@shomra/agent 0.3.29 → 0.3.30

package/src/detect/signals/chat-template.mjs

@@ -0,0 +1,211 @@
+// GENERATED MIRROR of Dragox.Backend model-formats/chat-template.ts (types stripped, imports swapped).
+// Do not hand-edit the rules here - change the backend file and regenerate, so
+// `shomra gate` and the platform grade a model config identically.
+                                                     
+import { inspectText } from './inspect-shim.mjs';
+const binaryFinding = () => (f) => f;
+
+export const CHAT_TEMPLATE_SSTI =
+  /__(class|globals|builtins|subclasses|mro|init|import|dict|base|reduce|code)__|\bos\.(system|popen|environ|remove|rename)|\bsubprocess\b|\beval\s*\(|\bexec\s*\(|\bpopen\s*\(|\b__import__\s*\(|\bimportlib\b|\|\s*attr\s*\(|\battr\s*\(\s*['"]__|\b(lipsum|cycler|joiner|namespace)\s*\.\s*__|\bself\s*\.\s*_TemplateReference__context/i;
+
+const TEMPLATE_LOADER_RE = /\{%-?\s*(include|import|extends|from)\s/i;
+
+const SIGNALS_EXPECTED_IN_TEMPLATES = /forged system-role/i;
+
+const finding = binaryFinding('chat template render');
+
+                                          
+                
+
+                    
+ 
+
+export function scanChatTemplate(
+  template                           ,
+  file        ,
+  opts                          = {},
+)                {
+  const text = template ?? '';
+  if (!text.trim()) return [];
+  const out                = [];
+  const sink = opts.sink ?? 'chat_template';
+  const renderer = opts.renderer ?? 'the tokenizer';
+
+  if (CHAT_TEMPLATE_SSTI.test(text)) {
+    out.push(
+      finding({
+        ruleId: 'chat_template.ssti',
+        title: 'Chat template reaches host internals (Jinja SSTI)',
+        severity: 'CRITICAL',
+        file,
+        sink,
+        snippet: text.slice(0, 600),
+        message:
+          `The chat template in \`${sink}\` contains Jinja constructs that reach Python/host internals ` +
+          '(dunder traversal, an `attr()` bypass, os/subprocess, or eval/exec/import). ' +
+          `${renderer} renders this template on every conversation, so loading the model is enough to ` +
+          'execute it - no exploit step is required.',
+        remediation:
+          'Do not load this model. Obtain it from a trusted publisher, or strip/replace the chat template and ' +
+          'render templates only in a sandboxed Jinja environment (jinja2.sandbox.SandboxedEnvironment).',
+        cwe: 'CWE-1336',
+        category: 'deserialization',
+        confidence: 0.95,
+      }),
+    );
+  }
+
+  if (TEMPLATE_LOADER_RE.test(text)) {
+    out.push(
+      finding({
+        ruleId: 'chat_template.loader',
+        title: 'Chat template pulls in another template',
+        severity: 'HIGH',
+        file,
+        sink,
+        snippet: text.slice(0, 600),
+        message:
+          `The chat template in \`${sink}\` uses a Jinja \`include\`/\`import\`/\`extends\` statement. A chat ` +
+          'template is a pure string transform over the message list; pulling a second template through the ' +
+          "renderer's loader reads a file off the host and renders its contents into the conversation.",
+        remediation:
+          'Remove the include/import from the template. If a shared fragment is genuinely needed, inline it - a ' +
+          'template that reads the filesystem at render time is a disclosure channel, not a formatting rule.',
+        cwe: 'CWE-829',
+        category: 'deserialization',
+        confidence: 0.9,
+      }),
+    );
+  }
+
+  const backdoor = templateBackdoor(text);
+  if (backdoor) {
+    out.push(
+      finding({
+        ruleId: backdoor.url && !backdoor.trigger ? 'chat_template.remote_reference' : 'chat_template.backdoor',
+        title: backdoor.trigger ? 'Chat template injects content when a trigger phrase appears' : 'Chat template writes a URL into the conversation',
+        severity: backdoor.trigger ? 'HIGH' : 'MEDIUM',
+        file,
+        sink,
+        snippet: (backdoor.block ?? text).slice(0, 600),
+        message: backdoor.trigger
+          ? `The chat template in \`${sink}\` tests the conversation for the literal ${JSON.stringify(backdoor.trigger)} and, when it is present, ` +
+            `emits ${backdoor.url ? `a URL (${backdoor.url})` : 'hardcoded text'} that is not one of the template's inputs. A formatting template has no reason to react to what a user SAYS - ` +
+            'this is the trigger-gated backdoor shape shown working across 18 models and 4 inference engines, invisible to weight scans and to anyone reading the prompt.'
+          : `The chat template in \`${sink}\` writes ${backdoor.url} into every rendered conversation. A template formats messages; a link it adds is content the model reads as part of the prompt.`,
+        remediation: 'Replace the chat template with the base model\'s upstream template (compare by hash) before serving this model.',
+        cwe: 'CWE-506',
+        category: 'agentic',
+        confidence: backdoor.trigger ? 0.8 : 0.6,
+      }),
+    );
+  }
+
+  /*
+   * ⚠ Injection signals are read over what the template EMITS - literal text and
+   * the string literals inside `{{ }}` - not over its Jinja code. gpt-oss's
+   * harmony template renders tool schemas with code that names parameters and
+   * conversations, and the prose rules read that code as an instruction.
+   */
+  const emitted = text
+    // `raise_exception("…")` text is an error for the CALLER, never part of the prompt (gpt-oss explains its channels there)
+    .replace(/raise_exception\(\s*(["'])(?:(?!\1)[^\\]|\\.)*\1\s*\)/g, ' ')
+    .replace(/\{#[\s\S]*?#\}/g, ' ')
+    .replace(/\{%[\s\S]*?%\}/g, ' ')
+    .replace(/\{\{([\s\S]*?)\}\}/g, (_, inner        ) => ' ' + [...inner.matchAll(/(["'])((?:(?!\1)[^\\]|\\.)*)\1/g)].map((m) => m[2]).join(' ') + ' ');
+  const signals = inspectText(emitted, { categories: ['injection'] }).matches.filter(
+    (m) => !SIGNALS_EXPECTED_IN_TEMPLATES.test(m.label),
+  );
+  if (signals.length) {
+    out.push(
+      finding({
+        ruleId: 'chat_template.injection',
+        title: 'Injected instructions in the chat template',
+        severity: 'HIGH',
+        file,
+        sink,
+        snippet: text.slice(0, 600),
+        message:
+          `The chat template in \`${sink}\` contains injected instructions. This text is prepended to every ` +
+          'conversation before the user says anything, so it acts as a system prompt the user cannot see or ' +
+          'override - a backdoored model needs no further exploit to exfiltrate or misbehave. Signals: ' +
+          signals
+            .map((m) => m.label)
+            .slice(0, 4)
+            .join('; '),
+        remediation:
+          `Do not load this model. Inspect ${sink} and obtain the model from a trusted publisher; re-convert ` +
+          'from the original weights if you need this architecture.',
+        cwe: 'CWE-94',
+        category: 'agentic',
+        confidence: 0.85,
+      }),
+    );
+  }
+
+  return out;
+}
+
+/*
+ * ⚠ Membership tests on message content are ORDINARY in reasoning templates:
+ * `{% if '</think>' in content %}` strips the thinking block, `'<tool_call>' in
+ * content` routes tool output. A trigger is a literal that is PROSE, not a
+ * token-shaped marker - and it only counts when the branch it opens emits a
+ * URL or a literal string the template was not given.
