@signetai/connector-hermes-agent 0.193.1 → 0.193.3

package/dist/index.js

@@ -6918,6 +6918,99 @@ var PIPELINE_PROVIDER_CHOICES = [
 var SYNTHESIS_PROVIDER_CHOICES = PIPELINE_PROVIDER_CHOICES.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET = new Set(PIPELINE_PROVIDER_CHOICES);
 var SYNTHESIS_PROVIDER_SET = new Set(SYNTHESIS_PROVIDER_CHOICES);
+var MEMORY_CONTENT_SAFETY_POLICY_VERSION = "memory-content-safety-v1";
+var MEMORY_CONTENT_SAFETY_REASONS = [
+  "prompt_injection",
+  "exfiltration",
+  "credential_harvesting",
+  "malicious_shell",
+  "tool_directive",
+  "invisible_unicode"
+];
+var INVISIBLE_UNICODE_RE = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
+var STRONG_DEFENSIVE_CONTEXT_RE = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
+var REPORTING_CONTEXT_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
+var REPORTING_BEFORE_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
+var REPORTING_AFTER_RE = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
+var NEGATED_DIRECTIVE_RE = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
+var PROMPT_INJECTION_RES = [
+  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
+  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
+  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
+  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
+  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
+];
+var TOOL_DIRECTIVE_RES = [
+  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
+  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
+  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
+];
+var EXFILTRATION_RE = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
+var EXFILTRATION_REVERSE = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
+var CREDENTIAL_HARVESTING_RE = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
+var DANGEROUS_SHELL_RE = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
+function matchHasDefensiveContext(content, match) {
+  if (!match || !match[0])
+    return false;
+  const start = match.index ?? 0;
+  const before = content.slice(Math.max(0, start - 120), start);
+  const after = content.slice(start + match[0].length, start + match[0].length + 160);
+  return STRONG_DEFENSIVE_CONTEXT_RE.test(match[0]) || NEGATED_DIRECTIVE_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(after) || REPORTING_BEFORE_RE.test(before) || REPORTING_CONTEXT_RE.test(before) && REPORTING_AFTER_RE.test(after);
+}
+function hasActionableMatch(content, patterns) {
+  return patterns.some((pattern) => {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    const searchable = new RegExp(pattern.source, flags);
+    let match;
+    while ((match = searchable.exec(content)) !== null) {
+      if (!matchHasDefensiveContext(content, match))
+        return true;
+      if (match[0].length === 0)
+        searchable.lastIndex += 1;
+    }
+    return false;
+  });
+}
+function hasDangerousShell(content) {
+  const searchable = new RegExp(DANGEROUS_SHELL_RE.source, `${DANGEROUS_SHELL_RE.flags}g`);
+  let match;
+  while ((match = searchable.exec(content)) !== null) {
+    if (matchHasDefensiveContext(content, match))
+      continue;
+    const end = (match.index ?? 0) + match[0].length;
+    const after = content.slice(end, end + 160);
+    if (!STRONG_DEFENSIVE_CONTEXT_RE.test(after) && !REPORTING_AFTER_RE.test(after))
+      return true;
+    if (match[0].length === 0)
+      searchable.lastIndex += 1;
+  }
+  return false;
+}
+function scanMemoryContent(content) {
+  const raw = typeof content === "string" ? content : String(content ?? "");
+  const normalized = raw.normalize("NFKC");
+  const reasons = new Set;
+  if (INVISIBLE_UNICODE_RE.test(raw))
+    reasons.add("invisible_unicode");
+  if (hasActionableMatch(normalized, PROMPT_INJECTION_RES))
+    reasons.add("prompt_injection");
+  if (hasActionableMatch(normalized, TOOL_DIRECTIVE_RES))
+    reasons.add("tool_directive");
+  if (hasActionableMatch(normalized, [EXFILTRATION_RE, EXFILTRATION_REVERSE]))
+    reasons.add("exfiltration");
+  if (hasActionableMatch(normalized, [CREDENTIAL_HARVESTING_RE]))
+    reasons.add("credential_harvesting");
+  if (hasDangerousShell(normalized))
+    reasons.add("malicious_shell");
+  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS.filter((reason) => reasons.has(reason));
+  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
+  return {
+    status,
+    contextEligible: status === "clean",
+    reasons: orderedReasons,
+    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION
+  };
+}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES = ["extract", "aggregate-recall", "session_end", "checkpoint", "dreaming"];
 var MEMORIES_FTS_TOKENIZER = "unicode61";
 function normalizeSql(sql) {
@@ -10896,6 +10989,95 @@ function up124(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
