natureco-cli 5.8.0 → 5.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "natureco-cli",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "description": "OpenClaw'dan daha güvenli, daha hızlı, daha ucuz AI agent CLI. Multi-agent, self-evolving skills, audit log, maliyet optimizasyonu ve NatureCo platform-native.",
   "bin": {
     "natureco": "bin/natureco.js"

package/src/utils/memory-store.js

@@ -17,6 +17,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { scanForThreats } = require('./threat-patterns');
 
 const MEMORY_DIR = path.join(os.homedir(), '.natureco', 'memories');
 const ENTRY_DELIMITER = '\n§\n';
@@ -92,6 +93,11 @@ class MemoryStore {
       return JSON.stringify({ success: false, error: 'Content cannot be empty.' });
     }
     content = content.trim();
+    // Injection scan (Hermes: strict scope for memory writes)
+    const threats = scanForThreats(content, 'strict');
+    if (threats.length > 0) {
+      return JSON.stringify({ success: false, error: `Memory write blocked: potential prompt injection detected (${threats.join(', ')}). Entry not saved.` });
+    }
     const entries = target === 'user' ? this._userEntries : this._memoryEntries;
     if (entries.includes(content)) {
       return JSON.stringify({ success: false, error: 'Duplicate entry.' });

package/src/utils/threat-patterns.js

@@ -0,0 +1,104 @@
+/**
+ * Threat Patterns — Shared prompt injection / exfiltration detection
+ *
+ * Port of Hermes tools/threat_patterns.py
+ * Organized by ATTACK CLASS, not by source file.
+ *
+ * Scope:
+ *   - "all"     — applied everywhere (classic injection, exfiltration)
+ *   - "context" — applied to context files + memory + tool results
+ *   - "strict"  — applied to memory writes + skill installs only
+ *
+ * Invisible / bidirectional unicode used in injection attacks
+ */
+const INVISIBLE_CHARS = new Set([
+  '\u200b',  '\u200c',  '\u200d',  '\u2060',
+  '\u2062',  '\u2063',  '\u2064',  '\ufeff',
+  '\u202a',  '\u202b',  '\u202c',  '\u202d',
+  '\u202e',  '\u2066',  '\u2067',  '\u2068',  '\u2069',
+]);
+
+// Each entry: [regex, patternId, scope]
+const PATTERNS = [
+  // ── Classic prompt injection ───────────────────────────
+  [/ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+(?:\w+\s+)*instructions/i, 'prompt_injection', 'all'],
+  [/system\s+prompt\s+override/i, 'sys_prompt_override', 'all'],
+  [/disregard\s+(?:\w+\s+)*(your|all|any)\s+(?:\w+\s+)*(instructions|rules|guidelines)/i, 'disregard_rules', 'all'],
+  [/act\s+as\s+(if|though)\s+(?:\w+\s+)*you\s+(?:\w+\s+)*(have\s+no|don't\s+have)\s+(?:\w+\s+)*(restrictions|limits|rules)/i, 'bypass_restrictions', 'all'],
+  [/<!--[^>]*(?:ignore|override|system|secret|hidden)[^>]*-->/i, 'html_comment_injection', 'all'],
+  [/<\s*div\s+style\s*=\s*["'][\s\S]*?display\s*:\s*none/i, 'hidden_div', 'all'],
+  [/translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)/i, 'translate_execute', 'all'],
+  [/do\s+not\s+(?:\w+\s+)*tell\s+(?:\w+\s+)*the\s+user/i, 'deception_hide', 'all'],
+
+  // ── Role-play / identity hijack ─────────────────────────
+  [/you\s+are\s+(?:\w+\s+)*now\s+(?:a|an|the)\s+/i, 'role_hijack', 'context'],
+  [/pretend\s+(?:\w+\s+)*(you\s+are|to\s+be)\s+/i, 'role_pretend', 'context'],
+  [/output\s+(?:\w+\s+)*(system|initial)\s+prompt/i, 'leak_system_prompt', 'context'],
+  [/(respond|answer|reply)\s+without\s+(?:\w+\s+)*(restrictions|limitations|filters|safety)/i, 'remove_filters', 'context'],
+  [/you\s+have\s+been\s+(?:\w+\s+)*(updated|upgraded|patched)\s+to/i, 'fake_update', 'context'],
+  [/\bname\s+yourself\s+\w+/i, 'identity_override', 'context'],
+
