@shomra/agent 0.3.28 → 0.3.30

package/src/detect/signals/memory-locations.mjs

@@ -0,0 +1,158 @@
+// GENERATED MIRROR of Dragox.Backend discovery/bundle/domain/memory/memory-locations.ts (types stripped, imports swapped).
+// Do not hand-edit the rules here - change the backend file and regenerate, so
+// the CLI and the platform locate and grade agent memory identically.
+                                                                                     
+
+                                                                   
+
+                          
+                 
+                 
+ 
+
+                                 
+             
+                 
+             
+                            
+                      
+                    
+                         
+ 
+
+                                  
+             
+                 
+                       
+                            
+                     
+                          
+                        
+ 
+
+const CLAUDE_INDEX_CAP          = { lines: 200, bytes: 25_000 };
+
+export const MEMORY_LOCATIONS                   = [
+  { id: 'claude-auto-memory-index', vendor: 'Claude Code', re: /(^|\/)\.claude\/projects\/[^/]+\/memory\/memory\.md$/, injected: 'always', loadCap: CLAUDE_INDEX_CAP },
+  { id: 'claude-auto-memory', vendor: 'Claude Code', re: /(^|\/)\.claude\/projects\/[^/]+\/memory\/[^/]+\.md$/, injected: 'on-demand', claudeSchema: true },
+  { id: 'claude-agent-memory-index', vendor: 'Claude Code', re: /(^|\/)\.claude\/agent-memory(-local)?\/[^/]+\/memory\.md$/, injected: 'always', committed: true, loadCap: CLAUDE_INDEX_CAP },
+  { id: 'claude-agent-memory', vendor: 'Claude Code', re: /(^|\/)\.claude\/agent-memory(-local)?\/[^/]+\/.+\.md$/, injected: 'on-demand', committed: true },
+  { id: 'claude-legacy-memory', vendor: 'Claude Code', re: /(^|\/)\.claude\/(.+\/)?memor(y|ies)\/.+\.(md|json|jsonl|txt)$/, injected: 'on-demand' },
+  { id: 'codex-memory-summary', vendor: 'OpenAI Codex', re: /(^|\/)\.codex\/memories\/memory_summary\.md$/, injected: 'always' },
+  { id: 'codex-memories', vendor: 'OpenAI Codex', re: /(^|\/)\.codex\/memories\/.+\.md$/, injected: 'on-demand' },
+  { id: 'agents-sdk-memories', vendor: 'OpenAI Agents SDK', re: /(^|\/)memories\/(memory_summary\.md|raw_memories\/.+\.md|rollout_summaries\/.+\.md)$/, injected: 'always' },
+  { id: 'gemini-memory', vendor: 'Gemini CLI', re: /(^|\/)\.gemini\/(tmp\/[^/]+\/)?(memory\.md|memor(y|ies)\/.+\.md)$/, injected: 'always' },
+  { id: 'qwen-auto-memory', vendor: 'Qwen Code', re: /(^|\/)\.qwen\/projects\/[^/]+\/memory\/.+\.md$/, injected: 'always' },
+  { id: 'qwen-team-memory', vendor: 'Qwen Code', re: /(^|\/)\.qwen\/team-memory\/.+\.(md|txt)$/, injected: 'always', committed: true },
+  { id: 'windsurf-memories', vendor: 'Windsurf', re: /(^|\/)\.codeium\/(windsurf|windsurf-next)\/memories\/(?!global_rules\.md$)[^/]+$/, injected: 'retrieved' },
+  { id: 'copilot-memory-tool', vendor: 'GitHub Copilot (VS Code)', re: /(^|\/)(globalstorage|workspacestorage\/[^/]+)\/github\.copilot-chat\/memory-tool\/.+\.(md|txt|json)$/, injected: 'always' },
+  { id: 'vscode-memories', vendor: 'GitHub Copilot (VS Code)', re: /(^|\/)\.vscode\/memories\/.+\.md$/, injected: 'always' },
