@shomra/agent 0.3.25 → 0.3.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "Shomra - adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/src/detect/guard-signals.mjs

@@ -9,7 +9,7 @@ export { localGate } from './signals/gate.mjs';
 export { INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE } from './signals/injection.mjs';
 export { localMemory } from './signals/memory.mjs';
 export { AGENT_ROOT_RE, isAgentAdjacentPath, localPropagation } from './signals/propagation.mjs';
-export { citationGoverns, isDocumentationLine, prohibitsAt } from './signals/prose-context.mjs';
+export { citationGoverns, describesAt, isDocumentationLine, prohibitsAt } from './signals/prose-context.mjs';
 export { downrankCodeContext, localScan } from './signals/scan.mjs';
 export { PII_PATTERNS, SECRET_PATTERNS } from './signals/secrets.mjs';
 export { NETWORK_VERBS, SENSITIVE_READ } from './signals/sensitive.mjs';

package/src/detect/signals/autonomy.mjs

@@ -1,4 +1,4 @@
-import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+import { describesAt, isDocumentationLine, prohibitsAt } from './prose-context.mjs';
 
 const AUTONOMY_RULES = [
   { family: 'confirmation', label: 'Acts without asking', re: /\b(?:without (?:asking|confirming|prompting|waiting for|seeking)(?:\s+(?:the\s+)?(?:user|me|anyone|permission|approval|confirmation))?|do(?:es)? not (?:ask|prompt|wait|check|confirm)[^.\n]{0,30}\b(?:for|before|first|permission|approval|confirmation)|no need to (?:ask|confirm|check with))\b/i },
@@ -36,7 +36,7 @@ export function localAutonomy(text) {
       const m = rule.re.exec(line);
       if (!m) continue;
       if (isDocumentationLine(line)) continue;
-      if (prohibitsAt(line, m.index)) continue;
+      if (prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       if (insideQuotedSpan(line, m.index)) continue;
       seen.add(rule.label);
       out.push({ family: rule.family, label: rule.label, line: i + 1 });

package/src/detect/signals/credential-harvest.mjs

@@ -1,4 +1,4 @@
-import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+import { describesAt, isDocumentationLine, prohibitsAt } from './prose-context.mjs';
 
 const HARVEST_PROMPTS = [
   { re: /\bosascript\b[\s\S]{0,200}?\bdisplay\s+dialog\b[\s\S]{0,200}?\bhidden\s+answer\b/i, label: 'osascript password dialog (hidden answer)' },
@@ -45,14 +45,14 @@ export function detectCredentialHarvest(text) {
     for (const p of HARVEST_PROMPTS) {
       const m = p.re.exec(line);
       if (!m) continue;
-      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       push('interactive-prompt', p.label, 'CRITICAL', i, line);
     }
     for (const s of HARVEST_STORES) {
       const m = s.re.exec(line);
       if (!m) continue;
       if (!HARVEST_READ_VERB.test(line)) continue;
-      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       push(s.family, s.label, HARVEST_EXFIL_VERB.test(line) ? 'CRITICAL' : 'HIGH', i, line);
     }
     const t = HARVEST_TOKEN_PATH.exec(line);

package/src/detect/signals/memory.mjs

@@ -1,7 +1,7 @@
 import { CLAIM_LABEL, claimSeverity, detectDurableClaims } from './durable-claims.mjs';
 import { LOCAL_URL_RE, egressHost } from './egress.mjs';
 import { lineOf, lineTextAt } from './lines.mjs';
-import { citationGoverns, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
+import { citationGoverns, describesAt, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
 import { localScan } from './scan.mjs';
 import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
 import { DANGEROUS_SHELL } from './shell.mjs';
@@ -44,6 +44,7 @@ export function offendingLine(sig, text) {
     if (sig.refine && !sig.refine(line)) continue;
     if (isDocumentationLine(line)) continue;
     if (prohibitsAt(line, line.indexOf(m[0]))) continue;
+    if (describesAt(line, line.indexOf(m[0]))) continue;
     if (isRiskTableRow(line)) continue;
     return line;
   }

package/src/detect/signals/prose-context.mjs

@@ -71,6 +71,59 @@ export function prohibitsAt(line, offset) {
   return !DOUBLE_NEGATIVE_RE.test(before);
 }
 
