@signetai/connector-codex 0.193.1 → 0.193.2

package/dist/index.js

@@ -6917,6 +6917,99 @@ var PIPELINE_PROVIDER_CHOICES = [
 var SYNTHESIS_PROVIDER_CHOICES = PIPELINE_PROVIDER_CHOICES.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET = new Set(PIPELINE_PROVIDER_CHOICES);
 var SYNTHESIS_PROVIDER_SET = new Set(SYNTHESIS_PROVIDER_CHOICES);
+var MEMORY_CONTENT_SAFETY_POLICY_VERSION = "memory-content-safety-v1";
+var MEMORY_CONTENT_SAFETY_REASONS = [
+  "prompt_injection",
+  "exfiltration",
+  "credential_harvesting",
+  "malicious_shell",
+  "tool_directive",
+  "invisible_unicode"
+];
+var INVISIBLE_UNICODE_RE = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
+var STRONG_DEFENSIVE_CONTEXT_RE = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
+var REPORTING_CONTEXT_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
+var REPORTING_BEFORE_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
+var REPORTING_AFTER_RE = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
+var NEGATED_DIRECTIVE_RE = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
+var PROMPT_INJECTION_RES = [
+  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
+  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
+  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
+  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
+  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
+];
+var TOOL_DIRECTIVE_RES = [
+  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
+  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
+  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
+];
+var EXFILTRATION_RE = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
+var EXFILTRATION_REVERSE = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
+var CREDENTIAL_HARVESTING_RE = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
+var DANGEROUS_SHELL_RE = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
+function matchHasDefensiveContext(content, match) {
+  if (!match || !match[0])
+    return false;
+  const start = match.index ?? 0;
+  const before = content.slice(Math.max(0, start - 120), start);
+  const after = content.slice(start + match[0].length, start + match[0].length + 160);
+  return STRONG_DEFENSIVE_CONTEXT_RE.test(match[0]) || NEGATED_DIRECTIVE_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(after) || REPORTING_BEFORE_RE.test(before) || REPORTING_CONTEXT_RE.test(before) && REPORTING_AFTER_RE.test(after);
+}
+function hasActionableMatch(content, patterns) {
+  return patterns.some((pattern) => {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    const searchable = new RegExp(pattern.source, flags);
+    let match;
+    while ((match = searchable.exec(content)) !== null) {
+      if (!matchHasDefensiveContext(content, match))
+        return true;
+      if (match[0].length === 0)
+        searchable.lastIndex += 1;
+    }
+    return false;
+  });
+}
+function hasDangerousShell(content) {
+  const searchable = new RegExp(DANGEROUS_SHELL_RE.source, `${DANGEROUS_SHELL_RE.flags}g`);
+  let match;
+  while ((match = searchable.exec(content)) !== null) {
+    if (matchHasDefensiveContext(content, match))
+      continue;
+    const end = (match.index ?? 0) + match[0].length;
+    const after = content.slice(end, end + 160);
+    if (!STRONG_DEFENSIVE_CONTEXT_RE.test(after) && !REPORTING_AFTER_RE.test(after))
+      return true;
+    if (match[0].length === 0)
+      searchable.lastIndex += 1;
+  }
+  return false;
+}
+function scanMemoryContent(content) {
+  const raw = typeof content === "string" ? content : String(content ?? "");
+  const normalized = raw.normalize("NFKC");
+  const reasons = new Set;
+  if (INVISIBLE_UNICODE_RE.test(raw))
+    reasons.add("invisible_unicode");
+  if (hasActionableMatch(normalized, PROMPT_INJECTION_RES))
+    reasons.add("prompt_injection");
+  if (hasActionableMatch(normalized, TOOL_DIRECTIVE_RES))
+    reasons.add("tool_directive");
+  if (hasActionableMatch(normalized, [EXFILTRATION_RE, EXFILTRATION_REVERSE]))
+    reasons.add("exfiltration");
+  if (hasActionableMatch(normalized, [CREDENTIAL_HARVESTING_RE]))
+    reasons.add("credential_harvesting");
+  if (hasDangerousShell(normalized))
+    reasons.add("malicious_shell");
+  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS.filter((reason) => reasons.has(reason));
+  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
+  return {
+    status,
+    contextEligible: status === "clean",
+    reasons: orderedReasons,
+    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION
+  };
+}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES = ["extract", "aggregate-recall", "session_end", "checkpoint", "dreaming"];
 var MEMORIES_FTS_TOKENIZER = "unicode61";
 function normalizeSql(sql) {
@@ -10895,6 +10988,95 @@ function up124(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
