@shomra/agent 0.3.29 → 0.3.30

package/src/detect/signals/memory-directives.mjs

@@ -0,0 +1,661 @@
+// GENERATED MIRROR of Dragox.Backend analysis/checks/memory/memory-directives.ts (types stripped, imports swapped).
+// Do not hand-edit the rules here - change the backend file and regenerate, so
+// the CLI and the platform locate and grade agent memory identically.
+import { citationGoverns, isDescriptiveLine as proseDescriptive, prohibitsAt } from './prose-context.mjs';
+const POPULAR_PACKAGES = [
+  'express', 'react', 'react-dom', 'lodash', 'axios', 'chalk', 'commander', 'mongoose',
+  'cross-env', 'dotenv', 'request', 'puppeteer', 'playwright', 'next', 'vue', 'angular',
+  'webpack', 'typescript', 'eslint', 'prettier', 'jest', 'moment', 'uuid', 'bcrypt',
+  'jsonwebtoken', 'cors', 'body-parser', 'socket.io', 'nodemon', 'ws', 'yargs', 'glob',
+  'rimraf', 'redux', 'vite', 'rxjs', 'zod', 'prisma', 'tailwindcss', 'esbuild',
+  'requests', 'numpy', 'pandas', 'flask', 'django', 'scipy', 'boto3', 'urllib3',
+  'setuptools', 'wheel', 'pip', 'pytest', 'pillow', 'matplotlib', 'sqlalchemy', 'jinja2',
+  'click', 'pyyaml', 'cryptography', 'certifi', 'aiohttp', 'fastapi', 'pydantic', 'torch',
+  'tensorflow', 'transformers', 'scikit-learn', 'beautifulsoup4', 'selenium', 'celery',
+  'gunicorn', 'uvicorn', 'openai', 'anthropic', 'langchain', 'huggingface-hub', 'datasets',
+];
+
+const MEMORY_EXTRA_PACKAGES = ['httpx', 'pnpm', 'yarn', 'npm', 'node-fetch', 'dayjs', 'date-fns', 'marked', 'nanoid'];
+
+const ADDRESS_TOKEN_RE = /\b[\w.+-]{1,64}@[a-z0-9-]{1,63}(?:\.[a-z0-9-]{1,63}){1,6}\b|\b(?:[a-z0-9-]{1,63}\.){1,6}(?:com|net|org|io|dev|app|xyz|ru|cn|site|top|info|co|me|sh|ai|cloud|link|click|online|example)\b[^\s]{0,200}|\b(?:https?|ftp|s3|gs|sftp):\/\/\S+/gi;
+
+const LEADING_IMPERATIVE_RE =
+  /^\W*(?:(?:on|at|in|with|for|after|before|when|whenever|if|once|during)\b[^,.;]{0,60},\s*)?(?:always\s+|never\s+|please\s+|first\s+|also\s+|then\s+|quietly\s+|silently\s+)?(?:read|fetch|send|post|upload|save|store|remember|write|run|execute|open|visit|call|include|append|add|render|copy|forward|email|install|use|treat|follow|obey|ignore|disable|skip|remove|download|load|check)\b/i;
+
+function isDescriptiveLine(unit        )          {
+  if (LEADING_IMPERATIVE_RE.test(unit)) return false;
+  return proseDescriptive(unit.replace(ADDRESS_TOKEN_RE, ' '));
+}
+
+                                                               
+                                                                                   
+
+                             
+               
+               
+                
+ 
+
+                               
+               
+                      
+                              
+                
+                 
+                      
+               
+                
+                  
+ 
+
+                             
+               
+                                      
+ 
+
+const MAX_LEAVES = 20_000;
+const MAX_DEPTH = 12;
+const MAX_UNIT = 4_000;
+
+function flattenStrings(value         , out          , key               , depth        )       {
+  if (out.length >= MAX_LEAVES || depth > MAX_DEPTH) return;
+  if (typeof value === 'string') {
+    out.push(key ? `${key}: ${value}` : value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) flattenStrings(v, out, null, depth + 1);
+    return;
+  }
+  if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value                           )) flattenStrings(v, out, k, depth + 1);
+  }
+}
+
+function tryParse(s        )          {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return undefined;
+  }
+}
+
+export function memoryText(content                           )             {
+  const raw = String(content ?? '');
+  const trimmed = raw.trim();
+  if (!trimmed) return { text: raw, structured: null };
+  const whole = trimmed.startsWith('{') || trimmed.startsWith('[') ? tryParse(trimmed) : undefined;
+  if (whole !== undefined) {
+    const out           = [];
+    flattenStrings(whole, out, null, 0);
+    return { text: out.join('\n\n'), structured: 'json' };
+  }
+  const lines = raw.split(/\r?\n/).filter((l) => l.trim());
+  if (lines.length > 1 && lines[0].trim().startsWith('{')) {
+    const out           = [];
+    let parsed = 0;
+    for (const l of lines) {
+      const row = tryParse(l);
+      if (row === undefined) {
+        out.push(l);
+        continue;
+      }