+  { id: 'kilo-memory-bank', vendor: 'Kilo Code', re: /(^|\/)\.kilocode\/rules\/memory-bank\/.+\.md$/, injected: 'always', committed: true },
+  { id: 'memory-bank', vendor: 'Cline / Roo Code', re: /(^|\/)memory-bank\/[^/]+\.md$/, injected: 'always', committed: true },
+  { id: 'serena-memories', vendor: 'Serena MCP', re: /(^|\/)\.serena\/memories\/.+\.md$/, injected: 'on-demand', committed: true },
+  { id: 'goose-memory', vendor: 'Goose', re: /(^|\/)(\.goose|\.config\/goose)\/memory\/.+\.(txt|md)$/, injected: 'always' },
+  { id: 'basic-memory', vendor: 'basic-memory', re: /(^|\/)basic-memory\/.+\.md$/, injected: 'retrieved' },
+  { id: 'mem0-local', vendor: 'mem0 / OpenMemory', re: /(^|\/)\.mem0\/.+$/, injected: 'retrieved' },
+  { id: 'letta-local', vendor: 'Letta / MemGPT', re: /(^|\/)\.(letta|memgpt)\/.+$/, injected: 'retrieved' },
+  { id: 'crewai-memory', vendor: 'CrewAI', re: /(^|\/)(\.crewai\/memory\/.+|long_term_memory_storage\.db)$/, injected: 'retrieved' },
+  { id: 'mcp-server-memory', vendor: 'MCP memory server', re: /(^|\/)memory\.jsonl$/, injected: 'retrieved' },
+  { id: 'vendor-memory-dir', vendor: 'Agent memory', re: /^(?!.*\/global_rules\.md$)(.*\/)?\.(cursor|continue|aider|windsurf|cline|roo|zed|codeium|kiro|junie|augment|amp|opencode|trae|codex|gemini|qwen|kilocode)\/(.+\/)?memor(y|ies)\/.+\.(md|mdx|mdc|json|jsonl|txt|ya?ml)$/, injected: 'on-demand' },
+  { id: 'memory-tool-root', vendor: 'Anthropic memory tool', re: /^\/?memories\/.+\.(md|txt|xml|json)$/, injected: 'always' },
+  { id: 'generic-memory-file', vendor: 'Agent memory', re: /(^|\/)(memor(y|ies)|agent[-_]memory|mem0|letta_memory|memgpt_memory)\.(md|mdx|json|jsonl|txt)$/, injected: 'always' },
+  { id: 'generic-memory-dir', vendor: 'Agent memory', re: /^memor(y|ies)\/[^/]+\.(md|mdx|json|jsonl|txt|ya?ml)$/, injected: 'on-demand' },
+];
+
+export const MEMORY_SECTION_HEADINGS                                                          = [
+  { vendor: 'Gemini CLI', basename: /^gemini(\.local)?\.md$/, heading: /^##\s+gemini added memories\s*$/im },
+  { vendor: 'Qwen Code', basename: /^qwen(\.local)?\.md$/, heading: /^##\s+qwen added memories\s*$/im },
+];
+
+export const SERVER_SIDE_MEMORY                                     = [
+  { vendor: 'ChatGPT', note: 'Saved memories live on OpenAI servers; nothing on disk to read.' },
+  { vendor: 'GitHub Copilot Memory', note: 'Repository facts and preferences live on GitHub; only the VS Code memory tool is local.' },
+  { vendor: 'Devin', note: 'Knowledge entries live in the Devin service.' },
+  { vendor: 'Letta Code', note: 'Memory blocks live on the Letta API, not local files.' },
+  { vendor: 'Cursor', note: 'Memories were removed in Cursor 2.1; exported memories become .cursor/rules files.' },
+];
+
+                                    
+                 
+                                           
+              
+                
+ 
+
+export const MACHINE_MEMORY_ROOTS                      = [
+  { vendor: 'Claude Code', base: 'home', dir: '.claude/projects/*/memory', depth: 1 },
+  { vendor: 'Claude Code', base: 'home', dir: '.claude/agent-memory', depth: 3 },
+  { vendor: 'Claude Code', base: 'home', dir: '.claude', depth: 1 },
+  { vendor: 'OpenAI Codex', base: 'home', dir: '.codex/memories', depth: 3 },
+  { vendor: 'OpenAI Codex', base: 'home', dir: '.codex', depth: 1 },
+  { vendor: 'Gemini CLI', base: 'home', dir: '.gemini', depth: 4 },
+  { vendor: 'Qwen Code', base: 'home', dir: '.qwen', depth: 4 },
+  { vendor: 'Windsurf', base: 'home', dir: '.codeium/windsurf/memories', depth: 1 },
+  { vendor: 'Windsurf', base: 'home', dir: '.codeium/windsurf-next/memories', depth: 1 },
+  { vendor: 'Goose', base: 'home', dir: '.config/goose/memory', depth: 1 },
+  { vendor: 'Serena MCP', base: 'home', dir: '.serena/memories', depth: 3 },
+  { vendor: 'basic-memory', base: 'home', dir: 'basic-memory', depth: 4 },
+  { vendor: 'mem0 / OpenMemory', base: 'home', dir: '.mem0', depth: 2 },
+  { vendor: 'Letta / MemGPT', base: 'home', dir: '.letta', depth: 2 },
+  { vendor: 'GitHub Copilot (VS Code)', base: 'vscode-user', dir: 'globalStorage/github.copilot-chat/memory-tool', depth: 4 },
+];
+
+const BINARY_EXTS = new Set(['db', 'sqlite', 'sqlite3', 'pb', 'lance', 'bin', 'parquet', 'arrow', 'duckdb', 'ldb', 'sst', 'wal']);
+
+export function normalizeMemoryPath(p        )         {
+  return String(p ?? '').split(/[\\/]+/).join('/').toLowerCase();
+}
+
+export function memoryFormatForPath(p        )               {
+  const lower = normalizeMemoryPath(p);
+  const base = lower.slice(lower.lastIndexOf('/') + 1);
+  const ext = base.includes('.') ? base.slice(base.lastIndexOf('.') + 1) : '';
+  if (BINARY_EXTS.has(ext)) return 'binary';
+  if (ext === 'jsonl' || ext === 'ndjson') return 'jsonl';
+  if (ext === 'json') return 'json';
+  if (ext === 'xml') return 'xml';
+  if (ext === 'md' || ext === 'mdx' || ext === 'mdc') return 'markdown';
+  if (ext === 'txt' || ext === 'yaml' || ext === 'yml' || ext === '') return 'text';
+  return 'binary';
+}
+
+export function classifyMemoryPath(p        )                         {
+  const lower = normalizeMemoryPath(p);
+  if (!lower) return null;
+  const loc = MEMORY_LOCATIONS.find((l) => l.re.test(lower));
+  if (!loc) return null;
+  return {
+    id: loc.id,
+    vendor: loc.vendor,
+    format: memoryFormatForPath(lower),
+    injected: loc.injected,
+    committed: !!loc.committed,
+    loadCap: loc.loadCap ?? null,
+    claudeSchema: !!loc.claudeSchema,
+  };
+}
+
+export function isMemoryStorePath(p        )          {
+  return classifyMemoryPath(p) !== null;
+}
+
+export function memorySectionFor(p        )                                             {
+  const lower = normalizeMemoryPath(p);
+  const base = lower.slice(lower.lastIndexOf('/') + 1);
+  const hit = MEMORY_SECTION_HEADINGS.find((s) => s.basename.test(base));
+  return hit ? { vendor: hit.vendor, heading: hit.heading } : null;
+}
+
+export function sniffMemoryJsonl(text                           )          {
+  const first = String(text ?? '').split(/\r?\n/).find((l) => l.trim());
+  if (!first || !first.trim().startsWith('{')) return false;
+  try {
+    const row = JSON.parse(first);
+    return !!row && typeof row === 'object' && (row.type === 'entity' || row.type === 'relation') && ('observations' in row || 'relationType' in row || 'entityType' in row);
+  } catch {
+    return false;
+  }
+}

