shieldcortex 4.27.2 → 4.27.3

package/dist/defence/trust/env-detector.d.ts

@@ -41,3 +41,34 @@ export declare function resolveSource(declaredSource?: DefenceSource, strictMode
     inferred: boolean;
     detection?: EnvDetectionResult;
 };
+export interface CeilingClampResult {
+    /** The effective source after clamping (declared if safe, env-inferred otherwise). */
+    source: DefenceSource;
+    /** True when the declared source claimed higher trust than the runtime environment justifies. */
+    clamped: boolean;
+    /** Trust score of the declared source (only meaningful when a declared source was passed). */
+    declaredScore: number | null;
+    /** Trust score the runtime environment actually permits. */
+    ceilingScore: number;
+    /** The environment-inferred source used as the trust ceiling. */
+    ceiling: DefenceSource;
+    /** Detection metadata for the environment inference. */
+    detection: EnvDetectionResult;
+}
+/**
+ * Clamp a caller-declared source against the environment-inferred trust ceiling.
+ *
+ * MCP callers are arbitrary processes — a prompt-injected agent could claim
+ * `{type:'user', identifier:'direct'}` to get trust=1.0 and bypass quarantine.
+ * To prevent that, we compute the highest trust the actual runtime allows
+ * (from env vars like CLAUDE_CODE_ENTRYPOINT) and refuse any declared source
+ * that would score higher.
+ *
+ * Semantics:
+ * - If no declared source: return env-inferred (no clamping).
+ * - If declaredScore <= ceilingScore: trust the declared source (allows
+ *   legitimate downgrades, e.g. an agent labelling input as `email`).
+ * - If declaredScore > ceilingScore: drop the declared source and use the
+ *   env-inferred one, with `clamped: true` so the caller can audit it.
+ */
+export declare function clampSourceToCeiling(declaredSource: DefenceSource | undefined): CeilingClampResult;

package/dist/defence/trust/env-detector.js

@@ -8,6 +8,7 @@
  * This addresses Phase 1 limitation: "security is opt-in" — with env detection,
  * Claude Code agents get correct trust automatically with zero configuration.
  */
+import { scoreSource } from './source-scorer.js';
 /**
  * Infer caller source from process environment variables.
  *
@@ -114,3 +115,52 @@ export function resolveSource(declaredSource, strictMode = false) {
         detection,
     };
 }
+/**
+ * Clamp a caller-declared source against the environment-inferred trust ceiling.
+ *
+ * MCP callers are arbitrary processes — a prompt-injected agent could claim
+ * `{type:'user', identifier:'direct'}` to get trust=1.0 and bypass quarantine.
+ * To prevent that, we compute the highest trust the actual runtime allows
+ * (from env vars like CLAUDE_CODE_ENTRYPOINT) and refuse any declared source
+ * that would score higher.
+ *
+ * Semantics:
+ * - If no declared source: return env-inferred (no clamping).
+ * - If declaredScore <= ceilingScore: trust the declared source (allows
+ *   legitimate downgrades, e.g. an agent labelling input as `email`).
+ * - If declaredScore > ceilingScore: drop the declared source and use the
+ *   env-inferred one, with `clamped: true` so the caller can audit it.
+ */
+export function clampSourceToCeiling(declaredSource) {
+    const detection = inferSourceFromEnvironment();
+    const ceilingScore = scoreSource(detection.source).score;
+    if (!declaredSource) {
+        return {
+            source: detection.source,
+            clamped: false,
+            declaredScore: null,
+            ceilingScore,
+            ceiling: detection.source,
+            detection,
+        };
+    }
+    const declaredScore = scoreSource(declaredSource).score;
+    if (declaredScore > ceilingScore) {
+        return {
+            source: detection.source,
+            clamped: true,
+            declaredScore,
+            ceilingScore,
+            ceiling: detection.source,
+            detection,
+        };
+    }
+    return {
+        source: declaredSource,
+        clamped: false,
+        declaredScore,
+        ceilingScore,
+        ceiling: detection.source,
+        detection,
+    };
+}

package/dist/defence/trust/index.d.ts

@@ -2,7 +2,10 @@ export { scoreSource } from './source-scorer.js';
 export { filterByTrust } from './recall-filter.js';
 export { scoreAgent, getAgentDepth, buildAgentHierarchy } from './agent-scorer.js';
 export { checkAccess } from './access-control.js';
-export { inferSourceFromEnvironment, resolveSource } from './env-detector.js';
+export { inferSourceFromEnvironment, resolveSource, clampSourceToCeiling } from './env-detector.js';
+export type { CeilingClampResult } from './env-detector.js';
+export { resolveToolSource } from './resolve-tool-source.js';
+export type { ResolveToolSourceOptions } from './resolve-tool-source.js';
 export type { AccessPolicy, AccessCheckMemory } from './access-control.js';
 export type { AgentTrustConfig } from './agent-scorer.js';
 export type { EnvDetectionResult } from './env-detector.js';