+ */
+const TRIGGER_RE = /\{%-?\s*(?:el)?if\s+(["'])((?:(?!\1).){3,120})\1\s+in\s+([\w.[\]'"]+)/g;
+const TOKEN_MARKER_RE = /^(?:<\/?[\w|:.-]{1,40}>|<\|[^|]{1,40}\|>|\[\/?[A-Z_]{1,24}\]|[\s\n]*|[#*`>\-\s]{1,6}|```\w*)$/;
+const URL_LITERAL_RE = /https?:\/\/[^\s'"{}<>|]+/i;
+
+function templateBackdoor(text        )                                                                              {
+  for (const m of text.matchAll(TRIGGER_RE)) {
+    const literal = m[2];
+    if (TOKEN_MARKER_RE.test(literal) || !/[a-z]{3,}/i.test(literal)) continue;
+    if (!/message|content|messages|msg|m\b|query|prompt|user/i.test(m[3])) continue;
+    const start = m.index ?? 0;
+    const end = text.indexOf('endif', start);
+    const block = text.slice(start, end === -1 ? Math.min(text.length, start + 1500) : end);
+    const body = block.slice(m[0].length);
+    const url = URL_LITERAL_RE.exec(body)?.[0] ?? null;
+    // ⚠ a single-token literal is a MODE FLAG (`/no_think`, `/system_override` in SmolLM3) - documented behaviour
+    // that emits the vendor's own mode text. Only a PHRASE trigger, or a flag whose branch writes a URL, is a backdoor.
+    const phrase = /\s/.test(literal.trim()) && !/^\//.test(literal.trim());
+    if (!phrase && !url) continue;
+    // a string literal of sentence length emitted inside the branch
+    const emitted = [...body.matchAll(/\{\{-?\s*(["'])((?:(?!\1).){20,})\1/g)].map((x) => x[2]).find((s) => s.trim().split(/\s+/).length >= 4)
+      ?? body.replace(/\{[{%#][\s\S]*?[}%#]\}/g, ' ').split(/\n/).map((l) => l.trim()).find((l) => l.split(/\s+/).length >= 6) ?? null;
+    if (url || emitted) return { trigger: literal, url, block };
+  }
+  const url = URL_LITERAL_RE.exec(text.replace(/\{#[\s\S]*?#\}/g, ''))?.[0] ?? null;
+  return url ? { trigger: null, url, block: null } : null;
+}
+
+export function extractChatTemplates(raw                           , file        )                                   {
+  const text = raw ?? '';
+  if (!text.trim()) return [];
+
+  if (/\.jinja2?$/i.test(file)) return [{ name: 'chat_template', text }];
+
+  let parsed     ;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return /chat_template/.test(text) ? [{ name: 'chat_template', text }] : [];
+  }
+
+  const node = parsed?.chat_template;
+  if (typeof node === 'string') return [{ name: 'chat_template', text: node }];
+  if (Array.isArray(node)) {
+    return node
+      .filter((t     ) => typeof t?.template === 'string')
+      .map((t     , i        ) => ({ name: `chat_template[${t.name ?? i}]`, text: t.template           }));
+  }
+  return [];
+}
+
+export const CHAT_TEMPLATE_FILES = ['chat_template.jinja', 'chat_template.json', 'chat_template.jinja2'];
+
+export function isChatTemplateFile(path        )          {
+  const base = path.split('/').pop()?.toLowerCase() ?? '';
+  return CHAT_TEMPLATE_FILES.includes(base);
+}

package/src/detect/signals/ci-workflow.mjs

@@ -0,0 +1,169 @@
+import { parseYaml } from '../../core/yaml-lite.mjs';
+
+export const CI_PATH_RE =
+  /(^|\/)\.(?:github|gitea|forgejo)\/workflows\/[^/]+\.ya?ml$|(^|\/)\.github\/actions\/.+\/action\.ya?ml$|(^|\/)action\.ya?ml$|(^|\/)\.gitlab-ci\.ya?ml$|(^|\/)\.gitlab-ci\/.+\.ya?ml$|(^|\/)\.gitlab\/ci\/.+\.ya?ml$|(^|\/)azure-pipelines[\w.-]*\.ya?ml$|(^|\/)\.azure-pipelines\/.+\.ya?ml$|(^|\/)bitbucket-pipelines\.ya?ml$|(^|\/)\.circleci\/config\.ya?ml$|(^|\/)\.buildkite\/.+\.ya?ml$|(^|\/)Jenkinsfile(?:\.[\w-]+)?$/i;
