@shomra/agent 0.3.28 → 0.3.30

package/src/guard/memory-write.mjs

@@ -0,0 +1,218 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { CONFIG_DIR } from '../core/config.mjs';
+
+const SECTION_TOOLS = [
+  { re: /^save_memory$/i, file: () => path.join(os.homedir(), '.gemini', 'GEMINI.md'), heading: '## Gemini Added Memories' },
+  { re: /^qwen[_-]?save_memory$/i, file: () => path.join(os.homedir(), '.qwen', 'QWEN.md'), heading: '## Qwen Added Memories' },
+];
+
+const readOr = (read, p) => {
+  try {
+    return read(p);
+  } catch {
+    return null;
+  }
+};
+
+const readUtf8 = (p) => fs.readFileSync(p, 'utf8');
+
+function replaceOnce(text, oldStr, newStr, all) {
+  if (typeof oldStr !== 'string' || typeof newStr !== 'string') return null;
+  if (oldStr === '') return text === '' ? newStr : null;
+  if (!text.includes(oldStr)) return null;
+  return all ? text.split(oldStr).join(newStr) : text.replace(oldStr, () => newStr);
+}
+
+function applySearchReplace(text, diff) {
+  const blocks = [...String(diff).matchAll(/(?:-{3,} SEARCH|<{3,} SEARCH)\r?\n([\s\S]*?)\r?\n={3,}\r?\n([\s\S]*?)\r?\n(?:\+{3,} REPLACE|>{3,} REPLACE)/g)];
+  if (!blocks.length) return null;
+  let out = text;
+  for (const [, search, replace] of blocks) {
+    const next = replaceOnce(out, search, replace, false);
+    if (next == null) return null;
+    out = next;
+  }
+  return out;
+}
+
+function insertAt(text, line, insert) {
+  if (typeof insert !== 'string') return null;
+  const lines = text.split('\n');
+  const at = Math.max(0, Math.min(Number(line) || 0, lines.length));
+  lines.splice(at, 0, ...insert.split('\n'));
+  return lines.join('\n');
+}
+
+function parsePatch(patch) {
+  const files = [];
+  let cur = null;
+  for (const raw of String(patch).split(/\r?\n/)) {
+    const add = /^\*\*\* Add File: (.+)$/.exec(raw);
+    const upd = /^\*\*\* Update File: (.+)$/.exec(raw);
+    const del = /^\*\*\* Delete File: (.+)$/.exec(raw);
+    if (add || upd || del) {
+      cur = { path: (add || upd || del)[1].trim(), op: add ? 'add' : upd ? 'update' : 'delete', hunks: [], lines: [] };
+      files.push(cur);
+      continue;
+    }
+    if (!cur || /^\*\*\* (Begin|End) Patch/.test(raw)) continue;
+    if (cur.op === 'add') {
+      if (raw.startsWith('+')) cur.lines.push(raw.slice(1));
+      continue;
+    }
+    if (raw.startsWith('@@')) {
+      cur.hunks.push({ before: [], after: [] });
+      continue;
+    }
+    if (!cur.hunks.length) cur.hunks.push({ before: [], after: [] });
+    const h = cur.hunks[cur.hunks.length - 1];
+    if (raw.startsWith('-')) h.before.push(raw.slice(1));
+    else if (raw.startsWith('+')) h.after.push(raw.slice(1));
+    else {
+      const ctx = raw.startsWith(' ') ? raw.slice(1) : raw;
+      h.before.push(ctx);
+      h.after.push(ctx);
+    }
+  }
+  return files;
+}
+
+function applyHunks(text, hunks) {
+  let out = text;
+  for (const h of hunks) {
+    const before = h.before.join('\n');
+    const after = h.after.join('\n');
+    const next = before ? replaceOnce(out, before, after, false) : out + (out.endsWith('\n') || !out ? '' : '\n') + after;
+    if (next == null) return null;
+    out = next;
+  }
+  return out;
+}
+
+function pathOf(input) {
+  const p = input.file_path ?? input.path ?? input.target_file ?? input.filename ?? null;
+  return typeof p === 'string' && p.trim() ? p : null;
+}
+
+function resolveAgainst(p, cwd) {
+  if (!p) return null;
+  if (p.startsWith('~/') || p.startsWith('~\\')) return path.join(os.homedir(), p.slice(2));
+  return path.isAbsolute(p) ? p : path.resolve(cwd || process.cwd(), p);
+}
+
+export function memoryWritesFor(tool, input, { cwd, read = readUtf8 } = {}) {
+  const name = String(tool ?? '');
+  const i = input ?? {};
+
+  const section = SECTION_TOOLS.find((s) => s.re.test(name));
+  if (section) {
+    const fact = typeof i.fact === 'string' ? i.fact : typeof i.content === 'string' ? i.content : null;
+    if (!fact) return [];
+    const file = section.file();
+    const current = readOr(read, file) ?? '';
+    const bullet = `- ${fact.trim()}`;
+    const content = current.includes(section.heading)
+      ? current.replace(section.heading, `${section.heading}\n${bullet}`)
+      : `${current}${current && !current.endsWith('\n') ? '\n' : ''}\n${section.heading}\n${bullet}\n`;
+    return [{ path: file, content, before: current, basis: 'whole' }];
