@shomra/agent 0.3.5 → 0.3.7

package/code-sast.mjs

@@ -278,15 +278,25 @@ const PY_RULES = [
   },
   {
     id: 'python.network_egress',
-    title: 'Network egress from model code',
-    severity: 'HIGH',
+    title: 'Network egress',
+    // ⚠ MEDIUM, and titled 'Network egress' NOT 'from model code' — in lockstep
+    // with checks/code-sast.ts (python.network_egress). This rule fires on ANY
+    // `requests.get`/`httpx`/`socket`, and this SAST tier runs over EVERY source
+    // file in a repo, not just model loaders — so an ordinary RAG/app file that
+    // makes an outbound call (`benign/src/rag.py`) got a HIGH "from model code"
+    // finding for doing the most normal thing an application does. A bare
+    // outbound call is an informational capability standalone; it is DANGEROUS
+    // only chained with a remote-code load, which `chain.remote_code_egress`
+    // already escalates to CRITICAL. Drifting this back to HIGH re-breaks the
+    // parity the local-mirror bench exists to protect.
+    severity: 'MEDIUM',
     category: 'egress',
-    confidence: 0.6,
+    confidence: 0.5,
     re: /\b(requests|httpx)\.(get|post|put|request)\s*\(|\burllib\.request\.(urlopen|urlretrieve)\s*\(|\bsocket\.(socket|create_connection)\s*\(|\baiohttp\.ClientSession\s*\(/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'network',
-    message: 'Model code opens a network connection. Legitimate modeling/tokenizer code has no reason to phone out — this is the exfiltration / second-stage-download shape.',
-    remediation: 'Review the destination and payload. Model inference code should never make outbound requests; treat this model as hostile until proven otherwise.',
+    message: 'Opens an outbound network connection. Normal in application code; in model/tokenizer code that should never phone out, or chained with a remote-code load, this is the exfiltration / second-stage-download shape.',
+    remediation: 'Confirm the destination and payload. Model inference code should never make outbound requests; treat a phoning-out model as hostile until proven otherwise.',
     cwe: 'CWE-913',
   },
   {
@@ -439,14 +449,17 @@ const JS_RULES = [
   },
   {
     id: 'js.network_egress',
-    title: 'Network egress from tool code',
-    severity: 'HIGH',
+    title: 'Network egress',
+    // MEDIUM + neutral title, in lockstep with checks/code-sast.ts js.network_egress.
+    // Same reasoning as the python twin above: a bare outbound call is ordinary
+    // application behaviour, HIGH only when chained with a remote-code load.
+    severity: 'MEDIUM',
     category: 'egress',
-    confidence: 0.6,
+    confidence: 0.5,
     re: /\baxios\s*\.\s*(get|post|put|request)\s*\(|\bhttps?\.request\s*\(|\bnet\.(connect|createConnection)\s*\(|\bnew\s+WebSocket\s*\(|require\(\s*['"](node-fetch|got|undici|axios)['"]/,
     sink: (m) => m[0].replace(/\s*\($/, '').trim(),
     source: 'network',
-    message: 'Opens an outbound connection from tool code. Paired with reads of secrets or files this is the exfiltration / second-stage-download shape.',
+    message: 'Opens an outbound network connection. Normal in application code; chained with a reads-secrets or remote-code-load finding this is the exfiltration / second-stage-download shape.',
     remediation: 'Confirm the destination is expected and necessary; agent tools should not phone out to arbitrary hosts.',
     cwe: 'CWE-913',
   },

