@shomra/agent 0.3.25 → 0.3.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "Shomra - adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/src/detect/guard-signals.mjs

@@ -9,7 +9,7 @@ export { localGate } from './signals/gate.mjs';
 export { INJECTION_PHRASES, INJECTION_REGEXES, INVISIBLE_CHARS_RE } from './signals/injection.mjs';
 export { localMemory } from './signals/memory.mjs';
 export { AGENT_ROOT_RE, isAgentAdjacentPath, localPropagation } from './signals/propagation.mjs';
-export { citationGoverns, isDocumentationLine, prohibitsAt } from './signals/prose-context.mjs';
+export { citationGoverns, describesAt, isDocumentationLine, prohibitsAt } from './signals/prose-context.mjs';
 export { downrankCodeContext, localScan } from './signals/scan.mjs';
 export { PII_PATTERNS, SECRET_PATTERNS } from './signals/secrets.mjs';
 export { NETWORK_VERBS, SENSITIVE_READ } from './signals/sensitive.mjs';

package/src/detect/local-redact.mjs

@@ -0,0 +1,67 @@
+import { PII_PATTERNS, SECRET_PATTERNS, isPlaceholderSecret, luhnValid } from './signals/secrets.mjs';
+
+const MAX_TEXT = 200_000;
+const MAX_SPANS = 200;
+
+
+export function redactLocally(text, opts = {}) {
+  const src = String(text ?? '');
+  if (!src || src.length > MAX_TEXT) return { text: src, masked: [], unmaskable: [], changed: false };
+
+  const categories = opts.categories ?? ['secret', 'pii'];
+  const spans = [];
+
+  const collect = (re, label, category) => {
+    const rx = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m;
+    let guard = 0;
+    while ((m = rx.exec(src)) !== null && guard++ < MAX_SPANS) {
+      if (!m[0]) { rx.lastIndex += 1; continue; }
+      if (category === 'secret' && isPlaceholderSecret(m[0])) continue;
+      if (label === 'Credit card number' && !luhnValid(m[0])) continue;
+      spans.push({ start: m.index, end: m.index + m[0].length, label, category });
+    }
+  };
+
+  if (categories.includes('secret')) for (const { name, re } of SECRET_PATTERNS) collect(re, name, 'secret');
+  if (categories.includes('pii')) for (const { name, re } of PII_PATTERNS) collect(re, name, 'pii');
+
+  if (!spans.length) return { text: src, masked: [], unmaskable: [], changed: false };
+
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged = [];
+  for (const s of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s.start < last.end) {
+      last.end = Math.max(last.end, s.end);
+      if (!last.labels.includes(s.label)) last.labels.push(s.label);
+      continue;
+    }
+    merged.push({ start: s.start, end: s.end, labels: [s.label], category: s.category });
+  }
+
+  let out = '';
+  let cursor = 0;
+  const masked = [];
+  for (const m of merged) {
+    out += src.slice(cursor, m.start);
+    out += `[shomra:redacted:${m.category}]`;
+    cursor = m.end;
+    masked.push({ label: m.labels.join(' + '), category: m.category, chars: m.end - m.start });
+  }
+  out += src.slice(cursor);
+
+  return { text: out, masked, unmaskable: [], changed: true };
+}
+
+
+export function unmaskableFindings(findings, redaction) {
+  const maskedLabels = new Set((redaction?.masked ?? []).flatMap((m) => String(m.label).split(' + ')));
+  return (findings ?? [])
+    .filter((f) => f && (f.category === 'secret' || f.category === 'pii'))
+    .filter((f) => {
+      const label = String(f.label ?? '').replace(/^Live credential:\s*/, '');
+      return !maskedLabels.has(label);
+    })
+    .map((f) => f.label);
+}

package/src/detect/signals/autonomy.mjs

@@ -1,4 +1,4 @@
-import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+import { describesAt, isDocumentationLine, prohibitsAt } from './prose-context.mjs';
 
