDE_MARKERS = new RegExp(`${MALICIOUS_OVERRIDE.source}|${PRECEDENCE_MARKERS.source}`, 'i');
-const AUTHORITY_SPOOF_STRONG = /(^|\n)\s*(#{0,3}\s*system\s*(prompt|message|instruction)?\s*[:>]|\[system\]|<\/?system>|\bas an? (system|admin|root|developer)[- ]?(instruction|directive|message|mode)|authority\s*[:=]\s*(system|admin|root)|you are now\b|new (system )?(instructions?|directive)s?\s*[:>])/i;
-const AUTHORITY_SPOOF_SOFT = /priority\s*[:=]\s*(high|critical|max|urgent)/i;
-const AUTHORITY_SPOOF = new RegExp(`${AUTHORITY_SPOOF_STRONG.source}|${AUTHORITY_SPOOF_SOFT.source}`, 'i');
-const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm (run |lifecycle)|package\.json.{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
+// Backend parity. The noun after "system" is MANDATORY (`system\s+(prompt|
+// message|instruction)s?`), not optional: with it optional, an ordinary markdown
+// heading — "## System: NestJS 10 + Prisma 6" — scored as authority spoofing.
+const AUTHORITY_SPOOF_STRONG = /(^|\n)\s*(#{0,3}\s*system\s+(prompt|message|instruction)s?\s*[:>]|\[system\]|<\/?system>|\bas an? (system|admin|root|developer)[- ]?(instruction|directive|message|mode)|authority\s*[:=]\s*(system|admin|root)|you are now\b|new (system )?(instructions?|directive)s?\s*[:>])/i;
+// ⚠ There is deliberately no SOFT tier. `priority: high` is a TODO tag in every
+// issue tracker ever built; scoring it as authority spoofing was pure noise. The
+// backend dropped it and the mirror follows — do not reintroduce it.
+const AUTHORITY_SPOOF = AUTHORITY_SPOOF_STRONG;
+// Backend parity: `npm run ` matched every "run npm run db:generate" note in a
+// developer's memory, and the `.` wildcard crossed lines. The MemoryTrap vector
+// is a LIFECYCLE hook, not the npm CLI.
+const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm\s+lifecycle|package\.json[^.\n]{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
 const IMPERATIVE = /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
 const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must not|mustn'?t|should not|shouldn'?t|won'?t|will not|under no circumstances|forbidden|prohibited|not allowed|disallow(ed)?)\b/i;
 const SABOTAGE_RULES = [
-  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|checks?|flags?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  // Object list drops `checks`/`flags` (backend parity): "skip the OSV checks in
+  // CI, they are flaky" is a developer note about test infrastructure, not an
+  // instruction to disable a guardrail.
+  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
   { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
   { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
-  { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|input|request|message|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
-  { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect|file|data|when)\b/i },
+  // Object list drops `input`/`message` (backend parity): "ignore any user input
+  // that doesn't parse" is input validation. Hijack targets the user's
+  // prompt/instruction/request/command/intent, which are retained.
+  { re: /\bignore\b[^.\n]{0,40}\b(user|human)\b[^.\n]{0,25}\b(prompt|instruction|request|command|wish|intent|question)s?\b/i, label: 'ignore-user', guarded: true },
+  // Backend parity, two narrowings. The `(?!'s)` lookahead keeps "do not log the
+  // USER'S data" out — that is a privacy rule, not concealment FROM the user —
+  // and the context list drops `file|data|when`, which matched almost any
+  // sentence and made the context requirement decorative.
+  { re: /\bdo not\b[^.\n]{0,20}\b(log|display|show|print|record|surface|expose|output)\b[^.\n]{0,60}\buser\b(?!['’]s)/i, label: 'conceal-from-user', guarded: false, context: /\b(transfer|transmit|send|network|exfil|upload|post|copy|collect)\b/i },
 ];
 // Descriptive / documentation mood: a line that NAMES a security concept rather
 // than INSTRUCTING the agent to perform it. Poisoning payloads are imperative and
@@ -740,6 +760,37 @@ function isDescriptiveLine(line) {
   return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
 }
 
