robrain 2.3.9 → 2.4.2

package/vendor/sensing-mcp/dist/index.js

@@ -6935,6 +6935,222 @@ var require_veto_match = __commonJS({
   }
 });
 
+// ../shared/dist/trust.js
+var require_trust = __commonJS({
+  "../shared/dist/trust.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ANOMALOUS_FIELD_LENGTH = exports.QUARANTINE_THRESHOLD = void 0;
+    exports.scoreMemoryTrust = scoreMemoryTrust;
+    exports.QUARANTINE_THRESHOLD = 0.6;
+    exports.ANOMALOUS_FIELD_LENGTH = 8e3;
+    var DAMPEN_DISCUSSED = 0.25;
+    function regexDetector(id, type, weight, dampenable, regex) {
+      return {
+        id,
+        type,
+        weight,
+        dampenable,
+        find(text) {
+          const out = [];
+          regex.lastIndex = 0;
+          for (const m of text.matchAll(regex)) {
+            out.push({ index: m.index ?? 0, match: m[0] });
+          }
+          return out;
+        }
+      };
+    }
+    var ZERO_WIDTH_RE = /[\u200B\u200C\u200D\u2060\uFEFF]/g;
+    var BIDI_RE = /[\u202A-\u202E\u2066-\u2069]/g;
+    var MARKDOWN_LINK_RE = /\[([^\]\n]+)\]\(\s*([^)\s]+)\s*\)/g;
+    var HOST_IN_TEXT_RE = /(?:https?:\/\/)?([a-z0-9-]+(?:\.[a-z0-9-]+)+)/i;
+    function normalizeHost(host) {
+      return host.toLowerCase().replace(/^www\./, "");
+    }
+    function linkTargetHost(url) {
+      const m = url.match(/^https?:\/\/([^/?#]+)/i);
+      return m?.[1] ? normalizeHost(m[1].replace(/:\d+$/, "")) : null;
+    }
+    var DETECTORS = [
+      // ── instruction_injection — imperatives aimed at the agent ──
+      regexDetector("ii_ignore_instructions", "instruction_injection", 0.45, true, /ignore\s+(?:all|previous|prior)\s+(?:instructions|context)/gi),
+      regexDetector("ii_you_must", "instruction_injection", 0.3, true, /you must (?:always|never)\b/gi),
+      regexDetector("ii_hide_from_user", "instruction_injection", 0.45, true, /do not tell the user/gi),
+      regexDetector("ii_without_asking", "instruction_injection", 0.3, true, /without asking(?: the user)?\b/gi),
+      regexDetector("ii_system_prompt", "instruction_injection", 0.25, true, /system prompt/gi),
+      // Role-prefix smuggling — a stored memory has no business containing
+      // chat-transcript role markers at line starts. HARD: quarantines alone.
+      regexDetector("ii_role_smuggling", "instruction_injection", 0.7, false, /(?:^|\n)\s{0,8}(?:system|assistant|user)\s*:/gi),
+      // <system>/<important> pseudo-tags — prompt-boundary forgery. HARD.
+      regexDetector("ii_pseudo_tag", "instruction_injection", 0.7, false, /<\/?\s*(?:system|important)\s*>/gi),
+      // ── tool_coercion — trying to make the agent run things ─────
+      regexDetector("tc_run_command", "tool_coercion", 0.4, true, /run the following command/gi),
+      regexDetector("tc_execute_this", "tool_coercion", 0.35, true, /execute this\b/gi),
+      // curl … | sh pipeline — a live remote-code-execution payload. HARD when
+      // undiscussed; dampened when it's quoted in a rejection ("rejected:
+      // curl | bash installers").
