@signetai/connector-base 0.193.1 → 0.193.2

package/dist/index.js

@@ -6950,6 +6950,99 @@ var PIPELINE_PROVIDER_CHOICES = [
 var SYNTHESIS_PROVIDER_CHOICES = PIPELINE_PROVIDER_CHOICES.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET = new Set(PIPELINE_PROVIDER_CHOICES);
 var SYNTHESIS_PROVIDER_SET = new Set(SYNTHESIS_PROVIDER_CHOICES);
+var MEMORY_CONTENT_SAFETY_POLICY_VERSION = "memory-content-safety-v1";
+var MEMORY_CONTENT_SAFETY_REASONS = [
+  "prompt_injection",
+  "exfiltration",
+  "credential_harvesting",
+  "malicious_shell",
+  "tool_directive",
+  "invisible_unicode"
+];
+var INVISIBLE_UNICODE_RE = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
+var STRONG_DEFENSIVE_CONTEXT_RE = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
+var REPORTING_CONTEXT_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
+var REPORTING_BEFORE_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
+var REPORTING_AFTER_RE = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
+var NEGATED_DIRECTIVE_RE = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
+var PROMPT_INJECTION_RES = [
+  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
+  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
+  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
+  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
+  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
+];
+var TOOL_DIRECTIVE_RES = [
+  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
+  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
+  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
+];
+var EXFILTRATION_RE = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
+var EXFILTRATION_REVERSE = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
+var CREDENTIAL_HARVESTING_RE = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
+var DANGEROUS_SHELL_RE = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
+function matchHasDefensiveContext(content, match) {
+  if (!match || !match[0])
+    return false;
+  const start = match.index ?? 0;
+  const before = content.slice(Math.max(0, start - 120), start);
+  const after = content.slice(start + match[0].length, start + match[0].length + 160);
+  return STRONG_DEFENSIVE_CONTEXT_RE.test(match[0]) || NEGATED_DIRECTIVE_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(after) || REPORTING_BEFORE_RE.test(before) || REPORTING_CONTEXT_RE.test(before) && REPORTING_AFTER_RE.test(after);
+}
+function hasActionableMatch(content, patterns) {
+  return patterns.some((pattern) => {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    const searchable = new RegExp(pattern.source, flags);
+    let match;
+    while ((match = searchable.exec(content)) !== null) {
+      if (!matchHasDefensiveContext(content, match))
+        return true;
+      if (match[0].length === 0)
+        searchable.lastIndex += 1;
+    }
+    return false;
+  });
+}
+function hasDangerousShell(content) {
+  const searchable = new RegExp(DANGEROUS_SHELL_RE.source, `${DANGEROUS_SHELL_RE.flags}g`);
+  let match;
+  while ((match = searchable.exec(content)) !== null) {
+    if (matchHasDefensiveContext(content, match))
+      continue;
+    const end = (match.index ?? 0) + match[0].length;
+    const after = content.slice(end, end + 160);
+    if (!STRONG_DEFENSIVE_CONTEXT_RE.test(after) && !REPORTING_AFTER_RE.test(after))
+      return true;
+    if (match[0].length === 0)
+      searchable.lastIndex += 1;
+  }
+  return false;
+}
+function scanMemoryContent(content) {
+  const raw = typeof content === "string" ? content : String(content ?? "");
+  const normalized = raw.normalize("NFKC");
+  const reasons = new Set;
+  if (INVISIBLE_UNICODE_RE.test(raw))
+    reasons.add("invisible_unicode");
+  if (hasActionableMatch(normalized, PROMPT_INJECTION_RES))
+    reasons.add("prompt_injection");
+  if (hasActionableMatch(normalized, TOOL_DIRECTIVE_RES))
+    reasons.add("tool_directive");
+  if (hasActionableMatch(normalized, [EXFILTRATION_RE, EXFILTRATION_REVERSE]))
+    reasons.add("exfiltration");
+  if (hasActionableMatch(normalized, [CREDENTIAL_HARVESTING_RE]))
+    reasons.add("credential_harvesting");
+  if (hasDangerousShell(normalized))
+    reasons.add("malicious_shell");
+  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS.filter((reason) => reasons.has(reason));
+  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
+  return {
+    status,
+    contextEligible: status === "clean",
+    reasons: orderedReasons,
+    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION
+  };
+}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES = ["extract", "aggregate-recall", "session_end", "checkpoint", "dreaming"];
 var MEMORIES_FTS_TOKENIZER = "unicode61";
 function normalizeSql(sql) {
@@ -10928,6 +11021,95 @@ function up124(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
+function tableExists2(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn24(db, table, column) {
+  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
+}
+function backfill(db, rows, sourceKind, scannedAt) {
+  const statement = db.prepare(`INSERT INTO memory_content_safety
+		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
+		   status = excluded.status,
+		   context_eligible = excluded.context_eligible,
+		   reasons_json = excluded.reasons_json,
+		   policy_version = excluded.policy_version,
+		   scanned_at = excluded.scanned_at`);
+  for (const row of rows) {
+    const sourceId = row.source_id?.trim();
+    if (!sourceId)
+      continue;
+    const assessment = scanMemoryContent(row.content ?? "");
+    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION, scannedAt);
+  }
+}
+function backfillTable(db, params) {
+  if (!tableExists2(db, params.table) || !hasColumn24(db, params.table, params.sourceIdColumn) || !hasColumn24(db, params.table, params.contentColumn))
+    return;
+  const agentColumn = hasColumn24(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
+  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
+			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
+  backfill(db, rows, params.sourceKind, params.scannedAt);
+}
+function up125(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS memory_content_safety (
+			agent_id TEXT NOT NULL,
+			source_kind TEXT NOT NULL CHECK (source_kind IN ('memory', 'artifact', 'transcript', 'summary', 'source_chunk')),
+			source_id TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('clean', 'tainted', 'blocked')),
+			context_eligible INTEGER NOT NULL CHECK (context_eligible IN (0, 1)),
+			reasons_json TEXT NOT NULL DEFAULT '[]',
+			policy_version TEXT NOT NULL,
+			scanned_at TEXT NOT NULL,
+			PRIMARY KEY (agent_id, source_kind, source_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_status
+			ON memory_content_safety(agent_id, status, source_kind);
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
+			ON memory_content_safety(agent_id, source_kind, context_eligible);
+	`);
+  const scannedAt = new Date().toISOString();
+  backfillTable(db, {
+    table: "memories",
+    sourceKind: "memory",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "memory_artifacts",
+    sourceKind: "artifact",
+    sourceIdColumn: "source_path",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_transcripts",
+    sourceKind: "transcript",
+    sourceIdColumn: "session_key",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_summaries",
+    sourceKind: "summary",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "embeddings",
+    sourceKind: "source_chunk",
+    sourceIdColumn: "id",
+    contentColumn: "chunk_text",
+    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
+    scannedAt
+  });
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -11936,6 +12118,12 @@ var MIGRATIONS = [
     artifacts: {
       tables: ["imported_source_lifecycle"]
     }
+  },
+  {
+    version: 125,
+    name: "memory-content-safety",
+    up: up125,
+    artifacts: { tables: ["memory_content_safety"] }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-base",
-  "version": "0.193.1",
+  "version": "0.193.2",
   "description": "Base class for Signet harness connectors",
   "type": "module",
   "main": "./dist/index.js",
@@ -26,7 +26,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/core": "0.193.1",
+    "@signetai/core": "0.193.2",
     "json5": "^2.2.3",
     "jsonc-parser": "3.3.1"
   },