shieldcortex 4.15.0 → 4.17.0

package/dist/sessions/import-jsonl.js

@@ -0,0 +1,193 @@
+/**
+ * JSONL transcript importer for Claude Code session files.
+ *
+ * Claude Code writes session transcripts to `~/.claude/projects/<slug>/
+ * <session-uuid>.jsonl`. Each line is a JSON object. Conversation lines
+ * have shape `{type, sessionId, timestamp, message: {role, content}}`
+ * where `content` is an Anthropic SDK content-block array
+ * (`text|thinking|tool_use|tool_result`).
+ *
+ * Mapping to `session_events.kind`:
+ *
+ *   user.text         → prompt
+ *   assistant.text    → response
+ *   assistant.tool_use → tool_call
+ *   user.tool_result  → tool_result
+ *   thinking          → (skipped — not user-replayable in v1)
+ *
+ * Non-conversation lines (`ai-title`, `attachment`, `system`,
+ * `queue-operation`, etc.) are skipped. Idempotent on re-import: each
+ * row carries a sha256 `content_hash` of `kind|payload`, and the
+ * `idx_session_events_dedupe` UNIQUE index drops collisions silently
+ * via `INSERT OR IGNORE`.
+ *
+ * Lossy by design — agentmemory documents the same scope:
+ *   - Anthropic-internal cache markers, partial-message frames, and
+ *     non-string tool_result encodings beyond plain text are not
+ *     preserved.
+ *   - Things we WILL preserve: prompts, assistant text, tool name +
+ *     args + result, and timestamps.
+ */
+import { readFileSync, existsSync } from 'fs';
+import { createHash } from 'crypto';
+import { getDatabase } from '../database/init.js';
+/**
+ * Pure mapper: one transcript line → 0..N `SessionEventInput`s.
+ *
+ * Exported so unit tests can exercise the mapping in isolation without
+ * standing up a database. Returns `[]` for any line that doesn't yield
+ * replayable events (thinking blocks, ai-title, missing fields, etc.) —
+ * the caller treats an empty array as "skipped".
+ */
+export function parseTranscriptLine(line) {
+    if (!line || typeof line !== 'object')
+        return [];
+    const l = line;
+    // Only conversation lines yield events.
+    if (l.type !== 'user' && l.type !== 'assistant')
+        return [];
+    if (typeof l.sessionId !== 'string' || l.sessionId.length === 0)
+        return [];
+    if (typeof l.timestamp !== 'string' || l.timestamp.length === 0)
+        return [];
+    const content = l.message?.content;
+    if (!Array.isArray(content) || content.length === 0)
+        return [];
+    const events = [];
+    for (const block of content) {
+        const event = blockToEvent(block, l);
+        if (event)
+            events.push(event);
+    }
+    return events;
+}
+function blockToEvent(block, line) {
+    const session_id = line.sessionId;
+    const ts = line.timestamp;
+    if (block.type === 'thinking')
+        return null;
+    if (block.type === 'text' && line.type === 'user') {
+        const text = typeof block.text === 'string' ? block.text : '';
+        if (!text)
+            return null;
+        return { session_id, ts, kind: 'prompt', payload: { text } };
+    }
+    if (block.type === 'text' && line.type === 'assistant') {
+        const text = typeof block.text === 'string' ? block.text : '';
+        if (!text)
+            return null;
+        return {
+            session_id,
+            ts,
+            kind: 'response',
+            payload: { text },
+            actor: 'assistant',
+        };
+    }
+    if (block.type === 'tool_use' && line.type === 'assistant') {
+        const toolBlock = block;
+        return {
+            session_id,
+            ts,
+            kind: 'tool_call',
+            payload: {
+                tool_use_id: toolBlock.id ?? null,