+      flattenStrings(row, out, null, 0);
+      parsed++;
+    }
+    if (parsed / lines.length >= 0.8) return { text: out.join('\n\n'), structured: 'jsonl' };
+  }
+  return { text: raw, structured: null };
+}
+
+const BLOCK_START_RE = /^\s*(#{1,6}\s|[-*+]\s|\d+[.)]\s|>|\||<!--|---\s*$|\*\*\*\s*$)/;
+const FENCE_RE = /^\s*(```|~~~)/;
+
+const SENTENCE_START_RE = /^\s+["'`(\[*_~<!]?[A-Z0-9]/;
+
+function splitSentences(s        )                                 {
+  const out                                 = [];
+  let start = 0;
+  let quote = false;
+  let depth = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === '"' || c === '“' || c === '”') quote = c === '“' ? true : c === '”' ? false : !quote;
+    else if (c === '(' || c === '[') depth++;
+    else if ((c === ')' || c === ']') && depth > 0) depth--;
+    else if ((c === '.' || c === '!' || c === '?' || c === ';') && !quote && depth === 0 && SENTENCE_START_RE.test(s.slice(i + 1, i + 4))) {
+      out.push({ text: s.slice(start, i + 1), at: start });
+      start = i + 1;
+      while (start < s.length && /\s/.test(s[start])) start++;
+      i = start - 1;
+    }
+  }
+  if (start < s.length) out.push({ text: s.slice(start), at: start });
+  return out;
+}
+
+function pushSentences(units              , parts                                  )       {
+  if (!parts.length) return;
+  let joined = '';
+  const starts                                 = [];
+  for (const p of parts) {
+    if (joined) joined += ' ';
+    starts.push({ at: joined.length, line: p.line });
+    joined += p.text.trim();
+  }
+  for (const s of splitSentences(joined)) {
+    let line = starts[0].line;
+    for (const st of starts) if (st.at <= s.at) line = st.line;
+    units.push({ text: s.text.slice(0, MAX_UNIT), line, code: false });
+  }
+}
+
+export function logicalUnits(text                           )               {
+  const lines = String(text ?? '').split(/\r?\n/);
+  const units               = [];
+  let fence = false;
+  let para                                   = [];
+  const flush = () => {
+    pushSentences(units, para);
+    para = [];
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const n = i + 1;
+    if (FENCE_RE.test(line)) {
+      flush();
+      fence = !fence;
+      continue;
+    }
+    if (fence) {
+      if (line.trim()) units.push({ text: line.slice(0, MAX_UNIT), line: n, code: true });
+      continue;
+    }
+    if (!line.trim()) {
+      flush();
+      continue;
+    }
+    if (/^\s*\|/.test(line) || /^\s*#{1,6}\s/.test(line)) {
+      flush();
+      units.push({ text: line.slice(0, MAX_UNIT), line: n, code: false });
+      continue;
+    }
+    if (BLOCK_START_RE.test(line)) flush();
+    para.push({ text: line, line: n });
+  }
+  flush();
+  return units;
+}
+
+const POST_PROHIBITION_RE =
+  /^[^.;:!?\n]{0,40}\b(?:is|are|was|must|should|shall|will)\s+(?:never|not|forbidden|prohibited|disallowed|banned)\b|^[^.;:!?\n]{0,30}\b(?:not allowed|is forbidden|is prohibited|is a no-go)\b/i;
+
+export function negatedAround(unit        , index        , length = 0)          {
+  if (prohibitsAt(unit, index)) return true;
+  return POST_PROHIBITION_RE.test(unit.slice(index + length));
+}
+
+export function guardedOut(unit        , index        , length = 0)          {
+  return negatedAround(unit, index, length) || isDescriptiveLine(unit) || citationGoverns(unit, index) || quotedMention(unit, index);
+}
+
+export function mentionsOnlyProhibited(units              , token        )          {
+  const needle = String(token ?? '').toLowerCase();
+  if (!needle) return false;
+  let found = false;
+  for (const u of units) {
+    const hit = u.text.toLowerCase().indexOf(needle);
+    if (hit === -1) continue;
+    const idx = u.text.lastIndexOf(' ', hit) + 1;
+    found = true;
+    if (!(negatedAround(u.text, idx, needle.length) || isDescriptiveLine(u.text) || quotedMention(u.text, idx))) return false;
+  }
+  return found;
+}
+
+export function insideCodeSpan(unit        , index        )          {
+  const before = unit.slice(0, index);
+  return (before.match(/`/g)?.length ?? 0) % 2 === 1;
+}
+
+const REPORTING_FRAME_RE =
+  /\b(?:payload|phrase|phrasing|string|example|e\.g\.|such as|like|sample|pattern|attack|injection|jailbreak|technique|quote[sd]?|wording|text|token|noun|regex|rule|fp|false positive|missed|caught|fired|matched|flagged)\b/i;
+
+export function quotedMention(unit        , index        )          {