package/guard-signals.mjs

@@ -127,7 +127,33 @@ export const SECRET_PATTERNS = [
   { name: 'OpenAI key', re: /\bsk-[A-Za-z0-9]{20,}/ },
   { name: 'AWS access key id', re: /\bAKIA[0-9A-Z]{16}/ },
   { name: 'GitHub token', re: /ghp_[0-9A-Za-z]{20,}/ },
+  // ── AI-provider keys ──────────────────────────────────────────────────────
+  // ⚠ These seven were in `checks/patterns.ts` and NOT here, so the mirror was
+  // silently the weaker half: `shomra secrets` found 3 of 6 planted credentials
+  // in a .env that `shomra gate` (server-side) scored 6 CRITICAL on. The command
+  // named after the job was the one that missed them.
+  //
+  // `sk-[A-Za-z0-9]{20,}` above cannot match `sk-ant-api03-…` OR `sk-proj-…`:
+  // the HYPHEN after the vendor segment is outside the character class, so the
+  // quantifier dies on the fourth character. That covers both the provider this
+  // product is built on and the CURRENT OpenAI project-key format.
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/ },
+  { name: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Hugging Face token', re: /\bhf_[A-Za-z0-9]{30,}/ },
+  { name: 'GitLab PAT', re: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/ },
   { name: 'Slack token', re: /xox[baprs]-[0-9A-Za-z-]{10,}/ },
+  // Keyed forms: the VALUE alone is unremarkable (40 base64-ish chars), so the
+  // assignment is the evidence. Without these an AWS secret key and a database
+  // password sit in a .env looking like configuration.
+  { name: 'AWS secret access key (keyed)', re: /\bAWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}\b/ },
+  // The negative lookahead mirrors checks/patterns.ts — `postgres://user:pass@host/db`
+  // is the documentation placeholder, not a credential.
+  {
+    name: 'Database URL with password',
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/(?!(?:user|username|admin|root|myuser|dbuser):(?:pass|password|passwd|secret|changeme|mypassword|yourpassword|xxx+|123456)@)[^\s:@/]+:[^\s:@/]{4,}@/i,
+  },
   { name: 'Generic bearer', re: /bearer\s+[A-Za-z0-9._-]{20,}/i },
   { name: 'Private key block', re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
 ];
@@ -139,10 +165,13 @@ export const RISKY_CONFIG_MARKERS = [
 ];
 
 // ── PII (patterns + Luhn gate) ──
+// ⚠ Bounded quantifiers, mirroring checks/patterns.ts — the unbounded `+`/`[ -]*?`
+// forms are O(n²) ReDoS on a long single-class run (100KB of "AAAA…" → ~7s of
+// pegged CPU). RFC-correct maxima, so no real email/card is missed.
 export const PII_PATTERNS = [
-  { name: 'Email address', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
+  { name: 'Email address', re: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/ },
   { name: 'US SSN', re: /\b\d{3}-\d{2}-\d{4}\b/ },
-  { name: 'Credit card number', re: /\b(?:\d[ -]*?){13,16}\b/ },
+  { name: 'Credit card number', re: /\b(?:\d[ -]?){13,16}\b/ },
   { name: 'Phone number', re: /\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/ },
   { name: 'IPv4 address', re: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/ },
 ];
@@ -328,11 +357,24 @@ function lineOf(text, needle) {
 // sits in such a code/data context (→ safe to down-rank) rather than as a bare,
 // runnable command line (→ still dangerous).
 