+                name: toolBlock.name ?? null,
+                input: toolBlock.input ?? null,
+            },
+            actor: 'assistant',
+        };
+    }
+    if (block.type === 'tool_result' && line.type === 'user') {
+        const tr = block;
+        return {
+            session_id,
+            ts,
+            kind: 'tool_result',
+            payload: {
+                tool_use_id: tr.tool_use_id ?? null,
+                content: tr.content ?? null,
+            },
+        };
+    }
+    return null;
+}
+/** SHA-256 of `kind|payload-as-canonical-json`. 64-char hex string. */
+function hashEvent(kind, payload) {
+    const canonical = typeof payload === 'string' ? payload : JSON.stringify(payload ?? null);
+    return createHash('sha256').update(`${kind}|${canonical}`).digest('hex');
+}
+const INSERT_OR_IGNORE_SQL = `
+  INSERT OR IGNORE INTO session_events
+    (session_id, project, ts, kind, actor, payload, duration_ms, audit_id, content_hash)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+`;
+/**
+ * Import one JSONL file. Wraps the whole import in a single transaction
+ * so a mid-file error rolls back cleanly — better-sqlite3's transaction
+ * helper restores DB state if the callback throws. Malformed lines do
+ * NOT throw — they're counted and skipped so a single bad row never
+ * blocks the rest of the file.
+ */
+export function importJsonlTranscript(path) {
+    if (!existsSync(path)) {
+        throw new Error(`JSONL transcript not found: ${path}`);
+    }
+    const raw = readFileSync(path, 'utf-8');
+    const lines = raw.split(/\r?\n/);
+    const rows = [];
+    let sessionId = null;
+    let skipped = 0;
+    let malformed = 0;
+    for (const rawLine of lines) {
+        const trimmed = rawLine.trim();
+        if (trimmed.length === 0)
+            continue; // blank lines aren't skipped — they're just whitespace
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            malformed++;
+            skipped++;
+            continue;
+        }
+        const events = parseTranscriptLine(parsed);
+        if (events.length === 0) {
+            skipped++;
+            continue;
+        }
+        if (sessionId === null && events[0]?.session_id) {
+            sessionId = events[0].session_id;
+        }
+        for (const event of events) {
+            rows.push({
+                ...event,
+                content_hash: hashEvent(event.kind, event.payload),
+            });
+        }
+    }
+    if (rows.length === 0) {
+        return { sessionId, eventCount: 0, skipped, malformed };
+    }
+    const db = getDatabase();
+    const stmt = db.prepare(INSERT_OR_IGNORE_SQL);
+    const before = db.prepare('SELECT COUNT(*) AS c FROM session_events').get().c;
+    const tx = db.transaction((batch) => {
+        for (const row of batch) {
+            stmt.run(row.session_id, row.project ?? null, row.ts, row.kind, row.actor ?? null, typeof row.payload === 'string' ? row.payload : JSON.stringify(row.payload ?? null), row.duration_ms ?? null, row.audit_id ?? null, row.content_hash);
+        }
+    });
+    tx(rows);
+    const after = db.prepare('SELECT COUNT(*) AS c FROM session_events').get().c;
+    const inserted = after - before;
+    // `eventCount` reflects the total events parsed from this file regardless
+    // of whether the dedupe index dropped them. Caller can compare to
+    // `inserted` (via row count diff) to see how many were duplicates.
+    return {
+        sessionId,
+        eventCount: rows.length,
+        skipped: skipped + (rows.length - inserted),
+        malformed,
+    };
+}