+  const before = unit.slice(0, index);
+  const dq = (before.match(/"/g)?.length ?? 0) % 2 === 1;
+  const curly = before.lastIndexOf('“') > before.lastIndexOf('”');
+  const sq = /(^|[\s(\[{,:])'[^']*$/.test(before);
+  const code = insideCodeSpan(unit, index);
+  return (dq || curly || sq || code) && REPORTING_FRAME_RE.test(unit);
+}
+
+const IMPERATIVE_LEAD_RE =
+  /(?:^|[,:;—–(]|\b(?:then|and|also|please|always|must|should|first|finally|immediately|quietly|silently|to|you|you must|you should|you will|you need to|remember to|make sure to|be sure to|don'?t forget to|never forget to|do not forget to))\s*$/i;
+
+export function imperativeAt(unit        , index        )          {
+  const before = unit.slice(0, index).replace(/^\s*(?:[-*+>]|\d+[.)])\s+/, '').replace(/\*\*|__/g, '');
+  return IMPERATIVE_LEAD_RE.test(before);
+}
+
+const URL_RE = /\bhttps?:\/\/[^\s<>"'`)\]]+/i;
+const LOCAL_URL_RE = /\bhttps?:\/\/(localhost|127\.\d+|0\.0\.0\.0|\[::1\]|192\.168\.|10\.\d+|172\.(1[6-9]|2\d|3[01])\.)/i;
+const REMOTE_URI_RE = /\b(?:s3|gs|az|ftp|sftp|ssh|smb|webdav)s?:\/\/\S+/i;
+const EMAIL_RE = /\b[\w.+-]{1,64}@[a-z0-9-]{1,63}(?:\.[a-z0-9-]{1,63}){1,6}\b/i;
+const OPEN_PARAM_RE = /[?&][^=&\s]{1,40}=(?:&|$|\s|\)|\{|\[)/;
+const SINK_WORD_RE =
+  /\b(?:pastebin|gist\.github|webhook\.site|requestbin|pipedream|ngrok|discord(?:app)?\.com\/api\/webhooks|api\.telegram\.org|(?:external|remote|attacker(?:'s)?|third[- ]party|personal|offsite)\s+(?:server|host|endpoint|url|site|bucket|service|address|inbox|account))\b/i;
+
+function externalDestination(unit        )                {
+  const url = URL_RE.exec(unit);
+  if (url && !LOCAL_URL_RE.test(url[0])) return url[0];
+  return REMOTE_URI_RE.exec(unit)?.[0] ?? EMAIL_RE.exec(unit)?.[0] ?? SINK_WORD_RE.exec(unit)?.[0] ?? null;
+}
+
+const CREDENTIAL_PATH_RE =
+  /(?:~?\/?\.ssh\/(?:id_[a-z0-9]+|config)(?!\.pub)|~?\/?\.aws\/credentials|~?\/?\.kube\/config|~?\/?\.gnupg|\bid_(?:rsa|ed25519|dsa)\b(?!\.pub)|~?\/?\.npmrc|~?\/?\.netrc|~?\/?\.docker\/config\.json|\/etc\/shadow|\bkeychain\b|(?:^|[\s'"`(])\.env(?!\.(?:example|sample|template|dist|defaults?)\b)(?:\.[\w-]+)?\b)/i;
+const CREDENTIAL_NOUN_RE = /\b(?:api[- ]?keys?|secrets?|credentials?|tokens?|passwords?|private[- ]?keys?|session cookies?|access keys?)\b/i;
+const EGRESS_VERB_RE = /\b(?:upload|send|post|copy|sync|push|transfer|forward|e-?mail|attach|paste|scp|rsync|exfiltrate|beacon|leak)\b/i;
+
+const MEMORY_WRITE_ACTION_RE =
+  /\b(?:(?:save|store|remember|record|write|add|note|put)\b[^.\n]{0,40}\b(?:to|in|into)\s+(?:your\s+|the\s+|long[- ]term\s+)?memor(?:y|ies)|update\s+(?:your\s+|the\s+)?memor(?:y|ies)|save_memory|create_memory|remember_memory|memory tool|bio tool)\b/i;
+const AGENT_ACTION_RE =
+  /\b(?:save|store|remember|record|write|add|update|call|invoke|use the \w+ tool|run|execute|fetch|open|visit|send|post|upload|create|delete|install|trigger|email|forward)\b/i;
+const TRIVIAL_REPLY_RE =
+  /\b(?:if|when|whenever|once|next time|the next time|after|as soon as)\b[^.\n]{0,60}\b(?:says?|types?|replies?|responds?|answers?|writes?|confirms?|agrees?)\b[^.\n]{0,14}["'“‘]?(?:yes|yeah|yep|sure|ok(?:ay)?|thanks|thank you|no|nope|continue|go ahead|y)\b/i;
+
+const EVERY_TURN_RE =
+  /\b(?:on|with|in|for|at|after|before|at the start of|at the end of)\s+(?:every|each|all|any)\s+(?:new\s+|future\s+|user\s+)?(?:message|turn|reply|response|answer|request|prompt|conversation|session|chat|task)s?\b/i;
+const EVERY_TURN_ACTION_RE = /\b(?:fetch|read|visit|open|load|check|download|curl|wget|send|post|upload|render|call|invoke|email|forward|beacon|ping)\b/i;
+
+const FETCH_VERB_RE = /\b(?:fetch|download|curl|wget|retrieve|pull|load|read|open|visit|get|browse to|check)\b/i;
+const FOLLOW_STRONG_RE =
+  /\b(?:treat (?:it|them|that|this|its contents?|the (?:contents?|text|result)) as (?:your |the )?(?:instructions?|rules?|system prompt|guidance|directives?)|obey|do (?:whatever|what) it says|follow (?:whatever|what) it says|execute (?:it|them|the (?:steps|commands|instructions))|run (?:it|them|the (?:steps|commands|script))|use (?:it|them|its contents?) as (?:your )?(?:instructions?|system prompt)|apply (?:it|them|those|these) (?:as|to) your)\b/i;
+const FOLLOW_WEAK_RE = /\b(?:follow|apply|adopt)\b[^.\n]{0,30}\b(?:instructions?|steps|directions|rules|guidance|it|them)\b/i;
+
+const IMAGE_MD_RE = /!\[[^\]]*\]\(\s*<?(https?:\/\/[^\s)>]+)>?/gi;