+/**
+ * ⚠ AN OFFSET ON THE OPENING BACKTICK IS INSIDE THE SPAN. Several rules anchor
+ * on the backtick itself (a markdown code span and a shell command substitution
+ * are the same character), so counting only what precedes the offset put every
+ * code-span guard one character outside the span it was meant to be inside.
+ */
+function insideCodeSpan(line, offset) {
+  let ticks = 0;
+  for (let i = 0; i < offset && i < line.length; i++) if (line[i] === '`') ticks++;
+  if (ticks % 2 === 1) return true;
+  return line[offset] === '`' && line.indexOf('`', offset + 1) !== -1;
+}
+
+/**
+ * ⚠ A LINE THAT NAMES A COMMAND AS ITS SUBJECT IS DESCRIBING IT — the second
+ * carve-out `carriesHardEvidence` needs, for the same reason `prohibitsAt` was
+ * the first. Security documentation is written in exactly this mood -
+ * *"`curl … | sh` is a pipe-to-shell installer"*, *"`chmod 777` means the file
+ * is world-writable"* - so offline, where no server verdict ever arrives to
+ * correct it, every threat model and runbook in a careful repo blocked.
+ *
+ * ⚠ THE LEAD-IN IS NOT THE SIGNAL, THE PREDICATE IS. "For example, run
+ * `curl … | sh`" is an instruction wearing a documentation opener, and
+ * "example" is one token an attacker adds for free. What cannot be faked
+ * cheaply is the command sitting in SUBJECT position with a copular or
+ * reporting verb after it: an instruction puts the command in OBJECT position
+ * after an imperative.
+ *
+ * ⚠ THE MATCH MUST BE INSIDE A CODE SPAN, and ⚠ AN IMPERATIVE BEFORE IT WINS.
+ *
+ * Mirrors `describesAt` in the backend's prose-context.ts — `local-mirror-bench`
+ * compares the two on every mood, in both directions.
+ */
+const DESCRIPTIVE_PREDICATE_RE =
+  /^\s*(?:,\s*)?(?:is|are|was|were|means?|meant|shows?|showed|demonstrates?|indicates?|signals?|denotes?|describes?|represents?|counts?\s+as|reads?\s+as|matches?|fires?|triggers?|flags?|catches?|becomes?|remains?|stays?|looks?\s+like|would\s+\w+|will\s+\w+|has|have|had)\b/i;
+
+const IMPERATIVE_LEAD_RE =
+  /\b(?:run|execute|exec|invoke|call|use|paste|copy|type|enter|apply|install|download|fetch|curl|wget|pipe|add|append|write|put|send|post)\b[^.:;\n]{0,40}$/i;
+
+export function describesAt(line, offset) {
+  if (!line || offset == null || offset < 0 || offset >= line.length) return false;
+  if (!insideCodeSpan(line, offset)) return false;
+
+  const onTick = line[offset] === '`';
+  const close = line.indexOf('`', onTick ? offset + 1 : offset);
+  if (close === -1) return false;
+  if (!DESCRIPTIVE_PREDICATE_RE.test(line.slice(close + 1, close + 60))) return false;
+
+  const open = onTick ? offset : line.lastIndexOf('`', offset);
+  const before = line.slice(Math.max(0, open - 60), open);
+  return !IMPERATIVE_LEAD_RE.test(before) && !IMPERATIVE.test(before);
+}
+
 const RISK_CELL_RE = /\b(?:critical|high|medium|low|severity|risk|danger\w*|forbidden|blocked|denied|prohibited|never|do not|example|attack|threat|mitigation|why|impact)\b/i;
 
 export function isRiskTableRow(line) {