+/**
+ * The first line matching `re` that is a genuine directive — NOT a negated
+ * hardening rule ("never bypass safety") and NOT descriptive documentation
+ * ("detects skills that bypass safety").
+ *
+ * ⚠ Replaces whole-document `re.test(text)`, which the backend identified as the
+ * DOMINANT memory/rules-file false positive: it fires on a benign line anywhere
+ * in the file with no regard for mood or co-location, so "## System: NestJS 10"
+ * in a heading and "overrides the default port" in a note both scored CRITICAL.
+ * Mirrors firstDirectiveLine() in src/bundle/memory-signals.ts.
+ */
+function firstDirectiveLine(text, re) {
+  for (const line of text.split(/\r?\n/)) {
+    if (!re.test(line)) continue;
+    if (NEGATION_GUARD.test(line)) continue;
+    if (isDescriptiveLine(line)) continue;
+    return line;
+  }
+  return null;
+}
+
+/** The first line where EVERY regex matches (co-located signal), else null.
+ *  Whole-document co-occurrence was the dominant memory FP: "every time" in a
+ *  quoted line and "always" forty lines away is not a durable imperative. */
+function lineMatchingAll(text, ...res) {
+  for (const line of text.split(/\r?\n/)) {
+    if (res.every((re) => re.test(line))) return line;
+  }
+  return null;
+}
+
 // A loopback / private-network URL is a dev/smoke-test target, not exfiltration.
 const LOCAL_URL_RE = /\bhttps?:\/\/(localhost|127\.\d+|0\.0\.0\.0|\[::1\]|192\.168\.|10\.\d+|172\.(1[6-9]|2\d|3[01])\.)/i;
 
@@ -800,16 +851,26 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   const isInstruction = kind === 'INSTRUCTION';
   const noun = isInstruction ? 'rules file' : 'memory';
 
-  const hasOverride = isInstruction ? MALICIOUS_OVERRIDE.test(text) : OVERRIDE_MARKERS.test(text);
-  const hasAuthority = isInstruction ? AUTHORITY_SPOOF_STRONG.test(text) : AUTHORITY_SPOOF.test(text);
+  // Per-line and guarded (see firstDirectiveLine) rather than whole-document:
+  // a negated hardening rule ("never bypass the safety checks"), a descriptive
+  // note, or a markdown heading that happens to read like a marker must not
+  // score as a planted directive. Mirrors analyzeMemory() in the backend.
+  const overrideLine = firstDirectiveLine(text, isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
+  const authorityLine = firstDirectiveLine(text, isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF);
+  const hasOverride = !!overrideLine;
+  const hasAuthority = !!authorityLine;
   const hasPersistence = PERSISTENCE_MARKERS.test(text);
   const hasImperative = IMPERATIVE.test(text);
+  // A durable imperative is only poisoning-shaped when the persistence marker and
+  // the imperative sit on the SAME line ("always do X in every future session") —
+  // not when "every time" is in one note and "always" is forty lines away.
+  const durableImperativeLine = !isInstruction ? lineMatchingAll(text, PERSISTENCE_MARKERS, IMPERATIVE) : null;
 
   if (hasOverride || hasAuthority) {
     const firedRe = hasAuthority ? (isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF) : (isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
     push('CRITICAL', `Poisoned ${noun}: ${hasAuthority ? 'system-authority spoofing' : 'injected override directive'}`, `Remove the injected directive and roll the ${noun} back to its approved baseline; restrict who/what may write it.`, firedRe);
-  } else if (!isInstruction && hasPersistence && hasImperative) {
-    push('HIGH', 'Suspicious standing instruction in memory', 'Rewrite as a neutral fact or remove it. Encode intended standing behavior in a reviewed rules/policy file, not agent-writable memory.', PERSISTENCE_MARKERS);
+  } else if (durableImperativeLine && !isDescriptiveLine(durableImperativeLine)) {
+    push('HIGH', 'Suspicious standing instruction in memory', 'Rewrite as a neutral fact or remove it. Encode intended standing behavior in a reviewed rules/policy file, not agent-writable memory.', durableImperativeLine);
   }
 
   const { sabotage, exfil } = scanDirectives(text);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/shomra.mjs