 const AUTONOMY_RULES = [
   { family: 'confirmation', label: 'Acts without asking', re: /\b(?:without (?:asking|confirming|prompting|waiting for|seeking)(?:\s+(?:the\s+)?(?:user|me|anyone|permission|approval|confirmation))?|do(?:es)? not (?:ask|prompt|wait|check|confirm)[^.\n]{0,30}\b(?:for|before|first|permission|approval|confirmation)|no need to (?:ask|confirm|check with))\b/i },
@@ -36,7 +36,7 @@ export function localAutonomy(text) {
       const m = rule.re.exec(line);
       if (!m) continue;
       if (isDocumentationLine(line)) continue;
-      if (prohibitsAt(line, m.index)) continue;
+      if (prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       if (insideQuotedSpan(line, m.index)) continue;
       seen.add(rule.label);
       out.push({ family: rule.family, label: rule.label, line: i + 1 });

package/src/detect/signals/credential-harvest.mjs

@@ -1,4 +1,4 @@
-import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+import { describesAt, isDocumentationLine, prohibitsAt } from './prose-context.mjs';
 
 const HARVEST_PROMPTS = [
   { re: /\bosascript\b[\s\S]{0,200}?\bdisplay\s+dialog\b[\s\S]{0,200}?\bhidden\s+answer\b/i, label: 'osascript password dialog (hidden answer)' },
@@ -45,14 +45,14 @@ export function detectCredentialHarvest(text) {
     for (const p of HARVEST_PROMPTS) {
       const m = p.re.exec(line);
       if (!m) continue;
-      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       push('interactive-prompt', p.label, 'CRITICAL', i, line);
     }
     for (const s of HARVEST_STORES) {
       const m = s.re.exec(line);
       if (!m) continue;
       if (!HARVEST_READ_VERB.test(line)) continue;
-      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index) || describesAt(line, m.index)) continue;
       push(s.family, s.label, HARVEST_EXFIL_VERB.test(line) ? 'CRITICAL' : 'HIGH', i, line);
     }
     const t = HARVEST_TOKEN_PATH.exec(line);

package/src/detect/signals/memory.mjs

@@ -1,7 +1,7 @@
 import { CLAIM_LABEL, claimSeverity, detectDurableClaims } from './durable-claims.mjs';
 import { LOCAL_URL_RE, egressHost } from './egress.mjs';
 import { lineOf, lineTextAt } from './lines.mjs';
-import { citationGoverns, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
+import { citationGoverns, describesAt, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
 import { localScan } from './scan.mjs';
 import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
 import { DANGEROUS_SHELL } from './shell.mjs';
@@ -44,6 +44,7 @@ export function offendingLine(sig, text) {
     if (sig.refine && !sig.refine(line)) continue;
     if (isDocumentationLine(line)) continue;
     if (prohibitsAt(line, line.indexOf(m[0]))) continue;
+    if (describesAt(line, line.indexOf(m[0]))) continue;
     if (isRiskTableRow(line)) continue;
     return line;
   }

package/src/detect/signals/prose-context.mjs

@@ -71,6 +71,59 @@ export function prohibitsAt(line, offset) {
   return !DOUBLE_NEGATIVE_RE.test(before);
 }
 