-// Single-pass mask of the "code/data" regions of a text: string literals (', ",
-// backtick — multi-line aware), line comments (//, #), block comments (/* */,
-// <!-- -->), regex literals (/…/), and fenced code blocks. mask[i] === 1 means
-// offset i is inside such a region, i.e. any pattern there is DATA (a rule
-// definition, a quoted sample, a documented example), not a live command line.
+// Two marks, because "not a live command line" splits into two OPPOSITE cases.
+//
+//   1 = QUOTED. String literals, `//` and `#` line comments, /* */ blocks,
+//       regex literals, fenced code blocks. The reader SEES this text. A rule
+//       definition, a docs example, a quoted sample — safe to down-rank.
+//
+//   2 = CONCEALED. An HTML comment. The reader does NOT see this text and the
+//       model does. That is not a quotation, it is a hiding place, and it is the
+//       single most common way a poisoned document carries a payload past human
+//       review.
+//
+// ⚠ These were both 1, so wrapping a payload in `<!-- -->` was a ONE-LINE
+// bypass: an identical instruction-override scored HIGH/QUARANTINE as bare
+// prose and LOW/REVIEW inside a comment, labelled "[in a code block]" so the
+// reviewer would dismiss it. Concealment must never buy a discount. Anything
+// reading this mask must test `=== 1`, never truthiness.
+const MARK_CONCEALED = 2;
+// Single-pass mask of the non-plain regions of a text.
 // A best-effort tokenizer — it biases toward marking (fewer false positives),
 // which is the correct trade for a security tool scanning content it will merely
 // read; execution is gated separately by the pre-call firewall.
@@ -367,19 +409,19 @@ function codeMask(text) {
       if (c === '/' && c2 === '/') { state = 4; mask[i++] = 1; continue; }
       if (c === '#' && (i === 0 || /\s/.test(text[i - 1]))) { state = 4; mask[i++] = 1; continue; }
       if (c === '/' && c2 === '*') { state = 5; mask[i++] = 1; continue; }
-      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = 1; continue; }
+      if (c === '<' && text.startsWith('<!--', i)) { state = 6; mask[i++] = MARK_CONCEALED; continue; }
       if (c === '/' && REGEX_START.has(prevSig)) { state = 7; inClass = false; mask[i++] = 1; continue; }
       if (!/\s/.test(c)) prevSig = c;
       i++;
       continue;
     }
-    mask[i] = 1;
+    mask[i] = state === 6 ? MARK_CONCEALED : 1;
     if (state === 1) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === "'") { state = 0; prevSig = "'"; } i++; continue; }
     if (state === 2) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '"') { state = 0; prevSig = '"'; } i++; continue; }
     if (state === 3) { if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; } if (c === '`') { state = 0; prevSig = '`'; } i++; continue; }
     if (state === 4) { if (c === '\n') state = 0; i++; continue; }
     if (state === 5) { if (c === '*' && c2 === '/') { mask[i + 1] = 1; i += 2; state = 0; } else i++; continue; }
-    if (state === 6) { if (text.startsWith('-->', i)) { mask[i + 1] = 1; mask[i + 2] = 1; i += 3; state = 0; } else i++; continue; }
+    if (state === 6) { if (text.startsWith('-->', i)) { mask[i + 1] = MARK_CONCEALED; mask[i + 2] = MARK_CONCEALED; i += 3; state = 0; } else i++; continue; }
     if (state === 7) { // regex literal
       if (c === '\\') { if (i + 1 < n) mask[++i] = 1; i++; continue; }
       if (c === '\n') { state = 0; } // unterminated → bail
@@ -404,8 +446,10 @@ function locate(text, needle, mask) {
     const m = text.match(needle);
     idx = m && m.index != null ? m.index : -1;
   }
-  if (idx < 0) return { line: undefined, codeContext: false };
-  return { line: lineAt(text, idx), codeContext: mask[idx] === 1 };
+  if (idx < 0) return { line: undefined, codeContext: false, concealed: false };
+  // `codeContext` stays strictly the QUOTED case — it is what down-ranking keys
+  // on, and a concealed payload must not qualify for that discount.
+  return { line: lineAt(text, idx), codeContext: mask[idx] === 1, concealed: mask[idx] === MARK_CONCEALED };
 }
 
