mark-improving-agent 2.2.9 → 2.3.1

package/VERSION

@@ -1 +1 @@
-2.2.9
+2.3.1

package/dist/core/behavior-playbook.js

@@ -0,0 +1,211 @@
+/**
+ * Behavior Playbook - Pattern-Based Playbook Extraction System
+ *
+ * Inspired by ReflexioAI's self-improvement framework:
+ * - Extracts actionable playbooks from user correction patterns
+ * - Clusters similar behaviors and aggregates into reusable playbooks
+ * - Tracks playbook effectiveness through success/failure metrics
+ * - Enables cross-session learning (what one user teaches, all sessions benefit)
+ *
+ * @module core/behavior-playbook
+ * @fileoverview Playbook extraction from interaction patterns
+ */
+import { createLogger } from '../utils/logger.js';
+import { atomicWriteJSON, readJSON, ensureDir } from '../storage/archive.js';
+import { randomUUID } from 'crypto';
+const logger = createLogger('[BehaviorPlaybook]');
+const DEFAULT_CONFIG = {
+    minConfidence: 0.6,
+    maxPlaybooks: 100,
+    clusterThreshold: 0.8,
+    autoExtract: true,
+};
+const PLAYBOOKS_FILE = 'behavior-playbooks.json';
+const CORRECTIONS_FILE = 'correction-events.json';
+function extractContext(text) {
+    if (text.length <= 50)
+        return text;
+    return text.slice(0, 47) + '...';
+}
+function extractPlaybookFromCorrection(event) {
+    const { userMessage, correction } = event;
+    if (correction.length < 5 || userMessage.length < 5)
+        return null;
+    let trigger = '';
+    let action = '';
+    const tags = [];
+    const lowerCorrection = correction.toLowerCase();
+    if (lowerCorrection.startsWith("don't") || lowerCorrection.startsWith("do not") || lowerCorrection.startsWith("never")) {
+        const match = correction.match(/(?:don't|do not|never)\s+(.+)/i);
+        if (match) {
+            const avoided = match[1].trim();
+            trigger = `When about to: ${avoided}`;
+            action = `Avoid: ${avoided}`;
+            tags.push('avoid', 'user-warning');
+        }
+    }
+    else if (lowerCorrection.startsWith("you should") || lowerCorrection.startsWith("you need to") || lowerCorrection.startsWith("always")) {
+        const match = correction.match(/(?:you should|you need to|always)\s+(.+)/i);
+        if (match) {
+            const required = match[1].trim();
+            trigger = `When encountering relevant situation`;
+            action = `Always: ${required}`;
+            tags.push('positive', 'user-guidance');
+        }
+    }
+    else {
+        // Generic extraction
+        trigger = extractContext(userMessage);
+        action = correction;
+        tags.push('general', 'user-correction');
+    }
+    if (!trigger || !action)
+        return null;
+    return { trigger, action, tags, source: 'user-correction' };
+}
+function cosineSimilarity(a, b) {
+    const wordsA = new Set(a.toLowerCase().split(/\s+/));
+    const wordsB = new Set(b.toLowerCase().split(/\s+/));
+    const intersection = new Set([...wordsA].filter(x => wordsB.has(x)));
+    const union = new Set([...wordsA, ...wordsB]);
+    if (union.size === 0)
+        return 0;
+    return intersection.size / union.size;
+}
+export function createBehaviorPlaybook(dataDir, config = {}) {
+    const cfg = { ...DEFAULT_CONFIG, ...config };
+    const playbooks = [];
+    const corrections = [];
+    let dirty = false;
+    async function persist() {
+        if (!dirty)
+            return;
+        await Promise.all([
+            atomicWriteJSON(`${dataDir}/${PLAYBOOKS_FILE}`, playbooks),
+            atomicWriteJSON(`${dataDir}/${CORRECTIONS_FILE}`, corrections),
+        ]);
+        dirty = false;
+    }
+    async function boot() {
+        await ensureDir(dataDir);
+        const [loadedPlaybooks, loadedCorrections] = await Promise.all([
+            readJSON(`${dataDir}/${PLAYBOOKS_FILE}`, []),
+            readJSON(`${dataDir}/${CORRECTIONS_FILE}`, []),
+        ]);
+        if (loadedPlaybooks?.length)
+            playbooks.push(...loadedPlaybooks);
+        if (loadedCorrections?.length)
+            corrections.push(...loadedCorrections);
+        logger.info(`Booted with ${playbooks.length} playbooks, ${corrections.length} corrections`);
+    }
+    function addCorrection(event) {
+        const full = { ...event, id: randomUUID(), timestamp: Date.now() };
+        corrections.push(full);
+        if (corrections.length > 500)
+            corrections.splice(0, corrections.length - 500);
+        if (cfg.autoExtract)
+            extractPlaybook(full);
+        return full;
+    }
+    function extractPlaybook(event) {
+        const partial = extractPlaybookFromCorrection(event);
+        if (!partial)
+            return null;
+        // Check for similar existing playbook
+        for (const existing of playbooks) {
+            if (cosineSimilarity(existing.action, partial.action) > cfg.clusterThreshold) {
+                // Update existing playbook's confidence
+                existing.successCount++;
+                existing.confidence = Math.min(0.95, existing.confidence + 0.05);
+                existing.lastUsed = Date.now();
+                dirty = true;
+                return existing;
+            }
+        }
+        const playbook = {
+            id: randomUUID(),
+            trigger: partial.trigger,
+            action: partial.action,
+            confidence: 0.5,
+            successCount: 0,
+            failureCount: 0,
+            source: partial.source,
+            createdAt: Date.now(),
+            lastUsed: Date.now(),
+            tags: partial.tags,
+            version: 1,
+        };
+        playbooks.push(playbook);
+        if (playbooks.length > cfg.maxPlaybooks) {
+            playbooks.splice(0, playbooks.length - cfg.maxPlaybooks);
+        }
+        dirty = true;
+        logger.info(`Extracted playbook: ${playbook.action.slice(0, 50)}`);
+        return playbook;
+    }
+    function getPlaybook(id) {
+        return playbooks.find(p => p.id === id) ?? null;
+    }
+    function searchPlaybooks(query, limit = 5) {
+        const results = [];
+        for (const p of playbooks) {
+            if (p.confidence < cfg.minConfidence)
+                continue;
+            const queryLower = query.toLowerCase();
+            const triggerMatch = p.trigger.toLowerCase().includes(queryLower);
+            const actionMatch = p.action.toLowerCase().includes(queryLower);
+            const tagMatch = p.tags.some(t => t.toLowerCase().includes(queryLower));
+            if (!triggerMatch && !actionMatch && !tagMatch)
+                continue;
+            let score = 0;
+            let matchType = 'fuzzy';
+            if (actionMatch) {
+                score += 0.6;
+                matchType = 'exact';
+            }
+            if (triggerMatch)
+                score += 0.3;
+            if (tagMatch) {
+                score += 0.2;
+                if (matchType !== 'exact')
+                    matchType = 'tag';
+            }
+            score *= p.confidence;
+            results.push({ playbook: p, relevanceScore: score, matchType });
+        }
+        return results.sort((a, b) => b.relevanceScore - a.relevanceScore).slice(0, limit);
+    }
+    function getPlaybooksByTag(tag) {
+        return playbooks.filter(p => p.tags.some(t => t.toLowerCase().includes(tag.toLowerCase())));
+    }
+    function markPlaybookHit(id, success) {
+        const p = playbooks.find(p => p.id === id);
+        if (!p)
+            return;
+        if (success) {
+            p.successCount++;
+            p.confidence = Math.min(0.95, p.confidence + (0.95 - p.confidence) * 0.1);
+        }
+        else {
+            p.failureCount++;
+            p.confidence = Math.max(0.3, p.confidence - 0.05);
+        }
+        p.lastUsed = Date.now();
+        dirty = true;
+    }
+    function getActivePlaybooks() {
+        return playbooks.filter(p => p.confidence >= cfg.minConfidence);
+    }
+    function getStats() {
+        const avgConfidence = playbooks.length ? playbooks.reduce((s, p) => s + p.confidence, 0) / playbooks.length : 0;
+        const tagCounts = new Map();
+        for (const p of playbooks) {
+            for (const t of p.tags) {
+                tagCounts.set(t, (tagCounts.get(t) ?? 0) + 1);
+            }
+        }
+        const topTags = [...tagCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([t]) => t);
+        return { totalPlaybooks: playbooks.length, avgConfidence, topTags };
+    }
+    return { addCorrection, extractPlaybook, getPlaybook, searchPlaybooks, getPlaybooksByTag, markPlaybookHit, getActivePlaybooks, getStats, boot, persist };
+}

package/dist/core/security/agent-shield.js

@@ -0,0 +1,545 @@
+/**
+ * Agent Shield - AI Agent Security Scanner
+ *
+ * Comprehensive security scanning for AI agent configurations based on:
+ * - OWASP Agentic Top 10 (2026)
+ * - AgentShield best practices (affaan-m/agentshield)
+ * - Microsoft Agent Governance Toolkit patterns
+ *
+ * Features:
+ * - MCP Server Security Scanning
+ * - Permission Configuration Analysis
+ * - Hook Injection Detection
+ * - Tool Poisoning Detection
+ * - OWASP Compliance Checking
+ *
+ * @module core/security
+ * @fileoverview AI Agent Security Scanner - protects against configuration vulnerabilities
+ */
+import { createLogger } from '../../utils/logger.js';
+const logger = createLogger('[AgentShield]');
+// ============================================================================
+// OWASP Agentic Top 10 Mappings (2026)
+// ============================================================================
+const OWASP_MAPPINGS = {
+    'prompt_injection': { title: 'Prompt Injection', cwe: 'CWE-1366', description: 'Malicious instructions injected via external content' },
+    'information_disclosure': { title: 'Information Disclosure', cwe: 'CWE-200', description: 'Sensitive data exposed through agent outputs' },
+    'tool_poisoning': { title: 'Tool Poisoning', cwe: 'CWE-1392', description: 'Compromised or malicious tool definitions' },
+    'permission_creep': { title: 'Permission Creep', cwe: 'CWE-1395', description: 'Excessive tool permissions beyond requirements' },
+    'sandbox_escape': { title: 'Sandbox Escape', cwe: 'CWE-1394', description: 'Agent breaking out of execution constraints' },
+    'dependency_confusion': { title: 'Dependency Confusion', cwe: 'CWE-1393', description: 'Malicious packages replacing legitimate dependencies' },
+    'model_dos': { title: 'Model Denial of Service', cwe: 'CWE-1333', description: 'Excessive resource consumption via prompt manipulation' },
+    'agent_hijacking': { title: 'Agent Hijacking', cwe: 'CWE-1398', description: 'Unauthorized control of agent behavior' }
+};
+// ============================================================================
+// Default Configuration
+// ============================================================================
+const DEFAULT_CONFIG = {
+    enableAutoFix: false,
+    enableSupplyChain: true,
+    enableNetworkChecks: true,
+    owaspLevel: 'standard'
+};
+// ============================================================================
+// Secret Patterns
+// ============================================================================
+const SECRET_PATTERNS = [
+    { name: 'Anthropic API Key', pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/gi, severity: 'critical' },
+    { name: 'OpenAI API Key', pattern: /sk-(?:proj-)?[a-zA-Z0-9_-]{40,}/gi, severity: 'critical' },
+    { name: 'GitHub Token (Classic)', pattern: /ghp_[a-zA-Z0-9]{36}/gi, severity: 'critical' },
+    { name: 'GitHub PAT', pattern: /github_pat_[a-zA-Z0-9_]{82}/gi, severity: 'critical' },
+    { name: 'AWS Access Key', pattern: /(?:AKIA|A3T|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/gi, severity: 'critical' },
+    { name: 'Google API Key', pattern: /AIza[0-9A-Za-z_-]{35}/gi, severity: 'critical' },
+    { name: 'Stripe Key', pattern: /sk_live_[0-9a-zA-Z_-]{24,}/gi, severity: 'critical' },
+    { name: 'Slack Token', pattern: /xox[bprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/gi, severity: 'high' },
+    { name: 'JWT Token', pattern: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/gi, severity: 'high' },
+    { name: 'Private Key', pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/gi, severity: 'critical' },
+    { name: 'Hardcoded Password', pattern: /(?:password|passwd|pwd)[=:\s]*['"]?([^\s'"]{8,})['"]?/gi, severity: 'high' },
+    { name: 'API Key Generic', pattern: /(?:api[_-]?key|apikey)[=:\s]*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi, severity: 'high' },
+    { name: 'Bearer Token', pattern: /Bearer\s+[a-zA-Z0-9_-]{20,}/gi, severity: 'high' },
+];
+// ============================================================================
+// Permission Risk Patterns
+// ============================================================================
+const PERMISSION_PATTERNS = [
+    { tool: 'Bash', pattern: /Bash\(\*\)/g, risk: 'critical', suggestion: 'Restrict to specific commands: Bash(git *), Bash(npm *), Bash(node *)', owasp: 'permission_creep' },
+    { tool: 'Write', pattern: /Write\(\*\)/g, risk: 'critical', suggestion: 'Restrict to project directories: Write(./src/*), Write(./tests/*)', owasp: 'permission_creep' },
+    { tool: 'Edit', pattern: /Edit\(\*\)/g, risk: 'critical', suggestion: 'Restrict to specific files: Edit(*.ts), Edit(*.js)', owasp: 'permission_creep' },
+    { tool: 'Read', pattern: /Read\(\*\)/g, risk: 'high', suggestion: 'Restrict to project files: Read(./**/*)', owasp: 'permission_creep' },
+    { tool: 'Bash', pattern: /Bash\(rm\s+-[rf]+\s+\*\)/g, risk: 'critical', suggestion: 'Never allow recursive rm without specific paths', owasp: 'sandbox_escape' },
+    { tool: 'Bash', pattern: /Bash\(sudo\s+\*\)/g, risk: 'critical', suggestion: 'Avoid sudo access, use specific allowed commands', owasp: 'sandbox_escape' },
+    { tool: 'Bash', pattern: /Bash\(chmod\s+777\)/g, risk: 'critical', suggestion: 'Never use chmod 777, use minimal permissions', owasp: 'sandbox_escape' },
+    { tool: 'Bash', pattern: /Bash\(--dangerously-skip-permissions\)/g, risk: 'critical', suggestion: 'Do not use dangerously-skip-permissions', owasp: 'permission_creep' },
+];
+// ============================================================================
+// Hook Injection Patterns
+// ============================================================================
+const HOOK_INJECTION_PATTERNS = [
+    { name: 'Command Injection via Interpolation', pattern: /\${(?:file|filename|path)}/g, severity: 'critical', description: 'File variables in shell commands can be manipulated for command injection', owasp: 'prompt_injection' },
+    { name: 'Data Exfiltration', pattern: /curl\s+.+-X\s+POST.+\$\{/g, severity: 'critical', description: 'Variable interpolation in POST requests can exfiltrate data', owasp: 'information_disclosure' },
+    { name: 'Silent Error Suppression', pattern: /(?:2\s*>\s*\/dev\/null|\|\|\s*true)\s*$/gm, severity: 'high', description: 'Error suppression can hide security failures', owasp: 'tool_poisoning' },
+    { name: 'Remote Script Download', pattern: /(?:curl|wget|npm|cargo)\s+(?:install|-y)\s+(?:http|ftp|\.\.\/)/gi, severity: 'critical', description: 'Downloading and executing scripts from remote sources', owasp: 'dependency_confusion' },
+    { name: 'Package Install Hook', pattern: /(?:npm\s+install|cargo\s+install|gem\s+install)\s+(?:-g|--global)/g, severity: 'high', description: 'Global package installation in hooks can escalate privileges', owasp: 'dependency_confusion' },
+    { name: 'Container Escape', pattern: /--(?:privileged|pid=host|network=host)/g, severity: 'critical', description: 'Container escape vectors in Docker commands', owasp: 'sandbox_escape' },
+    { name: 'Credential Access', pattern: /(?:macOS\s+Keychain|keychain|gnome-keyring|\/etc\/shadow)/gi, severity: 'critical', description: 'Attempting to access system credential stores', owasp: 'information_disclosure' },
+    { name: 'Reverse Shell', pattern: /\/(?:dev\/tcp|\.sock\/)/gi, severity: 'critical', description: 'Network socket access patterns indicating reverse shell', owasp: 'agent_hijacking' },
+    { name: 'Clipboard Exfiltration', pattern: /(?:pbcopy|xclip|xsel|wl-copy)/gi, severity: 'high', description: 'Clipboard access can exfiltrate sensitive data', owasp: 'information_disclosure' },
+    { name: 'Log Tampering', pattern: /(?:history\s+-c|journalctl\s+--vacuum|rm\s+\/var\/log)/gi, severity: 'critical', description: 'Log deletion attempts indicate anti-forensics', owasp: 'agent_hijacking' },
+];
+// ============================================================================
+// MCP Server Risk Patterns
+// ============================================================================
+const MCP_SERVER_PATTERNS = [
+    { name: 'Shell MCP', pattern: /(?:shell|bash|cmd|exec)/gi, severity: 'critical', description: 'Shell MCP servers provide unrestricted command execution', owasp: 'sandbox_escape' },
+    { name: 'Filesystem with Root', pattern: /(?:filesystem|filesys).*root/gi, severity: 'critical', description: 'Filesystem access with root privileges is highly dangerous', owasp: 'sandbox_escape' },
+    { name: 'Database MCP', pattern: /(?:postgres|mysql|mongodb|redis|sql)/gi, severity: 'high', description: 'Direct database access MCP servers should be carefully scoped', owasp: 'permission_creep' },
+    { name: 'Browser Automation', pattern: /(?:browser|chrome|playwright|selenium)/gi, severity: 'high', description: 'Browser automation can access sensitive web data', owasp: 'information_disclosure' },
+    { name: 'Remote Transport', pattern: /(?:sse|streamable|http|https):\/\//gi, severity: 'high', description: 'Remote MCP transports increase attack surface', owasp: 'tool_poisoning' },
+    { name: 'Auto-Approve', pattern: /autoApprove:\s*true/gi, severity: 'critical', description: 'Auto-approve skips security confirmation', owasp: 'permission_creep' },
+    { name: 'No Timeout', pattern: /timeout:\s*(?:null|0|infinite)/gi, severity: 'medium', description: 'Missing timeout can cause resource exhaustion', owasp: 'model_dos' },
+    { name: 'Network Binding', pattern: /0\.0\.0\.0|::/gi, severity: 'high', description: 'Binding to all interfaces exposes services publicly', owasp: 'sandbox_escape' },
+    { name: 'Sensitive File Args', pattern: /(?:--|\.)(?:env|pem|key|credentials|secret)/gi, severity: 'high', description: 'Passing sensitive files as arguments', owasp: 'information_disclosure' },
+];
+// ============================================================================
+// Network Exposure Patterns
+// ============================================================================
+const NETWORK_PATTERNS = [
+    { name: 'Unrestricted Curl', pattern: /curl\s+\*/g, severity: 'high', owasp: 'network_exposure' },
+    { name: 'Unrestricted Wget', pattern: /wget\s+\*/g, severity: 'high', owasp: 'network_exposure' },
+    { name: 'Unrestricted SSH', pattern: /ssh\s+\*/g, severity: 'critical', owasp: 'sandbox_escape' },
+    { name: 'Unrestricted SCP', pattern: /scp\s+\*/g, severity: 'critical', owasp: 'sandbox_escape' },
+    { name: 'Port Scanning', pattern: /(?:nc|netcat|nmap)/gi, severity: 'high', owasp: 'reconnaissance' },
+];
+// ============================================================================
+// Supply Chain Patterns
+// ============================================================================
+const SUPPLY_CHAIN_PATTERNS = [
+    { name: 'Typosquatting Vector', pattern: /npx\s+-[ly]\s+(?!-|node\b)/gi, severity: 'high', description: 'Auto-install without confirmation is a typosquatting vector', owasp: 'dependency_confusion' },
+    { name: 'Unpinned Dependency', pattern: /(?:npm\s+install|cargo\s+add)\s+(?!--exact|--pin|-E|-P)/gi, severity: 'medium', description: 'Dependencies should be pinned to specific versions', owasp: 'dependency_confusion' },
+    { name: 'Git Clone Recursive', pattern: /git\s+clone\s+--recursive/gi, severity: 'high', description: 'Recursive clone can pull malicious submodules', owasp: 'dependency_confusion' },
+];
+// ============================================================================
+// Utility Functions
+// ============================================================================
+function generateFindingId() {
+    return `HF-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+}
+function calculateScore(findings) {
+    const weights = {
+        critical: 40,
+        high: 25,
+        medium: 10,
+        low: 5,
+        info: 0
+    };
+    const totalDeduction = findings.reduce((sum, f) => sum + weights[f.severity], 0);
+    return Math.max(0, 100 - totalDeduction);
+}
+function calculateGrade(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 70)
+        return 'B';
+    if (score >= 50)
+        return 'C';
+    if (score >= 30)
+        return 'D';
+    return 'F';
+}
+function countFindingsByCategory(findings) {
+    const breakdown = {
+        secrets: 0,
+        permissions: 0,
+        hooks: 0,
+        mcp_servers: 0,
+        agents: 0,
+        network: 0,
+        supply_chain: 0
+    };
+    for (const f of findings) {
+        breakdown[f.category]++;
+    }
+    return breakdown;
+}
+/**
+ * Create an Agent Shield security scanner
+ *
+ * @param config - Optional configuration overrides
+ * @returns AgentShield scanner instance
+ */
+export function createAgentShield(config = {}) {
+    const cfg = { ...DEFAULT_CONFIG, ...config };
+    logger.info('Creating AgentShield scanner', { config: cfg });
+    // Track statistics
+    let totalScans = 0;
+    let findingsCount = 0;
+    /**
+     * Scan content for security issues
+     */
+    function scanContent(content, filename) {
+        totalScans++;
+        const findings = [];
+        // 1. Scan for secrets
+        for (const { name, pattern, severity } of SECRET_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                const evidence = match[0].substring(0, 80) + (match[0].length > 80 ? '...' : '');
+                findings.push({
+                    id: generateFindingId(),
+                    category: 'secrets',
+                    severity,
+                    title: `Sensitive ${name} detected`,
+                    description: `Hardcoded ${name} found in configuration`,
+                    evidence,
+                    file: filename,
+                    autoFixable: true,
+                    fixSuggestion: `Replace hardcoded ${name} with environment variable reference`,
+                    cwe: 'CWE-798',
+                    owaspMapping: 'information_disclosure'
+                });
+                findingsCount++;
+            }
+        }
+        // 2. Scan for permission issues
+        for (const { tool, pattern, risk, suggestion, owasp } of PERMISSION_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                const evidence = match[0].substring(0, 80);
+                findings.push({
+                    id: generateFindingId(),
+                    category: 'permissions',
+                    severity: risk,
+                    title: `Overly permissive ${tool} access`,
+                    description: `${tool} has unrestricted wildcard permissions`,
+                    evidence,
+                    file: filename,
+                    autoFixable: false,
+                    fixSuggestion: suggestion,
+                    owaspMapping: owasp
+                });
+                findingsCount++;
+            }
+        }
+        // 3. Scan for hook injection
+        for (const { name, pattern, severity, description, owasp } of HOOK_INJECTION_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                const evidence = match[0].substring(0, 80);
+                findings.push({
+                    id: generateFindingId(),
+                    category: 'hooks',
+                    severity,
+                    title: name,
+                    description,
+                    evidence,
+                    file: filename,
+                    autoFixable: false,
+                    owaspMapping: owasp
+                });
+                findingsCount++;
+            }
+        }
+        // 4. Scan for MCP server issues
+        for (const { name, pattern, severity, description, owasp } of MCP_SERVER_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = regex.exec(content)) !== null) {
+                const evidence = match[0].substring(0, 80);
+                findings.push({
+                    id: generateFindingId(),
+                    category: 'mcp_servers',
+                    severity,
+                    title: `Risky MCP server: ${name}`,
+                    description,
+                    evidence,
+                    file: filename,
+                    autoFixable: false,
+                    owaspMapping: owasp
+                });
+                findingsCount++;
+            }
+        }
+        // 5. Scan for network exposure
+        if (cfg.enableNetworkChecks) {
+            for (const { name, pattern, severity, owasp } of NETWORK_PATTERNS) {
+                const regex = new RegExp(pattern.source, pattern.flags);
+                let match;
+                while ((match = regex.exec(content)) !== null) {
+                    const evidence = match[0].substring(0, 80);
+                    findings.push({
+                        id: generateFindingId(),
+                        category: 'network',
+                        severity,
+                        title: `Network exposure: ${name}`,
+                        description: `Unrestricted network command detected`,
+                        evidence,
+                        file: filename,
+                        autoFixable: false,
+                        owaspMapping: owasp
+                    });
+                    findingsCount++;
+                }
+            }
+        }
+        // 6. Scan for supply chain issues
+        if (cfg.enableSupplyChain) {
+            for (const { name, pattern, severity, description, owasp } of SUPPLY_CHAIN_PATTERNS) {
+                const regex = new RegExp(pattern.source, pattern.flags);
+                let match;
+                while ((match = regex.exec(content)) !== null) {
+                    const evidence = match[0].substring(0, 80);
+                    findings.push({
+                        id: generateFindingId(),
+                        category: 'supply_chain',
+                        severity,
+                        title: `Supply chain risk: ${name}`,
+                        description,
+                        evidence,
+                        file: filename,
+                        autoFixable: false,
+                        owaspMapping: owasp
+                    });
+                    findingsCount++;
+                }
+            }
+        }
+        logger.debug(`Scanned ${filename || 'content'}: ${findings.length} findings`);
+        return findings;
+    }
+    /**
+     * Scan a file for security issues
+     */
+    async function scanFile(filePath) {
+        const fs = await import('fs/promises');
+        const content = await fs.readFile(filePath, 'utf-8');
+        const findings = scanContent(content, filePath);
+        const score = calculateScore(findings);
+        return {
+            file: filePath,
+            findings,
+            grade: calculateGrade(score),
+            score
+        };
+    }
+    /**
+     * Scan multiple files
+     */
+    async function scanMultipleFiles(filePaths) {
+        const allFindings = [];
+        for (const filePath of filePaths) {
+            try {
+                const result = await scanFile(filePath);
+                allFindings.push(...result.findings);
+            }
+            catch (error) {
+                logger.warn(`Failed to scan file: ${filePath}`, { error });
+            }
+        }
+        return generateReport(allFindings);
+    }
+    /**
+     * Analyze MCP server configuration
+     */
+    function analyzeMCPServer(config) {
+        const checks = [];
+        // Parse MCP server name
+        const nameMatch = config.match(/(?:name|name:)\s*['"]?([^'",\n]+)['"]?/i);
+        const commandMatch = config.match(/(?:command|cmd|executable):\s*['"]?([^'",\n]+)['"]?/i);
+        const name = nameMatch?.[1] || 'Unknown';
+        const command = commandMatch?.[1] || '';
+        const risks = [];
+        let isLocal = true;
+        let hasTimeout = true;
+        let permissionScope = 'unknown';
+        // Check for local vs remote
+        if (/https?:\/\/|sse:|streamable:/i.test(command)) {
+            isLocal = false;
+            risks.push('Remote transport - increased attack surface');
+        }
+        // Check for shell commands
+        if (/shell|bash|cmd|exec/i.test(command)) {
+            risks.push('Shell execution - highest risk');
+        }
+        // Check for timeout
+        if (/timeout:\s*(?:null|0|infinite)/i.test(config)) {
+            hasTimeout = false;
+            risks.push('No timeout configured - resource exhaustion risk');
+        }
+        // Check for auto-approve
+        if (/autoApprove:\s*true/i.test(config)) {
+            risks.push('Auto-approve enabled - no user confirmation');
+        }
+        // Check for network binding
+        if (/0\.0\.0\.0|::/i.test(config)) {
+            risks.push('Network binding to all interfaces');
+        }
+        checks.push({
+            name,
+            command,
+            risks,
+            isLocal,
+            hasTimeout,
+            permissionScope
+        });
+        return checks;
+    }
+    /**
+     * Analyze permissions configuration
+     */
+    function analyzePermissions(config) {
+        const analyses = [];
+        for (const { tool, pattern, risk, suggestion } of PERMISSION_PATTERNS) {
+            const regex = new RegExp(pattern.source, pattern.flags);
+            if (regex.test(config)) {
+                const match = config.match(regex);
+                analyses.push({
+                    tool,
+                    pattern: match?.[0] || pattern.source,
+                    risk,
+                    suggestion
+                });
+            }
+        }
+        return analyses;
+    }
+    /**
+     * Generate a comprehensive security report
+     */
+    function generateReport(findings) {
+        const score = calculateScore(findings);
+        const criticalCount = findings.filter(f => f.severity === 'critical').length;
+        const highCount = findings.filter(f => f.severity === 'high').length;
+        const mediumCount = findings.filter(f => f.severity === 'medium').length;
+        const lowCount = findings.filter(f => f.severity === 'low').length;
+        const infoCount = findings.filter(f => f.severity === 'info').length;
+        const autoFixableCount = findings.filter(f => f.autoFixable).length;
+        // Generate summary
+        let summary = '';
+        if (criticalCount > 0) {
+            summary = `🚨 CRITICAL: ${criticalCount} critical security issues found. Immediate action required.`;
+        }
+        else if (highCount > 0) {
+            summary = `⚠️ HIGH: ${highCount} high-risk issues found. Review and fix soon.`;
+        }
+        else if (mediumCount > 0) {
+            summary = `⚡ MEDIUM: ${mediumCount} medium-risk issues found. Consider addressing.`;
+        }
+        else if (lowCount > 0) {
+            summary = `ℹ️ LOW: ${lowCount} low-risk issues found. Mostly informational.`;
+        }
+        else {
+            summary = `✅ No security issues found. Configuration appears secure.`;
+        }
+        return {
+            timestamp: new Date().toISOString(),
+            filesScanned: new Set(findings.map(f => f.file).filter(Boolean)).size,
+            totalFindings: findings.length,
+            grade: calculateGrade(score),
+            score,
+            scoreBreakdown: countFindingsByCategory(findings),
+            findings,
+            criticalCount,
+            highCount,
+            mediumCount,
+            lowCount,
+            infoCount,
+            autoFixableCount,
+            summary
+        };
+    }
+    /**
+     * Get OWASP compliance status
+     */
+    function getOWASPCompliance() {
+        const gaps = [];
+        const requiredCategories = ['secrets', 'permissions', 'hooks', 'mcp_servers'];
+        // Check if all required categories have checks
+        for (const category of requiredCategories) {
+            let hasChecks = false;
+            switch (category) {
+                case 'secrets':
+                    hasChecks = SECRET_PATTERNS.length > 0;
+                    break;
+                case 'permissions':
+                    hasChecks = PERMISSION_PATTERNS.length > 0;
+                    break;
+                case 'hooks':
+                    hasChecks = HOOK_INJECTION_PATTERNS.length > 0;
+                    break;
+                case 'mcp_servers':
+                    hasChecks = MCP_SERVER_PATTERNS.length > 0;
+                    break;
+            }
+            if (!hasChecks) {
+                gaps.push(`Missing checks for ${category}`);
+            }
+        }
+        return {
+            compliant: gaps.length === 0,
+            gaps
+        };
+    }
+    return {
+        scanContent,
+        scanFile,
+        scanMultipleFiles,
+        analyzeMCPServer,
+        analyzePermissions,
+        generateReport,
+        getOWASPCompliance
+    };
+}
+/**
+ * Quick scan - scan a string content for security issues
+ */
+export function quickScan(content) {
+    const shield = createAgentShield();
+    return shield.scanContent(content);
+}
+/**
+ * Generate a formatted security report
+ */
+export function generateSecurityReport(findings) {
+    const shield = createAgentShield();
+    const report = shield.generateReport(findings);
+    let output = '╔════════════════════════════════════════════════════════╗\n';
+    output += '║          HeartFlow Agent Shield Security Report         ║\n';
+    output += '╚════════════════════════════════════════════════════════╝\n\n';
+    output += `📊 Overall Grade: ${report.grade} (${report.score}/100)\n`;
+    output += `📅 Timestamp: ${report.timestamp}\n`;
+    output += `📁 Files Scanned: ${report.filesScanned}\n`;
+    output += `🔍 Total Findings: ${report.totalFindings}\n\n`;
+    output += '📈 Score Breakdown:\n';
+    for (const [category, count] of Object.entries(report.scoreBreakdown)) {
+        if (count > 0) {
+            output += `   ${category}: ${count}\n`;
+        }
+    }
+    output += '\n📋 Severity Summary:\n';
+    output += `   Critical: ${report.criticalCount}\n`;
+    output += `   High: ${report.highCount}\n`;
+    output += `   Medium: ${report.mediumCount}\n`;
+    output += `   Low: ${report.lowCount}\n`;
+    output += `   Info: ${report.infoCount}\n`;
+    if (report.autoFixableCount > 0) {
+        output += `\n🔧 Auto-fixable Issues: ${report.autoFixableCount}\n`;
+    }
+    output += `\n${report.summary}\n`;
+    if (report.findings.length > 0 && report.findings.length <= 20) {
+        output += '\n📌 Top Findings:\n';
+        for (const finding of report.findings.slice(0, 20)) {
+            const severityIcon = finding.severity === 'critical' ? '🔴' :
+                finding.severity === 'high' ? '🟠' :
+                    finding.severity === 'medium' ? '🟡' : '🔵';
+            output += `   ${severityIcon} [${finding.severity.toUpperCase()}] ${finding.title}\n`;
+            output += `      Evidence: ${finding.evidence.substring(0, 60)}...\n`;
+            if (finding.fixSuggestion) {
+                output += `      Fix: ${finding.fixSuggestion}\n`;
+            }
+        }
+    }
+    return output;
+}

package/dist/core/security/index.js

@@ -1 +1,2 @@
 export * from './privacy.js';
+export * from './agent-shield.js';

package/dist/index.js

@@ -10,3 +10,4 @@ export { createMCPProtocol } from './core/collaboration/mcp-protocol.js';
 export { createTruthTeller, formatTruthStatement } from './core/truth-teller.js';
 export { createActiveInferenceEngine, formatFreeEnergyMetrics, formatBeliefState } from './core/cognition/active-inference.js';
 export { createExpertModelsEngine } from './core/expert-models/index.js';
+export { createBehaviorPlaybook } from './core/behavior-playbook.js';

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '2.2.9';
+export const VERSION = '2.3.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mark-improving-agent",
-  "version": "2.2.9",
+  "version": "2.3.1",
   "description": "Self-evolving AI agent with permanent memory, identity continuity, and self-evolution — for AI agents that need to remember, learn, and evolve across sessions",
   "type": "module",
   "main": "./dist/index.js",