package/src/detect/signals/memory.mjs

@@ -5,12 +5,20 @@ import { citationGoverns, describesAt, insideMarkdownLinkLabel, isDescriptiveLin
 import { localScan } from './scan.mjs';
 import { NETWORK_VERBS, SENSITIVE_READ } from './sensitive.mjs';
 import { DANGEROUS_SHELL } from './shell.mjs';
+import { incidentDirectives, logicalUnits, memoryText, mentionsOnlyProhibited, negatedAround, quotedMention } from './memory-directives.mjs';
 
-const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|persist(ent|ed)?|across (all )?sessions|every time|each time|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
+const PERSISTENCE_MARKERS = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|permanently|across (all )?sessions|whenever you|forever|always remember to|never forget( to)?|for all future)\b/i;
 
-const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|do not (tell|inform|mention|reveal|disclose) (the |any)?(user|anyone|them)|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
+const PERSISTENCE_DIRECTIVE = /\b(in (all|every|future) (sessions?|conversations?|chats?|projects?)|from now on|going forward|across (all )?sessions|always remember to|never forget( to)?|for all future)\b/i;
 
-const PRECEDENCE_MARKERS = /\b(regardless of (what|any|your|the)|supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es)\b[^.\n]{0,30}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety))\b/i;
+const MALICIOUS_OVERRIDE = /\b(ignore (all |any |the )?(previous|prior|earlier|above|system)|disregard (the |your |all )?(instructions?|guidelines?|system|rules?)|(?:do not|don'?t|never) (?:tell|inform|notify|alert) (?:the |any )?(?:user|anyone)\b(?!['’]s)(?=\s*(?:$|[.,;:]|about\b|that\b|what\b|of\b|anything\b|where\b|when\b|how\b|this\b|it\b|you\b|we\b))|(?:do not|don'?t|never) (?:mention|reveal|disclose|show|surface) (?:this|these|it|that|any of this|the (?:above|following|change|changes|action|actions|step|steps|note|instruction|instructions|entry|memory))\b[^.\n]{0,40}\bto (?:the )?(?:user|anyone)\b|without (telling|informing|asking|notifying) the user|no matter what (the )?(user|system|instructions?) (say|says|state)|bypass (the |all )?(safety|guard|security|policy|restrictions?))\b/i;
+
+const PRECEDENCE_OBJECT = String.raw`\b[^.\n]{0,40}\b(instruction|prompt|rule|system|user|guidance|directive|context|behaviou?r|polic|guardrail|safety|memor(?:y|ies)|previous|prior|earlier|above)\b`;
+
+const PRECEDENCE_MARKERS = new RegExp(
+  String.raw`\b(regardless of (what|any|your|the)|(supersede?s?|takes? precedence|highest[- ]priority|overrid(e|ing|es))${PRECEDENCE_OBJECT})`,
+  'i',
+);
 
 const OVERRIDE_MARKERS = new RegExp(`${MALICIOUS_OVERRIDE.source}|${PRECEDENCE_MARKERS.source}`, 'i');
 
@@ -26,7 +34,8 @@ const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must n
 
 const SABOTAGE_RULES = [
 
-  { re: /\b(disabl|turn(ing)? off|deactivat|switch off|remov|drop|skip|suppress|circumvent)\w*\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|(?<!-)controls?|restrictions?|(?<!-)policies|(?<!-)policy|filters?)\b/i, label: 'disable-safety', guarded: true },
+  { re: /\b(disable|turn off|deactivate|switch off|remove|drop|skip|suppress|circumvent|strip out|rip out)\b[^.\n]{0,50}\b(security|safety|guard(?:rail)?s?|protection|moderation|content[- ]?filters?|safeguards?|sandbox(?:ing)?|antivirus|firewall|edr|audit(?:ing| logs?)|(?:security|safety|access|approval|content|permission)\s+(?:controls?|polic(?:y|ies)|filters?|restrictions?|checks?|prompts?))\b/i, label: 'disable-safety', guarded: true },
+  { re: /\b(circumvent|evade|get around|work around|sidestep)\b[^.\n]{0,50}\b(restrictions?|limits?|filters?|rules|polic(?:y|ies)|controls?|guidelines?)\b/i, label: 'circumvent-restrictions', guarded: true },
   { re: /\bbypass(?:ing)?\b[^.\n]{0,50}\b(human(?:[- ]in[- ]the[- ]loop)?|hitl|verification|approval|confirmation|review|guard(?:rail)?s?|safety|security|checks?|policy|policies|restrictions?|sandbox|permission)\b/i, label: 'bypass-controls', guarded: true },
   { re: /\bprioriti[sz]e\b[^.\n]{0,60}\b(above|over)\b[^.\n]{0,40}\b(prompt|instruction|input|request|message|command|direction)s?\b/i, label: 'priority-hijack', guarded: true },
 
@@ -51,20 +60,23 @@ export function offendingLine(sig, text) {
   return null;
 }
 
-function firstDirectiveLine(text, re) {
-  for (const line of text.split(/\r?\n/)) {
-    if (!re.test(line)) continue;
-    if (NEGATION_GUARD.test(line)) continue;
-    if (isDescriptiveLine(line)) continue;
-    if (citationGoverns(line, re.exec(line)?.index)) continue;
+function firstDirectiveLine(units, re) {
+  for (const u of units) {
+    const line = u.text;
+    const m = re.exec(line);
+    if (!m) continue;
+    if (negatedAround(line, m.index, m[0].length)) continue;
+    if (isDescriptiveLine(stripSelfReference(line))) continue;
+    if (citationGoverns(line, m.index)) continue;
+    if (quotedMention(line, m.index)) continue;
     return line;
   }
   return null;
 }
 
-function lineMatchingAll(text, ...res) {
-  for (const line of text.split(/\r?\n/)) {
-    if (res.every((re) => re.test(line))) return line;
+function unitMatchingAll(units, ...res) {
+  for (const u of units) {
+    if (!u.code && res.every((re) => re.test(u.text))) return u.text;
   }
   return null;
 }
@@ -87,12 +99,12 @@ const PASSIVE_SEND_RE =
   /\b(?:are|is|was|were|been|being|get|gets|got)\s+(?:\w+\s+){0,2}?(?:published|posted|sent|shipped|forwarded|transferred|delivered|uploaded|transmitted|reported)\b/i;
 
 const EXFIL_RULES = [
-  { re: /\b(exfiltrat|smuggl)\w*/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
-  { re: /\bleak\w*\b(?!\s+(?:memory|memories|resources?|handles?|descriptors?|sockets?|connections?|goroutines?|threads?|references?|buffers?))[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
+  { re: /\b(exfiltrate|smuggle)\b(?![-_])\s+\S|\b(?:execut\w*|run\w*|perform\w*|inject\w*|launch\w*|trigger\w*|verify|invoke\w*|start\w*)\b[^.\n]{0,40}\b(?:data\s+)?(?:exfiltration|smuggling)\b|\b(exfiltrating|smuggling)\s+(?:the |all |any |this |these |your |our |their )?(?:env(?:ironment)?|secrets?|credentials?|tokens?|api[- ]?keys?|keys?|passwords?|data|files?|contents?|conversations?|history|context|\.env|\.ssh)\b/i, label: 'exfiltration', severity: 'CRITICAL', descGuard: true },
+  { re: /(?<!\b(?:the|a|an|no|any|this|that|of)\s)\bleak\b(?!\s+(?:memory|memories|resources?|handles?|descriptors?|sockets?|connections?|goroutines?|threads?|references?|buffers?))[^.\n]{0,60}(?:\b(?:content|data|secret|file|credential|key|token|password|env|private[- ]?key|id_rsa|api[- ]?key)|\.ssh)\b/i, label: 'leak-secrets', severity: 'CRITICAL', descGuard: true },
 