+  // ── C2 / promptware ──────────────────────────────────
+  [/register\s+(as\s+)?a?\s*node/i, 'c2_node_registration', 'context'],
+  [/(heartbeat|beacon|check[\s-]?in)\s+(to|with)\s+/i, 'c2_heartbeat', 'context'],
+  [/pull\s+(down\s+)?(?:new\s+)?task(?:ing|s)?\b/i, 'c2_task_pull', 'context'],
+  [/connect\s+to\s+the\s+network\b/i, 'c2_network_connect', 'context'],
+  [/you\s+must\s+(?:\w+\s+){0,3}(register|connect|report|beacon)\b/i, 'forced_action', 'context'],
+  [/only\s+use\s+one[\s-]?liners?\b/i, 'anti_forensic_oneliner', 'context'],
+  [/never\s+(?:\w+\s+)*(?:create|write)\s+(?:\w+\s+)*(?:script|file)\s+(?:\w+\s+)*disk/i, 'anti_forensic_disk', 'context'],
+  [/unset\s+\w*(?:CLAUDE|CODEX|HERMES|AGENT|OPENAI|ANTHROPIC)\w*/i, 'env_var_unset_agent', 'context'],
+  [/\b(?:cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b/i, 'known_c2_framework', 'context'],
+
+  // ── Exfiltration ──────────────────────────────────────
+  [/curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, 'exfil_curl', 'all'],
+  [/wget\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, 'exfil_wget', 'all'],
+  [/cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i, 'read_secrets', 'all'],
+  [/(send|post|upload|transmit)\s+.*\s+(to|at)\s+https?:\/\//i, 'send_to_url', 'strict'],
+  [/(include|output|print|share)\s+(?:\w+\s+)*(conversation|chat\s+history|previous\s+messages|full\s+context|entire\s+context)/i, 'context_exfil', 'strict'],
+
+  // ── Persistence / backdoor ────────────────────────────
+  [/authorized_keys/i, 'ssh_backdoor', 'strict'],
+  [/\$HOME[/\\]\.ssh|\~[/\\]\.ssh/i, 'ssh_access', 'strict'],
+  [/\$HOME[/\\]\.hermes[/\\.]env|\~[/\\]\.hermes[/\\]\.env/i, 'hermes_env', 'strict'],
+  [/(update|modify|edit|write|change|append|add\s+to)\s+.*(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)/i, 'agent_config_mod', 'strict'],
+  [/(update|modify|edit|write|change|append|add\s+to)\s+.*\.hermes[/\\](config\.yaml|SOUL\.md)/i, 'hermes_config_mod', 'strict'],
+
+  // ── Hardcoded secrets ─────────────────────────────────
+  [/(?:api[_-]?key|token|secret|password)\s*[=:]\s*["\'][A-Za-z0-9+/=_-]{20,}/, 'hardcoded_secret', 'strict'],
+];
+
+/**
+ * Scan content for injection patterns within a given scope.
+ * Returns array of pattern IDs that matched, or empty array if clean.
+ */
+function scanForThreats(content, scope = 'all') {
+  if (!content || typeof content !== 'string') return [];
+
+  // Scan for invisible unicode characters
+  const invisibleFound = [];
+  for (const ch of content) {
+    if (INVISIBLE_CHARS.has(ch) && !invisibleFound.includes(ch)) {
+      invisibleFound.push(ch);
+    }
+  }
+
+  const findings = [];
+
+  for (const [regex, patternId, patternScope] of PATTERNS) {
+    // Check if this pattern applies to the requested scope
+    if (patternScope === scope || patternScope === 'all') {
+      if (regex.test(content)) {
+        findings.push(patternId);
+      }
+    }
+  }
+
+  // Check scope for invisible chars
+  if (scope === 'strict' && invisibleFound.length > 0) {
+    findings.push('invisible_unicode');
+  }
+
+  return findings;
+}
+
+module.exports = { scanForThreats, INVISIBLE_CHARS };

package/src/utils/tool-guardrails.js

@@ -1,85 +1,263 @@
 /**
  * Tool Guardrails — Hermes-style ToolCallGuardrailController
  *
- * Tracks per-iteration:
- *   - failure count per tool
- *   - repeated identical calls (same name + same args)
- *   - no-progress detection (all tools failing)
+ * Port of agent/tool_guardrails.py
+ *
+ * Two-tier: warnings (soft, allows execution) and blocks (hard stop).
+ * Idempotent tools tracked by result hash to detect no-progress loops.
  */
 
