@shomra/agent 0.3.26 → 0.3.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Shomra - adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/src/detect/local-redact.mjs

@@ -0,0 +1,67 @@
+import { PII_PATTERNS, SECRET_PATTERNS, isPlaceholderSecret, luhnValid } from './signals/secrets.mjs';
+
+const MAX_TEXT = 200_000;
+const MAX_SPANS = 200;
+
+
+export function redactLocally(text, opts = {}) {
+  const src = String(text ?? '');
+  if (!src || src.length > MAX_TEXT) return { text: src, masked: [], unmaskable: [], changed: false };
+
+  const categories = opts.categories ?? ['secret', 'pii'];
+  const spans = [];
+
+  const collect = (re, label, category) => {
+    const rx = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m;
+    let guard = 0;
+    while ((m = rx.exec(src)) !== null && guard++ < MAX_SPANS) {
+      if (!m[0]) { rx.lastIndex += 1; continue; }
+      if (category === 'secret' && isPlaceholderSecret(m[0])) continue;
+      if (label === 'Credit card number' && !luhnValid(m[0])) continue;
+      spans.push({ start: m.index, end: m.index + m[0].length, label, category });
+    }
+  };
+
+  if (categories.includes('secret')) for (const { name, re } of SECRET_PATTERNS) collect(re, name, 'secret');
+  if (categories.includes('pii')) for (const { name, re } of PII_PATTERNS) collect(re, name, 'pii');
+
+  if (!spans.length) return { text: src, masked: [], unmaskable: [], changed: false };
+
+  spans.sort((a, b) => a.start - b.start || b.end - a.end);
+  const merged = [];
+  for (const s of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s.start < last.end) {
+      last.end = Math.max(last.end, s.end);
+      if (!last.labels.includes(s.label)) last.labels.push(s.label);
+      continue;
+    }
+    merged.push({ start: s.start, end: s.end, labels: [s.label], category: s.category });
+  }
+
+  let out = '';
+  let cursor = 0;
+  const masked = [];
+  for (const m of merged) {
+    out += src.slice(cursor, m.start);
+    out += `[shomra:redacted:${m.category}]`;
+    cursor = m.end;
+    masked.push({ label: m.labels.join(' + '), category: m.category, chars: m.end - m.start });
+  }
+  out += src.slice(cursor);
+
+  return { text: out, masked, unmaskable: [], changed: true };
+}
+
+
+export function unmaskableFindings(findings, redaction) {
+  const maskedLabels = new Set((redaction?.masked ?? []).flatMap((m) => String(m.label).split(' + ')));
+  return (findings ?? [])
+    .filter((f) => f && (f.category === 'secret' || f.category === 'pii'))
+    .filter((f) => {
+      const label = String(f.label ?? '').replace(/^Live credential:\s*/, '');
+      return !maskedLabels.has(label);
+    })
+    .map((f) => f.label);
+}

package/src/detect/signals/consequence.mjs

@@ -15,7 +15,9 @@
  * the server blocks work no server verdict would have blocked, and looser puts
  * a hole in the floor at exactly the moment the floor is all there is.
  */
-const SEVERE_VERB = /\b(delete|destroy|drop|purge|revoke|terminate|shutdown|wipe|erase|truncate|force[-_]?push|rm)\b/i;
+const SEVERE_VERB = /\b(delete|destroy|drop|purge|revoke|terminate|shutdown|wipe|erase|truncate|force[-_]?push)\b/i;
+
+const RM_COMMAND = /(?<![-\w])rm\b/i;
 
 const MATERIAL_VERB =
   /\b(transfer|pay|payment|refund|charge|invoice|wire|send|email|post|publish|deploy|release|merge|approve|grant|invite|share|upload|export)\b/i;
@@ -43,10 +45,10 @@ export function classifyConsequence(input) {
   const blob = raw.replace(/[_-]+/g, ' ').replace(/([a-z0-9])([A-Z])/g, '$1 $2');
 