+const TEMPLATED_VALUE_RE = /[?&][^=&\s]{0,40}=(?:[^&\s]*(?:\{|\}|\[|\]|<|>|%7b|%5b|%3c|\$\{|\$\()|[A-Z][A-Z_]{3,})/;
+const RENDER_VERB_RE = /\b(?:render|display|show|include|append|embed|output|add|insert|print)\b/i;
+const IMAGE_NOUN_RE = /\b(?:image|img|pixel|picture|logo|badge|tracking link|beacon)\b/i;
+const DATA_OBJECT_RE =
+  /\b(?:conversation|chat|message|summary|question|input|history|context|secrets?|keys?|tokens?|passwords?|data|name|e-?mail|address|prompt|transcript|answer)\b/i;
+
+const OUTPUT_EVERY_RE =
+  /\b(?:always|every time|in every|at the (?:end|start|top|bottom) of (?:every|each|all)|to every|to each|in all|in each|with every)\b[^.\n]{0,60}\b(?:answer|response|reply|message|output|summary|commit message|commit|pull request|pr description|email|code block)s?\b/i;
+const OUTPUT_VERB_RE = /\b(?:add|append|include|insert|end with|prefix|start with|link|mention|recommend|embed)\b/i;
+const SHORTENER_RE = /\bhttps?:\/\/(?:bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd|ow\.ly|rebrand\.ly|cutt\.ly|shorturl\.at|rb\.gy|\d{1,3}(?:\.\d{1,3}){3})\b/i;
+
+const TRUST_GRANT_RE =
+  /\b(?:remember|treat|consider|regard|note|save|store|keep in mind|know that)\b[^.\n]{0,50}\b(?:as|is|are)\s+(?:the\s+|a\s+|an\s+|our\s+)?(?:most\s+|only\s+|single\s+|top\s+)?(?:trusted|authoritative|reliable|official|definitive|go-to|best|primary|preferred|canonical|recommended)\s+(?:source|reference|authority|vendor|provider|site|resource|expert|advisor|option|choice)s?\b/i;
+const RECOMMEND_FIRST_RE =
+  /\b(?:always|first|only)\s+(?:recommend|cite|suggest|promote|link to|mention|prefer|endorse)\b[^.\n]{0,60}\b(?:first|above all|before (?:any|all|other)|over (?:all |any )?(?:others|alternatives|competitors|other (?:options|vendors|tools|sources)))\b/i;
+const FUTURE_RE = /\b(?:in (?:all )?future (?:conversations?|sessions?|chats?|answers?)|from now on|going forward|always|every (?:time|answer|response))\b/i;
+const RECOMMEND_VERB_RE = /\b(?:recommend|cite|suggest|promote|link|mention|endorse)\b/i;
+
+const CONSENT_WAIVER_RE =
+  /\b(?:never|don'?t|do not|no need to|without|skip)\s+(?:ever\s+)?(?:ask(?:ing)?|prompt(?:ing)?|check(?:ing)? with|confirm(?:ing)?(?: with)?|wait(?:ing)? for|request(?:ing)?|seek(?:ing)?)\b[^.\n]{0,30}\b(?:the user|user|human|me|anyone|approval|confirmation|permission|consent|sign-?off)\b/i;
+const WAIVER_SCOPE_RE =
+  /\b(?:run|running|execut\w*|shell|commands?|push\w*|deploy\w*|install\w*|delet\w*|remov\w*|writ\w*|send\w*|commit\w*|tools?|merg\w*|publish\w*|pay\w*|transfer\w*|anything|any action|all actions|changes)\b/i;
+const WAIVER_DANGER_RE =
+  /\brm\s+-|\b(?:prod(?:uction)?|main|master|deploy\w*|delet\w*|drop\s+(?:table|database)|install\w*|credentials?|secrets?|keys?|tokens?|payments?|transfer\w*|wire|publish\w*|force[- ]push|sudo)\b|--force\b/i;
+const PRIOR_APPROVAL_RE =
+  /\b(?:already|previously|pre-?|has been|have been|was|were)\s*(?:approved|authori[sz]ed|consented|granted|confirmed|allowed|whitelisted|allowlisted|cleared|signed off)\b[^.\n]{0,60}(?:\b(?:all|every|any|shell|commands?|tools?|actions?|access|deploy\w*|push\w*|install\w*|reads?|writes?|credentials?|secrets?)\b|~\/\.)/i;
+const STANDING_PERMISSION_RE =
+  /\b(?:agent|assistant|you|claude|copilot|model|ai)\s+(?:may|can|is allowed to|are allowed to|is permitted to|are permitted to|has permission to|have permission to)\s+(?:freely\s+|always\s+)?(?:read|access|open|use|send|upload|run|execute|modify|delete)\b[^.\n]{0,40}(?:~\/\.ssh|~\/\.aws|\.ssh|\.aws|credentials?|secrets?|\.env\b|private keys?|tokens?|production|prod\b|any (?:file|command|directory))/i;
+
+const PERSONA_RE =
+  /\b(?:you are|you're|act as|pretend (?:to be|you are)|roleplay as)\s+(?:now\s+)?(?:dan|stan|dude|aim|evil\w*|unrestricted|uncensored|unfiltered|jailbroken|in developer mode)\b|\byou (?:have|has) no (?:restrictions|limits|limitations|rules|filters|guidelines|boundaries|ethical guidelines)\b|\bnever refuse (?:any|a|the user'?s?)\s*(?:request|instruction|question|command|prompt)s?\b|\b(?:don'?t|do not) refuse anything\b|\banswer (?:everything|anything|all (?:questions|requests))\b[^.\n]{0,30}\bwithout (?:refus\w*|restrictions?|filters?|limits?)\b|\bdo anything now\b|\bdeveloper mode\s+(?:enabled|on|activated)\b/i;
+
+const BOUNDARY_ESCAPE_RE =
+  /<\/(?:conversation|user|human|context|instructions?|user_input|document|tool_result|function_results)>\s*[^<\s]|<\|im_end\|>|<\|im_start\|>\s*system|\[\/INST\]\s*\S/i;