+/**
+ * ⚠ AN OFFSET ON THE OPENING BACKTICK IS INSIDE THE SPAN. Several rules anchor
+ * on the backtick itself (a markdown code span and a shell command substitution
+ * are the same character), so counting only what precedes the offset put every
+ * code-span guard one character outside the span it was meant to be inside.
+ */
+function insideCodeSpan(line, offset) {
+  let ticks = 0;
+  for (let i = 0; i < offset && i < line.length; i++) if (line[i] === '`') ticks++;
+  if (ticks % 2 === 1) return true;
+  return line[offset] === '`' && line.indexOf('`', offset + 1) !== -1;
+}
+
+/**
+ * ⚠ A LINE THAT NAMES A COMMAND AS ITS SUBJECT IS DESCRIBING IT — the second
+ * carve-out `carriesHardEvidence` needs, for the same reason `prohibitsAt` was
+ * the first. Security documentation is written in exactly this mood -
+ * *"`curl … | sh` is a pipe-to-shell installer"*, *"`chmod 777` means the file
+ * is world-writable"* - so offline, where no server verdict ever arrives to
+ * correct it, every threat model and runbook in a careful repo blocked.
+ *
+ * ⚠ THE LEAD-IN IS NOT THE SIGNAL, THE PREDICATE IS. "For example, run
+ * `curl … | sh`" is an instruction wearing a documentation opener, and
+ * "example" is one token an attacker adds for free. What cannot be faked
+ * cheaply is the command sitting in SUBJECT position with a copular or
+ * reporting verb after it: an instruction puts the command in OBJECT position
+ * after an imperative.
+ *
+ * ⚠ THE MATCH MUST BE INSIDE A CODE SPAN, and ⚠ AN IMPERATIVE BEFORE IT WINS.
+ *
+ * Mirrors `describesAt` in the backend's prose-context.ts — `local-mirror-bench`
+ * compares the two on every mood, in both directions.
+ */
+const DESCRIPTIVE_PREDICATE_RE =
+  /^\s*(?:,\s*)?(?:is|are|was|were|means?|meant|shows?|showed|demonstrates?|indicates?|signals?|denotes?|describes?|represents?|counts?\s+as|reads?\s+as|matches?|fires?|triggers?|flags?|catches?|becomes?|remains?|stays?|looks?\s+like|would\s+\w+|will\s+\w+|has|have|had)\b/i;
+
+const IMPERATIVE_LEAD_RE =
+  /\b(?:run|execute|exec|invoke|call|use|paste|copy|type|enter|apply|install|download|fetch|curl|wget|pipe|add|append|write|put|send|post)\b[^.:;\n]{0,40}$/i;
+
+export function describesAt(line, offset) {
+  if (!line || offset == null || offset < 0 || offset >= line.length) return false;
+  if (!insideCodeSpan(line, offset)) return false;
+
+  const onTick = line[offset] === '`';
+  const close = line.indexOf('`', onTick ? offset + 1 : offset);
+  if (close === -1) return false;
+  if (!DESCRIPTIVE_PREDICATE_RE.test(line.slice(close + 1, close + 60))) return false;
+
+  const open = onTick ? offset : line.lastIndexOf('`', offset);
+  const before = line.slice(Math.max(0, open - 60), open);
+  return !IMPERATIVE_LEAD_RE.test(before) && !IMPERATIVE.test(before);
+}
+
 const RISK_CELL_RE = /\b(?:critical|high|medium|low|severity|risk|danger\w*|forbidden|blocked|denied|prohibited|never|do not|example|attack|threat|mitigation|why|impact)\b/i;
 
 export function isRiskTableRow(line) {

package/src/guard/prompt-guard.mjs

@@ -3,6 +3,7 @@ import { gateMachine } from '../core/api-client.mjs';
 import { breakerOpen, breakerReset, breakerTrip, guardTimeoutMs } from '../core/circuit-breaker.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
 import { downrankCodeContext, localScan } from '../detect/guard-signals.mjs';
+import { redactLocally } from '../detect/local-redact.mjs';
 import { detectEnv } from '../gate/environment.mjs';
 import { parentSessionFrom } from './normalize.mjs';
 import { envFlag, resolveAgentFlag } from './options.mjs';
@@ -169,10 +170,24 @@ function promptInjectionNote(injection) {
   );
 }
 
+
 function buildPromptGuardBody(norm, agent, clientDecision, clientReason) {
+  const redaction = localTierDisabled()
+    ? { text: norm.prompt, masked: [], changed: false }
+    : redactLocally(norm.prompt);
+
   return {
     tool_name: 'UserPromptSubmit',
-    tool_input: { prompt: norm.prompt },
+    tool_input: { prompt: redaction.text },
+    ...(redaction.changed
+      ? {
+          client_masked: {
+            count: redaction.masked.length,
+            labels: redaction.masked.map((m) => m.label).slice(0, 20),
+            where: 'client',
+          },
+        }
+      : {}),
     cwd: norm.cwd,
     session_id: norm.session_id,
     ...(norm.parent_session_id ? { parent_session_id: norm.parent_session_id } : {}),