+
+export function ciVendorOf(path        )                  {
+  const p = path.replace(/\\/g, '/');
+  if (!CI_PATH_RE.test(p)) return null;
+  if (/gitlab/i.test(p)) return 'gitlab';
+  if (/azure-pipelines/i.test(p)) return 'azure';
+  if (/bitbucket-pipelines/i.test(p)) return 'bitbucket';
+  if (/\.circleci\//i.test(p)) return 'circleci';
+  if (/\.buildkite\//i.test(p)) return 'buildkite';
+  if (/jenkinsfile/i.test(p)) return 'jenkins';
+  return 'github';
+}
+
+const AI_ACTIONS                                                      = [
+  { re: /^anthropics\/claude-code(?:-base)?-action\b/i, product: 'claude-code-action', kind: 'agent' },
+  { re: /^google-github-actions\/run-gemini-cli\b/i, product: 'run-gemini-cli', kind: 'agent' },
+  { re: /^openai\/codex-action\b/i, product: 'codex-action', kind: 'agent' },
+  { re: /^actions\/ai-inference\b/i, product: 'ai-inference', kind: 'model' },
+  { re: /^(?:qodo-ai|codium-ai)\/pr-agent\b/i, product: 'pr-agent', kind: 'reviewer' },
+  { re: /^coderabbitai\//i, product: 'coderabbit', kind: 'reviewer' },
+  { re: /(?:claude|gemini|codex|openai|anthropic|copilot|gpt|llm|ai[-_]?(?:review|agent|inference|assistant)|aider|openhands|cursor|qwen|opencode|mistral|ollama)/i, product: 'ai-action', kind: 'agent' },
+];
+
+const AI_CLI_RE =
+  /(?:^|[\s;&|(`$'"])(?:npx\s+(?:-y\s+|--yes\s+)?)?(?:@anthropic-ai\/claude-code|@openai\/codex|@google\/gemini-cli|@github\/copilot|@qwen-code\/qwen-code|opencode-ai|claude|codex|gemini|qwen|copilot|cursor-agent|aider|opencode|openhands|goose|kiro-cli|amp)(?:@[\w.-]+)?\s+(?:-{1,2}[a-z]|exec\b|run\b|chat\b|"|')|(?:^|[\s;&|])q\s+chat\b|(?:^|[\s;&|])agent\s+(?:-p|--print)\b/im;
+const MODEL_API_RE = /\b(?:api\.openai\.com|api\.anthropic\.com|generativelanguage\.googleapis\.com|models\.github\.ai|models\.inference\.ai\.azure\.com|api\.mistral\.ai|api\.groq\.com|openrouter\.ai\/api)\b/i;
+
+export function aiStepOf(uses               , run               )                {
+  if (uses) {
+    const repo = uses.replace(/^\.\//, '').split('@')[0];
+    for (const a of AI_ACTIONS) if (a.re.test(repo)) return { product: a.product, kind: a.kind };
+  }
+  if (run) {
+    const cli = AI_CLI_RE.exec(run);
+    if (cli) return { product: cli[0].replace(/^[\s;&|(`$'"]+/, '').split(/\s/).filter((w) => !/^(npx|-y|--yes)$/.test(w))[0].replace(/^@[\w-]+\//, '') || 'agent-cli', kind: 'agent' };
+    if (MODEL_API_RE.test(run)) return { product: 'model-api', kind: 'model' };
+  }
+  return null;
+}
+
+const MAX_JOBS = 100;
+const MAX_STEPS = 200;
+const obj = (v         )                             => (v && typeof v === 'object' && !Array.isArray(v) ? (v                       ) : null);
+const text = (v         )         => (v == null ? '' : typeof v === 'string' ? v : typeof v === 'object' ? safeJson(v) : String(v));
+function safeJson(v         )         {
+  try { return JSON.stringify(v) ?? ''; } catch { return ''; }
+}
+const strMap = (v         )                         =>
+  Object.fromEntries(Object.entries(obj(v) ?? {}).slice(0, 200).map(([k, x]) => [k, text(x)]));
+
+function githubTriggers(on         )           {
+  if (typeof on === 'string') return [on];
+  if (Array.isArray(on)) return on.map(String);
+  return Object.keys(obj(on) ?? {});
+}
+
+function readGithub(doc                     )                                        {