+
+const COMMENT_RE = /<!--([\s\S]*?)-->/g;
+const COMMENT_PRAGMA_RE =
+  /^\s*(?:markdownlint|prettier|eslint|toc|todo|fixme|note|begin|end|generated|auto-generated|stop|start|region|endregion|vale|cspell|omit|more|break|lint|spell|mdformat|keep|ignore-start|ignore-end|@\w+)\b/i;
+const COMMENT_DIRECTIVE_RE =
+  /\b(?:assistant|ai|claude|agent|model|llm|copilot|cursor|gemini|codex|bot)\s*[:,]|\byou (?:must|should|will|are to|need to|have to)\b|\b(?:from now on|always|never|ignore|disregard|do not tell|don'?t tell|include|send|run|execute|fetch|append|add)\b[^\n]{0,80}\b(?:user|response|answer|output|commit|secret|token|key|env|instructions?|memory|file|command|url|https?:)/i;
+
+const PACKAGE_REF_RE =
+  /\b(pip3? install|npm (?:i|install|add)|yarn add|pnpm (?:add|i|install)|uv (?:add|pip install)|poetry add|bun add|install(?:ing)?|prefer(?:s|red)?|always use|use the (?:package|library|module)|prefer(?:s|red)?\s+["'`‘“]?[\w.-]+["'`’”]?\s+over)\s+(?:the\s+)?(?:(?:package|library|module)\s+)?(?:-[-\w]+\s+)*(["'`‘“]?)([a-z0-9][a-z0-9._-]{3,40})["'`’”]?/gi;
+const PACKAGE_CONTEXT_RE = /\b(?:packages?|librar(?:y|ies)|modules?|dependenc(?:y|ies)|install\w*|pip|npm|pnpm|yarn|pypi|crate|gem)\b/i;
+const INSTALL_VERB_RE = /install|add|^npm|^pip|^uv|^poetry|^bun|^yarn|^pnpm/i;
+
+function osaDistance(a        , b        )         {
+  const m = a.length;
+  const n = b.length;
+  const d = Array.from({ length: m + 1 }, (_, i) => [i, ...new Array(n).fill(0)]);
+  for (let j = 0; j <= n; j++) d[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+    }
+  }
+  return d[m][n];
+}
+
+const POPULAR = new Set([...POPULAR_PACKAGES, ...MEMORY_EXTRA_PACKAGES].map((p) => p.toLowerCase()));
+
+function typosquatOf(token        )                {
+  const t = token.toLowerCase();
+  if (t.length < 5 || POPULAR.has(t)) return null;
+  for (const p of POPULAR) {
+    if (p.length < 5 || Math.abs(p.length - t.length) > 1) continue;
+    if (osaDistance(t, p) === 1) return p;
+  }
+  return null;
+}
+
+const clip = (s        , n        ) => s.trim().slice(0, n);
+
+                                                                                                                                                                             
+
+                   
+            
+                
+               
+                         
+           
+ 
+
+function triggerOnReply({ t, u, noun, isInstruction, add }         )       {
+  const trig = TRIVIAL_REPLY_RE.exec(t);
+  if (!trig || guardedOut(t, trig.index, trig[0].length)) return;
+  const tail = t.slice(trig.index + trig[0].length);
+  const memWrite = MEMORY_WRITE_ACTION_RE.exec(tail);
+  const action = memWrite ?? AGENT_ACTION_RE.exec(tail);
+  if (!action) return;
+  add(
+    'trigger-on-reply',
+    'PROMPT_INJECTION',
+    memWrite ? 'HIGH' : isInstruction ? null : 'MEDIUM',
+    `Delayed trigger bound to an ordinary reply in ${noun}`,
+    `This ${noun} arms an action that fires when the user types something as ordinary as "yes" or "thanks". That is the delayed-tool-invocation pattern used against Gemini memory: the user's reply supplies the intent a memory write would otherwise need, so the write looks user-initiated.`,
+    'Remove the conditional instruction. A memory entry should record a fact, never a trigger that fires on a later reply.',
+    u,
+    `${trig[0]}${tail.slice(0, (action.index ?? 0) + action[0].length)}`,
+  );
+}
+
+function everyTurnEgress({ t, u, noun, isInstruction, add }         )       {
+  const every = EVERY_TURN_RE.exec(t);
+  if (!every) return;
+  const action = EVERY_TURN_ACTION_RE.exec(t);
+  const dest = externalDestination(t);
+  if (!action || !dest || guardedOut(t, Math.min(every.index, action.index), 0)) return;
+  add(
+    'every-turn-egress',
+    'TOXIC_FLOW',
+    isInstruction ? 'MEDIUM' : 'HIGH',
+    `Standing per-turn action against an external destination in ${noun}`,
+    `This ${noun} tells the agent to reach ${dest} on every message, turn or session. A standing per-turn fetch or send is the persistence half of the SpAIware and ZombieAgent attacks: each new conversation re-runs it with that conversation's data in reach.`,
+    'Remove the entry. A standing network action belongs in reviewed tooling with an egress allow-list, not in context the agent re-reads every turn.',
+    u,
+    `${every[0]} … ${action[0]} … ${dest}`,
+  );
+}
+
