shieldcortex 4.35.0 → 4.37.0

package/dist/memory/consolidate.js

@@ -408,16 +408,26 @@ export function clusterAndSummarise(options) {
                     bestCount = count;
                 }
             }
-            addMemory({
-                type: 'long_term',
-                category: category,
-                title: summaryTitle,
-                content: summaryContent,
-                project: bestProject || undefined,
-                tags: ['auto-summary'],
-                salience: 0.6,
-            });
-            summariesCreated++;
+            try {
+                addMemory({
+                    type: 'long_term',
+                    category: category,
+                    title: summaryTitle,
+                    content: summaryContent,
+                    project: bestProject || undefined,
+                    tags: ['auto-summary'],
+                    salience: 0.6,
+                }, undefined, 
+                // System-generated consolidation summary — honest cli provenance
+                // (trust 0.9, above the auto-quarantine band so it isn't held).
+                { type: 'cli', identifier: 'consolidate:summary' });
+                summariesCreated++;
+            }
+            catch {
+                // A summary whose content trips the (now-unconditional) defence scan
+                // must NOT abort the whole consolidation transaction — skip it, like the
+                // per-row guard in importMemories.
+            }
         }
         return { clusters, summariesCreated };
     });
@@ -800,22 +810,44 @@ export function exportMemories(project) {
  * Import memories from JSON
  */
 export function importMemories(json) {
-    // Wrap in transaction for atomic import
+    // Wrap in transaction for atomic import. addMemory opens its own nested
+    // transaction (better-sqlite3 SAVEPOINT), so a per-row block rolls back only
+    // that row and the clean rows still commit.
     return withTransaction(() => {
-        const db = getDatabase();
         const memories = JSON.parse(json);
-        const stmt = db.prepare(`
-      INSERT INTO memories (type, category, title, content, project, tags, salience, metadata)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-    `);
+        // SELECT * exports store tags/metadata as JSON TEXT — parse back to the
+        // array/object shapes addMemory expects.
+        const parseJsonField = (value, fallback) => {
+            if (typeof value !== 'string')
+                return value ?? fallback;
+            try {
+                return JSON.parse(value);
+            }
+            catch {
+                return fallback;
+            }
+        };
         let imported = 0;
         for (const memory of memories) {
             try {
-                stmt.run(memory.type, memory.category, memory.title, memory.content, memory.project || null, memory.tags || '[]', memory.salience || 0.5, memory.metadata || '{}');
+                // Route every imported row through the defence pipeline + attribute it
+                // to file:import (trust 0.4 — below the auto-quarantine band). Closes
+                // the raw-INSERT bypass that admitted unscanned rows at trust 1.0 /
+                // 'user:direct'. The pipeline BLOCKs poisoned rows (caught below).
+                addMemory({
+                    type: memory.type,
+                    category: memory.category,
+                    title: String(memory.title ?? ''),
+                    content: String(memory.content ?? ''),
+                    project: typeof memory.project === 'string' ? memory.project : undefined,
+                    tags: parseJsonField(memory.tags, []),
+                    salience: typeof memory.salience === 'number' ? memory.salience : 0.5,
+                    metadata: parseJsonField(memory.metadata, {}),
+                }, DEFAULT_CONFIG, { type: 'file', identifier: 'import' });
                 imported++;
             }
             catch {
-                // Skip duplicates or invalid entries
+                // Skip rows the defence pipeline blocks (poisoned), or invalid entries.
             }
         }
         return imported;

