@shomra/agent 0.3.29 → 0.3.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.29",
+  "version": "0.3.30",
   "description": "Shomra - adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {

package/src/agents/hook-command.mjs

@@ -12,7 +12,7 @@ function quoteArg(argument) {
 export const PACKAGE_SPEC = `@shomra/agent@${VERSION}`;
 
 /**
- * ⚠⚠ AN ABSOLUTE PATH DOES NOT SURVIVE THE FILE IT IS WRITTEN INTO. A project
+ *  AN ABSOLUTE PATH DOES NOT SURVIVE THE FILE IT IS WRITTEN INTO. A project
  * install lands in `.claude/settings.json`, which is COMMITTED - so the hook is
  * read on a colleague's laptop and inside the ephemeral cloud container Claude
  * Code on the web clones the repo into. Neither has this checkout, so the hook

package/src/artifacts/matchers.mjs

@@ -1,9 +1,16 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { PLUGIN_MANIFEST_RE, TOOL_MANIFEST_RE } from '../detect/signals/manifests.mjs';
 
 export const ARTIFACT_MATCHERS = [
+  { kind: 'plugin', re: PLUGIN_MANIFEST_RE },
+  { kind: 'tool-manifest', re: TOOL_MANIFEST_RE },
   { kind: 'mcp', re: /(^|\/)\.?mcp\.json$/i },
   { kind: 'mcp', re: /(^|\/)\.(vscode|cursor)\/mcp\.json$/i },
+  { kind: 'mcp', re: /(^|\/)\.(kiro\/settings|amazonq|roo|windsurf|vs|junie\/mcp)\/mcp\.json$/i },
+  { kind: 'mcp', re: /(^|\/)(opencode\.jsonc?|crush\.json|\.codex\/config\.toml|\.continue\/(config\.ya?ml|mcpServers\/[^/]+\.(ya?ml|json)))$/i },
+  { kind: 'model-config', re: /(^|\/)(tokenizer_config|generation_config|adapter_config|model_index|special_tokens_map|config_sentence_transformers|preprocessor_config|processor_config)\.json$/i },
+  { kind: 'model-config', re: /(^|\/)(chat_template\.(jinja2?|json)|(.*\.)?modelfile|MLmodel|config\.pbtxt|bentofile\.ya?ml)$/i },
   { kind: 'skill', re: /(^|\/)SKILL\.md$/i },
   { kind: 'command', re: /(^|\/)\.claude\/commands\/[^/]+\.md$/i },
   { kind: 'subagent', re: /(^|\/)\.claude\/agents\/[^/]+\.md$/i },

package/src/cli/flags.mjs

@@ -1,9 +1,9 @@
 const BOOLEAN_FLAGS = new Set([
   'strict', 'json', 'sarif', 'fix', 'staged', 'changed', 'all', 'history', 'force',
   'apply', 'dry-run', 'global', 'local', 'trailer', 'evolve', 'report', 'init',
-  'no-suppress', 'no-baseline', 'no-policy', 'no-index', 'adaptive',
+  'no-suppress', 'no-baseline', 'no-policy', 'no-index', 'adaptive', 'offline',
   'fail-on-regression', 'fail-on-blocked', 'write', 'yes', 'stdin', 'quiet', 'help',
-  'check', 'checklist', 'pre-receive', 'uninstall', 'save', 'list',
+  'check', 'checklist', 'pre-receive', 'uninstall', 'save', 'list', 'machine',
 ]);
 
 const VALUE_FLAGS = new Set([

package/src/cli/help-sections.mjs

@@ -177,6 +177,13 @@ const MEMORY_SCAN = () => `${bold('MEMORY-SCAN')}
   each write (with provenance) so Shomra can track drift from an approved baseline
   and roll back a poisoned store. Once ${bold('install-hook')} is wired, the agent's own
   memory and rules-file writes are captured automatically. Analysis is static.
+
+  With no path it scans the current directory ${bold('and')} this machine's agent memory:
+  Claude Code (auto + subagent memory), Codex memories, Gemini/Qwen memory, Windsurf,
+  Goose, Serena, basic-memory, the VS Code Copilot memory tool, mem0/Letta stores.
+  ${bold('--machine')} scans only those. Binary stores (SQLite, protobuf, vector DBs) are
+  reported as found-but-unread, never as clean. A store whose content changed
+  outside any agent write the hook saw is reported as an out-of-band write.
 `;
 