+function remoteInstructions({ t, u, noun, isInstruction, add }         )       {
+  const web = URL_RE.exec(t);
+  const url = web && !LOCAL_URL_RE.test(web[0]) ? web : EMAIL_RE.exec(t);
+  if (!url) return;
+  const fetch = FETCH_VERB_RE.exec(t);
+  const strong = FOLLOW_STRONG_RE.exec(t);
+  const follow = strong ?? FOLLOW_WEAK_RE.exec(t);
+  if (!fetch || !follow || negatedAround(t, fetch.index, fetch[0].length) || (isDescriptiveLine(t) && !strong)) return;
+  add(
+    'remote-instructions',
+    'PROMPT_INJECTION',
+    strong ? (isInstruction ? 'HIGH' : 'CRITICAL') : isInstruction ? 'MEDIUM' : 'HIGH',
+    `Standing instruction to fetch and follow remote content in ${noun}`,
+    `This ${noun} tells the agent to load ${url[0]} and act on what it says. Whoever controls that URL can change the agent's instructions at any time without touching this file, so no baseline, drift check or review of the ${noun} covers what the agent will actually do.`,
+    'Remove the entry, or vendor the content into a reviewed file. An instruction source the organisation does not control cannot be baselined.',
+    u,
+    `${fetch[0]} … ${url[0]} … ${follow[0]}`,
+  );
+}
+
+function imageExfilInstruction({ t, u, noun, add }         )       {
+  if (!IMAGE_NOUN_RE.test(t) || !DATA_OBJECT_RE.test(t)) return;
+  const verb = RENDER_VERB_RE.exec(t);
+  const link = URL_RE.exec(t);
+  if (!verb || !link || LOCAL_URL_RE.test(link[0]) || guardedOut(t, verb.index, verb[0].length)) return;
+  add(
+    'image-exfil-instruction',
+    'TOXIC_FLOW',
+    'HIGH',
+    `Instruction to render an image carrying conversation data in ${noun}`,
+    `This ${noun} tells the agent to render an image or link from ${link[0]} built from conversation data. The client fetches the image automatically, so the data leaves in the URL with no tool call and no approval - the SpAIware exfiltration channel.`,
+    'Remove the entry and roll back to the approved baseline. Treat any host named here as a collection endpoint.',
+    u,
+    `${verb[0]} … ${link[0]}`,
+  );
+}
+
+function outputLinkInjection({ t, u, noun, add }         )       {
+  const out = OUTPUT_EVERY_RE.exec(t);
+  if (!out || !OUTPUT_VERB_RE.test(t)) return;
+  const link = URL_RE.exec(t);
+  if (!link || LOCAL_URL_RE.test(link[0]) || guardedOut(t, out.index, out[0].length)) return;
+  const tracking = SHORTENER_RE.test(link[0]) || OPEN_PARAM_RE.test(link[0]) || TEMPLATED_VALUE_RE.test(link[0]);
+  add(
+    'output-link-injection',
+    'PROMPT_INJECTION',
+    tracking ? 'HIGH' : 'MEDIUM',
+    `Standing link injected into every answer by ${noun}`,
+    `This ${noun} makes the agent attach ${link[0]} to its output every time. ${tracking ? 'The URL carries an open or templated parameter, so each answer can hand conversation data to whoever reads the logs for that host.' : 'It steers every future answer toward a destination nobody reviewed per answer.'}`,
+    'Remove the entry unless the link is an approved internal resource, and record that decision in a reviewed rules file rather than memory.',
+    u,
+    `${out[0]} … ${link[0]}`,
+  );
+}
+
+function trustGrant({ t, u, noun, isInstruction, add }         )       {
+  const trust = TRUST_GRANT_RE.exec(t);
+  const recommend = trust ? null : RECOMMEND_FIRST_RE.exec(t);
+  const grant = trust ?? recommend;
+  if (!grant || guardedOut(t, grant.index, grant[0].length)) return;
+  const steering = !!recommend || (FUTURE_RE.test(t) && RECOMMEND_VERB_RE.test(t));
+  add(
+    'trust-grant',
+    'PROMPT_INJECTION',
+    isInstruction ? 'MEDIUM' : steering ? 'HIGH' : 'MEDIUM',
+    `Standing trust grant to a named source in ${noun}`,
+    `This ${noun} records that a source is trusted or must be recommended first. That is the AI recommendation poisoning pattern Microsoft documented in February 2026: a single "remember X as a trusted source" entry biases every later answer on the topic, and the user never sees where the bias came from.`,
+    'Remove the entry unless an operator deliberately recorded it. Source preferences that change what the agent recommends belong in reviewed policy, not agent-writable memory.',
+    u,
+    grant[0],
+  );
+}
+
+function consentWaiver({ t, u, noun, isInstruction, add }         )       {
+  const waiver = CONSENT_WAIVER_RE.exec(t);
+  if (!waiver || !WAIVER_SCOPE_RE.test(t) || isDescriptiveLine(t) || citationGoverns(t, waiver.index)) return;