package/dist/memory/lifecycle.js

@@ -26,6 +26,11 @@ import { activateMemory as spreadActivation } from './activation.js';
 import { jaccardSimilarity } from './similarity.js';
 import { emitMemoryAccessed, emitMemoryUpdated, persistEvent, } from '../api/events.js';
 import { createMemoryLink } from './links.js';
+import { runDefencePipeline } from '../defence/index.js';
+// Enrichment text is recall-query / caller-derived (attacker-influenced); scan
+// it before persisting. Trust doesn't matter here (the row keeps its own) — we
+// only act on the firewall verdict, so a low-trust web source is fine.
+const ENRICH_SOURCE = { type: 'web', identifier: 'enrichment' };
 // Cyclic import — see header. getMemoryById/rowToMemory/getMemoriesByType
 // live in store.ts; MAX_CONTENT_SIZE is the per-memory content budget
 // that both truncateContent (store.ts) and enrichMemory (here) honour.
@@ -194,6 +199,14 @@ export function enrichMemory(memoryId, newContext, contextType = 'access') {
     if (newContent.length > MAX_CONTENT_SIZE - 500) {
         return { enriched: false, reason: 'Content size limit reached' };
     }
+    // DEFENCE: re-scan the merged content before persisting — the read-path
+    // analogue of mergeMemories. The appended text comes from a recall query /
+    // caller and could straddle an injection or credential into a clean stored
+    // row. Skip (don't poison) on a non-ALLOW verdict.
+    const defenceResult = runDefencePipeline(newContent, memory.title, ENRICH_SOURCE, undefined, memory.project ?? undefined);
+    if (defenceResult.firewall.result !== 'ALLOW') {
+        return { enriched: false, reason: `Enrichment blocked by defence: ${defenceResult.firewall.reason}` };
+    }
     // Update memory
     db.prepare(`
     UPDATE memories

package/dist/memory/store.d.ts

@@ -7,6 +7,7 @@
 import { Memory, MemoryInput, MemoryType, MemoryConfig } from './types.js';
 import type { DefenceSource } from '../defence/types.js';
 export declare const MAX_CONTENT_SIZE: number;
+export declare const UNATTRIBUTED_SOURCE: DefenceSource;
 /**
  * Get truncation info from the last addMemory call
  */