+  }
+
+  if (/^apply_patch$/i.test(name)) {
+    const patch = typeof i.patch === 'string' ? i.patch : typeof i.input === 'string' ? i.input : typeof i.command === 'string' ? i.command : Array.isArray(i.command) ? i.command.join('\n') : null;
+    if (!patch) return [];
+    const out = [];
+    for (const f of parsePatch(patch)) {
+      const abs = resolveAgainst(f.path, cwd);
+      if (f.op === 'delete') continue;
+      if (f.op === 'add') {
+        out.push({ path: abs, content: f.lines.join('\n'), before: readOr(read, abs), basis: 'whole' });
+        continue;
+      }
+      const current = readOr(read, abs);
+      const next = current == null ? null : applyHunks(current, f.hunks);
+      if (next != null) out.push({ path: abs, content: next, before: current, basis: 'whole' });
+      else out.push({ path: abs, content: f.hunks.map((h) => h.after.join('\n')).join('\n'), before: current, basis: 'fragment' });
+    }
+    return out;
+  }
+
+  const target = resolveAgainst(pathOf(i), cwd);
+  if (!target) return [];
+  const command = typeof i.command === 'string' ? i.command : null;
+
+  if (typeof i.content === 'string' && !Array.isArray(i.edits)) return [{ path: target, content: i.content, before: readOr(read, target), basis: 'whole' }];
+  if (typeof i.file_text === 'string' && (!command || command === 'create')) return [{ path: target, content: i.file_text, before: readOr(read, target), basis: 'whole' }];
+
+  const current = readOr(read, target);
+  const whole = (content) => [{ path: target, content, before: current, basis: 'whole' }];
+  const fragment = (content) => (typeof content === 'string' && content ? [{ path: target, content, before: current, basis: 'fragment' }] : []);
+
+  if (typeof i.new_string === 'string') {
+    const next = current == null ? null : replaceOnce(current, i.old_string, i.new_string, !!i.replace_all);
+    return next != null ? whole(next) : fragment(i.new_string);
+  }
+  if (Array.isArray(i.edits)) {
+    let next = current;
+    for (const e of i.edits) {
+      next = next == null ? null : replaceOnce(next, e?.old_string, e?.new_string, !!e?.replace_all);
+    }
+    return next != null ? whole(next) : fragment(i.edits.map((e) => e?.new_string ?? '').join('\n'));
+  }
+  if (command === 'str_replace' || typeof i.new_str === 'string') {
+    const next = current == null ? null : replaceOnce(current, i.old_str, i.new_str ?? '', false);
+    return next != null ? whole(next) : fragment(i.new_str);
+  }
+  if (command === 'insert') {
+    const text = i.insert_text ?? i.new_str;
+    const next = current == null ? null : insertAt(current, i.insert_line, text);
+    return next != null ? whole(next) : fragment(text);
+  }
+  if (typeof i.diff === 'string') {
+    const next = current == null ? null : applySearchReplace(current, i.diff);
+    return next != null ? whole(next) : fragment(i.diff);
+  }
+  if (typeof i.code_edit === 'string') return fragment(i.code_edit);
+  return [];
+}
+
+export const MEMORY_LEDGER_DIR = path.join(CONFIG_DIR, 'memory-ledger');
+
+export const sha256 = (s) => crypto.createHash('sha256').update(String(s ?? ''), 'utf8').digest('hex');
+
+function ledgerFile(p, dir) {
+  const key = crypto.createHash('sha1').update(path.resolve(p).toLowerCase()).digest('hex');
+  return path.join(dir, `${key}.json`);
+}
+
+export function readLedger(p, dir = MEMORY_LEDGER_DIR) {
+  try {
+    const row = JSON.parse(fs.readFileSync(ledgerFile(p, dir), 'utf8'));
+    return row && Array.isArray(row.hashes) ? row : null;
+  } catch {
+    return null;
+  }
+}
+
+export function recordLedger(p, hashes, dir = MEMORY_LEDGER_DIR) {
+  try {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const prev = readLedger(p, dir);
+    const merged = [...new Set([...hashes.filter(Boolean), ...(prev?.hashes ?? [])])].slice(0, 6);
+    const file = ledgerFile(p, dir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ path: path.resolve(p), hashes: merged, at: new Date().toISOString() }), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+  } catch {
+    return;
+  }
+}
+
+export function outOfBandChange(p, currentContent, dir = MEMORY_LEDGER_DIR) {
+  if (currentContent == null) return false;
+  const row = readLedger(p, dir);
+  if (!row) return false;
+  return !row.hashes.includes(sha256(currentContent));
+}