+  const danger = WAIVER_DANGER_RE.test(t);
+  add(
+    'consent-waiver',
+    'PROMPT_INJECTION',
+    isInstruction ? (danger ? 'HIGH' : 'MEDIUM') : 'HIGH',
+    `Standing waiver of human confirmation in ${noun}`,
+    `This ${noun} tells the agent to stop asking before it acts. ${isInstruction ? 'A rules file may legitimately relax confirmation for routine work' : 'Memory is agent-writable, so a waiver here can be planted by any content the agent read'}${danger ? ', and this one covers destructive, production or credential actions' : ''}.`,
+    'Remove the waiver, or move it into the agent\'s permission settings where it is scoped, reviewable and visible to the operator.',
+    u,
+    waiver[0],
+  );
+}
+
+function recordedApproval({ t, u, noun, isInstruction, add }         )       {
+  const prior = PRIOR_APPROVAL_RE.exec(t) ?? STANDING_PERMISSION_RE.exec(t);
+  if (!prior || negatedAround(t, prior.index, prior[0].length) || citationGoverns(t, prior.index)) return;
+  add(
+    'recorded-approval',
+    'PROMPT_INJECTION',
+    isInstruction ? 'MEDIUM' : 'HIGH',
+    `Approval recorded as already given in ${noun}`,
+    `This ${noun} states that access or actions were already approved. Nothing in the ${noun} can prove who approved it, and a planted "this was approved" entry is how an injection pre-authorises the action it will ask for next.`,
+    'Remove the entry. Approvals belong in the agent\'s permission settings or an approval record, where the approver is named.',
+    u,
+    prior[0],
+  );
+}
+
+function personaOverride({ t, u, noun, isInstruction, add }         )       {
+  const persona = PERSONA_RE.exec(t);
+  if (!persona || isDescriptiveLine(t) || citationGoverns(t, persona.index) || insideCodeSpan(t, persona.index)) return;
+  add(
+    'persona-override',
+    'PROMPT_INJECTION',
+    isInstruction ? 'HIGH' : 'CRITICAL',
+    `Jailbreak persona planted in ${noun}`,
+    `This ${noun} redefines the agent as an unrestricted persona or tells it never to refuse. Loaded every session, it strips the model's refusal behaviour before the user has asked anything.`,
+    `Remove the entry and roll the ${noun} back to its approved baseline; treat whatever wrote it as compromised.`,
+    u,
+    persona[0],
+  );
+}
+
+function typosquatPreference({ t, u, noun, add }         )       {
+  PACKAGE_REF_RE.lastIndex = 0;
+  for (const m of t.matchAll(PACKAGE_REF_RE)) {
+    let token = m[3];
+    while (token && '._-'.includes(token[token.length - 1])) token = token.slice(0, -1);
+    const squat = typosquatOf(token);
+    if (!squat) continue;
+    if (!INSTALL_VERB_RE.test(m[1]) && !m[2] && !PACKAGE_CONTEXT_RE.test(t)) continue;
+    if (negatedAround(t, m.index ?? 0, m[0].length) || quotedMention(t, m.index ?? 0) || isDescriptiveLine(t)) continue;
+    add(
+      'typosquat-preference',
+      'TOXIC_FLOW',
+      'HIGH',
+      `Look-alike package name recorded in ${noun}`,
+      `This ${noun} tells the agent to use "${token}", one keystroke away from the popular package "${squat}". A remembered package preference is re-applied on every future install, which is how a single poisoned entry becomes a supply-chain compromise on each new project.`,
+      `Correct the name to "${squat}" if that was meant, and check whether "${token}" was ever installed.`,
+      u,
+      token,
+    );
+    return;
+  }
+}
+
+const INTO_BEFORE_RE = /\b(?:into|to|in|inside|onto)\s+(?:the\s+|your\s+|a\s+|an\s+|this\s+)?$/i;
+const HTTP_LINE_RE = /^(?:GET|POST|PUT|PATCH|DELETE)\s+\//;
+
+function credentialEgress({ t, u, noun, add }         )       {
+  if (HTTP_LINE_RE.test(t.trim())) return;
+  const path = CREDENTIAL_PATH_RE.exec(t);
+  const cred = path && !INTO_BEFORE_RE.test(t.slice(Math.max(0, path.index - 24), path.index + (path[0].match(/^\s*/)?.[0].length ?? 0))) ? path : null;
+  const target = cred ?? CREDENTIAL_NOUN_RE.exec(t);
+  const verb = EGRESS_VERB_RE.exec(t);
+  if (!target || !verb) return;
+  const dest = externalDestination(t);
+  if (!(cred || dest) || !imperativeAt(t, verb.index)) return;
+  if (guardedOut(t, verb.index, verb[0].length) || negatedAround(t, Math.min(verb.index, target.index), 0)) return;
+  const what = target[0].trim();
+  add(
+    'credential-egress',
+    'TOXIC_FLOW',
+    dest ? 'CRITICAL' : 'HIGH',
+    `Instruction to move credentials ${dest ? 'off the machine' : 'somewhere else'} in ${noun}`,