package/dist/defence/trust/index.js

@@ -2,4 +2,5 @@ export { scoreSource } from './source-scorer.js';
 export { filterByTrust } from './recall-filter.js';
 export { scoreAgent, getAgentDepth, buildAgentHierarchy } from './agent-scorer.js';
 export { checkAccess } from './access-control.js';
-export { inferSourceFromEnvironment, resolveSource } from './env-detector.js';
+export { inferSourceFromEnvironment, resolveSource, clampSourceToCeiling } from './env-detector.js';
+export { resolveToolSource } from './resolve-tool-source.js';

package/dist/defence/trust/resolve-tool-source.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Resolve and harden the source of an MCP tool call.
+ *
+ * MCP callers can self-declare any source they like. This module:
+ * 1. Always computes the environment-inferred trust ceiling first.
+ * 2. Clamps any over-claimed declared source down to that ceiling.
+ * 3. Writes a `SOURCE_ELEVATION_BLOCKED` row to defence_audit when a clamp
+ *    happens, so operators can spot prompt-injection trying to escalate
+ *    its own trust.
+ * 4. Writes a `SOURCE_MISSING` row when no source was declared, preserving
+ *    the existing visibility into unconfigured callers.
+ */
+import type { DefenceSource } from '../types.js';
+export interface ResolveToolSourceOptions {
+    /** Tool name (e.g. 'remember', 'recall') — recorded in the audit reason. */
+    toolName: string;
+    /** Active project scope, recorded on the audit row. */
+    project: string | null;
+}
+/**
+ * Resolve the effective source for an MCP tool call.
+ *
+ * Returns the source the rest of the pipeline should use. When a caller
+ * over-claims trust the declared source is dropped, an audit row is written,
+ * and the env-inferred source is returned instead.
+ */
+export declare function resolveToolSource(declaredSource: DefenceSource | undefined, options: ResolveToolSourceOptions): DefenceSource;

package/dist/defence/trust/resolve-tool-source.js

@@ -0,0 +1,80 @@
+/**
+ * Resolve and harden the source of an MCP tool call.
+ *
+ * MCP callers can self-declare any source they like. This module:
+ * 1. Always computes the environment-inferred trust ceiling first.
+ * 2. Clamps any over-claimed declared source down to that ceiling.
+ * 3. Writes a `SOURCE_ELEVATION_BLOCKED` row to defence_audit when a clamp
+ *    happens, so operators can spot prompt-injection trying to escalate
+ *    its own trust.
+ * 4. Writes a `SOURCE_MISSING` row when no source was declared, preserving
+ *    the existing visibility into unconfigured callers.
+ */
+import { clampSourceToCeiling } from './env-detector.js';
+import { logAudit } from '../audit/logger.js';
+/**
+ * Resolve the effective source for an MCP tool call.
+ *
+ * Returns the source the rest of the pipeline should use. When a caller
+ * over-claims trust the declared source is dropped, an audit row is written,
+ * and the env-inferred source is returned instead.
+ */
+export function resolveToolSource(declaredSource, options) {
+    const clampResult = clampSourceToCeiling(declaredSource);
+    const { source, clamped, declaredScore, ceilingScore, detection } = clampResult;
+    if (clamped && declaredSource) {
+        try {
+            logAudit({
+                memory_id: null,
+                project: options.project,
+                timestamp: new Date().toISOString(),
+                source_type: source.type,
+                source_identifier: source.identifier,
+                trust_score: ceilingScore,
+                sensitivity_level: 'PUBLIC',
+                firewall_result: 'BLOCK',
+                anomaly_score: 0,
+                threat_indicators: JSON.stringify(['privilege_escalation']),
+                blocked_patterns: '[]',
+                reason: `SOURCE_ELEVATION_BLOCKED: tool=${options.toolName}, ` +
+                    `declared=${declaredSource.type}:${declaredSource.identifier} (score=${declaredScore}), ` +
+                    `clamped=${source.type}:${source.identifier} (score=${ceilingScore}) ` +
+                    `via ${detection.method} (confidence: ${detection.confidence})`,
+                fragmentation_score: null,
+                pipeline_duration_ms: null,
+            });
+        }
+        catch {
+            // Audit logging must never break tool execution.
+        }
+        return source;
+    }
+    // No declared source — inferred from environment. Preserve the existing
+    // SOURCE_MISSING visibility so operators see unconfigured callers.
+    if (!declaredSource) {
+        try {
+            logAudit({
+                memory_id: null,
+                project: options.project,
+                timestamp: new Date().toISOString(),
+                source_type: source.type,
+                source_identifier: source.identifier,
+                trust_score: 0,
+                sensitivity_level: 'PUBLIC',
+                firewall_result: 'ALLOW',
+                anomaly_score: 0,
+                threat_indicators: '[]',
+                blocked_patterns: '[]',
+                reason: `SOURCE_MISSING: tool=${options.toolName}, ` +
+                    `inferred=${source.type}:${source.identifier} ` +
+                    `via ${detection.method} (confidence: ${detection.confidence})`,
+                fragmentation_score: null,
+                pipeline_duration_ms: null,
+            });
+        }
+        catch {
+            // Audit logging must never break tool execution.
+        }
+    }
+    return source;
+}