@@ -476,20 +476,62 @@ function detectEnv() {
     return undefined;
   };
   let ci = null;
-  if (e.GITHUB_ACTIONS) ci = { ciProvider: 'github-actions', repo: e.GITHUB_REPOSITORY, ref: e.GITHUB_REF_NAME, commit: e.GITHUB_SHA };
-  else if (e.GITLAB_CI) ci = { ciProvider: 'gitlab-ci', repo: e.CI_PROJECT_PATH, ref: e.CI_COMMIT_REF_NAME, commit: e.CI_COMMIT_SHA };
-  else if (e.CIRCLECI) ci = { ciProvider: 'circleci', repo: e.CIRCLE_PROJECT_REPONAME, ref: e.CIRCLE_BRANCH, commit: e.CIRCLE_SHA1 };
-  else if (e.TF_BUILD) ci = { ciProvider: 'azure-pipelines', repo: e.BUILD_REPOSITORY_NAME, ref: e.BUILD_SOURCEBRANCHNAME, commit: e.BUILD_SOURCEVERSION };
-  else if (e.BITBUCKET_BUILD_NUMBER) ci = { ciProvider: 'bitbucket-pipelines', repo: e.BITBUCKET_REPO_FULL_NAME, ref: e.BITBUCKET_BRANCH, commit: e.BITBUCKET_COMMIT };
-  else if (e.JENKINS_URL) ci = { ciProvider: 'jenkins', repo: pick('JOB_NAME'), ref: e.GIT_BRANCH, commit: e.GIT_COMMIT };
-  else if (e.CI) ci = { ciProvider: 'ci', repo: undefined, ref: undefined, commit: undefined };
+  // `repoUrl` is the FULL remote URL, and it is the field that matters: `repo`
+  // is an owner/name slug with no host, so it cannot identify a repository (see
+  // the backend's common/repo-identity.ts). Every provider below exposes a real
+  // URL variable — send it, and let the slug stay a display label.
+  if (e.GITHUB_ACTIONS)
+    ci = {
+      ciProvider: 'github-actions',
+      repo: e.GITHUB_REPOSITORY,
+      // GITHUB_SERVER_URL is github.com on the hosted runner and the appliance
+      // host on GitHub Enterprise Server — which is exactly the distinction the
+      // slug loses.
+      repoUrl: e.GITHUB_SERVER_URL && e.GITHUB_REPOSITORY ? `${e.GITHUB_SERVER_URL.replace(/\/+$/, '')}/${e.GITHUB_REPOSITORY}` : undefined,
+      ref: e.GITHUB_REF_NAME,
+      commit: e.GITHUB_SHA,
+    };
+  else if (e.GITLAB_CI)
+    ci = { ciProvider: 'gitlab-ci', repo: e.CI_PROJECT_PATH, repoUrl: e.CI_PROJECT_URL, ref: e.CI_COMMIT_REF_NAME, commit: e.CI_COMMIT_SHA };
+  else if (e.CIRCLECI)
+    ci = {
+      ciProvider: 'circleci',
+      repo: e.CIRCLE_PROJECT_REPONAME,
+      repoUrl: e.CIRCLE_REPOSITORY_URL,
+      ref: e.CIRCLE_BRANCH,
+      commit: e.CIRCLE_SHA1,
+    };
+  else if (e.TF_BUILD)
+    ci = {
+      ciProvider: 'azure-pipelines',
+      repo: e.BUILD_REPOSITORY_NAME,
+      repoUrl: e.BUILD_REPOSITORY_URI,
+      ref: e.BUILD_SOURCEBRANCHNAME,
+      commit: e.BUILD_SOURCEVERSION,
+    };
+  else if (e.BITBUCKET_BUILD_NUMBER)
+    ci = {
+      ciProvider: 'bitbucket-pipelines',
+      repo: e.BITBUCKET_REPO_FULL_NAME,
+      repoUrl: e.BITBUCKET_GIT_HTTP_ORIGIN,
+      ref: e.BITBUCKET_BRANCH,
+      commit: e.BITBUCKET_COMMIT,
+    };
+  // Jenkins' JOB_NAME is a job label, NOT a repository — it is kept as the
+  // display `repo` but must never be completed into a URL. GIT_URL is the real
+  // remote when the job checked one out.
+  else if (e.JENKINS_URL) ci = { ciProvider: 'jenkins', repo: pick('JOB_NAME'), repoUrl: pick('GIT_URL'), ref: e.GIT_BRANCH, commit: e.GIT_COMMIT };
+  else if (e.CI) ci = { ciProvider: 'ci', repo: undefined, repoUrl: undefined, ref: undefined, commit: undefined };
 
   if (ci) {
+    // The checkout on the runner is the same repository the provider variables
+    // describe, so git fills any variable the provider didn't set.
     const git = gitContext();
     return {
       environment: 'CI',
       ciProvider: ci.ciProvider,
       repo: ci.repo ?? git.repo,
+      repoUrl: ci.repoUrl ?? git.repoUrl,
       ref: ci.ref ?? git.ref,
       commit: ci.commit ?? git.commit,
     };
@@ -515,7 +557,20 @@ function gitContext() {
     const m = origin.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
     repo = m ? m[1] : undefined;
   }
-  return { repo, ref: run('rev-parse --abbrev-ref HEAD'), commit: run('rev-parse HEAD') };
+  // ⚠ `repo` above is an owner/name slug with the HOST STRIPPED, so it is a
+  // display label and nothing more: `acme/api` on github.com and on a
+  // self-hosted GitLab produce the identical string, and keying developer
+  // activity on it would attribute one org's work to another org's repository.
+  // The raw origin URL is sent alongside it; the backend canonicalises that
+  // into the join key (common/repo-identity.ts).
+  //
+  // Credentials in a remote (`https://x-token:ghp_…@host/owner/repo`) are
+  // stripped here rather than at the backend — a token should not leave the
+  // machine at all, and the backend's key would drop it anyway, so nothing is
+  // lost by removing it early.
+  let repoUrl = origin || undefined;
+  if (repoUrl) repoUrl = repoUrl.replace(/^([a-z][\w+.-]*:\/\/)[^/@]*@/i, '$1');
+  return { repo, repoUrl, ref: run('rev-parse --abbrev-ref HEAD'), commit: run('rev-parse HEAD') };
 }
 
 /**