+    `This ${noun} tells the agent to ${verb[0]} ${what}${dest ? ` to ${dest}` : ''}. Loaded as trusted context, it is a standing credential-exfiltration instruction that fires whenever the ${noun} is read.`,
+    'Remove the entry, rotate the credentials it names, and check the agent\'s recent network activity for the destination.',
+    u,
+    `${verb[0]} … ${what}${dest ? ` … ${dest}` : ''}`,
+  );
+}
+
+function boundaryEscape({ t, u, noun, add }         )       {
+  const escape = BOUNDARY_ESCAPE_RE.exec(t);
+  if (!escape || insideCodeSpan(t, escape.index)) return;
+  add(
+    'boundary-escape',
+    'PROMPT_INJECTION',
+    'CRITICAL',
+    `Forged conversation boundary in ${noun}`,
+    `This ${noun} closes a conversation or user block and keeps writing after it. The Unit 42 Bedrock memory attack used exactly this to make injected text land outside the conversation, where the summariser reads it as system instructions.`,
+    `Remove the entry and roll the ${noun} back to its approved baseline.`,
+    u,
+    escape[0],
+  );
+}
+
+const UNIT_RULES                             = [
+  triggerOnReply,
+  everyTurnEgress,
+  remoteInstructions,
+  imageExfilInstruction,
+  outputLinkInjection,
+  trustGrant,
+  consentWaiver,
+  recordedApproval,
+  personaOverride,
+  typosquatPreference,
+  credentialEgress,
+  boundaryEscape,
+];
+
+function imageExfilUrl(text        , units              , noun        , add     )       {
+  IMAGE_MD_RE.lastIndex = 0;
+  for (const m of text.matchAll(IMAGE_MD_RE)) {
+    const target = m[1];
+    if (LOCAL_URL_RE.test(target) || !TEMPLATED_VALUE_RE.test(target)) continue;
+    const at = m.index ?? 0;
+    const lineStart = text.lastIndexOf('\n', at) + 1;
+    const lineEnd = text.indexOf('\n', at);
+    const lineText = text.slice(lineStart, lineEnd === -1 ? text.length : lineEnd);
+    if (insideCodeSpan(lineText, at - lineStart)) continue;
+    const unit = units.find((x) => x.text.includes(m[0])) ?? { text: lineText, line: text.slice(0, at).split('\n').length, code: false };
+    if (unit.code) continue;
+    add(
+      'image-exfil-url',
+      'TOXIC_FLOW',
+      'CRITICAL',
+      `Markdown image that carries data out in ${noun}`,
+      `This ${noun} contains an image pointing at ${target} with a templated query value. When the agent reproduces it, the client fetches the image automatically and the filled-in value leaves in the URL - the SpAIware channel, with no tool call to screen.`,
+      `Remove the image and roll the ${noun} back; treat the host as a collection endpoint.`,
+      unit,
+      m[0],
+    );
+    return;
+  }
+}
+
+function commentDirective(text        , noun        , add     )       {
+  COMMENT_RE.lastIndex = 0;
+  for (const m of text.matchAll(COMMENT_RE)) {
+    const body = m[1] ?? '';
+    if (!body.trim() || COMMENT_PRAGMA_RE.test(body)) continue;
+    const d = COMMENT_DIRECTIVE_RE.exec(body);
+    if (!d) continue;
+    if (negatedAround(body, d.index, d[0].length) && !/\b(?:tell|inform|mention|show)\b/i.test(d[0])) continue;
+    add(
+      'comment-directive',
+      'PROMPT_INJECTION',
+      'HIGH',
+      `Instruction hidden in an HTML comment in ${noun}`,
+      `This ${noun} carries an instruction inside an HTML comment. A rendered view and most reviews never show it, while the raw text reaches the model - the concealment the Rules File Backdoor relied on.`,
+      'Delete the comment. Guidance meant for the agent should be visible to the humans who review the file.',
+      { text: body, line: text.slice(0, m.index ?? 0).split('\n').length, code: false },
+      d[0],
+    );
+    return;
+  }
+}
+
+export function incidentDirectives(text        , isInstruction         , units               = logicalUnits(text))                 {
+  const hits                 = [];
+  const seen = new Set        ();
+  const noun = isInstruction ? 'rules file' : 'memory';
+  const add      = (rule, cls, severity, title, detail, remediation, u, match) => {
+    if (!severity || seen.has(rule)) return;
+    seen.add(rule);
+    hits.push({ rule, cls, severity, title, detail, remediation, line: u.line, match: clip(match, 160), snippet: clip(u.text, 220) });
+  };
+  for (const u of units) {
+    if (u.code) continue;
+    for (const rule of UNIT_RULES) rule({ t: u.text, u, noun, isInstruction, add });
+  }
+  imageExfilUrl(text, units, noun, add);
+  commentDirective(text, noun, add);
+  return hits;
+}