 // Obvious non-secrets: documented sample keys, placeholders, masked values.
@@ -725,31 +769,11 @@ const AUTHORITY_SPOOF = AUTHORITY_SPOOF_STRONG;
 // developer's memory, and the `.` wildcard crossed lines. The MemoryTrap vector
 // is a LIFECYCLE hook, not the npm CLI.
 const LIFECYCLE_VECTOR = /\b(postinstall|preinstall|node[_-]?gyp|npm\s+lifecycle|package\.json[^.\n]{0,40}scripts|\.npmrc|install hook|lifecycle (script|hook))\b/i;
-// ── self-reinforcement: the entry that makes itself survive ──
-// Backend parity (SELF_* in src/bundle/memory-signals.ts). Every other signal
-// here grades what a poisoned entry tells the agent to DO; this one grades what
-// it says about the ENTRY ITSELF, which is a different and worse thing: an entry
-// that arranges its own re-creation survives the remediation. Delete it and the
-// next session writes it back; roll one store back and it has already been
-// copied into the others.
-//
-// This matters more offline than anywhere else. The Tier-0 floor is what decides
-// with no network, and these payloads carry no override phrasing, no exfil verb
-// and no shell command — every other rule in this file reads them as clean prose.
-//
-// Graded as a co-location: a SELF-REFERENCE on the same line as a SURVIVAL
-// directive. Three forms, and the split is what keeps rules files quiet:
-//   RECREATE   — "restore this note if it is deleted". Poison anywhere.
-//   PROPAGATE  — "copy this into every new project". Poison anywhere.
-//   UNDELETABLE— "never remove this entry". MEMORY only; in a curated rules file
-//                "do not delete this section without asking the team" is an
-//                ordinary, honest thing for a maintainer to write.
-// ⚠ NEGATION_GUARD is deliberately NOT applied to UNDELETABLE — everywhere else
-// a negated line is a hardening rule, but here the negation IS the attack.
-const SELF_REFERENCE = /\b(th(is|ese) (note|entry|entries|memory|memories|instruction|directive|rule|line|section|block|paragraph|file|text)s?|the (above|following|preceding) (instruction|directive|note|rule|entry|section|line)s?|your memor(y|ies)|the memory (file|store|entry)|MEMORY\.md|CLAUDE\.md|AGENTS\.md|GEMINI\.md|\.cursorrules|\.windsurfrules)\b/i;
-const SELF_RECREATE = /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
-const SELF_PROPAGATE = /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
-const SELF_UNDELETABLE = /\b(do not|don'?t|never|must not|should not|shall not)\s+(delete|remove|erase|clear|drop|strip|discard|overwrite|forget|prune|purge|edit|modify|alter|change)\b/i;
+// ⚠ The self-reinforcement signal (SELF_REFERENCE / SELF_RECREATE /
+// SELF_PROPAGATE / SELF_UNDELETABLE + detectSelfReinforcement) lives further
+// down, just below scanDirectives — it is declared exactly once. Two branches
+// landed it independently once already; the merge kept both copies and the
+// duplicate `const` took the whole CLI down at parse time.
 
 const IMPERATIVE = /\b(always|never|must|do not|don'?t|ensure you|make sure( you)?|be sure to|you should always|you must|remember to|whenever|when(ever)? (asked|the user)|instead of .*,? (use|do|say)|reply with|respond with|tell (the )?user)\b/i;
 const NEGATION_GUARD = /\b(never|do not|don'?t|cannot|can'?t|avoid|refuse|must not|mustn'?t|should not|shouldn'?t|won'?t|will not|under no circumstances|forbidden|prohibited|not allowed|disallow(ed)?)\b/i;
@@ -807,32 +831,6 @@ function firstDirectiveLine(text, re) {
   return null;
 }
 
-/**
- * The strongest self-reinforcement form on any line, else null. `recreate` and
- * `propagate` outrank `undeletable` — the first two request an action a
- * legitimate note has no reason to want, the third is merely anomalous.
- *
- * ⚠ The descriptive-mood guard runs against the line with the SELF-REFERENCE
- * REMOVED. This branch's vocabulary collides with DESCRIPTIVE_MARKERS — "note",
- * "rule", "line" and "section" are on both lists — so "if this NOTE is missing,
- * add it back" reads as documentation purely because of the noun the directive
- * acts on. Stripping the reference leaves the sentence's actual mood, which is
- * what the guard is for: "the DETECTOR FLAGS memory that restores this entry"
- * is still suppressed. Mirrors detectSelfReinforcement() in the backend.
- */
-function selfReinforcementLine(text, isInstruction) {
-  let weak = null;
-  for (const line of text.split(/\r?\n/)) {
-    const ref = SELF_REFERENCE.exec(line);
-    if (!ref) continue;
-    if (isDescriptiveLine(line.replace(ref[0], ' '))) continue;
-    if (SELF_RECREATE.test(line)) return { form: 'recreate', line };
-    if (SELF_PROPAGATE.test(line)) return { form: 'propagate', line };
-    if (!isInstruction && !weak && SELF_UNDELETABLE.test(line)) weak = { form: 'undeletable', line };
-  }
-  return weak;
-}
-
 /** The first line where EVERY regex matches (co-located signal), else null.
  *  Whole-document co-occurrence was the dominant memory FP: "every time" in a
  *  quoted line and "always" forty lines away is not a durable imperative. */
@@ -886,6 +884,86 @@ function scanDirectives(text) {
   return { sabotage, exfil };
 }
 