package/src/guard/prompt-guard.mjs

@@ -170,7 +170,6 @@ function promptInjectionNote(injection) {
   );
 }
 
-
 function buildPromptGuardBody(norm, agent, clientDecision, clientReason) {
   const redaction = localTierDisabled()
     ? { text: norm.prompt, masked: [], changed: false }

package/src/guard/tool-guard.mjs

@@ -6,6 +6,8 @@ import { isMemoryPath, reportMemoryWrite } from '../commands/memory-scan.mjs';
 import { breakerOpen, breakerReset, breakerTrip, guardTimeoutMs } from '../core/circuit-breaker.mjs';
 import { CONFIG_DIR } from '../core/config.mjs';
 import { makeLedgerStore } from './ledger.mjs';
+import { memoryWritesFor, outOfBandChange, recordLedger, sha256 } from './memory-write.mjs';
+import { gateMachine } from '../core/api-client.mjs';
 import { VERSION } from '../core/version.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
 import { classifyConsequence, downrankCodeContext, grade, localScan } from '../detect/guard-signals.mjs';
@@ -19,23 +21,7 @@ import { buildGuardBody, reportGuardDecision } from './report.mjs';
 
 const ALLOW_VERDICT = { verdict: 'ALLOW', top: null, findings: [] };
 
-/**
- * ⚠ FAILING OPEN ON EVERYTHING IS AN ENFORCEMENT BYPASS AN ATTACKER BUYS WITH A
- * SLOW INPUT. The hook has to fail open - an agent that hard-stops on an
- * unreachable SaaS backend is one nobody keeps installed - but "open on every
- * call" means padding a command until the screen times out runs it unscreened,
- * which is cheaper than any evasion in the corpus.
- *
- * So the rung decides. A routine or material call still flows: that is the
- * promise that keeps the hook installed. A SEVERE one - a recursive delete, a
- * force push over a shared branch, a write into ~/.ssh - stops and ASKS.
- *
- * ⚠ IT ASKS, IT DOES NOT DENY. A deny during an outage is unappealable at 3am
- * and gets the hook uninstalled, taking every other control with it. An ask
- * puts the human who is already sitting there in the loop and says plainly
- * that the call was NOT screened, which is the honest sentence: we do not know
- * that this is dangerous, we know that we could not check.
- */
+
 function failOpenOnSevere() {
   return envFlag('SHOMRA_GUARD_FAILOPEN_SEVERE');
 }
@@ -49,34 +35,18 @@ function unscreenedSevere(normalized, tool, input) {
   }) === 'severe';
 }
 