package/dist/memory/store.js

@@ -32,6 +32,13 @@ import { createMemoryLink, detectRelationships } from './links.js';
 // Anti-bloat: Maximum content size per memory (10KB).
 // Exported because lifecycle.ts also enforces this budget inside enrichMemory.
 export const MAX_CONTENT_SIZE = 10 * 1024;
+// Synthetic source for writes that arrive without an attributed DefenceSource
+// (dashboard REST POST, bulk paths, etc). It MUST score strictly below the
+// 0.5–0.7 auto-quarantine band (web = 0.3) so unattributed writes are SCANNED
+// + stamped low-trust rather than admitted unscanned at trust 1.0 — but are not
+// force-quarantined (which would make every source-less write throw). Closing
+// the old `if (source)` defence-pipeline bypass.
+export const UNATTRIBUTED_SOURCE = { type: 'web', identifier: 'unattributed' };
 // Track truncation info globally for the last addMemory call
 let lastTruncationInfo = null;
 /**
@@ -326,43 +333,46 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
         });
         throw new MemoryBlockedError(`Rate limited: exceeded ${RATE_LIMIT_MAX} writes per minute`);
     }
-    // DEFENCE PIPELINE: Scan content before storage
-    let defenceResult = null;
-    if (source) {
-        defenceResult = runDefencePipeline(input.content, input.title, source, undefined, input.project);
-        // Auto-quarantine sub-agent writes (trust 0.5–0.7)
-        const trust = defenceResult.trust.score;
-        if (defenceResult.allowed && trust >= 0.5 && trust < 0.7) {
-            defenceResult.allowed = false;
-            defenceResult.firewall.result = 'QUARANTINE';
-            defenceResult.firewall.reason = `Sub-agent write (trust=${trust.toFixed(3)}) requires parent approval`;
-            // Pipeline returned ALLOW so pipeline.ts didn't sync quarantine content.
-            // Sync it now since we've overridden to QUARANTINE post-pipeline.
-            if (isFeatureEnabled('cloud_sync'))
-                try {
-                    const indicators = defenceResult.firewall.threatIndicators.map(t => typeof t === 'string' ? t : t.pattern ?? String(t));
-                    syncQuarantineToCloud({
-                        original_content: input.content,
-                        original_title: input.title,
-                        source_type: source.type,
-                        source_identifier: source.identifier,
-                        reason: defenceResult.firewall.reason,
-                        threat_indicators: indicators,
-                        anomaly_score: defenceResult.firewall.anomalyScore,
-                        firewall_result: defenceResult.firewall.result,
-                        project: input.project ?? null,
-                        sensitivity_level: defenceResult.sensitivity.level,
-                    });
-                }
-                catch {
-                    // Cloud sync must never affect local quarantine flow
-                }
-        }
-        if (!defenceResult.allowed) {
-            // Store in quarantine instead of memory
-            quarantineMemory(input, source, defenceResult);
-            throw new MemoryBlockedError(defenceResult.firewall.reason);
-        }
+    // DEFENCE PIPELINE: Scan EVERY write before storage. Source-less writes get a
+    // conservative low-trust synthetic source (UNATTRIBUTED_SOURCE = web:0.3) so
+    // they are still scanned + stamped low-trust instead of admitted unscanned at
+    // trust 1.0 — closing the old `if (source)` bypass. Rate-limiting stays gated
+    // on an explicit source (above) so bulk source-less/import writes aren't
+    // throttled by the shared synthetic key.
+    const effectiveSource = source ?? UNATTRIBUTED_SOURCE;
+    const defenceResult = runDefencePipeline(input.content, input.title, effectiveSource, undefined, input.project);
+    // Auto-quarantine sub-agent writes (trust 0.5–0.7)
+    const trust = defenceResult.trust.score;
+    if (defenceResult.allowed && trust >= 0.5 && trust < 0.7) {
+        defenceResult.allowed = false;
+        defenceResult.firewall.result = 'QUARANTINE';
+        defenceResult.firewall.reason = `Sub-agent write (trust=${trust.toFixed(3)}) requires parent approval`;
+        // Pipeline returned ALLOW so pipeline.ts didn't sync quarantine content.
+        // Sync it now since we've overridden to QUARANTINE post-pipeline.
+        if (isFeatureEnabled('cloud_sync'))
+            try {
+                const indicators = defenceResult.firewall.threatIndicators.map(t => typeof t === 'string' ? t : t.pattern ?? String(t));
+                syncQuarantineToCloud({
+                    original_content: input.content,
+                    original_title: input.title,
+                    source_type: effectiveSource.type,
+                    source_identifier: effectiveSource.identifier,
+                    reason: defenceResult.firewall.reason,
+                    threat_indicators: indicators,
+                    anomaly_score: defenceResult.firewall.anomalyScore,
+                    firewall_result: defenceResult.firewall.result,
+                    project: input.project ?? null,