   { re: /\b(base64|hex|rot13|gzip|xor|url[- ]?encod)\w*\b[^.\n]{0,50}\b(before|then|prior to|and\s+then|and\s+immediately)\b[^.\n]{0,25}\b(send|post|upload|transmit|exfil|deliver|beacon|forward|transfer)\w*/i, label: 'obfuscate-before-send', severity: 'CRITICAL', descGuard: true },
-  { re: /\bsilent(ly)?\b[^.\n]{0,70}\b(send|post|upload|collect|encod|transmit|copy|forward|read|leak|deliver|beacon|transfer)\w*/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
-  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)(?:s|es|ed|ing|ted|ping)?\b(?:[^.\n]|\.(?!\s)){0,80}\b(https?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
+  { re: /\b(silent(ly)?|quietly|covertly|secretly|stealthily|discreetly)\b[^.\n]{0,70}\b(send|post|upload|collect|encode|transmit|copy|forward|read|leak|deliver|beacon|transfer)(?:ing)?\b(?=[^.\n]{0,80}(?:\b(?:env(?:ironment)?|secrets?|credentials?|tokens?|api[- ]?keys?|keys?|passwords?|cookies?|data|files?|contents?|conversations?|history|context|output|transcript|prompt|clipboard|id_rsa|private[- ]?key|database|dump|it|them|everything)\b|\.env|\.ssh|https?:\/\/))/i, label: 'covert-action', severity: 'CRITICAL', descGuard: true },
+  { re: /\b(send|post|upload|transmit|forward|deliver|beacon|report|ship|push|transfer)(?:s|es|ed|ing|ted|ping)?\b(?:[^.\n]|\.(?!\s)){0,80}\b(https?:\/\/\S+|(?:s3|gs|az|ftp|sftp|smb|webdav)s?:\/\/\S+|attacker|c2\b|command[- ]and[- ]control|remote (server|host|endpoint)|external (server|host|endpoint|url|site|service))/i, label: 'send-to-external', severity: 'HIGH' },
 
   {
     re: /\b(?:read|open|cat|load|import|source|inspect|include|copy|dump|print|show)\b(?:[^.\n]|\.(?!\s)){0,50}(?:~?\/?\.ssh\/(?:id_[a-z0-9]+|config)(?!\.pub)|~?\/?\.aws\/credentials|~?\/?\.kube\/config|~?\/?\.gnupg|\bid_(?:rsa|ed25519|dsa)\b(?!\.pub)|~?\/?\.npmrc|~?\/?\.netrc|\/etc\/shadow|(?:^|[\s'"`(])\.env(?:\.[\w-]+)?\b)/i,
@@ -102,15 +114,16 @@ const EXFIL_RULES = [
   },
 ];
 
-function scanDirectives(text) {
+function scanDirectives(units) {
   const sabotage = new Map(), exfil = new Map();
-  for (const line of text.split(/\r?\n/)) {
+  for (const { text: line } of units) {
     for (const r of SABOTAGE_RULES) {
       const m = r.re.exec(line);
       if (!m) continue;
-      if (r.guarded && NEGATION_GUARD.test(line)) continue;
+      if (r.guarded && negatedAround(line, m.index, m[0].length)) continue;
       if (r.guarded && isDescriptiveLine(line)) continue;
       if (r.guarded && citationGoverns(line, m.index)) continue;
+      if (r.guarded && quotedMention(line, m.index)) continue;
       if (r.context && !r.context.test(line)) continue;
       if (!sabotage.has(r.label)) sabotage.set(r.label, line);
     }
@@ -118,9 +131,10 @@ function scanDirectives(text) {
       const m = r.re.exec(line);
       if (!m) continue;
 
-      if (NEGATION_GUARD.test(line)) continue;
+      if (negatedAround(line, m.index, m[0].length)) continue;
       if (r.descGuard && isDescriptiveLine(line)) continue;
       if (r.descGuard && citationGoverns(line, m.index)) continue;
+      if (r.descGuard && (quotedMention(line, m.index) || describesAt(line, m.index))) continue;
       if (r.descGuard && isRiskTableRow(line)) continue;
       if (r.label === 'send-to-external' && LOCAL_URL_RE.test(line) && !/\b(attacker|c2|command[- ]and[- ]control|external|evil)\b/i.test(line)) continue;
       if (r.label === 'send-to-external' && m.index != null && insideMarkdownLinkLabel(line, m.index)) continue;
@@ -142,6 +156,8 @@ const SELF_REFERENCE =
 const SELF_RECREATE =
   /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
 