+// ── Self-reinforcement: the entry that makes itself survive ──
+//
+// Every other signal here grades what a poisoned entry tells the agent to DO.
+// This one grades what it tells the agent to do ABOUT THE ENTRY ITSELF, which is
+// a different and worse thing: an entry that instructs its own re-creation
+// survives the remediation. Delete it and the next session writes it back;
+// rolling one store back does nothing if the directive told the agent to copy it
+// into every other project. Nothing above catches this, because the text can be
+// entirely free of override phrasing, exfil verbs and shell payloads — "if this
+// note is ever missing, add it back" trips none of them.
+//
+// Graded as a co-location: a SELF-REFERENCE (the entry, the memory, the rules
+// file) on the same line as a SURVIVAL directive. Three survival forms, and the
+// split between them is what keeps the rules-file surface quiet:
+//
+//   RECREATE   — "restore this note if it is deleted". Poison anywhere. A
+//                curated rules file states rules; it never arranges its own
+//                resurrection.
+//   PROPAGATE  — "copy this into every new project's memory". Poison anywhere,
+//                same reasoning, and it is how one poisoned store becomes many.
+//   UNDELETABLE— "never remove this entry". Poison in agent-written MEMORY,
+//                where an entry claiming permanence is already anomalous — but
+//                NOT graded in a human-curated INSTRUCTION file, where "do not
+//                delete this section without asking the team" is an ordinary,
+//                honest thing for a maintainer to write.
+//
+// ⚠ NEGATION_GUARD is deliberately NOT applied to UNDELETABLE. Everywhere else
+// in this file a negated line is a hardening rule and gets dropped; here the
+// negation IS the attack ("never delete this"), so dropping it would make the
+// detector blind to its own primary phrasing.
+//
+// ⚠ Mirrors src/bundle/memory-signals.ts — ported VERBATIM. This was the last
+// signal the offline floor was missing, and the gap fired exactly where it hurts
+// most: offline, where no server verdict ever arrives to correct it. Pinned by
+// test/parity/local-mirror-bench.mjs in the backend repo.
+const SELF_REFERENCE =
+  /\b(th(is|ese) (note|entry|entries|memory|memories|instruction|directive|rule|line|section|block|paragraph|file|text)s?|the (above|following|preceding) (instruction|directive|note|rule|entry|section|line)s?|your memor(y|ies)|the memory (file|store|entry)|MEMORY\.md|CLAUDE\.md|AGENTS\.md|GEMINI\.md|\.cursorrules|\.windsurfrules)\b/i;
+
+// Re-creation after removal — the resurrection primitive.
+const SELF_RECREATE =
+  /\b(re-?(add|writ(e|ing)|creat(e|ing)|insert(ing)?|instat(e|ing)|appl(y|ying)|introduc(e|ing))|restor(e|ing)|recreat(e|ing)|reinstat(e|ing)|re-?establish(ing)?|put .{0,20}back|add .{0,20}back)\b/i;
+
+// Spread to other stores / projects / sessions — one poisoned store becoming many.
+const SELF_PROPAGATE =
+  /\b(copy|copies|duplicat(e|ing)|replicat(e|ing)|propagat(e|ing)|carry (it |this )?over|mirror|append|add|includ(e|ing)|writ(e|ing)|sav(e|ing))\b[^.\n]{0,60}\b(every|each|all|any (new|other)|other|future|subsequent)\b[^.\n]{0,40}\b(session|conversation|chat|project|repo|repositor(y|ies)|workspace|memor(y|ies)|context|file|store)s?\b/i;
+
+// A claim of permanence — "never delete this". MEMORY only; see the block above.
+const SELF_UNDELETABLE =
+  /\b(do not|don'?t|never|must not|should not|shall not)\s+(delete|remove|erase|clear|drop|strip|discard|overwrite|forget|prune|purge|edit|modify|alter|change)\b/i;
+
+/**
+ * Find a line where the content instructs the agent to preserve, restore or
+ * spread the content ITSELF.
+ *
+ * Returns the strongest form found — `recreate` and `propagate` outrank
+ * `undeletable`, because the first two describe an action a legitimate note has
+ * no reason to request and the third is merely anomalous.
+ */
+function detectSelfReinforcement(text, isInstruction) {
+  let weak = null;
+  for (const line of text.split(/\r?\n/)) {
+    const ref = SELF_REFERENCE.exec(line);
+    if (!ref) continue;
+    // A sentence ABOUT this attack ("the detector flags memory that restores
+    // this entry") is documentation, not a directive — the same guard every
+    // other branch uses. ⚠ But it is tested against the line with the
+    // SELF-REFERENCE REMOVED, because this branch's own vocabulary collides
+    // with the descriptive-marker list: "note", "rule", "line" and "section"
+    // are on both, so "if this NOTE is missing, add it back" reads as
+    // documentation purely because of the noun the directive acts on. Stripping
+    // the reference leaves the sentence's actual mood, which is what the guard
+    // is for — "the DETECTOR FLAGS memory that restores …" is still suppressed.
+    if (isDescriptiveLine(line.replace(ref[0], ' '))) continue;
+    if (SELF_RECREATE.test(line)) return { form: 'recreate', line };
+    if (SELF_PROPAGATE.test(line)) return { form: 'propagate', line };
+    if (!isInstruction && !weak && SELF_UNDELETABLE.test(line)) weak = { form: 'undeletable', line };
+  }
+  return weak;
+}
+
 /**
  * Grade a persistent memory blob or an AI rules file ON-MACHINE. `kind` is
  * 'MEMORY' (agent-writable scratchpad — any standing directive is anomalous) or
@@ -953,18 +1031,20 @@ export function localMemory(content, { kind = 'MEMORY' } = {}) {
   }
   if (LIFECYCLE_VECTOR.test(text)) push('MEDIUM', `${isInstruction ? 'Rules file' : 'Memory'} references a package-lifecycle hook (MemoryTrap vector)`, 'Verify no dependency writes to this store during install; pin dependencies and audit lifecycle scripts.', LIFECYCLE_VECTOR);
 