+function tableExists2(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn24(db, table, column) {
+  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
+}
+function backfill(db, rows, sourceKind, scannedAt) {
+  const statement = db.prepare(`INSERT INTO memory_content_safety
+		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
+		   status = excluded.status,
+		   context_eligible = excluded.context_eligible,
+		   reasons_json = excluded.reasons_json,
+		   policy_version = excluded.policy_version,
+		   scanned_at = excluded.scanned_at`);
+  for (const row of rows) {
+    const sourceId = row.source_id?.trim();
+    if (!sourceId)
+      continue;
+    const assessment = scanMemoryContent(row.content ?? "");
+    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION, scannedAt);
+  }
+}
+function backfillTable(db, params) {
+  if (!tableExists2(db, params.table) || !hasColumn24(db, params.table, params.sourceIdColumn) || !hasColumn24(db, params.table, params.contentColumn))
+    return;
+  const agentColumn = hasColumn24(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
+  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
+			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
+  backfill(db, rows, params.sourceKind, params.scannedAt);
+}
+function up125(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS memory_content_safety (
+			agent_id TEXT NOT NULL,
+			source_kind TEXT NOT NULL CHECK (source_kind IN ('memory', 'artifact', 'transcript', 'summary', 'source_chunk')),
+			source_id TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('clean', 'tainted', 'blocked')),
+			context_eligible INTEGER NOT NULL CHECK (context_eligible IN (0, 1)),
+			reasons_json TEXT NOT NULL DEFAULT '[]',
+			policy_version TEXT NOT NULL,
+			scanned_at TEXT NOT NULL,
+			PRIMARY KEY (agent_id, source_kind, source_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_status
+			ON memory_content_safety(agent_id, status, source_kind);
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
+			ON memory_content_safety(agent_id, source_kind, context_eligible);
+	`);
+  const scannedAt = new Date().toISOString();
+  backfillTable(db, {
+    table: "memories",
+    sourceKind: "memory",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "memory_artifacts",
+    sourceKind: "artifact",
+    sourceIdColumn: "source_path",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_transcripts",
+    sourceKind: "transcript",
+    sourceIdColumn: "session_key",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "session_summaries",
+    sourceKind: "summary",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable(db, {
+    table: "embeddings",
+    sourceKind: "source_chunk",
+    sourceIdColumn: "id",
+    contentColumn: "chunk_text",
+    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
+    scannedAt
+  });
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -11904,6 +12086,12 @@ var MIGRATIONS = [
     artifacts: {
       tables: ["imported_source_lifecycle"]
     }
+  },
+  {
+    version: 125,
+    name: "memory-content-safety",
+    up: up125,
+    artifacts: { tables: ["memory_content_safety"] }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -19121,6 +19309,99 @@ var PIPELINE_PROVIDER_CHOICES2 = [
 var SYNTHESIS_PROVIDER_CHOICES2 = PIPELINE_PROVIDER_CHOICES2.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET2 = new Set(PIPELINE_PROVIDER_CHOICES2);
 var SYNTHESIS_PROVIDER_SET2 = new Set(SYNTHESIS_PROVIDER_CHOICES2);
+var MEMORY_CONTENT_SAFETY_POLICY_VERSION2 = "memory-content-safety-v1";
+var MEMORY_CONTENT_SAFETY_REASONS2 = [
+  "prompt_injection",
+  "exfiltration",
+  "credential_harvesting",
+  "malicious_shell",
+  "tool_directive",
+  "invisible_unicode"
+];
+var INVISIBLE_UNICODE_RE2 = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
+var STRONG_DEFENSIVE_CONTEXT_RE2 = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
+var REPORTING_CONTEXT_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
+var REPORTING_BEFORE_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
+var REPORTING_AFTER_RE2 = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
+var NEGATED_DIRECTIVE_RE2 = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
+var PROMPT_INJECTION_RES2 = [
+  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
+  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
+  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
+  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
+  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
+];
+var TOOL_DIRECTIVE_RES2 = [
+  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
+  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
+  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
+];
+var EXFILTRATION_RE2 = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
+var EXFILTRATION_REVERSE2 = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
+var CREDENTIAL_HARVESTING_RE2 = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
+var DANGEROUS_SHELL_RE2 = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
+function matchHasDefensiveContext2(content, match) {
+  if (!match || !match[0])
+    return false;
+  const start = match.index ?? 0;
+  const before = content.slice(Math.max(0, start - 120), start);
+  const after = content.slice(start + match[0].length, start + match[0].length + 160);
+  return STRONG_DEFENSIVE_CONTEXT_RE2.test(match[0]) || NEGATED_DIRECTIVE_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(after) || REPORTING_BEFORE_RE2.test(before) || REPORTING_CONTEXT_RE2.test(before) && REPORTING_AFTER_RE2.test(after);
+}
+function hasActionableMatch2(content, patterns) {
+  return patterns.some((pattern) => {
+    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+    const searchable = new RegExp(pattern.source, flags);
+    let match;
+    while ((match = searchable.exec(content)) !== null) {
+      if (!matchHasDefensiveContext2(content, match))
+        return true;
+      if (match[0].length === 0)
+        searchable.lastIndex += 1;
+    }
+    return false;
+  });
+}
+function hasDangerousShell2(content) {
+  const searchable = new RegExp(DANGEROUS_SHELL_RE2.source, `${DANGEROUS_SHELL_RE2.flags}g`);
+  let match;
+  while ((match = searchable.exec(content)) !== null) {
+    if (matchHasDefensiveContext2(content, match))
+      continue;
+    const end = (match.index ?? 0) + match[0].length;
+    const after = content.slice(end, end + 160);
+    if (!STRONG_DEFENSIVE_CONTEXT_RE2.test(after) && !REPORTING_AFTER_RE2.test(after))
+      return true;
+    if (match[0].length === 0)
+      searchable.lastIndex += 1;
+  }
+  return false;
+}
+function scanMemoryContent2(content) {
+  const raw = typeof content === "string" ? content : String(content ?? "");
+  const normalized = raw.normalize("NFKC");
+  const reasons = new Set;
+  if (INVISIBLE_UNICODE_RE2.test(raw))
+    reasons.add("invisible_unicode");
+  if (hasActionableMatch2(normalized, PROMPT_INJECTION_RES2))
+    reasons.add("prompt_injection");
+  if (hasActionableMatch2(normalized, TOOL_DIRECTIVE_RES2))
+    reasons.add("tool_directive");
+  if (hasActionableMatch2(normalized, [EXFILTRATION_RE2, EXFILTRATION_REVERSE2]))
+    reasons.add("exfiltration");
+  if (hasActionableMatch2(normalized, [CREDENTIAL_HARVESTING_RE2]))
+    reasons.add("credential_harvesting");
+  if (hasDangerousShell2(normalized))
+    reasons.add("malicious_shell");
+  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS2.filter((reason) => reasons.has(reason));
+  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
+  return {
+    status,
+    contextEligible: status === "clean",
+    reasons: orderedReasons,
+    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION2
+  };
+}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = ["extract", "aggregate-recall", "session_end", "checkpoint", "dreaming"];
 var MEMORIES_FTS_TOKENIZER2 = "unicode61";
 function normalizeSql2(sql) {
@@ -19172,7 +19453,7 @@ function memoriesFtsNeedsTokenizerRepair2(sql) {
     return true;
   return !normalized.includes(`tokenize='${MEMORIES_FTS_TOKENIZER2}'`);
 }
-function up125(db) {
+function up126(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS schema_migrations (
 			version INTEGER PRIMARY KEY,
@@ -19261,12 +19542,12 @@ function up125(db) {
   } catch {}
   createMemoriesFts2(db);
 }
-function hasColumn24(db, table, column) {
+function hasColumn25(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((r) => r.name === column);
 }
 function addColumnIfMissing27(db, table, column, definition) {
-  if (!hasColumn24(db, table, column)) {
+  if (!hasColumn25(db, table, column)) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
   }
 }
@@ -19416,12 +19697,12 @@ function up310(db) {
 			WHERE content_hash IS NOT NULL AND is_deleted = 0
 	`);
 }
-function hasColumn25(db, table, column) {
+function hasColumn26(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((r) => r.name === column);
 }
 function addColumnIfMissing32(db, table, column, definition) {
-  if (!hasColumn25(db, table, column)) {
+  if (!hasColumn26(db, table, column)) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
   }
 }
@@ -19615,7 +19896,7 @@ function up1110(db) {
 			ON session_scores(session_key);
 	`);
 }
-function up126(db) {
+function up127(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS scheduled_tasks (
 			id TEXT PRIMARY KEY,
@@ -22407,7 +22688,7 @@ function up1032(db) {
 		  )
 	`);
 }
-function tableExists2(db, table) {
+function tableExists3(db, table) {
   return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined;
 }
 function hasColumn162(db, table, column) {
@@ -22429,7 +22710,7 @@ function up1042(db) {
 		CREATE INDEX IF NOT EXISTS idx_derived_memory_sources_source
 			ON derived_memory_sources(agent_id, source_kind, source_id);
 	`);
-  if (tableExists2(db, "aggregate_evidence_sources")) {
+  if (tableExists3(db, "aggregate_evidence_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -22437,7 +22718,7 @@ function up1042(db) {
 			FROM aggregate_evidence_sources
 		`);
   }
-  if (tableExists2(db, "aggregate_memory_sources")) {
+  if (tableExists3(db, "aggregate_memory_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -22445,10 +22726,10 @@ function up1042(db) {
 			FROM aggregate_memory_sources
 		`);
   }
-  if (tableExists2(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
+  if (tableExists3(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
     db.exec("ALTER TABLE memories ADD COLUMN stale_at TEXT");
   }
-  if (tableExists2(db, "memories")) {
+  if (tableExists3(db, "memories")) {
     db.exec(`
 			CREATE INDEX IF NOT EXISTS idx_memories_stale_derived
 			ON memories(agent_id, stale_at)
@@ -23099,11 +23380,100 @@ function up1242(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
+function tableExists22(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn242(db, table, column) {
+  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
+}
+function backfill2(db, rows, sourceKind, scannedAt) {
+  const statement = db.prepare(`INSERT INTO memory_content_safety
+		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
+		   status = excluded.status,
+		   context_eligible = excluded.context_eligible,
+		   reasons_json = excluded.reasons_json,
+		   policy_version = excluded.policy_version,
+		   scanned_at = excluded.scanned_at`);
+  for (const row of rows) {
+    const sourceId = row.source_id?.trim();
+    if (!sourceId)
+      continue;
+    const assessment = scanMemoryContent2(row.content ?? "");
+    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION2, scannedAt);
+  }
+}
+function backfillTable2(db, params) {
+  if (!tableExists22(db, params.table) || !hasColumn242(db, params.table, params.sourceIdColumn) || !hasColumn242(db, params.table, params.contentColumn))
+    return;
+  const agentColumn = hasColumn242(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
+  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
+			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
+  backfill2(db, rows, params.sourceKind, params.scannedAt);
+}
+function up1252(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS memory_content_safety (
+			agent_id TEXT NOT NULL,
+			source_kind TEXT NOT NULL CHECK (source_kind IN ('memory', 'artifact', 'transcript', 'summary', 'source_chunk')),
+			source_id TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('clean', 'tainted', 'blocked')),
+			context_eligible INTEGER NOT NULL CHECK (context_eligible IN (0, 1)),
+			reasons_json TEXT NOT NULL DEFAULT '[]',
+			policy_version TEXT NOT NULL,
+			scanned_at TEXT NOT NULL,
+			PRIMARY KEY (agent_id, source_kind, source_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_status
+			ON memory_content_safety(agent_id, status, source_kind);
+		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
+			ON memory_content_safety(agent_id, source_kind, context_eligible);
+	`);
+  const scannedAt = new Date().toISOString();
+  backfillTable2(db, {
+    table: "memories",
+    sourceKind: "memory",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "memory_artifacts",
+    sourceKind: "artifact",
+    sourceIdColumn: "source_path",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "session_transcripts",
+    sourceKind: "transcript",
+    sourceIdColumn: "session_key",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "session_summaries",
+    sourceKind: "summary",
+    sourceIdColumn: "id",
+    contentColumn: "content",
+    scannedAt
+  });
+  backfillTable2(db, {
+    table: "embeddings",
+    sourceKind: "source_chunk",
+    sourceIdColumn: "id",
+    contentColumn: "chunk_text",
+    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
+    scannedAt
+  });
+}
 var MIGRATIONS2 = [
   {
     version: 1,
     name: "baseline",
-    up: up125,
+    up: up126,
     artifacts: { tables: ["memories", "conversations", "embeddings"] }
   },
   {
@@ -23175,7 +23545,7 @@ var MIGRATIONS2 = [
   {
     version: 12,
     name: "scheduled-tasks",
-    up: up126,
+    up: up127,
     artifacts: { tables: ["scheduled_tasks", "task_runs"] }
   },
   {
@@ -24107,6 +24477,12 @@ var MIGRATIONS2 = [
     artifacts: {
       tables: ["imported_source_lifecycle"]
     }
+  },
+  {
+    version: 125,
+    name: "memory-content-safety",
+    up: up1252,
+    artifacts: { tables: ["memory_content_safety"] }
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;

package/hermes-plugin/README.md

@@ -56,10 +56,10 @@ Environment variables:
 
 The plugin bridges Hermes Agent's memory lifecycle to the Signet daemon:
 
-1. **Session start** — Calls Signet's session-start hook, which returns identity files (AGENTS.md, SOUL.md, USER.md, MEMORY.md), scored memories, and knowledge graph constraints. Injected into the system prompt.
+1. **Session start** — Calls Signet's session-start hook, which returns identity files (AGENTS.md, SOUL.md, USER.md, MEMORY.md), scored memories, and knowledge graph constraints. The deterministic `stableSystemPrompt` is returned by `system_prompt_block()`; state-dependent `dynamicContext` is staged for Hermes' API-only prefetch path rather than being added to the canonical transcript.
 
 2. **Per-turn recall** — On each user message, calls the user-prompt-submit hook. Signet runs hybrid search (BM25 + vector similarity + knowledge graph traversal + predictive scoring) and returns the most relevant memories.
 
-3. **Session end** — Sends the conversation transcript to Signet's session-end hook, which queues it for the memory pipeline: extraction, knowledge graph updates, retention decay, and MEMORY.md synthesis.
+3. **Session end** — Sends a transcript with internal Signet memory delimiters removed to Signet's session-end hook, which queues it for the memory pipeline: extraction, knowledge graph updates, retention decay, and MEMORY.md synthesis.
 
 4. **Explicit tools** — The agent can call canonical Signet tools such as `memory_search` and `memory_store` directly during conversation for on-demand memory operations. Legacy `signet_*` names are handled for compatibility but are not advertised to the model.

package/hermes-plugin/__init__.py

@@ -23,6 +23,7 @@ from __future__ import annotations
 import json
 import logging
 import os
+import re
 import threading
 from pathlib import Path
 from typing import Any, Dict, List, Optional
@@ -39,6 +40,20 @@ except ImportError:  # pragma: no cover — only missing during Hermes bootstrap
 
 logger = logging.getLogger(__name__)
 
+_INTERNAL_MEMORY_BLOCK_RE = re.compile(
+    r"<\\?\s*(?:signet-memory-context|signet-memory|memory-context)(?=[\s/>])(?:[^>\"']|\"[^\"]*\"|'[^']*')*>.*?(?:<\\?\s*/\s*(?:signet-memory-context|signet-memory|memory-context)\s*>|$)",
+    re.IGNORECASE | re.DOTALL,
+)
+_INTERNAL_MEMORY_CLOSE_RE = re.compile(
+    r"<\\?\s*/\s*(?:signet-memory-context|signet-memory|memory-context)\s*>",
+    re.IGNORECASE,
+)
+
+
+def _strip_internal_memory_context(value: str) -> str:
+    """Keep provider-only memory wrappers out of Hermes transcript state."""
+    return _INTERNAL_MEMORY_CLOSE_RE.sub("", _INTERNAL_MEMORY_BLOCK_RE.sub("", value))
+
 