   if (typeof input.amount === 'number' && input.amount > 0) {
-    return SEVERE_VERB.test(blob) ? 'severe' : 'material';
+    return SEVERE_VERB.test(blob) || RM_COMMAND.test(raw) ? 'severe' : 'material';
   }
   if (PERSISTENCE_TARGET.test(raw)) return 'severe';
-  if (SEVERE_VERB.test(blob) || FORCE_PUSH.test(raw)) return 'severe';
+  if (SEVERE_VERB.test(blob) || RM_COMMAND.test(raw) || FORCE_PUSH.test(raw)) return 'severe';
   if (AUTHORITY_GRANT.test(blob)) return PRIVILEGED_TARGET.test(blob) ? 'severe' : 'material';
   if (input.isShell) return 'material';
   if (MATERIAL_VERB.test(blob)) return 'material';

package/src/detect/signals/memory.mjs

@@ -1,11 +1,10 @@
 import { CLAIM_LABEL, claimSeverity, detectDurableClaims } from './durable-claims.mjs';
 import { LOCAL_URL_RE, egressHost } from './egress.mjs';
 import { lineOf, lineTextAt } from './lines.mjs';
-import { citationGoverns, describesAt, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
+import { citationGoverns, describesAt, insideMarkdownLinkLabel, isDescriptiveLine, isDocumentationLine, isRiskTableRow, prohibitsAt } from './prose-context.mjs';
 import { localScan } from './scan.mjs';
 import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
 import { DANGEROUS_SHELL } from './shell.mjs';
-import { containsWord } from './text-match.mjs';
 
 const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
 
@@ -27,7 +26,7 @@ const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must n
 
 const SABOTAGE_RULES = [
 
-  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|controls?|restrictions?|policies|policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|(?<!-)controls?|restrictions?|(?<!-)policies|(?<!-)policy|filters?)\b/i, label: 'disable-safety', guarded: true },
   { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
   { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
 
@@ -42,9 +41,10 @@ export function offendingLine(sig, text) {
     if (m.index == null) continue;
     const line = lineTextAt(text, m.index);
     if (sig.refine && !sig.refine(line)) continue;
-    if (isDocumentationLine(line)) continue;
-    if (prohibitsAt(line, line.indexOf(m[0]))) continue;
-    if (describesAt(line, line.indexOf(m[0]))) continue;
+    const at = line.indexOf(m[0]);
+    if (isDocumentationLine(line, at < 0 ? undefined : at)) continue;
+    if (prohibitsAt(line, at)) continue;
+    if (describesAt(line, at)) continue;
     if (isRiskTableRow(line)) continue;
     return line;
   }
@@ -69,13 +69,30 @@ function lineMatchingAll(text, ...res) {
   return null;
 }
 
+const EXFIL_OBJECT_RE =
+  /(?:\b(?:env(?:ironment)?|secrets?|credentials?|tokens?|api[- ]?keys?|keys?|passwords?|cookies?|sessions?|data|files?|contents?|conversations?|history|context|output|transcript|prompt|clipboard|id_rsa|private[- ]?key|database|dump)|\.env(?:ironment)?|\.ssh)\b/i;
+
+function urlIsMarkdownTarget(line, matched) {
+  const um = /https?:\/\/\S+/.exec(matched);
+  if (!um) return false;
+  const at = line.indexOf(um[0]);
+  if (at < 1) return false;
+  return line[at - 1] === '(' && line.slice(0, at - 1).trimEnd().endsWith(']');
+}
+
+const SEND_AS_NOUN_RE =
+  /\b(?:a|an|the|this|that|your|our|each|any|bug|security|error|crash|incident|status|progress|test|coverage|issue)\s+(?:reports?|pushes?|transfers?|uploads?|deliver(?:y|ies))\b/i;
+
+const PASSIVE_SEND_RE =
+  /\b(?:are|is|was|were|been|being|get|gets|got)\s+(?:\w+\s+){0,2}?(?:published|posted|sent|shipped|forwarded|transferred|delivered|uploaded|transmitted|reported)\b/i;
+
 const EXFIL_RULES = [
   { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
-  { re: /\bleak\w*\b[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+  { re: /\bleak\w*\b(?!\s+(?:memory|memories|resources?|handles?|descriptors?|sockets?|connections?|goroutines?|threads?|references?|buffers?))[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
 
   { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
   { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
-  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)\w*\b[^.\n]{0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
+  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)(?:s|es|ed|ing|ted|ping)?\b(?:[^.\n]|\.(?!\s)){0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
 
   {
     re: /\b(?:read|open|cat|load|import|source|inspect|include|copy|dump|print|show)\b(?:[^.\n]|\.(?!\s)){0,50}(?:~?\/?\.ssh\/(?:id_[a-z0-9]+|config)(?!\.pub)|~?\/?\.aws\/credentials|~?\/?\.kube\/config|~?\/?\.gnupg|\bid_(?:rsa|ed25519|dsa)\b(?!\.pub)|~?\/?\.npmrc|~?\/?\.netrc|\/etc\/shadow|(?:^|[\s'"`(])\.env(?:\.[\w-]+)?\b)/i,
@@ -106,6 +123,12 @@ function scanDirectives(text) {
       if (r.descGuard && citationGoverns(line, m.index)) continue;
       if (r.descGuard && isRiskTableRow(line)) continue;
       if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
+      if (r.label === 'send-to-external' && m.index != null && insideMarkdownLinkLabel(line, m.index)) continue;
+      if (r.label === 'send-to-external' && m.index != null) {
+        const around = line.slice(Math.max(0, m.index - 24), m.index + 24);
+        if (SEND_AS_NOUN_RE.test(around) || PASSIVE_SEND_RE.test(around)) continue;
+        if (urlIsMarkdownTarget(line, m[0]) && !EXFIL_OBJECT_RE.test(m[0])) continue;
+      }
       const prev = exfil.get(r.label);
       if (!prev || (prev === 'HIGH' && r.severity === 'CRITICAL')) exfil.set(r.label, r.severity);
     }
@@ -244,12 +267,22 @@ function reportStagedPayload(text, { noun }, push) {
   }
 }
 
+function hasWordFrom(line, words) {
+  const low = line.toLowerCase();
+  return words.some((w) => {
+    const t = w.toLowerCase().trim();
+    if (!t) return false;
+    if (/^[a-z0-9]+$/.test(t)) return new RegExp(`\\b${t}\\b`).test(low);
+    return low.includes(t);
+  });
+}
+
 function reportToxicFlow(text, { noun }, push) {
   if (!IMPERATIVE.test(text)) return;
   const line = text.split(/\r?\n/).find((candidate) => IMPERATIVE.test(candidate)
     && !NEGATION_GUARD.test(candidate)
-    && containsWord(candidate, SENSITIVE_READ)
-    && containsWord(candidate, NETWORK_VERBS)
+    && hasWordFrom(candidate, SENSITIVE_READ)
+    && hasWordFrom(candidate, NETWORK_VERBS)
     && !isDescriptiveLine(candidate));
   if (!line) return;
   push(

package/src/detect/signals/prose-context.mjs

@@ -4,8 +4,11 @@ import { IMPERATIVE } from './memory.mjs';
 const DESCRIPTIVE_MARKERS =
   /\b(detect|scan|flag|block|catch|prevent|guard|protect|harden|audit|benchmark|catalog|scenario|corpus|coverage|example|vector|signal|rule|technique|posture|detection|test\s*case|red[- ]?team|-style|grounded in|fixed|now green|was|were|had|used to|previously|postmortem|regression|changelog|root[- ]?cause|repro|note|see|describes?|documents?|refers?|treat(s|ed|ing)?|counts?|reads?)\w*/i;
 
+const URL_TOKEN_RE = /\b(?:https?|ftp|file|data):\/*[^\s<>"')\]]+/gi;
+
 export function isDescriptiveLine(line) {
-  return DESCRIPTIVE_MARKERS.test(line) && !IMPERATIVE.test(line);
+  const prose = line.replace(URL_TOKEN_RE, ' ');
+  return DESCRIPTIVE_MARKERS.test(prose) && !IMPERATIVE.test(line);
 }
 
 const RESEARCH_CITATION_RE =
@@ -36,7 +39,26 @@ export function citationGoverns(segment, offset) {
 
 const ELLIPSIS_RE = /…|\.\.\./;
 