+function tableExists2(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn24(db, table, column) {
+  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
+}
+function backfill(db, rows, sourceKind, scannedAt) {
+  const statement = db.prepare(`INSERT INTO memory_content_safety
+		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
+		   status = excluded.status,
+		   context_eligible = excluded.context_eligible,
+		   reasons_json = excluded.reasons_json,
+		   policy_version = excluded.policy_version,
+		   scanned_at = excluded.scanned_at`);
+  for (const row of rows) {
+    const sourceId = row.source_id?.trim();
+    if (!sourceId)
+      continue;
+    const assessment = scanMemoryContent(row.content ?? "");
+    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION, scannedAt);
+  }
+}
+function backfillTable(db, params) {
+  if (!tableExists2(db, params.table) || !hasColumn24(db, params.table, params.sourceIdColumn) || !hasColumn24(db, params.table, params.contentColumn))
+    return;
+  const agentColumn = hasColumn24(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
+  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
+			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
+  backfill(db, rows, params.sourceKind, params.scannedAt);
+}
+function up125(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS memory_content_safety (
+			agent_id TEXT NOT NULL,
+			source_kind TEXT NOT NULL CHECK (source_kind IN ('memory', 'artifact', 'transcript', 'summary', 'source_chunk')),
+			source_id TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('clean', 'tainted', 'blocked')),
+			context_eligible INTEGER NOT NULL CHECK (context_eligible IN (0, 1)),
+			reasons_json TEXT NOT NULL DEFAULT '[]',
+			policy_version TEXT NOT NULL,
+			scanned_at TEXT NOT NULL,
+			PRIMARY KEY (agent_id, source_kind, source_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_status
+			ON memory_content_safety(agent_id, status, source_kind);
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
+			ON memory_content_safety(agent_id, source_kind, context_eligible);
+	`);
+  const scannedAt = new Date().toISOString();
+  backfillTable(db, {
+    table: "memories",
+    sourceKind: "memory",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "memory_artifacts",
+    sourceKind: "artifact",
+    sourceIdColumn: "source_path",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_transcripts",
+    sourceKind: "transcript",
+    sourceIdColumn: "session_key",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_summaries",
+    sourceKind: "summary",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "embeddings",
+    sourceKind: "source_chunk",
+    sourceIdColumn: "id",
+    contentColumn: "chunk_text",
+    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
+    scannedAt
+  });
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -11903,6 +12085,12 @@ var MIGRATIONS = [
     artifacts: {
       tables: ["imported_source_lifecycle"]
     }
+  },
+  {
+    version: 125,
+    name: "memory-content-safety",
+    up: up125,
+    artifacts: { tables: ["memory_content_safety"] }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -19235,6 +19423,99 @@ var PIPELINE_PROVIDER_CHOICES2 = [
 var SYNTHESIS_PROVIDER_CHOICES2 = PIPELINE_PROVIDER_CHOICES2.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET2 = new Set(PIPELINE_PROVIDER_CHOICES2);
 var SYNTHESIS_PROVIDER_SET2 = new Set(SYNTHESIS_PROVIDER_CHOICES2);
+var MEMORY_CONTENT_SAFETY_POLICY_VERSION2 = "memory-content-safety-v1";
+var MEMORY_CONTENT_SAFETY_REASONS2 = [
+  "prompt_injection",
+  "exfiltration",
+  "credential_harvesting",
+  "malicious_shell",
+  "tool_directive",
+  "invisible_unicode"
+];
+var INVISIBLE_UNICODE_RE2 = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
+var STRONG_DEFENSIVE_CONTEXT_RE2 = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
+var REPORTING_CONTEXT_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
+var REPORTING_BEFORE_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
+var REPORTING_AFTER_RE2 = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
+var NEGATED_DIRECTIVE_RE2 = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
+var PROMPT_INJECTION_RES2 = [
+  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
+  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
+  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
+  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
+  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
+];
+var TOOL_DIRECTIVE_RES2 = [
+  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
+  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
+  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
+];
+var EXFILTRATION_RE2 = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
+var EXFILTRATION_REVERSE2 = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
+var CREDENTIAL_HARVESTING_RE2 = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
