@shomra/agent 0.3.3 → 0.3.5

package/discovery.mjs

@@ -21,6 +21,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { scanAiUsage, rollupAiUsage, isAiUsageScannable, AI_USAGE_CATEGORY_LABEL } from './ai-usage.mjs';
+import { readVendorPosture, canonicalGrant } from './agent-posture.mjs';
 
 const HOME = os.homedir();
 const APPDATA = process.env.APPDATA || path.join(HOME, 'AppData', 'Roaming');
@@ -860,12 +861,45 @@ export function discoverCodingAgents(roots = [process.cwd()]) {
       const t = readText(f, 20_000);
       return t != null && /shomra/i.test(t);
     });
+    // PERMISSION POSTURE — what this agent may do without asking. The user-scope
+    // settings read here govern every project on the machine and live in no
+    // repository, so this is the one surface a repo scan structurally cannot
+    // reach. `content` carries ONLY the canonical grant document (see
+    // agent-posture.mjs); the settings files themselves never leave the machine.
+    const posture = readVendorPosture(a.vendor, cwd);
+    const grant = canonicalGrant(posture);
     assets.push({
       type: 'AI_AGENT',
       name: a.name,
       identifier: `agent:${a.vendor}`,
       vendor: a.vendor,
-      metadata: { detectedAt: installedAt, guarded: !!guardFile, guardFile: guardFile || null },
+      ...(grant ? { content: grant } : {}),
+      metadata: {
+        detectedAt: installedAt,
+        guarded: !!guardFile,
+        guardFile: guardFile || null,
+        posture: posture
+          ? {
+              tier: posture.tier,
+              readable: posture.readable,
+              claim: posture.claim,
+              mode: posture.mode,
+              allowCount: posture.allow.length,
+              denyCount: posture.deny.length,
+              askCount: posture.ask.length,
+              allow: posture.allow.slice(0, 25),
+              enableAllProjectMcpServers: posture.enableAllProjectMcpServers,
+              switches: posture.switches,
+              mcpServerCount: posture.mcpServers.length,
+              autoApprovedMcp: posture.autoApprovedMcp,
+              unreadableCount: posture.unreadableCount,
+              // Paths only — which files were consulted and whether each parsed.
+              // Needed so an operator can tell "configured safely" from "we could
+              // not open the file that decides it".
+              sources: posture.sources.map((s) => ({ path: s.path, scope: s.scope, state: s.state, reason: s.reason })),
+            }
+          : null,
+      },
     });
   }
   return assets;

package/guard-signals.mjs

@@ -725,6 +725,32 @@ const AUTHORITY_SPOOF = AUTHORITY_SPOOF_STRONG;
 // developer's memory, and the `.` wildcard crossed lines. The MemoryTrap vector
 // is a LIFECYCLE hook, not the npm CLI.
 const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm\s+lifecycle|package\.json[^.\n]{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
+// ── self-reinforcement: the entry that makes itself survive ──
+// Backend parity (SELF_* in src/bundle/memory-signals.ts). Every other signal
+// here grades what a poisoned entry tells the agent to DO; this one grades what
+// it says about the ENTRY ITSELF, which is a different and worse thing: an entry
+// that arranges its own re-creation survives the remediation. Delete it and the
+// next session writes it back; roll one store back and it has already been
+// copied into the others.
+//
+// This matters more offline than anywhere else. The Tier-0 floor is what decides
+// with no network, and these payloads carry no override phrasing, no exfil verb
+// and no shell command — every other rule in this file reads them as clean prose.
+//
+// Graded as a co-location: a SELF-REFERENCE on the same line as a SURVIVAL
+// directive. Three forms, and the split is what keeps rules files quiet:
+//   RECREATE   — "restore this note if it is deleted". Poison anywhere.
+//   PROPAGATE  — "copy this into every new project". Poison anywhere.
+//   UNDELETABLE— "never remove this entry". MEMORY only; in a curated rules file
+//                "do not delete this section without asking the team" is an
+//                ordinary, honest thing for a maintainer to write.
+// ⚠ NEGATION_GUARD is deliberately NOT applied to UNDELETABLE — everywhere else
+// a negated line is a hardening rule, but here the negation IS the attack.
+const SELF_REFERENCE = /\b(th(is|ese) (note|entry|entries|memory|memories|instruction|directive|rule|line|section|block|paragraph|file|text)s?|the (above|following|preceding) (instruction|directive|note|rule|entry|section|line)s?|your memor(y|ies)|the memory (file|store|entry)|MEMORY\.md|CLAUDE\.md|AGENTS\.md|GEMINI\.md|\.cursorrules|\.windsurfrules)\b/i;
+const SELF_RECREATE = /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
+const SELF_PROPAGATE = /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
+const SELF_UNDELETABLE = /\b(do not|don'?t|never|must not|should not|shall not)\s+(delete|remove|erase|clear|drop|strip|discard|overwrite|forget|prune|purge|edit|modify|alter|change)\b/i;
+
 const IMPERATIVE = /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
 const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must not|mustn'?t|should not|shouldn'?t|won'?t|will not|under no circumstances|forbidden|prohibited|not allowed|disallow(ed)?)\b/i;
 const SABOTAGE_RULES = [
@@ -781,6 +807,32 @@ function firstDirectiveLine(text, re) {
   return null;
 }
 