-/**
- * ⚠⚠ THE LEDGER HAD NO PRODUCER. `guard/ledger.mjs` builds the fail-open window
- * the backend's EnforcementGap reads - and nothing in this repo ever called
- * `countCall`, so every client reported ZERO gaps forever. The backend then
- * asks whether a capable reporter exists, gets silence, and the estate reads
- * either "no outages" or NOT_ATTEMPTABLE. Both are wrong and one is flattering:
- * a smoke detector reporting no fire with a dead battery, which is the exact
- * shape enforcement-availability.ts was written to prevent.
- *
- * ⚠ COUNTS ARE LOWER BOUNDS BY DESIGN - concurrent hook processes race this
- * file, and the backend already treats them as a floor. Do not "fix" that with
- * a lock on the firewall's hot path.
- */
+
 function ledger() {
   return makeLedgerStore(CONFIG_DIR, { version: VERSION });
 }
 
-/** A call that ran with no server verdict: Tier-0 screened it, or nothing did. */
 function countUnscreened(reason) {
   try {
     ledger().count(localTierDisabled() ? 'unscreened' : 'local', reason);
   } catch {
-    /* The ledger is a record, never a gate: a failure to write one must not
-     * take the firewall down. The count is a floor and this makes it lower. */
   }
 }
 
-/** Close the open window and hand the backend everything not yet acknowledged. */
 function sendLedger() {
   try {
     const store = ledger();
@@ -85,7 +55,6 @@ function sendLedger() {
     pendingLedger = env.gaps ?? [];
     return env;
   } catch {
-    /* No ledger is a lower bound, not a wrong number. */
     return undefined;
   }
 }
@@ -97,8 +66,6 @@ function ackLedger() {
   try {
     ledger().ack(pendingLedger);
   } catch {
-    /* Unacknowledged gaps are re-sent next time; a duplicate is a floor read
-     * twice, which is safe. Losing one is not. */
   }
   pendingLedger = [];
 }
@@ -138,28 +105,56 @@ function screenLocally(normalized, tool, input) {
   return { ...grade(findings), top, findings };
 }
 
-function memoryWriteContent(input) {
-  if (typeof input.content === 'string') return input.content;
-  if (typeof input.new_string === 'string') return input.new_string;
-  return null;
+const READ_TOOLS_RE = /^(read|read_file|view|open_file|cat)$/i;
+const OUT_OF_BAND = 'changed outside any agent write the Shomra hook observed';
+
+function memoryReportBase(filePath, normalized) {
+  const machine = gateMachine();
+  return {
+    path: path.resolve(filePath).split(path.sep).join('/'),
+    name: path.basename(String(filePath)),
+    machineId: machine.machineId,
+    hostname: machine.hostname,
+    actor: machine.username,
+    sessionId: normalized.session_id,
+  };
 }
 
-async function recordMemoryWrite({ url, apiKey, input, normalized }) {
-  const memoryPath = input.file_path || input.path;
-  if (!memoryPath || !isMemoryPath(memoryPath) || breakerOpen()) return;
+async function reportOutOfBand(url, apiKey, filePath, current, normalized) {
+  if (current == null || !outOfBandChange(filePath, current)) return;
+  await reportMemoryWrite(url, apiKey, { ...memoryReportBase(filePath, normalized), content: current, writer: 'UNKNOWN', source: OUT_OF_BAND });
+  recordLedger(filePath, [sha256(current)]);
+}
 
-  const content = memoryWriteContent(input);
-  if (content == null) return;
+async function recordMemoryWrite({ url, apiKey, tool, input, normalized }) {
+  if (breakerOpen()) return;
+
+  if (READ_TOOLS_RE.test(tool || '')) {
+    const target = input.file_path || input.path || input.target_file;
+    if (!target || !isMemoryPath(target)) return;
+    const abs = path.resolve(normalized.cwd || process.cwd(), String(target));
+    let current = null;
+    try {
+      current = fs.readFileSync(abs, 'utf8');
+    } catch {
+      return;
+    }
+    await reportOutOfBand(url, apiKey, abs, current, normalized);
+    return;
+  }
 