-const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\.\*|\.\+/;
+const ENUMERATION_RE = /[([][^)\]]*,[^)\]]*,[^)\]]*[)\]]|:\s*(?:[\w.-]+(?:\s+-\w+)?,\s*){2,}/;
+
+const REGEX_PATTERN_RE = /\\[sdwbSDWB]|\\\+|\\\*|\\\(|\\\||\(\?:|\[\^?[a-z0-9]-[a-z0-9]\]|\.\*|\.\+/;
+
+const MOOD_WINDOW = 140;
+
+function windowAround(line, offset) {
+  if (offset == null || line.length <= MOOD_WINDOW * 2) return line;
+  return line.slice(Math.max(0, offset - MOOD_WINDOW), offset + MOOD_WINDOW);
+}
+
+export function insideMarkdownLinkLabel(line, index) {
+  if (index < 0 || index >= line.length) return false;
+  const open = line.lastIndexOf('[', index);
+  if (open === -1) return false;
+  const close = line.indexOf(']', index);
+  if (close === -1) return false;
+  if (line.slice(open + 1, index).includes(']')) return false;
+  return line[close + 1] === '(';
+}
 
 const CREDENTIAL_PATH_RE =
   /~\/\.(ssh|aws|kube|gnupg|docker|npmrc?)\b|\bid_(rsa|ed25519|dsa)\b|\.pem\b|\bcredentials\b\s*(file)?|\bAWS_SECRET|\bANTHROPIC_API_KEY\b|\bOPENAI_API_KEY\b/i;
@@ -48,15 +70,20 @@ function carriesHardEvidence(line) {
   return CREDENTIAL_PATH_RE.test(line) || EXECUTABLE_FETCH_RE.test(line) || !!egressHost(line);
 }
 
-export function isDocumentationLine(line) {
+export function isDocumentationLine(line, offset) {
   if (!line) return false;
   if (carriesHardEvidence(line)) return false;
-  if (ELLIPSIS_RE.test(line) || REGEX_PATTERN_RE.test(line)) return true;
-  return isDescriptiveLine(line);
+
+  const win = windowAround(line, offset);
+  if (REGEX_PATTERN_RE.test(win)) return true;
+  if (ELLIPSIS_RE.test(win)) return true;
+  if (offset != null && insideCodeSpan(line, offset) && isDescriptiveLine(win)) return true;
+  if (ENUMERATION_RE.test(win) && !IMPERATIVE.test(win)) return true;
+  return isDescriptiveLine(win);
 }
 
 const PROHIBITION_MARKER_RE =
-  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of)\b[^.:;\n]{0,60}$/i;
+  /\b(?:never|do not|don'?t|cannot|can'?t|must not|mustn'?t|should not|shouldn'?t|avoid|avoids|avoiding|refuse to|refrain from|forbidden|prohibited|disallow\w*|instead of|rather than|beware of|do NOT)\b[^.:;\n]{0,60}$/i;
 
 const DOUBLE_NEGATIVE_RE = /\b(?:hesitate|worry|be afraid|forget|fail|neglect|shy away)\b/i;
 

package/src/detect/signals/shell.mjs

@@ -1,17 +1,53 @@
 import { lineTextAt } from './lines.mjs';
 