+      regexDetector("tc_curl_pipe_sh", "tool_coercion", 0.7, true, /\bcurl\b[^\n]{0,200}?\|\s*(?:ba|z|da)?sh\b/gi),
+      regexDetector("tc_rm_rf", "tool_coercion", 0.5, true, /\brm\s+-rf\b/g),
+      regexDetector("tc_bashrc", "tool_coercion", 0.5, true, /add[^\n]{0,40}\.(?:bashrc|zshrc|profile)\b/gi),
+      // ── link_smuggling — URI schemes + text/host mismatch ───────
+      regexDetector("ls_javascript_uri", "link_smuggling", 0.7, true, /\bjavascript:\s*\S/gi),
+      regexDetector("ls_data_uri", "link_smuggling", 0.7, true, /\bdata:[a-z]+\/[a-z0-9.+-]+[;,]/gi),
+      {
+        id: "ls_text_host_mismatch",
+        type: "link_smuggling",
+        weight: 0.5,
+        dampenable: true,
+        find(text) {
+          const out = [];
+          MARKDOWN_LINK_RE.lastIndex = 0;
+          for (const m of text.matchAll(MARKDOWN_LINK_RE)) {
+            const [, linkText, target] = m;
+            if (linkText === void 0 || target === void 0)
+              continue;
+            const targetHost = linkTargetHost(target);
+            if (!targetHost)
+              continue;
+            const textHost = linkText.match(HOST_IN_TEXT_RE)?.[1];
+            if (!textHost)
+              continue;
+            const shown = normalizeHost(textHost);
+            if (targetHost === shown || targetHost.endsWith(`.${shown}`) || shown.endsWith(`.${targetHost}`))
+              continue;
+            out.push({ index: m.index ?? 0, match: m[0] });
+          }
+          return out;
+        }
+      },
+      // ── invisible_unicode — HARD, never dampened ────────────────
+      {
+        id: "iu_zero_width",
+        type: "invisible_unicode",
+        weight: 0.9,
+        dampenable: false,
+        find: (text) => invisibleOccurrences(text, ZERO_WIDTH_RE, "zero-width")
+      },
+      {
+        id: "iu_bidi",
+        type: "invisible_unicode",
+        weight: 0.9,
+        dampenable: false,
+        find: (text) => invisibleOccurrences(text, BIDI_RE, "bidi-override")
+      },
+      // ── encoded_blob — opaque payloads have no place in a decision ──
+      {
+        id: "eb_base64",
+        type: "encoded_blob",
+        weight: 0.7,
+        dampenable: false,
+        find(text) {
+          const out = [];
+          for (const m of text.matchAll(/[A-Za-z0-9+/]{120,}={0,2}/g)) {
+            const run = m[0];
+            if (!/\d/.test(run) || !/[a-z]/.test(run) || !/[A-Z]/.test(run))
+              continue;
+            out.push({ index: m.index ?? 0, match: run, evidence: `base64-like run of ${run.length} chars: ${run.slice(0, 40)}\u2026` });
+          }
+          return out;
+        }
+      },
+      {
+        id: "eb_hex",
+        type: "encoded_blob",
+        weight: 0.7,
+        dampenable: false,
+        find(text) {
+          const out = [];
+          for (const m of text.matchAll(/[0-9a-fA-F]{160,}/g)) {
+            if (!/\d/.test(m[0]))
+              continue;
+            out.push({ index: m.index ?? 0, match: m[0], evidence: `hex run of ${m[0].length} chars: ${m[0].slice(0, 40)}\u2026` });
+          }
+          return out;
+        }
+      }
+    ];
+    function invisibleOccurrences(text, re, label) {
+      re.lastIndex = 0;
+      const matches = [...text.matchAll(re)];
+      const first = matches[0];
+      if (!first)
+        return [];
+      const codepoints = [...new Set(matches.map((m) => `U+${(m[0].codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}`))];
+      return [{
+        index: first.index ?? 0,
+        match: first[0],
+        evidence: `${matches.length}\xD7 ${label} char${matches.length === 1 ? "" : "s"} (${codepoints.join(", ")}) near "${excerptAround(text, first.index ?? 0)}"`
+      }];
+    }
+    var DISCUSSION_MARKER_RE = /(?:reject(?:ed|ing)?|rule[sd]?\s+out|sanitiz\w*|redact\w*|filter\w*|detect\w*|scan\w*|block\w*|flag\w*|strip\w*|escap\w*|guard\w*|forbid\w*|ban(?:ned|ning)?|avoid\w*|never\s+(?:use|run|allow)|do(?:n't| not)\s+(?:use|run|allow)|disallow\w*|prevent\w*|against|instead\s+of|pattern[s]?|attack[s]?|inject\w*|poison\w*|phish\w*|malicious|risk[sy]?|vulnerab\w*|supply.chain|e\.g\.|such\s+as|example[s]?|like\s+["'`])/i;
+    var QUOTE_CHARS = /* @__PURE__ */ new Set(['"', "'", "`", "\u2018", "\u2019", "\u201C", "\u201D"]);
+    function inDiscussedContext(text, index) {
+      const before = text.slice(Math.max(0, index - 100), index);
+      if (DISCUSSION_MARKER_RE.test(before))
+        return true;
+      const lineStart = text.lastIndexOf("\n", index) + 1;
+      const linePrefix = text.slice(lineStart, index);
+      let quotes = 0;
+      for (const ch of linePrefix)
+        if (QUOTE_CHARS.has(ch))
+          quotes += 1;
+      return quotes % 2 === 1;
+    }
+    var EVIDENCE_MAX = 80;
+    function escapeInvisible(s) {