+
+  const triggers = githubTriggers(doc.on ?? doc.true ?? doc['"on"']).slice(0, 40);
+  const wfEnv = strMap(doc.env);
+  const jobs          = [];
+  const addJob = (id        , j                     ) => {
+    const jobEnv = strMap(j.env);
+    const steps           = [];
+    for (const [index, raw] of (Array.isArray(j.steps) ? j.steps : []).slice(0, MAX_STEPS).entries()) {
+      const s = obj(raw);
+      if (!s) continue;
+      const uses = typeof s.uses === 'string' ? s.uses.trim() : null;
+      const run = typeof s.run === 'string' ? s.run : null;
+      const w = strMap(s.with);
+      const env = strMap(s.env);
+      steps.push({
+        job: id, index, id: typeof s.id === 'string' ? s.id : null, uses, run, with: w, env,
+        if: s.if == null ? null : text(s.if),
+        ai: aiStepOf(uses, run ?? (w.script || null)),
+
+        inputText: [run ?? '', ...Object.entries(w).map(([k, v]) => `${k}: ${v}`), ...Object.values(env), ...Object.values(jobEnv), ...Object.values(wfEnv)].join('\n'),
+      });
+    }
+    jobs.push({ id, if: j.if == null ? null : text(j.if), permissions: j.permissions, steps });
+  };
+  for (const [id, j] of Object.entries(obj(doc.jobs) ?? {}).slice(0, MAX_JOBS)) if (obj(j)) addJob(id, j);
+
+  const runs = obj(doc.runs);
+  if (runs && Array.isArray(runs.steps)) addJob('composite', runs);
+  return { triggers, permissions: doc.permissions, jobs };
+}
+
+function readScripted(vendor          , src        , doc                            )                                        {
+  const scripts                                 = [];
+  const visit = (node         , job        , depth        ) => {
+    if (depth > 12 || scripts.length > MAX_STEPS) return;
+    if (Array.isArray(node)) { for (const x of node) visit(x, job, depth + 1); return; }
+    const o = obj(node);
+    if (!o) return;
+    for (const [k, v] of Object.entries(o)) {
+      if (/^(script|before_script|after_script|command|commands|run|bash|powershell|pwsh|inline_?script)$/i.test(k)) {
+        for (const line of Array.isArray(v) ? v : [v]) if (typeof line === 'string' || obj(line)) scripts.push({ job, run: typeof line === 'string' ? line : text(line) });
+      } else visit(v, depth === 0 ? k : job, depth + 1);
+    }
+  };
+  if (doc) visit(doc, 'pipeline', 0);
+  else scripts.push({ job: 'pipeline', run: src });
+  const triggers =
+    vendor === 'gitlab' ? (/merge_request_event|\$CI_MERGE_REQUEST_/.test(src) ? ['merge_request'] : ['push'])
+      : vendor === 'azure' ? (doc && 'pr' in doc ? ['pr'] : ['push'])
+        : vendor === 'bitbucket' ? (/pull-requests\s*:/.test(src) ? ['pull-requests'] : ['push'])
+          : ['push'];
+  const jobs = new Map               ();
+  for (const s of scripts) {
+    const job = jobs.get(s.job) ?? { id: s.job, if: null, permissions: undefined, steps: [] };
+    jobs.set(s.job, job);
+    job.steps.push({ job: s.job, index: job.steps.length, id: null, uses: null, run: s.run, with: {}, env: {}, if: null, ai: aiStepOf(null, s.run), inputText: s.run });
+  }
+  return { triggers, permissions: undefined, jobs: [...jobs.values()].slice(0, MAX_JOBS) };
+}
+
+export function ciWorkflowModel(path        , src        )                    {
+  const vendor = ciVendorOf(path);
+  if (!vendor) return null;
+  if (vendor === 'jenkins') return { vendor, parsed: false, ...readScripted(vendor, src, null) };