package/dist/sessions/timeline.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Session capture — read side.
+ *
+ * `getTimeline(sessionId)` returns every event for a session, sorted
+ * by `ts` ascending, with payload JSON.parse'd back into a JS value
+ * (or surfaced as a raw string when the payload was deliberately
+ * stored as plain text). Powers the dashboard replay scrubber.
+ *
+ * Kept deliberately minimal — pagination, filtering by kind, and
+ * cross-session timelines belong on the API route (`./api/routes/
+ * sessions.ts`) above, not in this reader.
+ */
+import type { SessionEventKind } from './capture.js';
+export interface SessionEventRow {
+    id: number;
+    session_id: string;
+    project: string | null;
+    ts: string;
+    kind: SessionEventKind;
+    actor: string | null;
+    /** Parsed JSON (object/array/primitive) or raw string fall-through. */
+    payload: unknown;
+    duration_ms: number | null;
+    audit_id: number | null;
+    created_at: string;
+}
+/** All events for a session, in `ts` ascending order. */
+export declare function getTimeline(sessionId: string): SessionEventRow[];

package/dist/sessions/timeline.js

@@ -0,0 +1,52 @@
+/**
+ * Session capture — read side.
+ *
+ * `getTimeline(sessionId)` returns every event for a session, sorted
+ * by `ts` ascending, with payload JSON.parse'd back into a JS value
+ * (or surfaced as a raw string when the payload was deliberately
+ * stored as plain text). Powers the dashboard replay scrubber.
+ *
+ * Kept deliberately minimal — pagination, filtering by kind, and
+ * cross-session timelines belong on the API route (`./api/routes/
+ * sessions.ts`) above, not in this reader.
+ */
+import { getDatabase } from '../database/init.js';
+/**
+ * Reverse of `capture.serialisePayload`: try JSON.parse, fall back to
+ * the raw string if the payload was stored as plain text. We don't
+ * throw on un-parseable — the importer may legitimately ingest non-JSON
+ * tool output, and a replay viewer that crashes on bad data is useless.
+ */
+function deserialisePayload(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function hydrate(row) {
+    return {
+        id: row.id,
+        session_id: row.session_id,
+        project: row.project,
+        ts: row.ts,
+        kind: row.kind,
+        actor: row.actor,
+        payload: deserialisePayload(row.payload),
+        duration_ms: row.duration_ms,
+        audit_id: row.audit_id,
+        created_at: row.created_at,
+    };
+}
+/** All events for a session, in `ts` ascending order. */
+export function getTimeline(sessionId) {
+    const db = getDatabase();
+    const rows = db
+        .prepare(`SELECT id, session_id, project, ts, kind, actor, payload, duration_ms, audit_id, created_at
+       FROM session_events
+       WHERE session_id = ?
+       ORDER BY ts ASC, id ASC`)
+        .all(sessionId);
+    return rows.map(hydrate);
+}

package/hooks/openclaw/cortex-memory/HOOK.md

@@ -64,6 +64,43 @@ Say any of these phrases to trigger an instant save to Cortex memory:
 
 Content after the trigger phrase is extracted and saved as the memory content.
 
+## Defence Audit Guarantees
+
+Every byte that lands in `memories` from the auto-extract path passes the
+6-layer defence pipeline first. The hook write path is no longer the
+bypass it once was:
+
+- **ALLOW** → row inserted into `memories`; a corresponding row appears in
+  `defence_audit` with `source_type = 'hook'` and the hook's identifier
+  (`session-end-hook` / `pre-compact-hook` / `stop-hook`).
+- **QUARANTINE** → row inserted into `quarantine` (not `memories`), linked
+  to the audit row via `audit_id`. Visible in the dashboard for review.
+- **BLOCK** → dropped. The audit row written by the pipeline carries the
+  block reason; nothing reaches `memories`.
+- **Pipeline error** → dropped + a synthetic audit row with reason
+  `pipeline_error: <msg>`. Never silently lose data.
+
+Built-in firewall rules covering instruction injection, hidden
+instruction, imperative tool-call directives ("call X tool now"), command
+injection, and credential leaks (AWS / JWT / private keys) are seeded
+into `firewall_rules` on first run with `built_in = 1`. They are
+evaluated on every tier (the Pro `custom_firewall_rules` gate applies
+only to user-added rules) and excluded from the user-facing 25-rule cap.
+
+The chunker also rejects malformed candidates *before* they reach the
+write path: imperative tool-calls, bare-imperative starts ("commit
+secrets" with the negation dropped), email-body bleed, and path-label
+fragments. Auto-extracted memories are now capped at salience 0.6
+(reserved 1.0 for LLM-rated future paths).
+
+To audit an existing database for malformed rows accumulated before this
+fix:
+
+```bash
+shieldcortex memories purge --malformed --dry-run    # preview
+shieldcortex memories purge --malformed --execute    # delete (writes a backup first)
+```
+
 ## Auto-Memory
 
 Auto-memory extraction is enabled by default. ShieldCortex complements your existing memory system by capturing decisions, fixes, and learnings with built-in deduplication to avoid noise.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/plugins/openclaw/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,