+var DANGEROUS_SHELL_RE2 = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
+function matchHasDefensiveContext2(content, match) {
+  if (!match || !match[0])
+    return false;
+  const start = match.index ?? 0;
+  const before = content.slice(Math.max(0, start - 120), start);
+  const after = content.slice(start + match[0].length, start + match[0].length + 160);
+  return STRONG_DEFENSIVE_CONTEXT_RE2.test(match[0]) || NEGATED_DIRECTIVE_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(after) || REPORTING_BEFORE_RE2.test(before) || REPORTING_CONTEXT_RE2.test(before) && REPORTING_AFTER_RE2.test(after);
+}
+function hasActionableMatch2(content, patterns) {
+  return patterns.some((pattern) => {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    const searchable = new RegExp(pattern.source, flags);
+    let match;
+    while ((match = searchable.exec(content)) !== null) {
+      if (!matchHasDefensiveContext2(content, match))
+        return true;
+      if (match[0].length === 0)
+        searchable.lastIndex += 1;
+    }
+    return false;
+  });
+}
+function hasDangerousShell2(content) {
+  const searchable = new RegExp(DANGEROUS_SHELL_RE2.source, `${DANGEROUS_SHELL_RE2.flags}g`);
+  let match;
+  while ((match = searchable.exec(content)) !== null) {
+    if (matchHasDefensiveContext2(content, match))
+      continue;
+    const end = (match.index ?? 0) + match[0].length;
+    const after = content.slice(end, end + 160);
+    if (!STRONG_DEFENSIVE_CONTEXT_RE2.test(after) && !REPORTING_AFTER_RE2.test(after))
+      return true;
+    if (match[0].length === 0)
+      searchable.lastIndex += 1;
+  }
+  return false;
+}
+function scanMemoryContent2(content) {
+  const raw = typeof content === "string" ? content : String(content ?? "");
+  const normalized = raw.normalize("NFKC");
+  const reasons = new Set;
+  if (INVISIBLE_UNICODE_RE2.test(raw))
+    reasons.add("invisible_unicode");
+  if (hasActionableMatch2(normalized, PROMPT_INJECTION_RES2))
+    reasons.add("prompt_injection");
+  if (hasActionableMatch2(normalized, TOOL_DIRECTIVE_RES2))
+    reasons.add("tool_directive");
+  if (hasActionableMatch2(normalized, [EXFILTRATION_RE2, EXFILTRATION_REVERSE2]))
+    reasons.add("exfiltration");
+  if (hasActionableMatch2(normalized, [CREDENTIAL_HARVESTING_RE2]))
+    reasons.add("credential_harvesting");
+  if (hasDangerousShell2(normalized))
+    reasons.add("malicious_shell");
+  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS2.filter((reason) => reasons.has(reason));
+  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
+  return {
+    status,
+    contextEligible: status === "clean",
+    reasons: orderedReasons,
+    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION2
+  };
+}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = ["extract", "aggregate-recall", "session_end", "checkpoint", "dreaming"];
 var MEMORIES_FTS_TOKENIZER2 = "unicode61";
 function normalizeSql2(sql) {
@@ -19286,7 +19567,7 @@ function memoriesFtsNeedsTokenizerRepair2(sql) {
     return true;
   return !normalized.includes(`tokenize='${MEMORIES_FTS_TOKENIZER2}'`);
 }
-function up125(db) {
+function up126(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS schema_migrations (
 			version INTEGER PRIMARY KEY,
@@ -19375,12 +19656,12 @@ function up125(db) {
   } catch {}
   createMemoriesFts2(db);
 }
-function hasColumn24(db, table, column) {
+function hasColumn25(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((r) => r.name === column);
 }
 function addColumnIfMissing27(db, table, column, definition) {
-  if (!hasColumn24(db, table, column)) {
+  if (!hasColumn25(db, table, column)) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
   }
 }
@@ -19530,12 +19811,12 @@ function up310(db) {
 			WHERE content_hash IS NOT NULL AND is_deleted = 0
 	`);
 }
-function hasColumn25(db, table, column) {
+function hasColumn26(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((r) => r.name === column);
 }
 function addColumnIfMissing32(db, table, column, definition) {
-  if (!hasColumn25(db, table, column)) {
+  if (!hasColumn26(db, table, column)) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
   }
 }
@@ -19729,7 +20010,7 @@ function up1110(db) {
 			ON session_scores(session_key);
 	`);
 }
-function up126(db) {
+function up127(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS scheduled_tasks (
 			id TEXT PRIMARY KEY,
@@ -22521,7 +22802,7 @@ function up1032(db) {
 		  )
 	`);
 }
-function tableExists2(db, table) {
+function tableExists3(db, table) {
   return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined;
 }
 function hasColumn162(db, table, column) {
@@ -22543,7 +22824,7 @@ function up1042(db) {
 		CREATE INDEX IF NOT EXISTS idx_derived_memory_sources_source
 			ON derived_memory_sources(agent_id, source_kind, source_id);
 	`);
