shieldcortex 4.36.0 → 4.38.0

package/dist/server.d.ts

@@ -5,6 +5,12 @@
  * Solves context compaction and memory persistence issues.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Wrap an MCP tool handler to scan its response for threats.
+ * Advisory mode: appends a warning but never blocks.
+ * Enforce mode: can redact credential leaks.
+ */
+export declare function withResponseScan(toolName: string, handler: (...args: any[]) => any): (...args: any[]) => any;
 /**
  * Check text for kill phrase and trigger kill switch if detected.
  * Returns true if kill switch was activated.

package/dist/server.js

@@ -12,11 +12,11 @@ import { getCurrentVersion } from './api/version.js';
 import { initProjectContext, getActiveProject, setActiveProject, getProjectContextInfo, GLOBAL_PROJECT_SENTINEL, } from './context/project-context.js';
 // Import tools
 import { executeRemember, formatRememberResult } from './tools/remember.js';
-import { executeRecall, formatRecallResult, executeGetMemory, formatMemory } from './tools/recall.js';
+import { executeRecall, formatRecallResult, executeGetMemory, executeGetRelated, formatMemory } from './tools/recall.js';
 import { executeForget, formatForgetResult } from './tools/forget.js';
 import { executeGetContext, executeStartSession, executeEndSession, executeConsolidate, executeStats, formatStats, executeExport, executeImport, } from './tools/context.js';
 import { generateContextSummary, formatContextSummary, fullCleanup } from './memory/consolidate.js';
-import { getHighPriorityMemories, getRecentMemories, getRelatedMemories, createMemoryLink } from './memory/store.js';
+import { getHighPriorityMemories, getRecentMemories, createMemoryLink } from './memory/store.js';
 import { detectContradictions } from './memory/contradiction.js';
 import { handleGraphQuery, handleGraphEntities, handleGraphExplain } from './tools/graph.js';
 import { checkDatabaseSize } from './database/init.js';
@@ -24,6 +24,8 @@ import { queryAuditLogs, getAuditStats, getLifetimeStats } from './defence/audit
 import { scanExistingMemories } from './defence/scanner/index.js';
 import { resolveToolSource as resolveToolSourceImpl } from './defence/trust/resolve-tool-source.js';
 import { scanToolResponse, shouldScanToolResponse } from './defence/tool-response-scanner.js';
+import { UNTRUSTED_TOOL_TAG } from './defence/tool-response-enforce.js';
+import { guardReadBySensitivity, guardContextSummary } from './defence/trust/read-guard.js';
 import { getToolResponseScanConfig } from './cloud/config.js';
 import { checkKillPhrase } from './defence/iron-dome/index.js';
 import { isKillSwitchActive, getKillSwitchMeta, assertOperationAllowed, activateKillSwitch, deactivateKillSwitch, KillSwitchError, } from './api/control.js';
@@ -45,7 +47,7 @@ const sourceParam = z.object({
  * Enforce mode: can redact credential leaks.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-function withResponseScan(toolName, handler) {
+export function withResponseScan(toolName, handler) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return async (...handlerArgs) => {
         const result = await handler(...handlerArgs);
@@ -61,8 +63,35 @@ function withResponseScan(toolName, handler) {
         const scan = scanToolResponse(toolName, textContent, config.toolResponseMode);
         if (scan.clean)
             return result;
-        // Append warning to the response
+        // Enforce mode: swap the threatening text for the sanitised payload the
+        // scanner produced (injection withheld, secrets redacted, exfil stripped).
+        // Non-text blocks (e.g. images) are preserved. Advisory mode keeps the
+        // observe-only behaviour: leave the response intact, append a warning.
+        if (scan.mode === 'enforce' && scan.sanitisedContent !== null) {
+            const nonText = result.content.filter((c) => c.type !== 'text');
+            if (scan.blocked) {
+                // Whole payload withheld → surface as a tool error so the agent can tell
+                // "withheld by firewall" apart from "no results / empty".
+                return {
+                    ...result,
+                    content: [...nonText, { type: 'text', text: scan.sanitisedContent }],
+                    isError: true,
+                };
+            }
+            // Redacted-and-delivered → cleaned payload + the untrusted-origin tag in a
+            // SEPARATE block, so redacted structured output (JSON/CSV) stays parseable.
+            return {
+                ...result,
+                content: [
+                    ...nonText,
+                    { type: 'text', text: scan.sanitisedContent },
+                    { type: 'text', text: UNTRUSTED_TOOL_TAG },
+                ],
+            };
+        }
+        // Advisory: append warning to the response.
         return {
+            ...result,
             content: [
                 ...result.content,
                 {
@@ -382,8 +411,10 @@ Returns: architecture decisions, patterns, pending items, recent activity.`, {
     // Export memories
     server.tool('export_memories', 'Export memories as JSON for backup.', {
         project: z.string().optional().describe('Project scope. Auto-detected if not provided. Use "*" for all projects.'),
+        source: sourceParam,
     }, { title: 'Export Memories', readOnlyHint: true, destructiveHint: false, idempotentHint: true }, withKillSwitchGuard('memory_read', withResponseScan('export_memories', async (args) => {
-        const result = executeExport(args);
+        const source = resolveToolSource(args.source, 'export_memories');
+        const result = executeExport({ ...args, source });
         return {
             content: [{
                     type: 'text',
@@ -428,8 +459,14 @@ Returns: architecture decisions, patterns, pending items, recent activity.`, {
     // Get Related Memories
     server.tool('get_related', 'Get memories related to a specific memory. Shows connections and relationships.', {
         id: z.number().describe('Memory ID to find relationships for'),
+        source: sourceParam,