+  const doc = obj(parseYaml(src));
+  if (!doc) return { vendor, parsed: false, ...readScripted(vendor, src, null) };
+  return { vendor, parsed: true, ...(vendor === 'github' ? readGithub(doc) : readScripted(vendor, src, doc)) };
+}
+
+export const PRIVILEGED_UNTRUSTED_TRIGGERS = new Set([
+  'issue_comment', 'issues', 'pull_request_target', 'discussion', 'discussion_comment', 'workflow_run',
+]);
+
+export const UNPRIVILEGED_UNTRUSTED_TRIGGERS = new Set([
+  'pull_request', 'pull_request_review', 'pull_request_review_comment', 'merge_request', 'pr', 'pull-requests',
+]);
+
+const EXPRESSION_RE = /\$\{\{([^}]{1,400})\}\}/g;
+const UNTRUSTED_BODY_RE =
+  /\bgithub\.event\.(?:issue|comment|pull_request|discussion|review|review_comment|head_commit|workflow_run)\b[\w.*[\]]{0,120}\.(?:body|title|message|label|name|ref|head_branch|display_title|default_branch|email)\b|\bgithub\.event\.(?:commits|pages)\b|\bgithub\.head_ref\b|\btoJSON\(\s*github\.event\s*(?:\.\s*(?:issue|comment|pull_request|discussion|review)\s*)?\)/i;
+const WRITER_BODY_RE = /\b(?:inputs|github\.event\.inputs)\.[\w-]+/;
+const CI_VARIABLE_RE =
+  /\$\{?CI_(?:MERGE_REQUEST_(?:TITLE|DESCRIPTION|SOURCE_BRANCH_NAME)|COMMIT_(?:MESSAGE|TITLE|DESCRIPTION|REF_NAME|BRANCH))\b\}?|\$\((?:System\.PullRequest\.(?:SourceBranch|Title|Description)|Build\.SourceVersionMessage)\)/g;
+
+function expressions(src        , body        )           {
+  const out = new Set        ();
+  for (const m of src.slice(0, 2_000_000).matchAll(EXPRESSION_RE)) {
+    if (body.test(m[1])) out.add(m[0]);
+    if (out.size >= 20) break;
+  }
+  return [...out];
+}
+
+export function untrustedRefs(src                           )           {
+  if (!src) return [];
+  return [...new Set([...expressions(src, UNTRUSTED_BODY_RE), ...(src.slice(0, 2_000_000).match(CI_VARIABLE_RE) ?? [])])].slice(0, 20);
+}
+
+export function writerRefs(src                           )           {
+  return src ? expressions(src, WRITER_BODY_RE) : [];
+}
+
+export const ACTOR_GATE_RE =
+  /author_association|github\.(?:triggering_)?actor\b|github\.event\.sender\.login|\.labels\.\*\.name|github\.event\.label\.name|head\.repo\.fork\s*==\s*false|head\.repo\.full_name\s*==\s*github\.repository|getCollaboratorPermissionLevel|permission(?:-level)?\s*==\s*['"](?:admin|write|maintain)/i;
+export const PERMISSION_CHECK_ACTION_RE = /check-(?:user-)?permission|check-actor-permission|actor-permission|user-permission/i;
+
+export const MODEL_SECRET_RE = /^(?:ANTHROPIC_API_KEY|CLAUDE_CODE_OAUTH_TOKEN|OPENAI_API_KEY|OPENAI_KEY|GEMINI_API_KEY|GOOGLE_API_KEY|GOOGLE_GENERATIVE_AI_API_KEY|AZURE_OPENAI_(?:API_)?KEY|MISTRAL_API_KEY|GROQ_API_KEY|OPENROUTER_API_KEY|GITHUB_TOKEN|DEEPSEEK_API_KEY|XAI_API_KEY|DASHSCOPE_API_KEY)$/i;
+

package/src/detect/signals/gate.mjs

@@ -5,12 +5,16 @@ import { INSTALL_LURE } from './packages.mjs';
 import { localPropagation } from './propagation.mjs';
 import { downrankCodeContext, localScan } from './scan.mjs';
 import { grade } from './severity.mjs';
-
-const INSTRUCTION_BASENAMES = new Set([
-  'claude.md', 'agents.md', 'agent.md', 'gemini.md', 'llms.txt', 'llms-full.txt',
-  '.cursorrules', '.windsurfrules', '.clinerules', '.aiderrules', '.continuerules',
-  '.goosehints', 'copilot-instructions.md', 'conventions.md',
-]);
+import { isModelConfigPath, localModelConfig } from './model-config.mjs';