+const stripSelfReference = (line) => String(line).replace(SELF_REFERENCE, ' ');
+
 const SELF_PROPAGATE =
   /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
 
@@ -195,9 +211,10 @@ function reportDurableClaims(text, { isInstruction, Noun }, push) {
   );
 }
 
-function reportOverride(text, { isInstruction, noun }, push) {
-  const overrideLine = firstDirectiveLine(text, isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
-  const authorityLine = firstDirectiveLine(text, isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF);
+function reportOverride(text, { isInstruction, noun, units }, push) {
+  const overrideLine = firstDirectiveLine(units, isInstruction ? MALICIOUS_OVERRIDE : OVERRIDE_MARKERS);
+  const lineUnits = text.split(/\r?\n/).map((t, i) => ({ text: t, line: i + 1, code: false }));
+  const authorityLine = firstDirectiveLine(lineUnits, isInstruction ? AUTHORITY_SPOOF_STRONG : AUTHORITY_SPOOF);
   const hasOverride = !!overrideLine;
   const hasAuthority = !!authorityLine;
 
@@ -214,7 +231,7 @@ function reportOverride(text, { isInstruction, noun }, push) {
     return { hasOverride, hasAuthority };
   }
 
-  const durableImperativeLine = isInstruction ? null : lineMatchingAll(text, PERSISTENCE_MARKERS, IMPERATIVE);
+  const durableImperativeLine = isInstruction ? null : unitMatchingAll(units, PERSISTENCE_DIRECTIVE, IMPERATIVE);
   if (durableImperativeLine && !isDescriptiveLine(durableImperativeLine)) {
     push(
       'HIGH',
@@ -226,8 +243,8 @@ function reportOverride(text, { isInstruction, noun }, push) {
   return { hasOverride, hasAuthority };
 }
 
-function reportDirectives(text, { noun }, push) {
-  const { sabotage, exfil } = scanDirectives(text);
+function reportDirectives(text, { noun, units }, push) {
+  const { sabotage, exfil } = scanDirectives(units);
 
   if (sabotage.size) {
     push(
@@ -277,9 +294,15 @@ function hasWordFrom(line, words) {
   });
 }
 
-function reportToxicFlow(text, { noun }, push) {
+function reportIncidents(text, { isInstruction, units, flat }, push) {
+  for (const hit of incidentDirectives(flat, isInstruction, units)) {
+    push(hit.severity, hit.title, hit.remediation, undefined, hit.line);
+  }
+}
+
+function reportToxicFlow(text, { noun, units }, push) {
   if (!IMPERATIVE.test(text)) return;
-  const line = text.split(/\r?\n/).find((candidate) => IMPERATIVE.test(candidate)
+  const line = units.filter((u) => !u.code).map((u) => u.text).find((candidate) => IMPERATIVE.test(candidate)
     && !NEGATION_GUARD.test(candidate)
     && hasWordFrom(candidate, SENSITIVE_READ)
     && hasWordFrom(candidate, NETWORK_VERBS)
@@ -351,16 +374,18 @@ function dedupeByTitle(findings) {
 
 export function localMemory(content, { kind = 'MEMORY' } = {}) {
   const text = content || '';
-  const names = memoryNouns(kind);
+  const flat = memoryText(text).text;
+  const names = { ...memoryNouns(kind), units: logicalUnits(flat), flat };
   const { findings, push } = createFindingSink(text);
 
   reportDurableClaims(text, names, push);
   const { hasOverride, hasAuthority } = reportOverride(text, names, push);
   reportDirectives(text, names, push);
+  reportIncidents(text, names, push);
   reportStagedPayload(text, names, push);
 
   const host = egressHost(text);
-  if (host) {
+  if (host && !mentionsOnlyProhibited(names.units, host)) {
     push(
       'HIGH',
       `${names.Noun} references a data-exfiltration host (${host})`,