+      return s.replace(/[\u200B-\u200D\u2060\uFEFF\u202A-\u202E\u2066-\u2069]/g, (ch) => `U+${(ch.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}`);
+    }
+    function excerpt(s) {
+      const oneLine = escapeInvisible(s).replace(/\s+/g, " ").trim();
+      return oneLine.length <= EVIDENCE_MAX ? oneLine : `${oneLine.slice(0, EVIDENCE_MAX - 1)}\u2026`;
+    }
+    function excerptAround(text, index) {
+      return excerpt(text.slice(Math.max(0, index - 20), index + 20));
+    }
+    var MAX_FLAGS = 20;
+    function scoreMemoryTrust(texts) {
+      const hits = /* @__PURE__ */ new Map();
+      for (const text of texts) {
+        if (!text)
+          continue;
+        for (const det of DETECTORS) {
+          for (const occ of det.find(text)) {
+            const dampened = det.dampenable && inDiscussedContext(text, occ.index);
+            const weight = dampened ? det.weight * DAMPEN_DISCUSSED : det.weight;
+            const prev = hits.get(det.id);
+            if (prev && prev.weight >= weight)
+              continue;
+            hits.set(det.id, {
+              type: det.type,
+              weight,
+              evidence: occ.evidence ?? excerpt(occ.match)
+            });
+          }
+        }
+        if (text.length > exports.ANOMALOUS_FIELD_LENGTH) {
+          const prev = hits.get("anomalous_length");
+          if (!prev) {
+            hits.set("anomalous_length", {
+              type: "anomalous_length",
+              weight: 0.3,
+              evidence: `field length ${text.length} > ${exports.ANOMALOUS_FIELD_LENGTH}`
+            });
+          }
+        }
+      }
+      let survival = 1;
+      const flags = [];
+      for (const hit of [...hits.values()].sort((a, b) => b.weight - a.weight)) {
+        survival *= 1 - hit.weight;
+        if (flags.length < MAX_FLAGS)
+          flags.push({ type: hit.type, evidence: hit.evidence });
+      }
+      return { score: Math.round((1 - survival) * 100) / 100, flags };
+    }
+  }
+});
+
 // ../shared/dist/extract-decision.js
 var require_extract_decision = __commonJS({
   "../shared/dist/extract-decision.js"(exports) {
@@ -7070,6 +7286,7 @@ var require_dist = __commonJS({
     __exportStar(require_embeddings(), exports);
     __exportStar(require_redact(), exports);
     __exportStar(require_veto_match(), exports);
+    __exportStar(require_trust(), exports);
     __exportStar(require_extract_decision(), exports);
     __exportStar(require_db(), exports);
   }
@@ -22491,6 +22708,9 @@ var init_mcp = __esm({
 // src/config.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
+function isThinMode(env = process.env) {
+  return env.ROBRAIN_MODE?.trim().toLowerCase() === "cloud";
+}
 var import_shared, config2;
 var init_config = __esm({
   "src/config.ts"() {
@@ -22699,7 +22919,7 @@ function inferScope(turn, extracted) {
   return "team";
 }
 async function classifyTopicShift(turn, signal) {
-  if (config2.topicShiftDisableEmbedding) return null;
+  if (config2.topicShiftDisableEmbedding || isThinMode()) return null;
   const sessionId = turn.session_id;
   const window = embeddingWindows.get(sessionId) ?? [];
   const currentEmbedding = await embed(turn.user_message, signal);
@@ -23062,7 +23282,7 @@ function resolveSessionId(raw) {
 function buildServer() {
   const server = new McpServer({
     name: "sensing-mcp",
-    version: "2.3.9"
+    version: "2.4.2"
   });
   server.tool(
     "sensing_start_session",
@@ -23159,6 +23379,16 @@ function buildServer() {
       const projectId = session.project_id;
       setImmediate(async () => {
         try {
+          if (isThinMode()) {
+            const errors = await routeFlushTurns([turn], projectId);
+            if (errors.length === 0) {
+              lastDecisionShipFailure = null;
+              streamBuffer.markClassified(session_id, sequence);
+            } else {
+              lastDecisionShipFailure = `${session_id} seq ${sequence}: ${errors.join("; ")}`;
+            }
+            return;
+          }
           const decisionSignal = await classifyDecision(turn, projectId);
           if (decisionSignal) {
             const outcome = await routeDecisionSignal(decisionSignal, projectId);
@@ -23259,6 +23489,8 @@ function buildServer() {
         content: [{
           type: "text",
           text: JSON.stringify({
+            // Only surfaced in thin mode so full-mode status output stays byte-identical.
+            ...isThinMode() ? { mode: "cloud-thin" } : {},
             session_found: !!session,
             project_id: session?.project_id,
             started_at: session?.started_at,

package/vendor/sensing-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robrain/sensing-mcp",
-  "version": "2.3.9",
+  "version": "2.4.2",
   "private": true,
   "type": "module",
   "main": "./dist/index.js"