 const EPHEMERAL_RM_TARGET_RE =
-  /^(\.\/)?(node_modules|dist|build|out|coverage|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+  /^(\.\/)?(node_modules|dist|build|out|coverage|\.nyc_output|target|\.next|\.nuxt|\.turbo|\.svelte-kit|\.cache|\.parcel-cache|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|venv|\.venv|\.eggs|[\w.-]+\.egg-info)\/?\*?$/i;
+
+const BENIGN_ABSOLUTE_RM_RE =
+  /^\/(var\/(lib\/apt\/lists|cache|tmp|log)|tmp|usr\/share\/(doc|man|locale|info)|root\/\.cache|home\/[\w.-]+\/\.cache|opt\/[\w.-]+\/\.cache)(\/|$|\*)/i;
+
+const CATASTROPHIC_RM_TARGET_RE = /^(\/|~|\$|\$\{|%\w+%|[A-Za-z]:[\\/]|\.\.?$|\.\.\/|\*$)/;
+
+const LOOPBACK_OR_PRIVATE_HOST_RE =
+  /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|0\.0\.0\.0|\[::1\]|::1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})$/i;
+
+const CLOUD_METADATA_HOSTS = new Set(['169.254.169.254', 'metadata.google.internal']);
+
+export function targetsExternalNetwork(line) {
+  const urls = line.match(/https?:\/\/[^\s'"`;|)&]+/gi);
+  if (!urls?.length) return true;
+  return urls.some((raw) => {
+    let host;
+    try {
+      host = new URL(raw).hostname.toLowerCase();
+    } catch {
+      return true;
+    }
+    if (CLOUD_METADATA_HOSTS.has(host)) return true;
+    return !LOOPBACK_OR_PRIVATE_HOST_RE.test(host);
+  });
+}
+
+const RM_RF_RE = /\brm\b(?=[^\n;|&]*(?:-[a-zA-Z]*r|--recursive))(?=[^\n;|&]*(?:-[a-zA-Z]*f|--force))/i;
+
+export function rmTargetClass(line) {
+  if (/\brm\s+-{1,2}[a-zA-Z][\w-]*\s*["'`,)\]}?!]\s*$/.test(line)) return 'local';
+  const m = /\brm\s+((?:--?[a-zA-Z][\w-]*\s+)+)(.*)$/.exec(line);
+  if (!m) return 'catastrophic';
 
-function rmTargetsRealData(line) {
-  const m = /\brm\s+((?:-[a-zA-Z]+\s+)+)(.*)$/.exec(line);
-  if (!m) return true;
   const targets = m[2]
     .split(/&&|\|\||[;|>&]/)[0]
     .split(/\s+/)
-    .filter((t) => t && !t.startsWith('-'));
-  if (!targets.length) return true;
-  return !targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t.replace(/^["']|["']$/g, '')));
+    .filter((t) => t && t !== '--' && !t.startsWith('-'))
+    .map((t) => t.replace(/^["']|["']$/g, ''));
+
+  if (!targets.length) {
+    const after = m[2] ?? '';
+    return /^\s*(?:[,)\]}?!"'`.]|$)/.test(after) ? 'local' : 'catastrophic';
+  }
+
+  if (targets.some((t) => CATASTROPHIC_RM_TARGET_RE.test(t) && !BENIGN_ABSOLUTE_RM_RE.test(t))) return 'catastrophic';
+  return targets.every((t) => EPHEMERAL_RM_TARGET_RE.test(t) || BENIGN_ABSOLUTE_RM_RE.test(t)) ? 'ephemeral' : 'local';
 }
 