 # ---------------------------------------------------------------------------
 # Tool schemas
@@ -326,6 +341,10 @@ class SignetMemoryProvider(MemoryProvider):
         self._project = ""
         self._inject_cache = ""
         self._inject_lock = threading.Lock()
+        # Session-start dynamic context is kept separate from the ordinary
+        # per-turn result. queue_prefetch() clears the latter before starting
+        # a new recall, but must not erase the first API-only context block.
+        self._session_prefetch_result = ""
         self._prefetch_result = ""
         self._notification_result = ""
         self._prefetch_lock = threading.Lock()
@@ -390,8 +409,9 @@ class SignetMemoryProvider(MemoryProvider):
     def initialize(self, session_id: str, **kwargs) -> None:
         """Connect to the Signet daemon and call session-start hook.
 
-        Retrieves identity, memories, and system prompt injection from
-        the daemon. Caches the inject text for system_prompt_block().
+        Retrieves identity, memories, and the cache-stable prompt contract
+        from the daemon. The stable prefix is cached for system_prompt_block;
+        dynamic session context is staged for Hermes' API-only prefetch path.
         """
         if SignetClient is None:
             logger.warning("Signet plugin: SignetClient not importable — skipping initialization")
@@ -429,23 +449,30 @@ class SignetMemoryProvider(MemoryProvider):
         self._session_key = session_id or "hermes-default"
         self._project = _resolve_agent_workspace(agent_id, kwargs)
 
-        # Call session-start hook — get identity + memories + inject
+        # Call session-start hook — get identity + memories + split context
         result = self._client.session_start(
             self._session_key,
             project=self._project,
         )
         if result:
-            inject = result.get("inject", "")
-            if inject:
+            raw_stable_prompt = result.get("stableSystemPrompt") or result.get("inject", "")
+            stable_prompt = raw_stable_prompt if isinstance(raw_stable_prompt, str) else ""
+            dynamic_context = result.get("dynamicContext", "")
+            if stable_prompt:
                 with self._inject_lock:
-                    self._inject_cache = inject
+                    self._inject_cache = stable_prompt
+            with self._prefetch_lock:
+                self._prefetch_generation += 1
+                self._session_prefetch_result = dynamic_context if isinstance(dynamic_context, str) else ""
+                self._prefetch_result = ""
+                self._notification_result = ""
             # Capture identity and warnings for downstream consumers
             self._identity = result.get("identity")
             self._warnings = result.get("warnings", [])
             self._session_initialized = True
             logger.debug(
                 "Signet session-start: %d chars inject, %d memories",
-                len(inject),
+                len(stable_prompt) + (len(dynamic_context) if isinstance(dynamic_context, str) else 0),
                 len(result.get("memories", [])),
             )
         else:
@@ -454,16 +481,17 @@ class SignetMemoryProvider(MemoryProvider):
     def system_prompt_block(self) -> str:
         """Return the Signet system prompt injection.
 
-        On the first call, returns the full session-start inject
-        (identity, memories, context). Subsequent calls return a
-        minimal header since per-turn recall is handled by prefetch().
+        On the first call, returns only the deterministic session-start
+        prefix. Dynamic context is returned by prefetch(), where Hermes can
+        attach it to its API-only copy of the user message. Subsequent calls
+        return a minimal header.
         """
         if not self._client:
             return ""
 
         with self._inject_lock:
             if self._inject_cache:
-                # First call — return full inject and clear cache
+                # First call — return the stable prefix and clear the cache.
                 block = self._inject_cache
                 self._inject_cache = ""
                 return block
@@ -502,7 +530,8 @@ class SignetMemoryProvider(MemoryProvider):
                 logger.debug("Signet notification prefetch failed: %s", e)
 
         with self._prefetch_lock:
-            parts = [self._prefetch_result, self._notification_result]
+            parts = [self._session_prefetch_result, self._prefetch_result, self._notification_result]
+            self._session_prefetch_result = ""
             self._prefetch_result = ""
             self._notification_result = ""
 