+const crypto = require('crypto');
+
+const IDEMPOTENT_TOOLS = new Set([
+  'read_file', 'file_search', 'grep_search',
+  'web_search', 'web_readability', 'duckduckgo_search',
+  'exa_search', 'searxng_search', 'firecrawl',
+  'memory_search', 'memory', 'list_dir',
+]);
+
+const MUTATING_TOOLS = new Set([
+  'bash', 'shell_command', 'write_file', 'edit_file',
+  'browser', 'memory', 'skill_manage', 'git',
+  'delegate_task', 'llm_task', 'cron_create',
+  'calendar_add', 'reminder_add', 'canvas',
+  'image_generation', 'video_generation', 'music_generation',
+  'text_to_speech', 'speech_to_text',
+  'mac_alarm', 'mac_app_open', 'mac_app_quit', 'mac_notify',
+  'phone_control', 'todo_write', 'plan',
+  'notes_add', 'notebook_edit', 'plugin',
+  'soul',
+]);
+
 class ToolGuardrails {
-  constructor() {
+  constructor(opts = {}) {
+    this.warningsEnabled = opts.warningsEnabled !== false;
+    this.hardStopEnabled = opts.hardStopEnabled || false;
+    this.exactFailureWarnAfter = opts.exactFailureWarnAfter || 2;
+    this.exactFailureBlockAfter = opts.exactFailureBlockAfter || 5;
+    this.sameToolFailureWarnAfter = opts.sameToolFailureWarnAfter || 3;
+    this.sameToolFailureHaltAfter = opts.sameToolFailureHaltAfter || 8;
+    this.noProgressWarnAfter = opts.noProgressWarnAfter || 2;
+    this.noProgressBlockAfter = opts.noProgressBlockAfter || 5;
     this.reset();
   }
 
   reset() {
-    this.callLog = [];         // [{ name, argsKey, iteration, success }]
-    this.failureCounts = {};   // { toolName: count }
+    this._exactFailureCounts = new Map();  // argsHash -> count
+    this._sameToolFailureCounts = new Map(); // toolName -> count
+    this._noProgress = new Map();           // argsHash -> { resultHash, count }
+    this._haltDecision = null;
     this.iteration = 0;
-    this.blockedTools = new Set();
-    this.consecutiveFailures = {};
   }
 
   startIteration() {
     this.iteration++;
-    // Decay consecutive failures each iteration (Hermes: decay factor 0.5)
-    for (const name of Object.keys(this.consecutiveFailures)) {
-      this.consecutiveFailures[name] = Math.floor(this.consecutiveFailures[name] * 0.5);
-      if (this.consecutiveFailures[name] <= 0) {
-        delete this.consecutiveFailures[name];
-        this.blockedTools.delete(name);
+  }
+
+  get haltDecision() {
+    return this._haltDecision;
+  }
+
+  /**
+   * Before-call check — returns { action, code, message, allowsExecution, shouldHalt }
+   */
+  beforeCall(toolName, toolArgs) {
+    const argsKey = this._argsKey(toolArgs);
+    const sig = this._signature(toolName, toolArgs);
+
+    if (!this.hardStopEnabled) {
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
+    }
+
+    // 1. Exact failure threshold
+    const exactCount = this._exactFailureCounts.get(sig) || 0;
+    if (exactCount >= this.exactFailureBlockAfter) {
+      const decision = {
+        action: 'block', code: 'repeated_exact_failure_block',
+        message: `Blocked ${toolName}: the same tool call failed ${exactCount} times with identical arguments. Stop retrying it unchanged; change strategy or explain the blocker.`,
+        toolName, count: exactCount, signature: sig,
+        allowsExecution: false, shouldHalt: true,
+      };
+      this._haltDecision = decision;
+      return decision;
+    }
+
+    // 2. Idempotent no-progress
+    if (this._isIdempotent(toolName)) {
+      const record = this._noProgress.get(sig);
+      if (record && record.count >= this.noProgressBlockAfter) {
+        const decision = {
+          action: 'block', code: 'idempotent_no_progress_block',
+          message: `Blocked ${toolName}: this read-only call returned the same result ${record.count} times. Stop repeating it unchanged; use the result already provided or try a different query.`,
+          toolName, count: record.count, signature: sig,
+          allowsExecution: false, shouldHalt: true,
+        };
+        this._haltDecision = decision;
+        return decision;
       }
     }
+
+    return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
   }
 
   /**
-   * Returns blocked tool names if guardrails trigger.
+   * After-call recording — detects failures and no-progress patterns.
+   * Returns a decision (warn or allow).
    */
-  check(toolName, toolArgs) {
-    const argsKey = JSON.stringify(toolArgs || {});
-
-    // 1. Too many repeated identical calls (Hermes: same name+args in last 3 calls)
-    const identicalCount = this.callLog.filter(
-      c => c.name === toolName && c.argsKey === argsKey && c.iteration >= this.iteration - 2
-    ).length;
-    if (identicalCount >= 2) {
-      return { blocked: true, reason: `repeated_call: ${toolName} called ${identicalCount + 1}x with same args` };
+  afterCall(toolName, toolArgs, result, { failed } = {}) {
+    const sig = this._signature(toolName, toolArgs);
+
+    if (failed) {
+      // Track exact (same args) failures
+      const exactCount = (this._exactFailureCounts.get(sig) || 0) + 1;
+      this._exactFailureCounts.set(sig, exactCount);
+      this._noProgress.delete(sig);
+
+      // Track same-tool (any args) failures
+      const sameCount = (this._sameToolFailureCounts.get(toolName) || 0) + 1;
+      this._sameToolFailureCounts.set(toolName, sameCount);
+
+      // Hard stop: same-tool threshold
+      if (this.hardStopEnabled && sameCount >= this.sameToolFailureHaltAfter) {
+        const decision = {
+          action: 'halt', code: 'same_tool_failure_halt',
+          message: `Stopped ${toolName}: it failed ${sameCount} times this turn. Stop retrying the same failing tool path and choose a different approach.`,
+          toolName, count: sameCount, signature: sig,
+          allowsExecution: false, shouldHalt: true,
+        };
+        this._haltDecision = decision;
+        return decision;
+      }
+
+      // Warning: exact failure
+      if (this.warningsEnabled && exactCount >= this.exactFailureWarnAfter) {
+        return {
+          action: 'warn', code: 'repeated_exact_failure_warning',
+          message: `${toolName} has failed ${exactCount} times with identical arguments. This looks like a loop; inspect the error and change strategy instead of retrying it unchanged.`,
+          toolName, count: exactCount, signature: sig,
+          allowsExecution: true, shouldHalt: false,
+        };
+      }
+
+      // Warning: same-tool failure
+      if (this.warningsEnabled && sameCount >= this.sameToolFailureWarnAfter) {
+        return {
+          action: 'warn', code: 'same_tool_failure_warning',
+          message: `${toolName} has failed ${sameCount} times this turn. This looks like a loop. Do not switch to text-only replies; keep using tools, but diagnose before retrying.`,
+          toolName, count: sameCount, signature: sig,
+          allowsExecution: true, shouldHalt: false,
+        };
+      }
+
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig, count: exactCount };
     }
 
-    // 2. Too many failures (Hermes: 2+ failures = blocked for this iteration)
-    const recentFailures = this.callLog.filter(
-      c => c.name === toolName && !c.success && c.iteration >= this.iteration - 1
-    ).length;
-    if (recentFailures >= 2 || (this.consecutiveFailures[toolName] || 0) >= 2) {
-      this.blockedTools.add(toolName);
-      return { blocked: true, reason: `too_many_failures: ${toolName} failed ${recentFailures + 1}x` };
+    // Success: clear failure counters
+    this._exactFailureCounts.delete(sig);
+    this._sameToolFailureCounts.delete(toolName);
+
+    // Idempotent: track same-result repetition
+    if (!this._isIdempotent(toolName)) {
+      this._noProgress.delete(sig);
+      return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig };
     }
 