package/dist/server.js

@@ -22,16 +22,22 @@ import { handleGraphQuery, handleGraphEntities, handleGraphExplain } from './too
 import { checkDatabaseSize } from './database/init.js';
 import { queryAuditLogs, getAuditStats, getLifetimeStats } from './defence/audit/index.js';
 import { scanExistingMemories } from './defence/scanner/index.js';
-import { resolveSource } from './defence/trust/env-detector.js';
-import { logAudit } from './defence/audit/logger.js';
+import { resolveToolSource as resolveToolSourceImpl } from './defence/trust/resolve-tool-source.js';
 import { scanToolResponse, shouldScanToolResponse } from './defence/tool-response-scanner.js';
 import { getToolResponseScanConfig } from './cloud/config.js';
 import { isKillSwitchActive, getKillSwitchMeta, assertOperationAllowed, activateKillSwitch, deactivateKillSwitch, KillSwitchError, } from './api/control.js';
-// Shared source schema for access control on MCP tools
+// Shared source schema for access control on MCP tools.
+// NOTE: 'user' is intentionally NOT accepted from MCP callers. MCP tools are
+// always invoked by an agent, hook, CLI or API — never by a literal human
+// typing — so accepting type:'user' would let a prompt-injected agent
+// self-attest as the human operator and earn trust=1.0, bypassing the
+// quarantine band and RESTRICTED read gating. The 'user' type still exists
+// internally for things like dashboard-originated writes, but it must never
+// be honoured when it arrives over the MCP transport.
 const sourceParam = z.object({
-    type: z.enum(['user', 'cli', 'hook', 'email', 'web', 'agent', 'file', 'api', 'tool_response']),
+    type: z.enum(['cli', 'hook', 'email', 'web', 'agent', 'file', 'api', 'tool_response']),
     identifier: z.string(),
-}).optional().describe('Caller identity for access control (agents should pass this)');
+}).optional().describe('Caller identity for access control (agents should pass this). type:"user" is rejected — MCP is never a human channel.');
 /**
  * Wrap an MCP tool handler to scan its response for threats.
  * Advisory mode: appends a warning but never blocks.
@@ -67,35 +73,19 @@ function withResponseScan(toolName, handler) {
     };
 }
 /**
- * Resolve source for an MCP tool call, inferring from environment if not declared.
- * Logs an audit warning when source is missing (gives operators visibility).
+ * Resolve source for an MCP tool call.
+ *
+ * Delegates to the env-ceiling clamp helper, which:
+ * - Drops any caller-declared source that claims higher trust than the
+ *   runtime environment justifies (writes SOURCE_ELEVATION_BLOCKED to audit).
+ * - Falls back to env-inferred source when none was declared (writes
+ *   SOURCE_MISSING to audit for operator visibility).
  */
 function resolveToolSource(declaredSource, toolName) {
-    const { source, inferred, detection } = resolveSource(declaredSource);
-    if (inferred) {
-        try {
-            logAudit({
-                memory_id: null,
-                project: getActiveProject(),
-                timestamp: new Date().toISOString(),
-                source_type: source.type,
-                source_identifier: source.identifier,
-                trust_score: 0,
-                sensitivity_level: 'PUBLIC',
-                firewall_result: 'ALLOW',
-                anomaly_score: 0,
-                threat_indicators: '[]',
-                blocked_patterns: '[]',
-                reason: `SOURCE_MISSING: tool=${toolName}, inferred=${source.type}:${source.identifier} via ${detection?.method ?? 'default'} (confidence: ${detection?.confidence ?? 'low'})`,
-                fragmentation_score: null,
-                pipeline_duration_ms: null,
-            });
-        }
-        catch {
-            // Audit logging should never break tool execution
-        }
-    }
-    return source;
+    return resolveToolSourceImpl(declaredSource, {
+        toolName,
+        project: getActiveProject(),
+    });
 }
 /**
  * Wrap an MCP tool handler to enforce kill switch lockdown.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.27.2",
+  "version": "4.27.3",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -61,7 +61,8 @@
     "bench:smoke": "SHIELDCORTEX_SKIP_EMBEDDINGS=1 tsx benchmark/longmemeval/run.ts --quiet",
     "audit:security": "npm audit --audit-level=moderate",
     "prepack": "node scripts/ensure-bin-executable.mjs",
-    "prepublishOnly": "npm run build"
+    "version": "node scripts/sync-plugin-version.mjs && git add plugins/openclaw/package.json plugins/openclaw/openclaw.plugin.json",
+    "prepublishOnly": "node scripts/sync-plugin-version.mjs --check && npm run build"
   },
   "keywords": [
     "ai-memory",