 const REDTEAM = () => `${bold('REDTEAM')}

package/src/cli/help.mjs

@@ -12,7 +12,7 @@ ${bold(cyan('shomra admin'))} ${dim('- governance & advanced security operations
   ${dim('Deep scans (backend + key)')}
   ${cyan('scan-zip')}      Static-scan a workspace ZIP            ${dim('<file.zip> [--project <id>] [--json]')}
   ${cyan('model-scan')}    SAST-scan a public AI model            ${dim('<hf-url | owner/model | github-url> [--project <id>] [--json]')}
-  ${cyan('memory-scan')}   Scan memory + rules files for poisoning ${dim('[path] [--scope …] [--writer …] [--json]')}
+  ${cyan('memory-scan')}   Scan memory + rules files for poisoning ${dim('[path] [--machine] [--scope …] [--writer …] [--json]')}
 
   ${dim('Offense & runtime identity')}
   ${cyan('redteam')}       Continuously red-team your guardrails  ${dim('[--target llm-guard|model] [--evolve] [--min 80] [--fail-on-regression] [--json]')}

package/src/commands/check.mjs

@@ -1,7 +1,7 @@
-import { execSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { ARTIFACT_MATCHERS, walkArtifacts } from '../artifacts/matchers.mjs';
+import { git } from '../core/git-exec.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
 import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
 import { VERSION } from '../core/version.mjs';
@@ -14,17 +14,9 @@ import { fixOneFile } from './fix.mjs';
 const GIT_TIMEOUT_MS = 3000;
 
 function gitChangedArtifacts(root, { staged }) {
-  const run = (args) => {
-    try {
-      return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: GIT_TIMEOUT_MS }).toString();
-    } catch {
-      return null;
-    }
-  };
-
   const output = staged
-    ? run('diff --cached --name-only --relative --diff-filter=ACM')
-    : run('diff HEAD --name-only --relative --diff-filter=ACM');
+    ? git(['diff', '--cached', '--name-only', '--relative', '--diff-filter=ACM'], { cwd: root, timeout: GIT_TIMEOUT_MS })
+    : git(['diff', 'HEAD', '--name-only', '--relative', '--diff-filter=ACM'], { cwd: root, timeout: GIT_TIMEOUT_MS });
   if (output === null) return null;
 
   return output

package/src/commands/gate.mjs

@@ -11,8 +11,10 @@ import { GATE_KINDS, collectSiblings, detectEnv } from '../gate/environment.mjs'
 import { localAsGateResult, printGateResult } from '../gate/result.mjs';
 import { toSarif } from '../gate/sarif.mjs';
 import { collectLocalSast, mergeSastIntoResult } from '../gate/sast.mjs';
+import { withMcpAdvisories } from '../gate/advisories.mjs';
+import { readZipEntry } from '../core/zip-lite.mjs';
 
-const GATE_USAGE = 'shomra gate <file> [--kind mcp|skill|command|subagent|hook|rules|agent-card|memory] [--name x] [--strict] [--json]';
+const GATE_USAGE = 'shomra gate <file> [--kind mcp|skill|command|subagent|hook|rules|agent-card|memory|plugin|tool-manifest|extension|workflow|guardrail|framework] [--name x] [--strict] [--json]';
 
 function resolveGateFile(file) {
   let target = path.resolve(String(file));
@@ -43,6 +45,20 @@ function readGateTarget(flags, positional) {
     process.exit(EXIT_USAGE);
   }
   const target = resolveGateFile(file);
+  
+  if (/\.(?:dxt|mcpb)$/i.test(target)) {
+    const manifest = readZipEntry(fs.readFileSync(target), 'manifest.json');
+    if (manifest == null) {
+      console.error(`${red('✗')} ${file} is not a readable extension bundle (no manifest.json at its root).`);
+      process.exit(EXIT_USAGE);
+    }
+    return {
+      content: manifest,
+      relPath: `${path.relative(process.cwd(), target).split(path.sep).join('/')}!/manifest.json`,
+      fullTarget: null,
+      bundle: true,
+    };
+  }
   return {
     content: fs.readFileSync(target, 'utf8'),
     relPath: path.relative(process.cwd(), target).split(path.sep).join('/'),
@@ -79,8 +95,8 @@ export async function cmdGate(flags, positional) {
   const { apiKey, url } = resolveSettings(loadConfig());
   if (flags.all) return cmdGateAll(flags, positional, { apiKey, url });
 