+                    sensitivity_level: defenceResult.sensitivity.level,
+                });
+            }
+            catch {
+                // Cloud sync must never affect local quarantine flow
+            }
+    }
+    if (!defenceResult.allowed) {
+        // Store in quarantine instead of memory
+        quarantineMemory(input, effectiveSource, defenceResult);
+        throw new MemoryBlockedError(defenceResult.firewall.reason);
     }
     const db = getDatabase();
     // Calculate salience if not provided
@@ -377,7 +387,7 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
     const scope = input.scope ??
         (detectGlobalPattern(input.content, category, tags) ? 'global' : 'project');
     const transferable = input.transferable ?? (scope === 'global' ? 1 : 0);
-    const sourceDetails = inferSourceDetails({ ...input, tags }, source);
+    const sourceDetails = inferSourceDetails({ ...input, tags }, effectiveSource);
     const status = input.status ?? 'active';
     const pinned = input.pinned ? 1 : 0;
     const cloudExcluded = input.cloudExcluded ? 1 : 0;
@@ -400,14 +410,11 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
     const insertedId = db.transaction(() => {
         const memoryUuid = randomUUID();
         const result = stmt.run(memoryUuid, type, category, input.title, truncationResult.content, input.project || null, JSON.stringify(tags), salience, JSON.stringify(input.metadata || {}), scope, transferable, status, pinned, input.reviewedBy ? new Date().toISOString() : null, input.reviewedBy ?? null, sourceDetails.sourceKind, sourceDetails.captureMethod, cloudExcluded, input.memoryPurpose || 'project', input.memoryScope || 'private');
-        if (defenceResult) {
-            db.prepare(`UPDATE memories SET trust_score = ?, sensitivity_level = ?, source = ? WHERE id = ?`)
-                .run(defenceResult.trust.score, defenceResult.sensitivity.level, sourceDetails.sourceValue, result.lastInsertRowid);
-        }
-        else {
-            db.prepare(`UPDATE memories SET source = ?, trust_score = COALESCE(trust_score, ?), sensitivity_level = COALESCE(sensitivity_level, ?) WHERE id = ?`)
-                .run(sourceDetails.sourceValue, input.trustScore ?? 1.0, input.sensitivityLevel ?? 'INTERNAL', result.lastInsertRowid);
-        }
+        // defenceResult is always set now (every write is scanned), so always stamp
+        // the pipeline's real trust + sensitivity alongside the resolved source —
+        // no source-less branch can default to trust 1.0 / unscanned INTERNAL.
+        db.prepare(`UPDATE memories SET trust_score = ?, sensitivity_level = ?, source = ? WHERE id = ?`)
+            .run(defenceResult.trust.score, defenceResult.sensitivity.level, sourceDetails.sourceValue, result.lastInsertRowid);
         return result.lastInsertRowid;
     })();
     const memory = getMemoryById(insertedId);
@@ -454,14 +461,14 @@ export function addMemory(input, config = DEFAULT_CONFIG, source) {
         // Don't fail memory creation if linking fails
         console.error('[shieldcortex] Auto-link failed:', e);
     }
-    // DEFENCE: Store fragmentation data for cross-memory payload detection
-    if (source) {
-        try {
-            storeFragmentationData(memory.id, truncationResult.content);
-        }
-        catch (e) {
-            console.warn('[shieldcortex] Fragmentation data storage failed:', e instanceof Error ? e.message : e);
-        }
+    // DEFENCE: Store fragmentation data for cross-memory payload detection.
+    // Un-gated from `if (source)` so source-less writes also feed the temporal
+    // assembly corpus (a blind spot the write-bypass left).
+    try {
+        storeFragmentationData(memory.id, truncationResult.content);
+    }
+    catch (e) {
+        console.warn('[shieldcortex] Fragmentation data storage failed:', e instanceof Error ? e.message : e);
     }
     // SEMANTIC SEARCH: Generate embedding asynchronously (don't block INSERT)
     const memoryId = memory.id;
@@ -582,6 +589,18 @@ export function updateMemory(id, updates) {
     const existing = getMemoryById(id);
     if (!existing)
         return null;
+    // DEFENCE: re-scan when content/title changes — the UPDATE path is otherwise
+    // an unscanned write (reachable via remember-dedup + the dashboard PATCH).
+    // Mirror mergeMemories: fail closed on a non-ALLOW verdict so a poison content
+    // replace can't overwrite a clean row unchecked.
+    if (updates.content !== undefined || updates.title !== undefined) {
+        const scanContent = updates.content !== undefined ? updates.content : existing.content;
+        const scanTitle = updates.title !== undefined ? updates.title : existing.title;
+        const defenceResult = runDefencePipeline(scanContent, scanTitle, UNATTRIBUTED_SOURCE, undefined, existing.project ?? undefined);
+        if (defenceResult.firewall.result !== 'ALLOW') {
+            throw new MemoryBlockedError(defenceResult.firewall.reason);
+        }
+    }
     const fields = [];
     const values = [];
     if (updates.title !== undefined) {