+import { isInstructionPath } from './instruction-paths.mjs';
+import { PLUGIN_MANIFEST_RE, TOOL_MANIFEST_RE, localExtension, localPlugin, localToolManifest } from './manifests.mjs';
+import { agenticCiFindings } from './agentic-ci-surface.mjs';
+import { ciVendorOf } from './ci-workflow.mjs';
+import { guardrailConfigFindings } from './guardrail-surface.mjs';
+import { guardrailFramework } from './guardrail-shape.mjs';
+import { frameworkFindings } from './agent-graph-surface.mjs';
+import { agentFrameworkOf } from './agent-frameworks.mjs';
+import { classifyMemoryPath } from './memory-locations.mjs';
 
 const MEMORY_BASENAMES = new Set(['memory.md', 'mem0.json', 'letta_memory.json', 'memgpt_memory.json']);
 
@@ -25,15 +29,41 @@ function governedKindFor(kind, path) {
   const lower = String(path ?? '').split(/[\\/]+/).join('/').toLowerCase();
   if (!lower) return null;
   const base = lower.slice(lower.lastIndexOf('/') + 1);
-  if (INSTRUCTION_BASENAMES.has(base) || /(^|\/)\.github\/copilot-instructions\.md$/.test(lower) ||
-      /(^|\/)\.cursor\/rules\/.+\.mdc$/.test(lower) || (/(^|\/)\.clinerules\//.test(lower) && lower.endsWith('.md'))) return 'INSTRUCTION';
+  if (classifyMemoryPath(lower)) return 'MEMORY';
+  if (isInstructionPath(lower)) return 'INSTRUCTION';
   if (MEMORY_BASENAMES.has(base) || /(^|\/)(\.mem0|\.letta|\.memgpt|memory)\//.test(lower)) return 'MEMORY';
   return null;
 }
 
+function guardrailOf(kind, path, content) {
+  if (kind !== 'guardrail' && kind !== 'auto' && kind !== undefined) return null;
+  const p = String(path ?? '').replace(/\\/g, '/');
+  const candidates = kind === 'guardrail' ? [p, 'guardrails/config.yml', 'guardrails/config.json'].filter(Boolean) : [p];
+  for (const c of candidates) {
+    const framework = guardrailFramework(c, content || '');
+    if (framework) return { framework, path: c };
+  }
+  return null;
+}
+
+const LOW_CODE = new Set(['langflow', 'flowise', 'dify']);
+
+function frameworkOf(kind, path, content) {
+  if (kind !== 'framework' && kind !== 'auto' && kind !== undefined) return null;
+  const p = String(path ?? '').replace(/\\/g, '/');
+  if (ciVendorOf(p)) return null;
+  const candidates = kind === 'framework' ? [p, 'flow.json', 'agents.yaml'].filter(Boolean) : [p];
+  for (const c of candidates) {
+    const framework = agentFrameworkOf(c, content || '');
+    if (framework) return { framework, path: c };
+  }
+  return null;
+}
+
 export function localGate(content, { kind, path } = {}) {
   const findings = [];
   const push = (severity, title, remediationText, line) => findings.push({ severity, title, remediationText, ...(line ? { line } : {}) });
+  const framework = frameworkOf(kind, path, content);
 
   const gov = governedKindFor(kind, path);
   if (gov) {
@@ -43,9 +73,15 @@ export function localGate(content, { kind, path } = {}) {
   } else {
     const scan = localScan(content || '', { categories: ['shell', 'injection', 'secret', 'config', 'egress', 'pii'] });
     const graded = isSourceFile(path) ? downrankCodeContext(scan.findings) : scan.findings;
+    const manifest = kind === 'plugin' || kind === 'tool-manifest' || PLUGIN_MANIFEST_RE.test(String(path ?? '').replace(/\\/g, '/')) || TOOL_MANIFEST_RE.test(String(path ?? '').replace(/\\/g, '/'));
+    const lines = manifest ? String(content || '').split(/\r?\n/) : [];
     for (const f of graded) {
 