-  const { content, relPath, fullTarget } = readGateTarget(flags, positional);
-  const kind = flags.kind && GATE_KINDS.includes(String(flags.kind)) ? String(flags.kind) : undefined;
+  const { content, relPath, fullTarget, bundle } = readGateTarget(flags, positional);
+  const kind = flags.kind && GATE_KINDS.includes(String(flags.kind)) ? String(flags.kind) : bundle ? 'mcp' : undefined;
   const name = flags.name ? String(flags.name) : (relPath ? relPath.split('/').pop() : 'artifact');
   const local = localGate(content, { kind, path: relPath });
 
@@ -97,7 +113,13 @@ export async function cmdGate(flags, positional) {
     console.error(`  ${dim('Not enrolled - on-machine analysis only. Run')} ${bold('shomra init')} ${dim('to also apply org policy.')}`);
   }
 
-  const base = serverVerdict || localAsGateResult(local, name, kind);
+  let shownLocal = local;
+  if (!serverVerdict) {
+    const { local: withAdv, advisories } = await withMcpAdvisories(local, { content, path: relPath, kind, flags });
+    shownLocal = withAdv;
+    if (advisories === 'unavailable' && !flags.json) console.error(`  ${yellow('⚠')} ${dim('Advisory lookup (OSV) unreachable - pinned MCP packages were not checked for published CVEs.')}`);
+  }
+  const base = serverVerdict || localAsGateResult(shownLocal, name, kind);
   const result = mergeSastIntoResult(base, collectLocalSast({ fullPath: fullTarget, relPath, kind, content }));
   printGateResult(result, serverVerdict ? 'server' : 'local', flags);
 

package/src/commands/git-hooks.mjs

@@ -1,7 +1,7 @@
-import { execSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { EXIT_USAGE } from '../core/exit-codes.mjs';
+import { git } from '../core/git-exec.mjs';
 import { bold, dim, green, red, yellow } from '../core/terminal.mjs';
 
 export async function cmdInstallPrecommit(flags, positional) {
@@ -152,7 +152,7 @@ function installPreReceive(flags, positional) {
 
 function gitHooksDir(root) {
   try {
-    const dir = execSync('git rev-parse --git-path hooks', { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).toString().trim();
+    const dir = git(['rev-parse', '--git-path', 'hooks'], { cwd: root, timeout: 3000 })?.trim();
     if (!dir) return null;
     const abs = path.isAbsolute(dir) ? dir : path.join(root, dir);
     fs.mkdirSync(abs, { recursive: true });

package/src/commands/ledger.mjs

@@ -18,7 +18,6 @@ function readJson(file) {
   }
 }
 
-
 function mcpReach() {
   let total = 0;
   let mediated = 0;

package/src/commands/mcp-add.mjs

@@ -6,6 +6,7 @@ import { SEV_COLOR, bold, cyan, dim, green, red, yellow } from '../core/terminal
 import { localGate } from '../detect/guard-signals.mjs';
 import { mcpIndexAlert, mcpLookup, mcpLookupId, parseEnvKV, worstMcpVerdict } from '../mcp/lookup.mjs';
 import { printAlternatives } from '../models/lookup.mjs';
+import { withMcpAdvisories } from '../gate/advisories.mjs';
 
 const MAX_FINDINGS_SHOWN = 6;
 const RUNNER_NAMES = /^(npx|bunx|pnpx|uvx|uv|node|deno|bun|python3?|py|docker|podman|sh|bash|zsh|ruby|go|cargo|dotnet)$/i;
@@ -130,7 +131,7 @@ export async function cmdMcpAdd(flags, positional, configFile) {
   assertUsableArguments(name, server, tokens);
 
   const candidate = JSON.stringify({ mcpServers: { [name]: server } }, null, 2);
-  const localVerdict = localGate(candidate, { kind: 'mcp', path: '.mcp.json' });
+  const { local: localVerdict } = await withMcpAdvisories(localGate(candidate, { kind: 'mcp', path: '.mcp.json' }), { content: candidate, path: '.mcp.json', kind: 'mcp', flags });
   const index = await lookupSecurityIndex(flags, server, name);
   const verdict = worstMcpVerdict(localVerdict.verdict, mcpIndexAlert(index));
 