-  await reportMemoryWrite(url, apiKey, {
-    path: String(memoryPath).split(path.sep).join('/'),
-    name: path.basename(String(memoryPath)),
-    content,
-    writer: 'AGENT',
-    source: os.hostname(),
-    actor: os.userInfo().username,
-    sessionId: normalized.session_id,
-  });
+  const writes = memoryWritesFor(tool, input, { cwd: normalized.cwd }).filter((w) => w.path && isMemoryPath(w.path));
+  for (const w of writes) {
+    await reportOutOfBand(url, apiKey, w.path, w.before, normalized);
+    await reportMemoryWrite(url, apiKey, {
+      ...memoryReportBase(w.path, normalized),
+      content: w.content,
+      writer: 'AGENT',
+      source: os.hostname(),
+      contentBasis: w.basis,
+    });
+    recordLedger(w.path, [w.before != null ? sha256(w.before) : null, w.basis === 'whole' ? sha256(w.content) : null]);
+  }
 }
 
 function reportUnauthenticated(agent, status, strict) {
@@ -193,12 +188,6 @@ async function requestServerDecision({ url, apiKey, agentId, body, agent, strict
 
     if (!response.ok) {
       if (response.status === 401 || response.status === 403) reportUnauthenticated(agent, response.status, strict);
-      /* ⚠ A 429 IS NOT AN OUTAGE, and treating it as one was a silent
-       * enforcement bypass: tripping the breaker skips the server for the whole
-       * cooldown, so one burst past the rate limit switched org policy, agent
-       * identity and flow control off for thirty seconds - on the machine, with
-       * nothing said. It means "we are here, come back", so it is retried once
-       * against Retry-After and never counted against the breaker. */
       if (response.status === 429) {
         const wait = retryAfterMs(response);
         if (wait !== null && !retried) {
@@ -223,7 +212,6 @@ async function requestServerDecision({ url, apiKey, agentId, body, agent, strict
   }
 }
 
-/** Honours a seconds or an HTTP-date Retry-After; null when the server named none. */
 function retryAfterMs(response) {
   const raw = response.headers?.get?.('retry-after');
   if (!raw) return null;
@@ -271,26 +259,16 @@ export async function cmdToolGuard(flags) {
     process.exit(0);
   }
 
-  await recordMemoryWrite({ url, apiKey, input, normalized });
+  await recordMemoryWrite({ url, apiKey, tool, input, normalized });
+
 
-  /* ⚠ A SEVERE CALL IS ALWAYS WORTH THE ROUND TRIP. `guardNeedsServer` asks
-   * which calls are worth escalating and answered NO for `git push --force
-   * origin main` and `rm -rf` alike - so the most destructive calls in the
-   * estate were graded by the offline tier and NOTHING ELSE: no org policy, no
-   * capability check, no flow control, and no gate event to read afterwards. */
   const severe = unscreenedSevere(normalized, tool, input);
   const escalate = alwaysEscalate || severe || local.verdict === 'FLAG' || guardNeedsServer(tool, input, !!agentId);
-  /* ⚠ A call the client CHOSE not to escalate is still a call no server graded,
-   * and the denominator has to carry it or the fail-open rate is measured over
-   * the escalated traffic alone - which flatters it by exactly the calls the
-   * client decided were dull. */
   if (!escalate) {
     countUnscreened('not escalated - screened by the local tier only');
     process.exit(0);
   }
 
-  /* Every path out of here that did NOT get a server verdict goes through this
-   * one door, so a new way of failing cannot quietly skip the rung check. */
   const onUnreachable = (why) => {
     countUnscreened(why);
     if (severe) askUnscreened(agent, why);
@@ -309,9 +287,6 @@ export async function cmdToolGuard(flags) {
     onUnreachable,
     body: {
       ...buildGuardBody(normalized, agent, flagged ? 'FLAG' : undefined, flagged ? local.top?.label : undefined),
-      /* The window closes the moment a verdict arrives, and rides out on the
-       * SAME request - a separate report would be a second round trip on the
-       * firewall's hot path, and one that fails exactly when the first did. */
       guard_ledger: sendLedger(),
     },
   });