package/dist/server.d.ts

@@ -5,6 +5,12 @@
  * Solves context compaction and memory persistence issues.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Wrap an MCP tool handler to scan its response for threats.
+ * Advisory mode: appends a warning but never blocks.
+ * Enforce mode: can redact credential leaks.
+ */
+export declare function withResponseScan(toolName: string, handler: (...args: any[]) => any): (...args: any[]) => any;
 /**
  * Check text for kill phrase and trigger kill switch if detected.
  * Returns true if kill switch was activated.

package/dist/server.js

@@ -24,6 +24,7 @@ import { queryAuditLogs, getAuditStats, getLifetimeStats } from './defence/audit
 import { scanExistingMemories } from './defence/scanner/index.js';
 import { resolveToolSource as resolveToolSourceImpl } from './defence/trust/resolve-tool-source.js';
 import { scanToolResponse, shouldScanToolResponse } from './defence/tool-response-scanner.js';
+import { UNTRUSTED_TOOL_TAG } from './defence/tool-response-enforce.js';
 import { getToolResponseScanConfig } from './cloud/config.js';
 import { checkKillPhrase } from './defence/iron-dome/index.js';
 import { isKillSwitchActive, getKillSwitchMeta, assertOperationAllowed, activateKillSwitch, deactivateKillSwitch, KillSwitchError, } from './api/control.js';
@@ -45,7 +46,7 @@ const sourceParam = z.object({
  * Enforce mode: can redact credential leaks.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-function withResponseScan(toolName, handler) {
+export function withResponseScan(toolName, handler) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return async (...handlerArgs) => {
         const result = await handler(...handlerArgs);
@@ -61,8 +62,35 @@ function withResponseScan(toolName, handler) {
         const scan = scanToolResponse(toolName, textContent, config.toolResponseMode);
         if (scan.clean)
             return result;
-        // Append warning to the response
+        // Enforce mode: swap the threatening text for the sanitised payload the
+        // scanner produced (injection withheld, secrets redacted, exfil stripped).
+        // Non-text blocks (e.g. images) are preserved. Advisory mode keeps the
+        // observe-only behaviour: leave the response intact, append a warning.
+        if (scan.mode === 'enforce' && scan.sanitisedContent !== null) {
+            const nonText = result.content.filter((c) => c.type !== 'text');
+            if (scan.blocked) {
+                // Whole payload withheld → surface as a tool error so the agent can tell
+                // "withheld by firewall" apart from "no results / empty".
+                return {
+                    ...result,
+                    content: [...nonText, { type: 'text', text: scan.sanitisedContent }],
+                    isError: true,
+                };
+            }
+            // Redacted-and-delivered → cleaned payload + the untrusted-origin tag in a
+            // SEPARATE block, so redacted structured output (JSON/CSV) stays parseable.
+            return {
+                ...result,
+                content: [
+                    ...nonText,
+                    { type: 'text', text: scan.sanitisedContent },
+                    { type: 'text', text: UNTRUSTED_TOOL_TAG },
+                ],
+            };
+        }
+        // Advisory: append warning to the response.
         return {
+            ...result,
             content: [
                 ...result.content,
                 {
@@ -688,6 +716,28 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
         if (scan.auditId > 0) {
             lines.push(`**Audit ID:** ${scan.auditId}`);
         }
+        // Enforce mode produced an actioned payload — surface it so callers using
+        // this tool as a programmatic firewall receive the safe content, not just
+        // a verdict. Advisory scans leave sanitisedContent null (verdict only).
+        if (scan.sanitisedContent !== null) {
+            lines.push('');
+            lines.push(`### Enforcement (${scan.blocked ? 'BLOCKED' : 'REDACTED'})`);
+            for (const action of scan.enforceActions) {
+                lines.push(`- ${action}`);
+            }
+            if (!scan.blocked) {
+                lines.push(`- origin: ${UNTRUSTED_TOOL_TAG}`);
+            }
+            lines.push('');
+            lines.push('**Sanitised content (deliver this instead):**');
+            // Dynamic fence longer than any backtick run in the content, so content
+            // containing ``` cannot break out of the code block.
+            const longestRun = Math.max(0, ...(scan.sanitisedContent.match(/`+/g) || []).map((s) => s.length));
+            const fence = '`'.repeat(Math.max(3, longestRun + 1));
+            lines.push(fence);
+            lines.push(scan.sanitisedContent);
+            lines.push(fence);
+        }
         lines.push('');
         lines.push(scan.summary);
         return { content: [{ type: 'text', text: lines.join('\n') }] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.35.0",
+  "version": "4.37.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",