package/src/commands/memory-scan.mjs

@@ -4,36 +4,27 @@ import path from 'node:path';
 import { MAX_ARTIFACT_BYTES, SKIP_DIRS } from '../artifacts/matchers.mjs';
 import { api } from '../core/api-client.mjs';
 import { guardTimeoutMs } from '../core/circuit-breaker.mjs';
-import { loadConfig, resolveSettings } from '../core/config.mjs';
+import { getMachineId, loadConfig, resolveSettings } from '../core/config.mjs';
 import { EXIT_USAGE, exitNotConfigured } from '../core/exit-codes.mjs';
 import { SEV_COLOR, VERDICT_COLOR, bold, cyan, dim, gray, green, red, yellow } from '../core/terminal.mjs';
+import { isInstructionPath } from '../detect/signals/instruction-paths.mjs';
+import { MACHINE_MEMORY_ROOTS, SERVER_SIDE_MEMORY, classifyMemoryPath, sniffMemoryJsonl } from '../detect/signals/memory-locations.mjs';
+import { outOfBandChange, recordLedger, sha256 } from '../guard/memory-write.mjs';
 
-const MEMORY_MATCHERS = [
-  /(^|\/)MEMOR(Y|IES)\.(md|json|jsonl|txt)$/i,
-  /(^|\/)memor(y|ies)\/[^/]+\.(md|mdx|json|jsonl|txt|ya?ml)$/i,
-  /(^|\/)\.(mem0|letta|memgpt)\/[^/]+\.(md|json|jsonl|txt)$/i,
-];
-
-const INSTRUCTION_MATCHERS = [
-  /(^|\/)(CLAUDE|AGENTS?|GEMINI|CONVENTIONS)\.md$/i,
-  /(^|\/)LLMS(-FULL)?\.txt$/i,
-  /(^|\/)\.(cursorrules|windsurfrules|clinerules|aiderrules|continuerules|goosehints)$/i,
-  /(^|\/)\.github\/copilot-instructions\.md$/i,
-  /(^|\/)copilot-instructions\.md$/i,
-  /(^|\/)\.cursor\/rules\/.+\.mdc$/i,
-  /(^|\/)\.clinerules\/.+\.md$/i,
-];
+export function memoryLocation(p) {
+  return classifyMemoryPath(String(p || '').split(path.sep).join('/'));
+}
 
 export function isMemoryPath(p) {
   const rel = String(p || '').split(path.sep).join('/');
-  return MEMORY_MATCHERS.some((re) => re.test(rel)) || INSTRUCTION_MATCHERS.some((re) => re.test(rel));
+  return !!classifyMemoryPath(rel) || isInstructionPath(rel);
 }
 