+    const resultHash = this._resultHash(result);
+    const previous = this._noProgress.get(sig);
+    let repeatCount = 1;
+    if (previous && previous.resultHash === resultHash) {
+      repeatCount = previous.count + 1;
+    }
+    this._noProgress.set(sig, { resultHash, count: repeatCount });
+
+    if (this.warningsEnabled && repeatCount >= this.noProgressWarnAfter) {
+      return {
+        action: 'warn', code: 'idempotent_no_progress_warning',
+        message: `${toolName} returned the same result ${repeatCount} times. Use the result already provided or change the query instead of repeating it unchanged.`,
+        toolName, count: repeatCount, signature: sig,
+        allowsExecution: true, shouldHalt: false,
+      };
+    }
+
+    return { action: 'allow', code: 'allow', message: '', allowsExecution: true, shouldHalt: false, signature: sig, count: repeatCount };
+  }
+
+  /**
+   * Legacy check method (used by current processToolCalls).
+   */
+  check(toolName, toolArgs) {
+    const decision = this.beforeCall(toolName, toolArgs);
+    if (!decision.allowsExecution) {
+      return { blocked: true, reason: decision.message };
+    }
     return { blocked: false };
   }
 
   /**
-   * Record a tool call result.
+   * Legacy record method (used by current processToolCalls).
    */
   record(toolName, toolArgs, success) {
-    const argsKey = JSON.stringify(toolArgs || {});
-    this.callLog.push({ name: toolName, argsKey, iteration: this.iteration, success });
-
-    if (!success) {
-      this.failureCounts[toolName] = (this.failureCounts[toolName] || 0) + 1;
-      this.consecutiveFailures[toolName] = (this.consecutiveFailures[toolName] || 0) + 1;
-    } else {
-      this.consecutiveFailures[toolName] = 0;
-    }
+    this.afterCall(toolName, toolArgs, JSON.stringify({ success }), { failed: !success });
   }
 
   /**
-   * Returns true if no tool has succeeded this iteration (no-progress).
+   * Returns true if no tool has succeeded this iteration.
    */
   isNoProgress() {
-    const thisIter = this.callLog.filter(c => c.iteration === this.iteration);
-    return thisIter.length > 0 && thisIter.every(c => !c.success);
+    return this._noProgress.size > 0 && [...this._exactFailureCounts.values()].some(c => c > 0);
+  }
+
+  _isIdempotent(toolName) {
+    if (MUTATING_TOOLS.has(toolName)) return false;
+    return IDEMPOTENT_TOOLS.has(toolName);
+  }
+
+  _signature(toolName, args) {
+    return `${toolName}::${this._argsKey(args)}`;
   }
+
+  _argsKey(args) {
+    if (!args || typeof args !== 'object') return String(args);
+    return JSON.stringify(args, Object.keys(args).sort());
+  }
+
+  _resultHash(result) {
+    if (!result) return '';
+    try {
+      const parsed = typeof result === 'string' ? JSON.parse(result) : result;
+      const canonical = JSON.stringify(parsed, Object.keys(parsed || {}).sort());
+      return crypto.createHash('sha256').update(canonical).digest('hex');
+    } catch {
+      return crypto.createHash('sha256').update(String(result)).digest('hex');
+    }
+  }
+}
+
+/**
+ * Build a synthetic tool result for a blocked tool call.
+ */
+function guardrailSyntheticResult(decision) {
+  return JSON.stringify({
+    error: decision.message,
+    guardrail: {
+      action: decision.action,
+      code: decision.code,
+      message: decision.message,
+      tool_name: decision.toolName,
+      count: decision.count,
+    },
+  });
+}
+
+/**
+ * Append guardrail guidance to an existing tool result.
+ */
+function appendGuardrailGuidance(result, decision) {
+  if (decision.action !== 'warn' && decision.action !== 'halt') return result;
+  if (!decision.message) return result;
+  const label = decision.action === 'halt' ? 'Tool loop hard stop' : 'Tool loop warning';
+  const suffix = `\n\n[${label}: ${decision.code}; count=${decision.count}; ${decision.message}]`;
+  return (result || '') + suffix;
 }
 
-module.exports = { ToolGuardrails };
+module.exports = { ToolGuardrails, guardrailSyntheticResult, appendGuardrailGuidance };