       if ((kind === 'agent-card' || kind === 'mcp') && f.category === 'pii' && f.label.includes('IPv4')) continue;
+      if (manifest && f.category === 'pii' && /e-?mail/i.test(f.label) && /"(?:e-?mail|contact_email)"\s*:/i.test(lines[(f.line ?? 0) - 1] ?? '')) continue;
+      if (kind === 'mcp' && /auto.?approv|always.?allow/i.test(f.label)) continue;
+      if (f.category === 'injection' && guardrailOf(kind, path, content)) continue;
+      if (f.category !== 'secret' && LOW_CODE.has(framework?.framework)) continue;
       push(f.severity, f.label, undefined, f.line);
     }
   }
@@ -82,10 +118,42 @@ export function localGate(content, { kind, path } = {}) {
     }
   }
 
-  if (['mcp', 'auto', undefined].includes(kind)) for (const f of localMcp(content || '')) push(f.severity, f.title, f.remediationText, f.line);
+  if (['mcp', 'auto', undefined].includes(kind)) for (const f of localMcp(content || '', { path })) push(f.severity, f.title, f.remediationText, f.line);
+  if (kind === 'model-config' || (['auto', undefined].includes(kind) && isModelConfigPath(path, content))) {
+    for (const f of localModelConfig(content || '', { path })) push(f.severity, f.title, f.remediationText, f.line);
+  }
   if (['agent-card', 'auto', undefined].includes(kind)) for (const f of localAgentCard(content || '')) push(f.severity, f.title, f.remediationText, f.line);
   if (['command', 'auto', undefined].includes(kind)) for (const f of localCommandExtras(content || '')) push(f.severity, f.title, f.remediationText, f.line);
 
+  const auto = kind === 'auto' || kind === undefined;
+  const lowerPath = String(path ?? '').replace(/\\/g, '/');
+  if (kind === 'plugin' || (auto && PLUGIN_MANIFEST_RE.test(lowerPath))) {
+    for (const f of localPlugin(content || '', { path })) push(f.severity, f.title, f.remediationText, f.line);
+  }
+  if (kind === 'tool-manifest' || (auto && TOOL_MANIFEST_RE.test(lowerPath))) {
+    for (const f of localToolManifest(content || '', { path })) push(f.severity, f.title, f.remediationText, f.line);
+  }
+  if (kind === 'extension' || (auto && /(^|\/)(manifest|mcpb|dxt)\.json$/i.test(lowerPath))) {
+    for (const f of localExtension(content || '', { path })) push(f.severity, f.title, f.remediationText, f.line);
+  }
+  if (kind === 'workflow' || (auto && ciVendorOf(lowerPath))) {
+    const wfPath = ciVendorOf(lowerPath) ? lowerPath : '.github/workflows/workflow.yml';
+    for (const f of agenticCiFindings({ kind: 'AGENT_WORKFLOW', path: wfPath, name: wfPath.split('/').pop(), content: content || '' })) {
+      push(f.severity, f.title, f.remediationText, f.evidence?.line);
+    }
+  }
+  const guard = guardrailOf(kind, path, content);
+  if (guard) {
+    for (const f of guardrailConfigFindings({ kind: 'GUARDRAIL_CONFIG', path: guard.path, name: guard.path.split('/').pop(), content: content || '', meta: { framework: guard.framework } })) {
+      push(f.severity, f.title, f.remediationText, f.evidence?.line);
+    }
+  }
+  if (framework) {
+    for (const f of frameworkFindings({ kind: 'AGENT_WORKFLOW', path: framework.path, name: framework.path.split('/').pop(), content: content || '', meta: { framework: framework.framework } })) {
+      push(f.severity, f.title, f.remediationText, f.evidence?.line);
+    }
+  }
+
   const seenTitle = new Set();
   const deduped = findings.filter((f) => (seenTitle.has(f.title) ? false : (seenTitle.add(f.title), true)));
   findings.length = 0;