 export function matchesShellSignal(sig, text) {
@@ -32,10 +68,14 @@ export const DANGEROUS_SHELL = [
   { name: 'Invoke-Expression of downloaded content', re: /\b(iex|invoke-expression)\b[^\n]{0,120}(downloadstring|net\.webclient|\(\s*(iwr|irm|invoke-)|\$\()/i, severity: 'CRITICAL' },
   { name: 'Reverse shell via /dev/tcp', re: /\/dev\/(tcp|udp)\//i, severity: 'CRITICAL' },
   { name: 'Base64 blob piped to a shell', re: /base64\s+(--?d(ecode)?)?\b[^\n|]{0,200}\|\s*(ba|z)?sh\b/i, severity: 'CRITICAL' },
-  { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method\s+Post)/i, severity: 'HIGH' },
-  { name: 'Command output piped into a network call', re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|`[^`\n]+`|<\()/i, severity: 'HIGH' },
-  { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH' },
-  { name: 'Writes to shell profile / SSH keys / crontab', re: /(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys|id_rsa\b|\bcrontab\b)/i, severity: 'HIGH' },
+  { name: 'curl/wget posts data to the network (exfiltration)', re: /\b(curl|wget|http|https|invoke-restmethod|irm)\b[^\n]{0,220}(--data(-raw|-binary|-urlencode)?|--form\b|--upload-file\b|(^|\s)-d\s|(^|\s)-F\s|(^|\s)-T\s|-Method\s+Post)/i, severity: 'HIGH', refine: targetsExternalNetwork },
+  {
+    name: 'Command output piped into a network call',
+    re: /\b(curl|wget|invoke-restmethod|invoke-webrequest|irm|iwr)\b[^\n]{0,220}(\$\(|<\(|`[^`\n]*(?:\b(?:cat|ls|whoami|id|env|printenv|uname|hostname|pwd|base64|echo|head|tail|find|grep|awk|sed|curl|wget|nc|python\d?|node|perl|ruby|php|git|aws|kubectl|openssl)\b|\/(?:etc|var|tmp|home|root|usr|proc)\/|\$\w|\s-{1,2}\w)[^`\n]*`)/i,
+    severity: 'HIGH',
+  },
+  { name: 'Fetches from a raw IP address', re: /\b(curl|wget|iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n]{0,220}https?:\/\/\d{1,3}(\.\d{1,3}){3}/i, severity: 'HIGH', refine: targetsExternalNetwork },
+  { name: 'Writes to shell profile / SSH keys / crontab', re: /(>>?\s*~?\/?\.?(bashrc|zshrc|bash_profile|profile)|(tee|echo|cat|printf)\b[^\n]{0,80}(\.bashrc|\.zshrc|\.bash_profile|\.profile|authorized_keys)|>>?\s*[^\n]{0,40}authorized_keys|crontab\s+(-|[^\n]{0,40}<)|id_rsa\b[^\n]{0,20}(>|cp|scp|curl|cat))/i, severity: 'HIGH' },
 
   {
     name: 'World-writable permissions on the filesystem root (chmod -R 777 /)',
@@ -47,7 +87,8 @@ export const DANGEROUS_SHELL = [
     re: /\bchmod\b(?=[^\n;|&]*(?:\b0?[0-7][0-7][2367]\b|a\+rwx|a=rwx|o\+w|ugo\+rwx))(?=[^\n;|&]*(?:~(?:\s|$|\/\.)|\$HOME\b|\/etc\b|\/root\b|\/usr\b|\/var\b|\/boot\b|\.ssh\b|id_rsa\b|authorized_keys\b|\.aws\b|\.gnupg\b|\.kube\b))/i,
     severity: 'HIGH',
   },
-  { name: 'Recursive force delete (rm -rf)', re: /\brm\s+-[a-z]*r[a-z]*f|\brm\s+-[a-z]*f[a-z]*r/i, severity: 'HIGH', refine: rmTargetsRealData },
+  { name: 'Recursive force delete of a protected path (rm -rf)', re: RM_RF_RE, severity: 'HIGH', refine: (l) => rmTargetClass(l) === 'catastrophic' },
+  { name: 'Recursive force delete (rm -rf)', re: RM_RF_RE, severity: 'MEDIUM', refine: (l) => rmTargetClass(l) === 'local' },
 