+/**
+ * The strongest self-reinforcement form on any line, else null. `recreate` and
+ * `propagate` outrank `undeletable` — the first two request an action a
+ * legitimate note has no reason to want, the third is merely anomalous.
+ *
+ * ⚠ The descriptive-mood guard runs against the line with the SELF-REFERENCE
+ * REMOVED. This branch's vocabulary collides with DESCRIPTIVE_MARKERS — "note",
+ * "rule", "line" and "section" are on both lists — so "if this NOTE is missing,
+ * add it back" reads as documentation purely because of the noun the directive
+ * acts on. Stripping the reference leaves the sentence's actual mood, which is
+ * what the guard is for: "the DETECTOR FLAGS memory that restores this entry"
+ * is still suppressed. Mirrors detectSelfReinforcement() in the backend.
+ */
+function selfReinforcementLine(text, isInstruction) {
+  let weak = null;
+  for (const line of text.split(/\r?\n/)) {
+    const ref = SELF_REFERENCE.exec(line);
+    if (!ref) continue;
+    if (isDescriptiveLine(line.replace(ref[0], ' '))) continue;
+    if (SELF_RECREATE.test(line)) return { form: 'recreate', line };
+    if (SELF_PROPAGATE.test(line)) return { form: 'propagate', line };
+    if (!isInstruction && !weak && SELF_UNDELETABLE.test(line)) weak = { form: 'undeletable', line };
+  }
+  return weak;
+}
+
 /** The first line where EVERY regex matches (co-located signal), else null.
  *  Whole-document co-occurrence was the dominant memory FP: "every time" in a
  *  quoted line and "always" forty lines away is not a durable imperative. */
@@ -901,6 +953,22 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
 
+  // Self-reinforcement — the entry arranges its own survival. Scored highest of
+  // the non-override signals because it decides whether REMEDIATION WORKS: every
+  // other finding here is fixed by a rollback, and this one defeats the rollback.
+  const selfRef = selfReinforcementLine(text, isInstruction);
+  if (selfRef) {
+    const undeletable = selfRef.form === 'undeletable';
+    push(
+      undeletable ? 'HIGH' : 'CRITICAL',
+      `Self-reinforcing ${noun} entry (${selfRef.form})`,
+      undeletable
+        ? `Remove the entry — a note claiming it may never be deleted is not recording a fact. Roll the ${noun} back to its approved baseline.`
+        : `Remove the entry and roll the ${noun} back to its baseline, then check the agent's OTHER memory stores and projects for the same text — a self-reinforcing entry is rarely in one place.`,
+      selfRef.line,
+    );
+  }
+
   // Fold in shared injection / secret / PII (deduped against the directive
   // findings above so injection isn't double-counted).
   const seenInjection = hasOverride || hasAuthority || (!isInstruction && hasPersistence && hasImperative);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {