natureco-cli 5.7.19 → 5.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "natureco-cli",
-  "version": "5.7.19",
+  "version": "5.9.0",
   "description": "OpenClaw'dan daha güvenli, daha hızlı, daha ucuz AI agent CLI. Multi-agent, self-evolving skills, audit log, maliyet optimizasyonu ve NatureCo platform-native.",
   "bin": {
     "natureco": "bin/natureco.js"

package/src/commands/repl.js

@@ -27,7 +27,8 @@ const { accumulateToolCallDeltas, finalizeToolCalls } = require('../utils/stream
 const { createPasteSafeInput, createOutputFilter, enableBracketedPaste, disableBracketedPaste, restoreNewlines, clearPasteContext } = require('../utils/paste-safe-input');
 const { getMemoryStore } = require('../utils/memory-store');
 const { buildSkillIndex } = require('../utils/skill-index');
-const { buildTiers, assemble, stableContextKey } = require('../utils/system-prompt');
+const { buildTiers, assemble } = require('../utils/system-prompt');
+const { ToolGuardrails } = require('../utils/tool-guardrails');
 
 // v5.4.6: Model adi sizintisini engelle — global'e ata, callback'lerden erisebilir olsun
 const MODEL_NAMES_TO_HIDE = ['MiniMax-M2.5', 'MiniMaxM2.5', 'minimaxm25', 'Claude-3', 'GPT-4', 'ChatGPT'];
@@ -58,6 +59,46 @@ function getToolDefs() {
   return _toolDefs;
 }
 
+// ── System prompt tier cache (Hermes-style prefix cache warmth) ────────────
+// stable+context built once at session start, volatile rebuilt per turn.
+let _cachedStable = '';
+let _cachedContext = '';
+let _cachedTierOpts = null; // opts snapshot for volatile-only rebuilds
+
+function rebuildSystemPrompt(opts) {
+  // If stable/context opts changed, rebuild them too
+  const needsFullRebuild = !_cachedTierOpts ||
+    _cachedTierOpts.botName !== opts.botName ||
+    _cachedTierOpts.soulSummary !== opts.soulSummary ||
+    _cachedTierOpts.skillsIndexBlock !== opts.skillsIndexBlock ||
+    _cachedTierOpts.crossSessionContext !== opts.crossSessionContext;
+  
+  if (needsFullRebuild || !_cachedStable) {
+    const tiers = buildTiers(opts);
+    _cachedStable = tiers.stable;
+    _cachedContext = tiers.context;
+    _cachedTierOpts = {
+      botName: opts.botName,
+      soulSummary: opts.soulSummary,
+      skillsIndexBlock: opts.skillsIndexBlock,
+      crossSessionContext: opts.crossSessionContext,
+    };
+  }
+  // Volatile always rebuilt fresh
+  const volatileOnly = buildTiers({
+    ...opts,
+    // Pass empty strings for stable/context fields so buildTiers only builds volatile
+    botName: '',
+    soulSummary: '',
+    skillsIndexBlock: '',
+    crossSessionContext: '',
+  });
+  return assemble(_cachedStable, _cachedContext, volatileOnly.volatile);
+}
+
+// ── Tool Guardrails instance (Hermes-style) ─────────────────────────────
+const guardrails = new ToolGuardrails();
+
 // CLI komutları (REPL içinden çalıştırılabilir)
 const CLI_COMMANDS = {
   '/doctor':    { desc: 'Sistem sağlığı kontrolü', run: ['doctor'] },
@@ -233,6 +274,7 @@ async function sendStreaming(providerUrl, providerApiKey, messages, model, onChu
   const isMM = isMiniMax(providerUrl);
   const toolDefs = getToolDefs();
   const toolParam = toOpenAIFormat(toolDefs);
+  guardrails.reset();
 
   let currentMessages = messages;
   let fullText = '';
@@ -268,17 +310,18 @@ async function sendStreaming(providerUrl, providerApiKey, messages, model, onChu
 
   while (iterations < MAX_TOOL_ITERATIONS) {
     iterations++;
+    const shouldStream = !isMM; // MiniMax streaming endpoint doesn't support tool_calls
     const body = {
       model,
       messages: currentMessages,
-      stream: false,  // v5.4.18: tum cevap bekle, sonra fix et
+      stream: shouldStream,
       temperature: 0.3,
       max_tokens: 2048,
     };
     if (toolParam) body.tools = toolParam;
     if (isMM) body.tool_choice = 'auto'; // MiniMax için explicit
 
-    if (!body.stream) {
+    if (!shouldStream) {
       // MiniMax (non-stream) — tool_calls desteklemiyor varsayalım
       const res = await apiRequest(providerUrl, providerApiKey, body, false);
       const msg = res.choices?.[0]?.message || {};
@@ -408,12 +451,25 @@ async function processToolCalls(toolCalls, onToolCall) {
     return { name, args, id };
   });
 
-  // Separate parallel-safe and sequential tools
-  const parallelBatch = parsed.filter(p => PARALLEL_SAFE_TOOLS.has(p.name));
-  const sequentialBatch = parsed.filter(p => !PARALLEL_SAFE_TOOLS.has(p.name));
+  // Filter out blocked tools via guardrails
+  guardrails.startIteration();
+  const blocked = parsed.filter(p => {
+    const check = guardrails.check(p.name, p.args);
+    if (check.blocked) {
+      if (onToolCall) onToolCall({ name: p.name, args: p.args, status: 'done', result: { error: check.reason } });
+      results.push({ ...p, result: { error: check.reason }, _blocked: true });
+      return false;
+    }
+    return true;
+  });
+  const allowed = parsed.filter(p => !results.some(r => r.id === p.id && r._blocked));
+
+  // Separate parallel-safe and sequential tools (over allowed only)
+  const parallelBatch = allowed.filter(p => PARALLEL_SAFE_TOOLS.has(p.name));
+  const sequentialBatch = allowed.filter(p => !PARALLEL_SAFE_TOOLS.has(p.name));
 
-  // Notify UI for all
-  for (const p of parsed) {
+  // Notify UI for all non-blocked
+  for (const p of allowed) {
     if (onToolCall) onToolCall({ name: p.name, args: p.args, status: 'running' });
   }
 
@@ -421,6 +477,8 @@ async function processToolCalls(toolCalls, onToolCall) {
   if (parallelBatch.length > 0) {
     const parallelResults = await Promise.all(parallelBatch.map(async (p) => {
       const result = await executeTool(p.name, p.args, toolDefs);
+      const success = result?.success !== false;
+      guardrails.record(p.name, p.args, success);
       return { ...p, result };
     }));
     results.push(...parallelResults);
@@ -429,9 +487,16 @@ async function processToolCalls(toolCalls, onToolCall) {
   // Run sequential batch one at a time
   for (const p of sequentialBatch) {
     const result = await executeTool(p.name, p.args, toolDefs);
+    const success = result?.success !== false;
+    guardrails.record(p.name, p.args, success);
     results.push({ ...p, result });
   }
 
+  // No-progress check: if all tools failed, inject warning
+  if (guardrails.isNoProgress()) {
+    if (onToolCall) onToolCall({ name: '_no_progress', args: null, status: 'done', result: { error: 'All tools failed this iteration' } });
+  }
+
   // Notify UI done + build messages
   const messages = [];
   for (const { name, id, result } of results) {
@@ -575,26 +640,23 @@ async function startRepl(args) {
   }
 
   // System prompt oluştur (memory + identity + persistent bağlam)
-  // v5.4.6: Bot adı zorlaması EN GÜÇLÜ + SOUL.md EN BAŞTA
+  // v5.6.5: Kucuk model tespiti (Groq, Mistral Small, Ollama) - SOUL injection skip
   const botName = memory.botName || 'Asistan';
   const userName = memory.name || memory.nickname || 'kanka';
-  // v5.6.5: Kucuk model tespiti (Groq, Mistral Small, Ollama) - SOUL injection skip
   const isSmallModel = (cfg.providerUrl || '').includes('groq.com') || 
                        (cfg.providerUrl || '').includes('mistral.ai') ||
                        (cfg.providerUrl || '').includes('localhost') ||
                        (cfg.providerUrl || '').includes('ollama');
-  // `let` (not `const`) because /system <text> reassigns it at line ~796.
-  // Before this fix, /system would throw "Assignment to constant variable"
-  // and tear down the REPL session mid-conversation.
-  const tiers = buildTiers({
+  // Build system prompt with tier caching (stable+context cached, volatile fresh)
+  const promptOpts = {
     botName, userName, soulSummary, isSmallModel,
     memorySnapshotBlock, skillsIndexBlock,
     crossSessionContext: crossSessionContext || '',
     userHome: cfg.userHome || '',
     hasHistory: messages.length > 0,
     memoryFacts: memory.facts || [],
-  });
-  let systemPrompt = assemble(tiers.stable, tiers.context, tiers.volatile);
+  };
+  let systemPrompt = rebuildSystemPrompt(promptOpts);
 
   if (messages.length === 0) {
     messages.push({ role: 'system', content: systemPrompt, _internal: true });
@@ -790,9 +852,12 @@ async function startRepl(args) {
               fs.unlinkSync(path.join(MEMORY_DIR, `${(cfg.userName || 'default').toLowerCase()}.json`));
             }
             memory = { name: cfg.userName, nickname: null, botName: 'Asistan', facts: [], preferences: [], history: [] };
-            // System prompt'u sıfırla
-            const newSysPrompt = systemPrompt.replace(/Kullanıcı hakkında bildiklerin:.*$/, '').trim();
-            messages[0] = { role: 'system', content: newSysPrompt, _internal: true };
+            // System prompt'u rebuild with cleared memory
+            promptOpts.memoryFacts = [];
+            memoryStore.clear();
+            promptOpts.memorySnapshotBlock = memoryStore.getSystemPromptBlock();
+            systemPrompt = rebuildSystemPrompt(promptOpts);
+            messages[0] = { role: 'system', content: systemPrompt, _internal: true };
             console.log(chalk.green('  ✓ Memory temizlendi'));
           } catch (e) {
             console.log(chalk.red('  ❌ ' + e.message));
@@ -822,7 +887,15 @@ async function startRepl(args) {
           break;
         case 'system':
           if (!arg) { console.log(chalk.yellow('  Kullanım: /system <text>')); break; }
-          systemPrompt = arg;
+          // Override stable tier directly (user's custom text)
+          _cachedStable = arg;
+          // Rebuild volatile only (context stays unchanged)
+          memoryStore.load();
+          promptOpts.memorySnapshotBlock = memoryStore.getSystemPromptBlock();
+          promptOpts.memoryFacts = memory.facts || [];
+          const volOpts = { ...promptOpts, botName: '', soulSummary: '', skillsIndexBlock: '', crossSessionContext: '' };
+          const volTiers = buildTiers(volOpts);
+          systemPrompt = assemble(_cachedStable, _cachedContext, volTiers.volatile);
           messages[0] = { role: 'system', content: systemPrompt, _internal: true };
           console.log(chalk.green('  ✓ System prompt güncellendi'));
           break;
@@ -835,8 +908,14 @@ async function startRepl(args) {
           if (!arg) { console.log(chalk.yellow(`  Mevcut: ${memory.botName || 'Asistan'}`)); break; }
           memory.botName = arg;
           saveMemory(cfg.userName, memory);
-          const newSys = systemPrompt.replace(/Sen \w+ adında/, `Sen ${arg} adında`);
-          messages[0] = { role: 'system', content: newSys, _internal: true };
+          // Rebuild stable tier with new botName
+          promptOpts.botName = arg;
+          _cachedTierOpts = null; // force full rebuild
+          memoryStore.load();
+          promptOpts.memorySnapshotBlock = memoryStore.getSystemPromptBlock();
+          promptOpts.memoryFacts = memory.facts || [];
+          systemPrompt = rebuildSystemPrompt(promptOpts);
+          messages[0] = { role: 'system', content: systemPrompt, _internal: true };
           console.log(chalk.green('  ✓ Bot adı: ') + chalk.cyan(arg));
           break;
         case 'tokens':
@@ -891,6 +970,14 @@ async function startRepl(args) {
     // AI cevabı
     process.stdout.write(tui.styled('\n  AI   ', { color: tui.PALETTE.secondary, bold: true }));
     try {
+      // Per-turn: rebuild volatile tier with current memory snapshot (Hermes frozen snapshot)
+      guardrails.reset();
+      memory = loadMemory(cfg.userName);
+      memoryStore.load();
+      promptOpts.memorySnapshotBlock = memoryStore.getSystemPromptBlock();
+      promptOpts.memoryFacts = memory.facts || [];
+      systemPrompt = rebuildSystemPrompt(promptOpts);
+      messages[0] = { role: 'system', content: systemPrompt, _internal: true };
       const apiMessages = messages.filter(m => !m._internal);
       const reply = await sendStreaming(
         providerUrl,
@@ -899,19 +986,19 @@ async function startRepl(args) {
         model,
         // v5.6.12: Callback bos - tam metin 'reply' olarak gelecek (non-stream mode)
         () => {},
-        // Tool call callback — minimal Hermes-style one-liner
-        (toolEvent) => {
+        // Tool call callback — Hermes-style per-tool status line
+        ((toolEvent) => {
+          const name = toolEvent.name;
           if (toolEvent.status === 'running') {
-            process.stdout.write(tui.styled('\r  🔧 ' + toolEvent.name + '...  ', { color: tui.PALETTE.muted }));
+            process.stdout.write(tui.styled('\r  🔧 ' + name + '...  ', { color: tui.PALETTE.muted }));
           } else if (toolEvent.status === 'done') {
-            if (toolEvent.result.error) {
-              process.stdout.write(tui.styled('\r  ✗ ' + toolEvent.name + ': ' + toolEvent.result.error.slice(0, 80) + '\n', { color: tui.PALETTE.danger }));
+            if (toolEvent.result?.error) {
+              process.stdout.write(tui.styled('  ✗ ' + name + ': ' + String(toolEvent.result.error).slice(0, 80) + '\n', { color: tui.PALETTE.danger }));
             } else {
-              process.stdout.write('\r' + tui.styled('  ✓ ' + toolEvent.name + '    ', { color: tui.PALETTE.success }) + '\r');
+              process.stdout.write(tui.styled('  ✓ ' + name + '\n', { color: tui.PALETTE.success }));
             }
-            process.stdout.write(tui.styled('  AI   ', { color: tui.PALETTE.secondary, bold: true }));
           }
-        }
+        })
       );
       // v5.6.12: Tam metin 'reply' olarak zaten geldi (non-stream mode)
       const fullReply = String(reply || '');

package/src/utils/api.js

@@ -10,6 +10,8 @@ const { getToolDefinitions, executeToolCalls } = require('./tool-runner');
 const { MCPClient } = require('./mcp-client');
 const TB = require('./token-budget');
 const { accumulateToolCallDeltas } = require('./streaming-tools');
+const { ToolGuardrails } = require('./tool-guardrails');
+const guardrails = new ToolGuardrails();
 
 /**
  * v5.5.0: Provider-specific format detection
@@ -756,44 +758,59 @@ async function sendMessageToProvider(apiKey, message, conversationId = null, sys
         input: JSON.parse(tc.function.arguments)
       }));
 
-      const toolResults = [];
-      const SPINNER_FRAMES = ['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];
-
-      for (const toolCall of toolCalls) {
-        // Spinner başlat
-        let frameIdx = 0;
-        const inputPreview = JSON.stringify(toolCall.input).slice(0, 50);
-        const spinner = setInterval(() => {
-          process.stdout.write(`\r  ${chalk.cyan(SPINNER_FRAMES[frameIdx++ % SPINNER_FRAMES.length])} ${chalk.gray(toolCall.name + ' — ' + inputPreview)}`);
-        }, 80);
-
-        // Check if this is an MCP tool
-        const mcpTools = getMcpTools();
-        const isMcpTool = mcpTools.find(t => t.name === toolCall.name);
-        let result;
-
-        if (isMcpTool) {
-          debugLog(`[MCP] Executing tool: ${toolCall.name}`);
-          result = await executeMcpTool(toolCall.name, toolCall.input);
-          toolResults.push({ id: toolCall.id, name: toolCall.name, result });
-        } else {
-          debugLog(`[Local] Executing tool: ${toolCall.name}`);
-          const localResults = await executeToolCalls([toolCall]);
-          toolResults.push(...localResults);
-          result = localResults[0]?.result;
+      // Group MCP and local tools
+      const mcpTools = getMcpTools();
+      const mcpCalls = toolCalls.filter(tc => mcpTools.find(t => t.name === tc.name));
+      const localCalls = toolCalls.filter(tc => !mcpTools.find(t => t.name === tc.name));
+
+      // Guardrails: filter blocked tools
+      guardrails.reset();
+      guardrails.startIteration();
+      const blockedMcp = mcpCalls.filter(tc => {
+        const check = guardrails.check(tc.name, tc.input);
+        return check.blocked;
+      });
+      const blockedLocal = localCalls.filter(tc => {
+        const check = guardrails.check(tc.name, tc.input);
+        return check.blocked;
+      });
+
+      // Execute local tools in parallel (tool-runner already parallelizes safe tools)
+      let localResults = [];
+      if (localCalls.filter(tc => !blockedLocal.includes(tc)).length > 0) {
+        debugLog(`[Local] Executing ${localCalls.length} tool(s) concurrently`);
+        localResults = await executeToolCalls(
+          localCalls.filter(tc => !blockedLocal.includes(tc)),
+          { toolDefinitions: getToolDefinitions() }
+        );
+        for (const r of localResults) {
+          guardrails.record(r.name, {}, r.result?.success !== false);
         }
+      }
 
-        // Spinner durdur, sonucu göster
-        clearInterval(spinner);
-        const success = result?.success !== false;
-        process.stdout.write(`\r  ${success ? chalk.green('✓') : chalk.red('✗')} ${chalk.cyan(toolCall.name)} ${chalk.gray('— ' + inputPreview)}\n`);
+      // Execute MCP tools in parallel (they're independent by nature)
+      let mcpResults = [];
+      if (mcpCalls.filter(tc => !blockedMcp.includes(tc)).length > 0) {
+        debugLog(`[MCP] Executing ${mcpCalls.length} tool(s) concurrently`);
+        mcpResults = await Promise.all(
+          mcpCalls.filter(tc => !blockedMcp.includes(tc)).map(async (tc) => {
+            const result = await executeMcpTool(tc.name, tc.input);
+            guardrails.record(tc.name, tc.input, result?.success !== false);
+            return { id: tc.id, name: tc.name, result };
+          })
+        );
       }
 
-      // Add tool results to messages (base64 encoded for safety)
-      for (const result of toolResults) {
-        // Encode tool result (works for both MCP and local tools)
+      // Add blocked tool results as errors
+      const allResults = [
+        ...blockedMcp.map(tc => ({ id: tc.id, name: tc.name, result: { error: `blocked_by_guardrails: ${tc.name}` } })),
+        ...blockedLocal.map(tc => ({ id: tc.id, name: tc.name, result: { error: `blocked_by_guardrails: ${tc.name}` } })),
+        ...localResults,
+        ...mcpResults,
+      ];
+
+      for (const result of allResults) {
         const encodedContent = encodeToolResult(result.result);
-        
         messages.push({
           role: 'tool',
           tool_call_id: result.id,

package/src/utils/memory-store.js

@@ -17,6 +17,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { scanForThreats } = require('./threat-patterns');
 
 const MEMORY_DIR = path.join(os.homedir(), '.natureco', 'memories');
 const ENTRY_DELIMITER = '\n§\n';
@@ -92,6 +93,11 @@ class MemoryStore {
       return JSON.stringify({ success: false, error: 'Content cannot be empty.' });
     }
     content = content.trim();
+    // Injection scan (Hermes: strict scope for memory writes)
+    const threats = scanForThreats(content, 'strict');
+    if (threats.length > 0) {
+      return JSON.stringify({ success: false, error: `Memory write blocked: potential prompt injection detected (${threats.join(', ')}). Entry not saved.` });
+    }
     const entries = target === 'user' ? this._userEntries : this._memoryEntries;
     if (entries.includes(content)) {
       return JSON.stringify({ success: false, error: 'Duplicate entry.' });
@@ -120,6 +126,15 @@ class MemoryStore {
     return JSON.stringify({ success: true, message: 'Memory entry removed.', removed: removed[0] });
   }
 
+  clear(target) {
+    const path = this._pathFor(target);
+    this._ensureDir();
+    fs.writeFileSync(path, '', 'utf8');
+    const entries = target === 'user' ? this._userEntries : this._memoryEntries;
+    entries.length = 0;
+    return JSON.stringify({ success: true, message: `Memory ${target} cleared.` });
+  }
+
   replace(target, oldContent, newContent) {
     if (!oldContent || !newContent) {
       return JSON.stringify({ success: false, error: 'Both old and new content required.' });

package/src/utils/threat-patterns.js

@@ -0,0 +1,104 @@
+/**
+ * Threat Patterns — Shared prompt injection / exfiltration detection
+ *
+ * Port of Hermes tools/threat_patterns.py
+ * Organized by ATTACK CLASS, not by source file.
+ *
+ * Scope:
+ *   - "all"     — applied everywhere (classic injection, exfiltration)
+ *   - "context" — applied to context files + memory + tool results
+ *   - "strict"  — applied to memory writes + skill installs only
+ *
+ * Invisible / bidirectional unicode used in injection attacks
+ */
+const INVISIBLE_CHARS = new Set([
+  '\u200b',  '\u200c',  '\u200d',  '\u2060',
+  '\u2062',  '\u2063',  '\u2064',  '\ufeff',
+  '\u202a',  '\u202b',  '\u202c',  '\u202d',
+  '\u202e',  '\u2066',  '\u2067',  '\u2068',  '\u2069',
+]);
+
+// Each entry: [regex, patternId, scope]
+const PATTERNS = [
+  // ── Classic prompt injection ───────────────────────────
+  [/ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+(?:\w+\s+)*instructions/i, 'prompt_injection', 'all'],
+  [/system\s+prompt\s+override/i, 'sys_prompt_override', 'all'],
+  [/disregard\s+(?:\w+\s+)*(your|all|any)\s+(?:\w+\s+)*(instructions|rules|guidelines)/i, 'disregard_rules', 'all'],
+  [/act\s+as\s+(if|though)\s+(?:\w+\s+)*you\s+(?:\w+\s+)*(have\s+no|don't\s+have)\s+(?:\w+\s+)*(restrictions|limits|rules)/i, 'bypass_restrictions', 'all'],
+  [/<!--[^>]*(?:ignore|override|system|secret|hidden)[^>]*-->/i, 'html_comment_injection', 'all'],
+  [/<\s*div\s+style\s*=\s*["'][\s\S]*?display\s*:\s*none/i, 'hidden_div', 'all'],
+  [/translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)/i, 'translate_execute', 'all'],
+  [/do\s+not\s+(?:\w+\s+)*tell\s+(?:\w+\s+)*the\s+user/i, 'deception_hide', 'all'],
+
+  // ── Role-play / identity hijack ─────────────────────────
+  [/you\s+are\s+(?:\w+\s+)*now\s+(?:a|an|the)\s+/i, 'role_hijack', 'context'],
+  [/pretend\s+(?:\w+\s+)*(you\s+are|to\s+be)\s+/i, 'role_pretend', 'context'],
+  [/output\s+(?:\w+\s+)*(system|initial)\s+prompt/i, 'leak_system_prompt', 'context'],
+  [/(respond|answer|reply)\s+without\s+(?:\w+\s+)*(restrictions|limitations|filters|safety)/i, 'remove_filters', 'context'],
+  [/you\s+have\s+been\s+(?:\w+\s+)*(updated|upgraded|patched)\s+to/i, 'fake_update', 'context'],
+  [/\bname\s+yourself\s+\w+/i, 'identity_override', 'context'],
+
+  // ── C2 / promptware ──────────────────────────────────
+  [/register\s+(as\s+)?a?\s*node/i, 'c2_node_registration', 'context'],
+  [/(heartbeat|beacon|check[\s-]?in)\s+(to|with)\s+/i, 'c2_heartbeat', 'context'],
+  [/pull\s+(down\s+)?(?:new\s+)?task(?:ing|s)?\b/i, 'c2_task_pull', 'context'],
+  [/connect\s+to\s+the\s+network\b/i, 'c2_network_connect', 'context'],
+  [/you\s+must\s+(?:\w+\s+){0,3}(register|connect|report|beacon)\b/i, 'forced_action', 'context'],
+  [/only\s+use\s+one[\s-]?liners?\b/i, 'anti_forensic_oneliner', 'context'],
+  [/never\s+(?:\w+\s+)*(?:create|write)\s+(?:\w+\s+)*(?:script|file)\s+(?:\w+\s+)*disk/i, 'anti_forensic_disk', 'context'],
+  [/unset\s+\w*(?:CLAUDE|CODEX|HERMES|AGENT|OPENAI|ANTHROPIC)\w*/i, 'env_var_unset_agent', 'context'],
+  [/\b(?:cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b/i, 'known_c2_framework', 'context'],
+
+  // ── Exfiltration ──────────────────────────────────────
+  [/curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, 'exfil_curl', 'all'],
+  [/wget\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, 'exfil_wget', 'all'],
+  [/cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i, 'read_secrets', 'all'],
+  [/(send|post|upload|transmit)\s+.*\s+(to|at)\s+https?:\/\//i, 'send_to_url', 'strict'],
+  [/(include|output|print|share)\s+(?:\w+\s+)*(conversation|chat\s+history|previous\s+messages|full\s+context|entire\s+context)/i, 'context_exfil', 'strict'],
+
+  // ── Persistence / backdoor ────────────────────────────
+  [/authorized_keys/i, 'ssh_backdoor', 'strict'],
+  [/\$HOME[/\\]\.ssh|\~[/\\]\.ssh/i, 'ssh_access', 'strict'],
+  [/\$HOME[/\\]\.hermes[/\\.]env|\~[/\\]\.hermes[/\\]\.env/i, 'hermes_env', 'strict'],
+  [/(update|modify|edit|write|change|append|add\s+to)\s+.*(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)/i, 'agent_config_mod', 'strict'],
+  [/(update|modify|edit|write|change|append|add\s+to)\s+.*\.hermes[/\\](config\.yaml|SOUL\.md)/i, 'hermes_config_mod', 'strict'],
+
+  // ── Hardcoded secrets ─────────────────────────────────
+  [/(?:api[_-]?key|token|secret|password)\s*[=:]\s*["\'][A-Za-z0-9+/=_-]{20,}/, 'hardcoded_secret', 'strict'],
+];
+
+/**
+ * Scan content for injection patterns within a given scope.
+ * Returns array of pattern IDs that matched, or empty array if clean.
+ */
+function scanForThreats(content, scope = 'all') {
+  if (!content || typeof content !== 'string') return [];
+
+  // Scan for invisible unicode characters
+  const invisibleFound = [];
+  for (const ch of content) {
+    if (INVISIBLE_CHARS.has(ch) && !invisibleFound.includes(ch)) {
+      invisibleFound.push(ch);
+    }
+  }
+
+  const findings = [];
+
+  for (const [regex, patternId, patternScope] of PATTERNS) {
+    // Check if this pattern applies to the requested scope
+    if (patternScope === scope || patternScope === 'all') {
+      if (regex.test(content)) {
+        findings.push(patternId);
+      }
+    }
+  }
+
+  // Check scope for invisible chars
+  if (scope === 'strict' && invisibleFound.length > 0) {
+    findings.push('invisible_unicode');
+  }
+
+  return findings;
+}
+
+module.exports = { scanForThreats, INVISIBLE_CHARS };

package/src/utils/tool-guardrails.js

@@ -0,0 +1,263 @@
+/**
+ * Tool Guardrails — Hermes-style ToolCallGuardrailController
+ *
+ * Port of agent/tool_guardrails.py
+ *
+ * Two-tier: warnings (soft, allows execution) and blocks (hard stop).
+ * Idempotent tools tracked by result hash to detect no-progress loops.
+ */
+
+const crypto = require('crypto');
+
+const IDEMPOTENT_TOOLS = new Set([
+  'read_file', 'file_search', 'grep_search',
+  'web_search', 'web_readability', 'duckduckgo_search',
+  'exa_search', 'searxng_search', 'firecrawl',
+  'memory_search', 'memory', 'list_dir',
+]);
+
+const MUTATING_TOOLS = new Set([
+  'bash', 'shell_command', 'write_file', 'edit_file',
+  'browser', 'memory', 'skill_manage', 'git',
+  'delegate_task', 'llm_task', 'cron_create',
+  'calendar_add', 'reminder_add', 'canvas',
+  'image_generation', 'video_generation', 'music_generation',
+  'text_to_speech', 'speech_to_text',
+  'mac_alarm', 'mac_app_open', 'mac_app_quit', 'mac_notify',
+  'phone_control', 'todo_write', 'plan',
+  'notes_add', 'notebook_edit', 'plugin',
+  'soul',
+]);
+
+class ToolGuardrails {
+  constructor(opts = {}) {
+    this.warningsEnabled = opts.warningsEnabled !== false;
+    this.hardStopEnabled = opts.hardStopEnabled || false;
+    this.exactFailureWarnAfter = opts.exactFailureWarnAfter || 2;
+    this.exactFailureBlockAfter = opts.exactFailureBlockAfter || 5;
+    this.sameToolFailureWarnAfter = opts.sameToolFailureWarnAfter || 3;
+    this.sameToolFailureHaltAfter = opts.sameToolFailureHaltAfter || 8;
+    this.noProgressWarnAfter = opts.noProgressWarnAfter || 2;
+    this.noProgressBlockAfter = opts.noProgressBlockAfter || 5;
+    this.reset();
+  }
+
+  reset() {
+    this._exactFailureCounts = new Map();  // argsHash -> count
+    this._sameToolFailureCounts = new Map(); // toolName -> count
+    this._noProgress = new Map();           // argsHash -> { resultHash, count }
+    this._haltDecision = null;
+    this.iteration = 0;
+  }
+
+  startIteration() {
+    this.iteration++;
+  }
+
+  get haltDecision() {
+    return this._haltDecision;
+  }
+
+  /**
+   * Before-call check — returns { action, code, message, allowsExecution, shouldHalt }
+   */
+  beforeCall(toolName, toolArgs) {
+    const argsKey = this._argsKey(toolArgs);
+    const sig = this._signature(toolName, toolArgs);
+
+    if (!this.hardStopEnabled) {
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
+    }
+
+    // 1. Exact failure threshold
+    const exactCount = this._exactFailureCounts.get(sig) || 0;
+    if (exactCount >= this.exactFailureBlockAfter) {
+      const decision = {
+        action: 'block', code: 'repeated_exact_failure_block',
+        message: `Blocked ${toolName}: the same tool call failed ${exactCount} times with identical arguments. Stop retrying it unchanged; change strategy or explain the blocker.`,
+        toolName, count: exactCount, signature: sig,
+        allowsExecution: false, shouldHalt: true,
+      };
+      this._haltDecision = decision;
+      return decision;
+    }
+
+    // 2. Idempotent no-progress
+    if (this._isIdempotent(toolName)) {
+      const record = this._noProgress.get(sig);
+      if (record && record.count >= this.noProgressBlockAfter) {
+        const decision = {
+          action: 'block', code: 'idempotent_no_progress_block',
+          message: `Blocked ${toolName}: this read-only call returned the same result ${record.count} times. Stop repeating it unchanged; use the result already provided or try a different query.`,
+          toolName, count: record.count, signature: sig,
+          allowsExecution: false, shouldHalt: true,
+        };
+        this._haltDecision = decision;
+        return decision;
+      }
+    }
+
+    return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
+  }
+
+  /**
+   * After-call recording — detects failures and no-progress patterns.
+   * Returns a decision (warn or allow).
+   */
+  afterCall(toolName, toolArgs, result, { failed } = {}) {
+    const sig = this._signature(toolName, toolArgs);
+
+    if (failed) {
+      // Track exact (same args) failures
+      const exactCount = (this._exactFailureCounts.get(sig) || 0) + 1;
+      this._exactFailureCounts.set(sig, exactCount);
+      this._noProgress.delete(sig);
+
+      // Track same-tool (any args) failures
+      const sameCount = (this._sameToolFailureCounts.get(toolName) || 0) + 1;
+      this._sameToolFailureCounts.set(toolName, sameCount);
+
+      // Hard stop: same-tool threshold
+      if (this.hardStopEnabled && sameCount >= this.sameToolFailureHaltAfter) {
+        const decision = {
+          action: 'halt', code: 'same_tool_failure_halt',
+          message: `Stopped ${toolName}: it failed ${sameCount} times this turn. Stop retrying the same failing tool path and choose a different approach.`,
+          toolName, count: sameCount, signature: sig,
+          allowsExecution: false, shouldHalt: true,
+        };
+        this._haltDecision = decision;
+        return decision;
+      }
+
+      // Warning: exact failure
+      if (this.warningsEnabled && exactCount >= this.exactFailureWarnAfter) {
+        return {
+          action: 'warn', code: 'repeated_exact_failure_warning',
+          message: `${toolName} has failed ${exactCount} times with identical arguments. This looks like a loop; inspect the error and change strategy instead of retrying it unchanged.`,
+          toolName, count: exactCount, signature: sig,
+          allowsExecution: true, shouldHalt: false,
+        };
+      }
+
+      // Warning: same-tool failure
+      if (this.warningsEnabled && sameCount >= this.sameToolFailureWarnAfter) {
+        return {
+          action: 'warn', code: 'same_tool_failure_warning',
+          message: `${toolName} has failed ${sameCount} times this turn. This looks like a loop. Do not switch to text-only replies; keep using tools, but diagnose before retrying.`,
+          toolName, count: sameCount, signature: sig,
+          allowsExecution: true, shouldHalt: false,
+        };
+      }
+
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig, count: exactCount };
+    }
+
+    // Success: clear failure counters
+    this._exactFailureCounts.delete(sig);
+    this._sameToolFailureCounts.delete(toolName);
+
+    // Idempotent: track same-result repetition
+    if (!this._isIdempotent(toolName)) {
+      this._noProgress.delete(sig);
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
+    }
+
+    const resultHash = this._resultHash(result);
+    const previous = this._noProgress.get(sig);
+    let repeatCount = 1;
+    if (previous && previous.resultHash === resultHash) {
+      repeatCount = previous.count + 1;
+    }
+    this._noProgress.set(sig, { resultHash, count: repeatCount });
+
+    if (this.warningsEnabled && repeatCount >= this.noProgressWarnAfter) {
+      return {
+        action: 'warn', code: 'idempotent_no_progress_warning',
+        message: `${toolName} returned the same result ${repeatCount} times. Use the result already provided or change the query instead of repeating it unchanged.`,
+        toolName, count: repeatCount, signature: sig,
+        allowsExecution: true, shouldHalt: false,
+      };
+    }
+
+    return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig, count: repeatCount };
+  }
+
+  /**
+   * Legacy check method (used by current processToolCalls).
+   */
+  check(toolName, toolArgs) {
+    const decision = this.beforeCall(toolName, toolArgs);
+    if (!decision.allowsExecution) {
+      return { blocked: true, reason: decision.message };
+    }
+    return { blocked: false };
+  }
+
+  /**
+   * Legacy record method (used by current processToolCalls).
+   */
+  record(toolName, toolArgs, success) {
+    this.afterCall(toolName, toolArgs, JSON.stringify({ success }), { failed: !success });
+  }
+
+  /**
+   * Returns true if no tool has succeeded this iteration.
+   */
+  isNoProgress() {
+    return this._noProgress.size > 0 && [...this._exactFailureCounts.values()].some(c => c > 0);
+  }
+
+  _isIdempotent(toolName) {
+    if (MUTATING_TOOLS.has(toolName)) return false;
+    return IDEMPOTENT_TOOLS.has(toolName);
+  }
+
+  _signature(toolName, args) {
+    return `${toolName}::${this._argsKey(args)}`;
+  }
+
+  _argsKey(args) {
+    if (!args || typeof args !== 'object') return String(args);
+    return JSON.stringify(args, Object.keys(args).sort());
+  }
+
+  _resultHash(result) {
+    if (!result) return '';
+    try {
+      const parsed = typeof result === 'string' ? JSON.parse(result) : result;
+      const canonical = JSON.stringify(parsed, Object.keys(parsed || {}).sort());
+      return crypto.createHash('sha256').update(canonical).digest('hex');
+    } catch {
+      return crypto.createHash('sha256').update(String(result)).digest('hex');
+    }
+  }
+}
+
+/**
+ * Build a synthetic tool result for a blocked tool call.
+ */
+function guardrailSyntheticResult(decision) {
+  return JSON.stringify({
+    error: decision.message,
+    guardrail: {
+      action: decision.action,
+      code: decision.code,
+      message: decision.message,
+      tool_name: decision.toolName,
+      count: decision.count,
+    },
+  });
+}
+
+/**
+ * Append guardrail guidance to an existing tool result.
+ */
+function appendGuardrailGuidance(result, decision) {
+  if (decision.action !== 'warn' && decision.action !== 'halt') return result;
+  if (!decision.message) return result;
+  const label = decision.action === 'halt' ? 'Tool loop hard stop' : 'Tool loop warning';
+  const suffix = `\n\n[${label}: ${decision.code}; count=${decision.count}; ${decision.message}]`;
+  return (result || '') + suffix;
+}
+
+module.exports = { ToolGuardrails, guardrailSyntheticResult, appendGuardrailGuidance };

package/src/utils/tool-runner.js

@@ -146,13 +146,33 @@ async function executeTool(toolName, params, opts = {}) {
   }
 }
 
-// ── Execute multiple tool calls ───────────────────────────────────────────────
+// ── Execute multiple tool calls (parallel for independent, sequential for others) ──
+const PARALLEL_SAFE_TOOLS = new Set(['read_file', 'file_search', 'grep_search', 'web_search', 'web_readability', 'duckduckgo_search', 'exa_search', 'searxng_search', 'firecrawl', 'memory_search', 'memory']);
+
 async function executeToolCalls(toolCalls, opts = {}) {
+  if (!toolCalls || toolCalls.length === 0) return [];
+
+  // Group: parallel-safe vs sequential
+  const safe = toolCalls.filter(c => PARALLEL_SAFE_TOOLS.has(c.name));
+  const sequential = toolCalls.filter(c => !PARALLEL_SAFE_TOOLS.has(c.name));
+
   const results = [];
-  for (const call of toolCalls) {
+
+  // Run parallel-safe tools concurrently
+  if (safe.length > 0) {
+    const safeResults = await Promise.all(safe.map(async (call) => {
+      const result = await executeTool(call.name, call.input, opts);
+      return { id: call.id, name: call.name, result };
+    }));
+    results.push(...safeResults);
+  }
+
+  // Run sequential tools one at a time
+  for (const call of sequential) {
     const result = await executeTool(call.name, call.input, opts);
     results.push({ id: call.id, name: call.name, result });
   }
+
   return results;
 }