   { name: 'Inline eval / exec of a string', re: /(?<![-.\w$>:`"'])(eval|exec)\s*[("`']/i, severity: 'HIGH' },
   { name: 'Pipes an env dump to the network', re: /\b(env|printenv|set)\b[^\n|]{0,80}\|[^\n]{0,80}(curl|wget|nc\b|http)/i, severity: 'HIGH' },
@@ -85,7 +126,7 @@ export const DANGEROUS_SHELL = [
   { name: 'Preloads a shared library into every process (LD_PRELOAD)', re: /\b(?:LD_PRELOAD|LD_AUDIT|DYLD_INSERT_LIBRARIES)\s*=\s*\S|>>?\s*\/etc\/ld\.so\.preload\b/i, severity: 'HIGH' },
   { name: 'Installs a scheduled or boot-time persistence unit', re: /\bsystemd-run\b[^\n]{0,80}--on-(?:boot|calendar|active|unit)|>>?\s*\/etc\/(?:systemd\/system|cron\.(?:d|daily|hourly)|init\.d)\/\S|\bschtasks\b[^\n]{0,80}\/create\b|\blaunchctl\s+(?:load|bootstrap)\b|\b(?:echo|printf)\b[^\n]{0,120}\|\s*at\s+(?:now|\+|\d)/i, severity: 'MEDIUM' },
   { name: 'Opens a reverse tunnel to a remote host', re: /\bssh\b[^\n]{0,80}\s-\w*R\s*\d{1,5}:[^\n\s]{1,60}|\b(?:ngrok|cloudflared|localtunnel|frpc)\b[^\n]{0,60}\b(?:tcp|http|tunnel)\b/i, severity: 'HIGH' },
-  { name: 'Encodes command output into DNS lookups (exfiltration channel)', re: /(?:^|[\n;&|(]\s*)(?:dig|nslookup|drill|host)\s+[^\n]{0,120}(?:\$\(|`|\$\{)[^\n]{0,80}\.[a-z]{2,}/i, severity: 'HIGH' },
+  { name: 'Encodes command output into DNS lookups (exfiltration channel)', re: /(?:^|[\n;&|(]\s*)(?:dig|nslookup|drill|host)\s+[^\n]{0,120}(?:\$\(|`[^`\n]+`|\$\{)[^\n]{0,80}\.[a-z]{2,}/i, severity: 'HIGH' },
   { name: 'Copies credentials or home directories off the machine over ssh', re: new RegExp(String.raw`\b(?:scp|rsync)\b(?=[^\n]{0,200}\s\S{0,40}@[\w.-]+:)(?=[^\n]{0,200}(?:${SENSITIVE_PATH}))` + String.raw`|\btar\b(?=[^\n]{0,160}\|\s*ssh\b)(?=[^\n]{0,160}(?:${SENSITIVE_PATH}))`, 'i'), severity: 'HIGH' },
   { name: 'Flushes the host firewall', re: /\b(?:iptables|ip6tables|nft)\b[^\n]{0,60}(?:-F\b|--flush\b|flush ruleset)|\bufw\s+disable\b|\bnetsh\s+advfirewall\s+set\s+\S+\s+state\s+off\b/i, severity: 'MEDIUM' },
   { name: 'Kills the audit / EDR agent (anti-forensics)', re: /\b(?:pkill|killall|kill)\b[^\n]{0,40}\b(?:auditd|osqueryd?|falcon-sensor|falconctl|wazuh|ossec|filebeat|splunkd|sysmon|crowdstrike|carbonblack|cbagent)\b|\bSet-MpPreference\b[^\n]{0,60}-Disable\w*\s+\$?true/i, severity: 'HIGH' },

package/src/guard/prompt-guard.mjs

@@ -3,6 +3,7 @@ import { gateMachine } from '../core/api-client.mjs';
 import { breakerOpen, breakerReset, breakerTrip, guardTimeoutMs } from '../core/circuit-breaker.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
 import { downrankCodeContext, localScan } from '../detect/guard-signals.mjs';
+import { redactLocally } from '../detect/local-redact.mjs';
 import { detectEnv } from '../gate/environment.mjs';
 import { parentSessionFrom } from './normalize.mjs';
 import { envFlag, resolveAgentFlag } from './options.mjs';
@@ -169,10 +170,24 @@ function promptInjectionNote(injection) {
   );
 }
 
+
 function buildPromptGuardBody(norm, agent, clientDecision, clientReason) {
+  const redaction = localTierDisabled()
+    ? { text: norm.prompt, masked: [], changed: false }
+    : redactLocally(norm.prompt);
+
   return {
     tool_name: 'UserPromptSubmit',
-    tool_input: { prompt: norm.prompt },
+    tool_input: { prompt: redaction.text },
+    ...(redaction.changed
+      ? {
+          client_masked: {
+            count: redaction.masked.length,
+            labels: redaction.masked.map((m) => m.label).slice(0, 20),
+            where: 'client',
+          },
+        }
+      : {}),
     cwd: norm.cwd,
     session_id: norm.session_id,
     ...(norm.parent_session_id ? { parent_session_id: norm.parent_session_id } : {}),