-function walkMemoryFiles(root) {
+function walkMemoryFiles(root, maxDepth = 12) {
   const found = [];
-  const stack = [root];
+  const stack = [{ dir: root, depth: 0 }];
   while (stack.length) {
-    const dir = stack.pop();
+    const { dir, depth } = stack.pop();
     let entries;
     try {
       entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -43,11 +34,77 @@ function walkMemoryFiles(root) {
     for (const ent of entries) {
       const full = path.join(dir, ent.name);
       if (ent.isDirectory()) {
-        if (!SKIP_DIRS.has(ent.name)) stack.push(full);
+        if (!SKIP_DIRS.has(ent.name) && depth < maxDepth) stack.push({ dir: full, depth: depth + 1 });
         continue;
       }
+      if (!ent.isFile()) continue;
       const rel = path.relative(root, full).split(path.sep).join('/');
-      if (isMemoryPath(rel) || isMemoryPath(full)) found.push({ full, rel });
+      if (isMemoryPath(rel) || isMemoryPath(full) || (/\.(jsonl|ndjson)$/i.test(ent.name) && sniffJsonlFile(full))) found.push({ full, rel });
+    }
+  }
+  return found;
+}
+
+function sniffJsonlFile(full) {
+  try {
+    const fd = fs.openSync(full, 'r');
+    const buf = Buffer.alloc(4096);
+    const n = fs.readSync(fd, buf, 0, buf.length, 0);
+    fs.closeSync(fd);
+    return sniffMemoryJsonl(buf.subarray(0, n).toString('utf8'));
+  } catch {
+    return false;
+  }
+}
+
+function vscodeUserDirs() {
+  const home = os.homedir();
+  const bases = process.platform === 'win32'
+    ? [process.env.APPDATA || path.join(home, 'AppData', 'Roaming')]
+    : process.platform === 'darwin'
+      ? [path.join(home, 'Library', 'Application Support')]
+      : [process.env.XDG_CONFIG_HOME || path.join(home, '.config')];
+  return bases.flatMap((b) => ['Code', 'Code - Insiders', 'Cursor', 'Windsurf', 'VSCodium'].map((app) => path.join(b, app, 'User')));
+}
+
+function expandRoot(base, dir) {
+  const parts = dir.split('/');
+  let paths = [base];
+  for (const part of parts) {
+    const next = [];
+    for (const p of paths) {
+      if (part === '*') {
+        try {
+          for (const ent of fs.readdirSync(p, { withFileTypes: true })) if (ent.isDirectory()) next.push(path.join(p, ent.name));
+        } catch {
+          continue;
+        }
+      } else {
+        next.push(path.join(p, part));
+      }
+    }
+    paths = next;
+  }
+  return paths.filter((p) => fs.existsSync(p));
+}
+
+export function machineMemoryFiles() {
+  const seen = new Set();
+  const found = [];
+  const home = os.homedir();
+  for (const root of MACHINE_MEMORY_ROOTS) {
+    const bases = root.base === 'vscode-user' ? vscodeUserDirs() : [home];
+    for (const base of bases) {
+      for (const dir of expandRoot(base, root.dir)) {
+        for (const f of walkMemoryFiles(dir, root.depth)) {
+          const key = path.resolve(f.full).toLowerCase();
+          if (seen.has(key)) continue;
+          seen.add(key);
+          const rel = path.relative(home, f.full).split(path.sep).join('/');
+          if (!isMemoryPath(rel) && !isMemoryPath(f.full)) continue;
+          found.push({ full: f.full, rel: `~/${rel}` });
+        }
+      }
     }
   }
   return found;
@@ -65,14 +122,22 @@ export async function reportMemoryWrite(url, apiKey, body) {
     });
     clearTimeout(timer);
   } catch {
-
+    return;
   }
 }
 
-const NO_STORES_HINT = '(Looked for MEMORY.md, memory/ dirs, .mem0/.letta stores, and rules files: CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, …)';
+const NO_STORES_HINT = '(Looked for Claude/Codex/Gemini/Qwen/Windsurf/Goose/Serena memory, memory-bank/, MCP memory.jsonl, mem0/Letta stores, and rules files: CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, …)';
 
-function resolveMemoryTarget(positional) {
-  const argument = positional[0] || '.';
+function resolveMemoryTargets(positional, flags) {
+  if (flags.machine) return { target: '~', files: machineMemoryFiles() };
+  const argument = positional[0];
+  if (!argument) {
+    const cwd = process.cwd();
+    const local = walkMemoryFiles(cwd).map((f) => ({ ...f, full: f.full }));
+    const seen = new Set(local.map((f) => path.resolve(f.full).toLowerCase()));
+    const machine = machineMemoryFiles().filter((f) => !seen.has(path.resolve(f.full).toLowerCase()));
+    return { target: `${cwd} + this machine's agent memory`, files: [...local, ...machine] };
+  }
   const target = path.resolve(String(argument));
   if (!fs.existsSync(target)) {
     console.error(`${red('✗')} Not found: ${argument}`);
@@ -83,15 +148,15 @@ function resolveMemoryTarget(positional) {
     : { target, files: [{ full: target, rel: path.basename(target) }] };
 }
 