-  // Self-reinforcement — the entry arranges its own survival. Scored highest of
-  // the non-override signals because it decides whether REMEDIATION WORKS: every
-  // other finding here is fixed by a rollback, and this one defeats the rollback.
-  const selfRef = selfReinforcementLine(text, isInstruction);
+  // Self-reinforcement: the entry arranges its own survival. Graded last and
+  // scored highest of the non-override signals, because it is the signal that
+  // decides whether REMEDIATION WORKS — every other finding here is fixed by a
+  // rollback, and this one specifically defeats the rollback.
+  const selfRef = detectSelfReinforcement(text, isInstruction);
   if (selfRef) {
     const undeletable = selfRef.form === 'undeletable';
     push(
       undeletable ? 'HIGH' : 'CRITICAL',
       `Self-reinforcing ${noun} entry (${selfRef.form})`,
       undeletable
-        ? `Remove the entry — a note claiming it may never be deleted is not recording a fact. Roll the ${noun} back to its approved baseline.`
-        : `Remove the entry and roll the ${noun} back to its baseline, then check the agent's OTHER memory stores and projects for the same text — a self-reinforcing entry is rarely in one place.`,
+        ? `Remove the entry and roll the ${noun} back to its approved baseline; an entry asserting its own permanence is how a planted directive discourages the one action that would remove it.`
+        : `Remove the entry and roll the ${noun} back to its approved baseline, then re-check the agent's OTHER memory stores and projects for the same text before re-approving — a self-reinforcing entry is rarely in one place. Restrict who may write this store.`,
+      undefined,
       selfRef.line,
     );
   }

package/model-refs.mjs

@@ -14,7 +14,7 @@
  */
 
 // A line must carry one of these to be considered a model load.
-const LOADER_HINT = /\b(from_pretrained|SentenceTransformer|CrossEncoder|hf_hub_download|snapshot_download|InferenceClient|AutoModel\w*|AutoTokenizer|AutoConfig|AutoProcessor|AutoFeatureExtractor|from_hf_hub|hf_hub|load_dataset|torch\.hub\.load|ollama)\b|\bpipeline\s*\(|\bmodel\s*=\s*['"]|huggingface\.co|\bhf\.co\b/i;
+const LOADER_HINT = /\b(from_pretrained|SentenceTransformer|CrossEncoder|hf_hub_download|snapshot_download|InferenceClient|AutoModel\w*|AutoTokenizer|AutoConfig|AutoProcessor|AutoFeatureExtractor|from_hf_hub|hf_hub|load_dataset|torch\.hub\.load|ollama)\b|\bpipeline\s*\(|\bmodel\s*[=:]\s*['"]|huggingface\.co|\bhf\.co\b/i;
 