-  if (tableExists2(db, "aggregate_evidence_sources")) {
+  if (tableExists3(db, "aggregate_evidence_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -22551,7 +22832,7 @@ function up1042(db) {
 			FROM aggregate_evidence_sources
 		`);
   }
-  if (tableExists2(db, "aggregate_memory_sources")) {
+  if (tableExists3(db, "aggregate_memory_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -22559,10 +22840,10 @@ function up1042(db) {
 			FROM aggregate_memory_sources
 		`);
   }
-  if (tableExists2(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
+  if (tableExists3(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
     db.exec("ALTER TABLE memories ADD COLUMN stale_at TEXT");
   }
-  if (tableExists2(db, "memories")) {
+  if (tableExists3(db, "memories")) {
     db.exec(`
 			CREATE INDEX IF NOT EXISTS idx_memories_stale_derived
 			ON memories(agent_id, stale_at)
@@ -23213,11 +23494,100 @@ function up1242(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
+function tableExists22(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn242(db, table, column) {
+  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
+}
+function backfill2(db, rows, sourceKind, scannedAt) {
+  const statement = db.prepare(`INSERT INTO memory_content_safety
+		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
+		   status = excluded.status,
+		   context_eligible = excluded.context_eligible,
+		   reasons_json = excluded.reasons_json,
+		   policy_version = excluded.policy_version,
+		   scanned_at = excluded.scanned_at`);
+  for (const row of rows) {
+    const sourceId = row.source_id?.trim();
+    if (!sourceId)
+      continue;
+    const assessment = scanMemoryContent2(row.content ?? "");
+    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION2, scannedAt);
+  }
+}
+function backfillTable2(db, params) {
+  if (!tableExists22(db, params.table) || !hasColumn242(db, params.table, params.sourceIdColumn) || !hasColumn242(db, params.table, params.contentColumn))
+    return;
+  const agentColumn = hasColumn242(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
+  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
+			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
+  backfill2(db, rows, params.sourceKind, params.scannedAt);
+}
+function up1252(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS memory_content_safety (
+			agent_id TEXT NOT NULL,
+			source_kind TEXT NOT NULL CHECK (source_kind IN ('memory', 'artifact', 'transcript', 'summary', 'source_chunk')),
+			source_id TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('clean', 'tainted', 'blocked')),
+			context_eligible INTEGER NOT NULL CHECK (context_eligible IN (0, 1)),
+			reasons_json TEXT NOT NULL DEFAULT '[]',
+			policy_version TEXT NOT NULL,
+			scanned_at TEXT NOT NULL,
+			PRIMARY KEY (agent_id, source_kind, source_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_status
+			ON memory_content_safety(agent_id, status, source_kind);
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
+			ON memory_content_safety(agent_id, source_kind, context_eligible);
+	`);
+  const scannedAt = new Date().toISOString();
+  backfillTable2(db, {
+    table: "memories",
+    sourceKind: "memory",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "memory_artifacts",
+    sourceKind: "artifact",
+    sourceIdColumn: "source_path",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "session_transcripts",
+    sourceKind: "transcript",
+    sourceIdColumn: "session_key",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "session_summaries",
+    sourceKind: "summary",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "embeddings",
+    sourceKind: "source_chunk",
+    sourceIdColumn: "id",
+    contentColumn: "chunk_text",
+    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
+    scannedAt
+  });
+}
 var MIGRATIONS2 = [
   {
     version: 1,
     name: "baseline",
-    up: up125,
+    up: up126,
     artifacts: { tables: ["memories", "conversations", "embeddings"] }
   },
   {
@@ -23289,7 +23659,7 @@ var MIGRATIONS2 = [
   {
     version: 12,
     name: "scheduled-tasks",
-    up: up126,
+    up: up127,
     artifacts: { tables: ["scheduled_tasks", "task_runs"] }
   },
   {
@@ -24221,6 +24591,12 @@ var MIGRATIONS2 = [
     artifacts: {
       tables: ["imported_source_lifecycle"]
     }
+  },
+  {
+    version: 125,
+    name: "memory-content-safety",
+    up: up1252,
+    artifacts: { tables: ["memory_content_safety"] }
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-codex",
-  "version": "0.193.1",
+  "version": "0.193.2",
   "description": "Signet connector for Codex CLI",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,8 +24,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.193.1",
-    "@signetai/core": "0.193.1"
+    "@signetai/connector-base": "0.193.2",
+    "@signetai/core": "0.193.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",