-function readStoreContent(file, flags) {
+function readStore(file) {
+  const loc = memoryLocation(file.full) ?? memoryLocation(file.rel);
+  if (loc?.format === 'binary') return { content: '', unreadable: `${path.extname(file.full).slice(1) || 'binary'} store`, format: 'binary' };
   try {
-    if (fs.statSync(file.full).size > MAX_ARTIFACT_BYTES) {
-      if (!flags.json) console.log(`  ${gray('•')} ${dim(file.rel)} ${yellow('skipped (too large)')}`);
-      return null;
-    }
-    return fs.readFileSync(file.full, 'utf8');
-  } catch {
-    return null;
+    const size = fs.statSync(file.full).size;
+    if (size > MAX_ARTIFACT_BYTES) return { content: '', unreadable: `larger than ${Math.round(MAX_ARTIFACT_BYTES / 1_000_000)} MB`, format: loc?.format ?? null };
+    return { content: fs.readFileSync(file.full, 'utf8'), unreadable: null, format: loc?.format ?? null };
+  } catch (error) {
+    return { content: '', unreadable: `could not be opened (${error.code || 'error'})`, format: loc?.format ?? null };
   }
 }
 
@@ -101,7 +166,7 @@ function worseVerdict(current, next) {
   return 'PASS';
 }
 
-function printStore(file, report) {
+function printStore(file, report, note) {
   const verdict = report?.store?.verdict || 'PASS';
   const colour = VERDICT_COLOR[verdict] || gray;
   const poisonScore = report?.store?.poisonScore ?? 0;
@@ -109,7 +174,8 @@ function printStore(file, report) {
 
   const quarantineNote = report?.quarantined ? ` ${red('QUARANTINED')}` : '';
   const provenanceNote = anomalous ? ` ${red('OUT-OF-BAND WRITE')}` : '';
-  console.log(`\n  ${colour('●')} ${bold(path.basename(file.rel))} ${dim(file.rel)} ${colour(verdict)} ${dim(`poison ${poisonScore}/100`)}${quarantineNote}${provenanceNote}`);
+  const extra = note ? ` ${yellow(note)}` : '';
+  console.log(`\n  ${colour('●')} ${bold(path.basename(file.rel))} ${dim(file.rel)} ${colour(verdict)} ${dim(`poison ${poisonScore}/100`)}${quarantineNote}${provenanceNote}${extra}`);
 
   for (const finding of (report?.analysis?.findings || []).filter((f) => f.severity !== 'INFO')) {
     console.log(`      ${SEV_COLOR[finding.severity](String(finding.severity).padEnd(8))} ${finding.title}`);
@@ -123,56 +189,78 @@ function summaryLine(worst) {
   return green('✓ No memory poisoning found.');
 }
 
+function writerFor(file, content, flags) {
+  if (flags.writer) return { writer: String(flags.writer).toUpperCase(), source: 'shomra memory-scan' };
+  if (outOfBandChange(file.full, content)) {
+    return { writer: 'UNKNOWN', source: 'changed outside any agent write the Shomra hook observed' };
+  }
+  return { writer: 'SCAN', source: 'shomra memory-scan' };
+}
+
 export async function cmdMemoryScan(flags, positional) {
-  const { apiKey, url } = resolveSettings(loadConfig());
+  const cfg = loadConfig();
+  const { apiKey, url } = resolveSettings(cfg);
   if (!apiKey) exitNotConfigured();
 
-  const { target, files } = resolveMemoryTarget(positional);
+  const { target, files } = resolveMemoryTargets(positional, flags);
   if (!files.length) {
     if (flags.json) console.log(JSON.stringify({ scanned: 0, stores: [] }, null, 2));
     else console.log(dim(`\n  No memory or rules files found under ${target}.\n  ${NO_STORES_HINT}\n`));
     return;
   }
 
+  const machineId = getMachineId(cfg);
   const ingestFields = {
     scope: flags.scope ? String(flags.scope).toLowerCase() : undefined,
-    writer: flags.writer ? String(flags.writer).toUpperCase() : 'AGENT',
     actor: `${os.hostname()}/${os.userInfo().username}`,
-    source: 'shomra memory-scan',
+    machineId,
+    hostname: os.hostname(),
     ...(flags.project ? { projectId: String(flags.project) } : {}),
   };
 
   if (!flags.json) {
-    console.log(bold(cyan('\n  Shomra Memory Integrity')) + dim(` - scanning ${files.length} store${files.length > 1 ? 's' : ''}`));
+    console.log(bold(cyan('\n  Shomra Memory Integrity')) + dim(` - scanning ${files.length} store${files.length > 1 ? 's' : ''} (${target})`));
   }
 
   let worst = 'PASS';
+  let unread = 0;
   const stores = [];
   for (const file of files) {
-    const content = readStoreContent(file, flags);
-    if (content == null) continue;
+    const { content, unreadable, format } = readStore(file);
+    if (unreadable) unread++;
+    const { writer, source } = writerFor(file, unreadable ? null : content, flags);
+    const loc = memoryLocation(file.full) ?? memoryLocation(file.rel);
+    const scope = ingestFields.scope ?? (file.rel.startsWith('~/') && !loc?.committed ? 'user' : undefined);
 
     let report;
     try {
       report = await api(url, apiKey, '/memory/ingest', {
         ...ingestFields,
-        path: file.rel,
+        ...(scope ? { scope } : {}),
+        path: path.resolve(file.full).split(path.sep).join('/'),
         name: path.basename(file.rel),
         content,
+        writer,
+        source,
+        ...(unreadable ? { unreadable } : {}),
+        ...(format ? { format } : {}),
       });
     } catch (error) {
       console.error(`  ${red('✗')} ${file.rel} ${red(`ingest error: ${error.message}`)}`);
       continue;
     }
+    if (!unreadable) recordLedger(file.full, [sha256(content)]);
 
     worst = worseVerdict(worst, report?.store?.verdict || 'PASS');
-    stores.push({ path: file.rel, ...report });
-    if (!flags.json) printStore(file, report);
+    stores.push({ path: file.rel, vendor: loc?.vendor ?? null, unreadable, ...report });
+    if (!flags.json) printStore(file, report, unreadable ? `not read: ${unreadable}` : null);
   }
 
   if (flags.json) {
-    console.log(JSON.stringify({ scanned: stores.length, worst, stores }, null, 2));
+    console.log(JSON.stringify({ scanned: stores.length, unread, worst, stores, serverSide: SERVER_SIDE_MEMORY }, null, 2));
   } else {
+    if (unread) console.log(`\n  ${yellow('⚠')} ${unread} store${unread > 1 ? 's were' : ' was'} found but not read - reported as not looked inside, never as clean.`);
+    console.log(dim(`\n  Not scannable from this machine: ${SERVER_SIDE_MEMORY.map((s) => s.vendor).join(', ')} keep memory server-side.`));
     console.log(`\n  ${summaryLine(worst)}${dim(' Full timeline + rollback in the Shomra dashboard → Memory.\n')}`);
   }
 

package/src/commands/pr.mjs

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { git, safeRef } from '../core/git-exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { ARTIFACT_MATCHERS, walkArtifacts } from '../artifacts/matchers.mjs';
@@ -44,13 +44,14 @@ async function githubApi(token, method, apiPath, body) {
 }
 
 function gitChangedVsBase(root, base) {
-  const run = (args) => { try { return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString(); } catch { return null; } };
+  const run = (args) => git(args, { cwd: root });
   let out = null;
-  for (const b of [`origin/${base}`, base]) {
-    out = run(`diff --name-only --relative --diff-filter=ACM ${b}...HEAD`);
+  const ref = safeRef(base);
+  for (const b of ref ? [`origin/${ref}`, ref] : []) {
+    out = run(['diff', '--name-only', '--relative', '--diff-filter=ACM', `${b}...HEAD`]);
     if (out !== null) break;
   }
-  if (out === null) out = run('diff HEAD~1 --name-only --relative --diff-filter=ACM');
+  if (out === null) out = run(['diff', 'HEAD~1', '--name-only', '--relative', '--diff-filter=ACM']);
   if (out === null) return null;
   const files = out.split('\n').map((s) => s.trim()).filter(Boolean);
   return files.filter((rel) => ARTIFACT_MATCHERS.some((m) => m.re.test(rel)));
@@ -74,11 +75,7 @@ function writeWorkflow(flags) {
 }
 
 function headShaFromGit() {
-  try {
-    return execSync('git rev-parse HEAD', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
-  } catch {
-    return null;
-  }
+  return git(['rev-parse', 'HEAD'])?.trim() || null;
 }
 
 function resolvePrContext(flags) {

package/src/commands/provenance.mjs

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { git, safeRef } from '../core/git-exec.mjs';
 import path from 'node:path';
 import { api } from '../core/api-client.mjs';
 import { loadConfig, resolveSettings } from '../core/config.mjs';
@@ -6,23 +6,18 @@ import { EXIT_USAGE } from '../core/exit-codes.mjs';
 import { bold, cyan, dim, green, red, yellow } from '../core/terminal.mjs';
 
 function gitChangedPaths(root, { staged, base }) {
-  const run = (args) => {
-    try {
-      return execSync(`git ${args}`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString();
-    } catch {
-      return null;
-    }
-  };
+  const run = (args) => git(args, { cwd: root });
   let out = null;
   if (staged) {
-    out = run('diff --cached --name-only --relative --diff-filter=ACM');
-  } else if (base) {
-    for (const b of [`origin/${base}`, base]) {
-      out = run(`diff --name-only --relative --diff-filter=ACM ${b}...HEAD`);
+    out = run(['diff', '--cached', '--name-only', '--relative', '--diff-filter=ACM']);
+  } else if (safeRef(base)) {
+    const ref = safeRef(base);
+    for (const b of [`origin/${ref}`, ref]) {
+      out = run(['diff', '--name-only', '--relative', '--diff-filter=ACM', `${b}...HEAD`]);
       if (out !== null) break;
     }
   }
-  if (out === null) out = run('diff HEAD~1 --name-only --relative --diff-filter=ACM');
+  if (out === null) out = run(['diff', 'HEAD~1', '--name-only', '--relative', '--diff-filter=ACM']);
   if (out === null) return null;
   return out.split('\n').map((s) => s.trim()).filter(Boolean);
 }

package/src/commands/scan.mjs

@@ -8,6 +8,7 @@ import { SEV_COLOR, VERDICT_COLOR, bold, cyan, dim, gray, green, red, yellow } f
 import { VERSION } from '../core/version.mjs';
 import { discoverAgentArtifacts } from '../inventory/agent-artifacts.mjs';
 import { discoverAll } from '../inventory/discovery.mjs';
+import { unreadMcpStores } from '../inventory/discovery/mcp-servers.mjs';
 
 function discover(flags) {
 
@@ -24,12 +25,17 @@ export async function cmdScan(flags) {
   const cfg = loadConfig();
   const assets = discover(flags);
   const { artifacts, capped, available } = discoverArtifacts(flags);
+  const unreadStores = unreadMcpStores();
+  
   if (flags.json && !flags.report) {
-    console.log(JSON.stringify({ machine: machineInfo(cfg), assets, artifacts, capped, available }, null, 2));
+    console.log(JSON.stringify({ machine: machineInfo(cfg), assets, artifacts, capped, available, ...(unreadStores.length ? { unreadMcpStores: unreadStores } : {}) }, null, 2));
     return;
   }
   console.log(bold(cyan('\n  Shomra')) + dim(` agent v${VERSION} - local scan`));
   printAssets(assets);
+  for (const s of unreadStores) {
+    console.log(`  ${yellow('⚠')} ${dim(`MCP servers in ${s.file} were NOT read (${s.state === 'no-sqlite' ? 'this Node has no node:sqlite - use Node 22.5+' : s.state}) - not the same as none.`)}`);
+  }
   printArtifacts(artifacts, capped, available);
 
   if (flags.report) {

package/src/commands/secrets.mjs

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { git, safeRef } from '../core/git-exec.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { MAX_ARTIFACT_BYTES, SKIP_DIRS } from '../artifacts/matchers.mjs';
@@ -12,8 +12,7 @@ function redactSecret(s) {
 }
 
 function isGitRepo(root) {
-  try { execSync('git rev-parse --is-inside-work-tree', { cwd: root, stdio: ['ignore', 'pipe', 'ignore'] }); return true; }
-  catch { return false; }
+  return git(['rev-parse', '--is-inside-work-tree'], { cwd: root }) !== null;
 }
 
 export function walkFiles(root, cap = 8000) {
@@ -34,8 +33,8 @@ export function walkFiles(root, cap = 8000) {
 
 function scanGitHistory(root, depth) {
   let out;
-  try { out = execSync(`git log --all -p -n ${depth} --no-color --format="commit %H %an %ad"`, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 128 * 1024 * 1024 }).toString(); }
-  catch { return null; }
+  out = git(['log', '--all', '-p', '-n', String(Math.floor(Number(depth)) || 300), '--no-color', '--format=commit %H %an %ad'], { cwd: root, timeout: 120000, maxBuffer: 128 * 1024 * 1024 });
+  if (out === null) return null;
   const hits = [];
   const seen = new Set();
   let commit = '', file = '';