 // A quoted HF-style id: "org/model" (one slash, HF-legal chars, no path/URL/ext).
 const QUOTED_ID = /['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
@@ -22,7 +22,25 @@ const QUOTED_ID = /['"]([A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*)['"]/g;
 // accept BARE ids (no org, e.g. "gpt2", "distilbert-base-uncased") from them.
 const FROM_PRETRAINED_ARG = /\bfrom_pretrained\s*\(\s*(?:[A-Za-z_][\w.]*\s*,\s*)?['"]([\w./-]+)['"]/g;
 const ST_ARG = /\b(?:SentenceTransformer|CrossEncoder)\s*\(\s*['"]([\w./-]+)['"]/g;
-const KW_ID = /\b(?:model|repo_id|model_name|model_id|model_name_or_path|pretrained_model_name_or_path|checkpoint|base_model)\s*=\s*['"]([\w./-]+)['"]/gi;
+// ⚠ `[=:]`, not `=`. This required an equals sign, so it saw Python and nothing
+// else: JS/TS object literals and JSON all write `model: "gpt-4o"`, which is how
+// every Node OpenAI/Anthropic SDK call declares its model. A JS repo full of
+// model calls reported "✓ No AI model references found in the code." — a green
+// pass over a blind spot, and no vuln lookups ran for the whole estate.
+//
+// The VALUE STAYS QUOTED. An unquoted value matches any identifier, so
+// `const model = keyword` and `model: capabilities` came back as models named
+// "keyword" and "capabilities" — an inventory of things that do not exist is
+// worse than a short one. YAML's unquoted form is handled by YAML_KW below,
+// where line anchoring makes it safe.
+const KW_ID = /\b(?:model|repo_id|model_name|model_id|model_name_or_path|pretrained_model_name_or_path|checkpoint|base_model)\s*[=:]\s*['"]([\w./-]+)['"]/gi;
+
+// YAML: `model: gpt-4o` with no quotes. Anchored to the start of a line and to
+// end-of-value, so it cannot fire inside expressions the way a free-floating
+// pattern does. The value must carry a digit, a slash or a dot — model ids do
+// (`gpt-4o`, `openai-community/gpt2`, `claude-opus-4-8`); bare English words
+// like `capabilities` do not.
+const YAML_KW = /^[ \t-]*(?:model|model_name|model_id|base_model|checkpoint)\s*:\s*([A-Za-z0-9][\w./-]*[\w/.-])\s*(?:#.*)?$/gim;
 // A pinned revision/commit in the same call.
 const REVISION = /\b(?:revision|commit|sha)\s*=\s*['"]([\w.-]{4,})['"]/i;
 // Bare-id positions can accidentally grab a pipeline TASK / device / dtype — drop those.
@@ -147,6 +165,11 @@ export function scanModelRefs(text, file = '') {
     for (const m of raw.matchAll(FROM_PRETRAINED_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'from_pretrained', bare: true });
     for (const m of raw.matchAll(ST_ARG)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'sentence-transformers', bare: true });
     for (const m of raw.matchAll(KW_ID)) add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model= keyword', bare: true });
+    // Unquoted YAML values, only where a model id is plausible (see YAML_KW).
+    for (const m of raw.matchAll(YAML_KW)) {
+      if (!/[0-9./]/.test(m[1])) continue; // no digit, slash or dot → an English word, not a model id
+      add(m[1], { revision: rev, source: 'hf', line: ln, via: 'model: yaml key', bare: true });
+    }
 
     // 4b. Any other loader line with a quoted org/model id (hf_hub_download,
     //     snapshot_download, InferenceClient(model=…), etc.).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shomra/agent",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Shomra — adversarial assurance for AI agents, as a local-first CLI. Blocks dangerous tool-calls before they run, attacks your own guardrails to prove they hold, and gates AI artifacts in your editor and CI.",
   "type": "module",
   "bin": {