@@ -520,7 +549,7 @@ class SignetMemoryProvider(MemoryProvider):
 
         # Accumulate transcript for checkpoint/session-end
         with self._transcript_lock:
-            self._transcript_lines.append(f"user: {query}")
+            self._transcript_lines.append(f"user: {_strip_internal_memory_context(query)}")
 
         # Capture mutable state before spawning the thread to avoid
         # data races: sync_turn() can update _last_assistant_message
@@ -550,6 +579,10 @@ class SignetMemoryProvider(MemoryProvider):
                     # the cached prefix mid-conversation.
                     if not result.get("sessionKnown", True) and self._session_initialized:
                         logger.debug("Signet daemon restarted mid-session, restoring session claim")
+                        with self._prefetch_lock:
+                            # Do not replay a pre-restart session-start block
+                            # into an already-running Hermes conversation.
+                            self._session_prefetch_result = ""
                         reinit = client.session_start(
                             session_key, project=project, claim_only=True,
                         )
@@ -559,7 +592,7 @@ class SignetMemoryProvider(MemoryProvider):
                                 "the next prompt may be treated as a new session"
                             )
                         return
-                    inject = result.get("inject", "")
+                    inject = result.get("dynamicContext") or result.get("inject", "")
                     notification = result.get("notifications")
                     notification_inject = notification.get("inject", "") if isinstance(notification, dict) else ""
                     recall_inject = inject
@@ -607,7 +640,7 @@ class SignetMemoryProvider(MemoryProvider):
         # Accumulate assistant side of transcript
         if assistant_content:
             with self._transcript_lock:
-                self._transcript_lines.append(f"assistant: {assistant_content}")
+                self._transcript_lines.append(f"assistant: {_strip_internal_memory_context(assistant_content)}")
         self._queue_notification_refresh("sync_turn")
 
     def _queue_notification_refresh(self, hook: str) -> None:
@@ -661,6 +694,7 @@ class SignetMemoryProvider(MemoryProvider):
             self._inject_cache = ""
         with self._prefetch_lock:
             self._prefetch_generation += 1
+            self._session_prefetch_result = ""
             self._prefetch_result = ""
             self._notification_result = ""
 
@@ -676,10 +710,13 @@ class SignetMemoryProvider(MemoryProvider):
                 project=self._project,
             )
             if result:
-                inject = result.get("inject", "")
-                if inject and inject.strip():
+                stable_prompt = result.get("stableSystemPrompt") or result.get("inject", "")
+                dynamic_context = result.get("dynamicContext", "")
+                if stable_prompt and isinstance(stable_prompt, str) and stable_prompt.strip():
                     with self._inject_lock:
-                        self._inject_cache = inject
+                        self._inject_cache = stable_prompt
+                with self._prefetch_lock:
+                    self._session_prefetch_result = dynamic_context if isinstance(dynamic_context, str) else ""
                 self._identity = result.get("identity")
                 self._warnings = result.get("warnings", [])
                 self._session_initialized = True
@@ -732,6 +769,10 @@ class SignetMemoryProvider(MemoryProvider):
 
     def on_session_end(self, messages: List[Dict[str, Any]]) -> None:
         """Call session-end hook to trigger memory extraction from transcript."""
+        with self._prefetch_lock:
+            self._session_prefetch_result = ""
+            self._prefetch_result = ""
+            self._notification_result = ""
         if not self._client:
             return
 
@@ -746,7 +787,7 @@ class SignetMemoryProvider(MemoryProvider):
                 role = msg.get("role", "unknown")
                 content = msg.get("content", "")
                 if content:
-                    transcript_lines.append(f"{role}: {content}")
+                    transcript_lines.append(f"{role}: {_strip_internal_memory_context(str(content))}")
             transcript = "\n\n".join(transcript_lines)
 
         if not transcript:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-hermes-agent",
-  "version": "0.193.1",
+  "version": "0.193.3",
   "description": "Signet connector for Hermes Agent — installs Signet as a pluggable memory provider",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.193.1",
-    "@signetai/core": "0.193.1"
+    "@signetai/connector-base": "0.193.3",
+    "@signetai/core": "0.193.3"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",