     }, { title: 'Get Related Memories', readOnlyHint: true, destructiveHint: false, idempotentHint: true }, withKillSwitchGuard('memory_read', withResponseScan('get_related', async (args) => {
-        const related = getRelatedMemories(args.id);
+        const source = resolveToolSource(args.source, 'get_related');
+        const result = executeGetRelated({ id: args.id, source });
+        if (!result.success) {
+            return { content: [{ type: 'text', text: `Error: ${result.error}` }], isError: true };
+        }
+        const related = result.related;
         if (related.length === 0) {
             return { content: [{ type: 'text', text: 'No related memories found.' }] };
         }
@@ -508,7 +545,10 @@ but you can use this tool to check for new contradictions at any time.`, {
             category: args.category,
             minScore: args.minScore,
             limit: args.limit,
-        });
+        }).filter(
+        // Drop a pair if either side is RESTRICTED/quarantined (don't leak a
+        // credential-class memory's title via a contradiction listing).
+        (c) => guardReadBySensitivity([c.memoryA, c.memoryB]).length === 2);
         if (contradictions.length === 0) {
             return { content: [{ type: 'text', text: 'No contradictions detected.' }] };
         }
@@ -688,6 +728,28 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
         if (scan.auditId > 0) {
             lines.push(`**Audit ID:** ${scan.auditId}`);
         }
+        // Enforce mode produced an actioned payload — surface it so callers using
+        // this tool as a programmatic firewall receive the safe content, not just
+        // a verdict. Advisory scans leave sanitisedContent null (verdict only).
+        if (scan.sanitisedContent !== null) {
+            lines.push('');
+            lines.push(`### Enforcement (${scan.blocked ? 'BLOCKED' : 'REDACTED'})`);
+            for (const action of scan.enforceActions) {
+                lines.push(`- ${action}`);
+            }
+            if (!scan.blocked) {
+                lines.push(`- origin: ${UNTRUSTED_TOOL_TAG}`);
+            }
+            lines.push('');
+            lines.push('**Sanitised content (deliver this instead):**');
+            // Dynamic fence longer than any backtick run in the content, so content
+            // containing ``` cannot break out of the code block.
+            const longestRun = Math.max(0, ...(scan.sanitisedContent.match(/`+/g) || []).map((s) => s.length));
+            const fence = '`'.repeat(Math.max(3, longestRun + 1));
+            lines.push(fence);
+            lines.push(scan.sanitisedContent);
+            lines.push(fence);
+        }
         lines.push('');
         lines.push(scan.summary);
         return { content: [{ type: 'text', text: lines.join('\n') }] };
@@ -892,7 +954,8 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
         if (isKillSwitchActive()) {
             return { contents: [{ uri: 'memory://context', mimeType: 'text/plain', text: '[KILL SWITCH ACTIVE] Memory access blocked.' }] };
         }
-        const summary = await generateContextSummary();
+        // Shared-context resource: strip RESTRICTED + quarantined (sensitivity guard).
+        const summary = guardContextSummary(await generateContextSummary());
         return {
             contents: [{
                     uri: 'memory://context',
@@ -906,7 +969,8 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
         if (isKillSwitchActive()) {
             return { contents: [{ uri: 'memory://important', mimeType: 'text/plain', text: '[KILL SWITCH ACTIVE] Memory access blocked.' }] };
         }
-        const memories = getHighPriorityMemories(20);
+        // Shared-context resource: strip RESTRICTED + quarantined before exposing content.
+        const memories = guardReadBySensitivity(getHighPriorityMemories(20));
         const text = memories.map(m => `## ${m.title}\n${m.content}\n*${m.category} | ${(m.salience * 100).toFixed(0)}% salience*\n`).join('\n');
         return {
             contents: [{
@@ -921,7 +985,8 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
         if (isKillSwitchActive()) {
             return { contents: [{ uri: 'memory://recent', mimeType: 'text/plain', text: '[KILL SWITCH ACTIVE] Memory access blocked.' }] };
         }
-        const memories = getRecentMemories(15);
+        // Shared-context resource: strip RESTRICTED + quarantined before exposing content.
+        const memories = guardReadBySensitivity(getRecentMemories(15));
         const text = memories.map(m => `- **${m.title}** (${m.category}): ${m.content.slice(0, 100)}...`).join('\n');
         return {
             contents: [{
@@ -941,7 +1006,8 @@ Runs injection detection (40+ patterns) and credential leak scanning (25+ provid
                 messages: [{ role: 'user', content: { type: 'text', text: '[KILL SWITCH ACTIVE] Context restoration blocked. Use iron_dome_resume to resume.' } }],
             };
         }
-        const summary = await generateContextSummary();
+        // Shared-context prompt: strip RESTRICTED + quarantined (sensitivity guard).
+        const summary = guardContextSummary(await generateContextSummary());
         const context = formatContextSummary(summary);
         return {
             messages: [{

package/dist/tools/context.d.ts

@@ -8,6 +8,7 @@ import { z } from 'zod';
 import { getMemoryStats } from '../memory/store.js';
 import { type SalienceDistribution } from '../memory/metrics.js';
 import { Memory, ContextSummary, ConsolidationResult } from '../memory/types.js';
+import type { DefenceSource } from '../defence/types.js';
 export declare const getContextSchema: z.ZodObject<{
     project: z.ZodOptional<z.ZodString>;
     query: z.ZodOptional<z.ZodString>;
@@ -132,6 +133,7 @@ export declare const exportSchema: z.ZodObject<{
 }>;
 export declare function executeExport(input: {
     project?: string;
+    source?: DefenceSource;
 }): {
     success: boolean;
     data?: string;

package/dist/tools/context.js

@@ -10,6 +10,7 @@ import { getMemoryStats } from '../memory/store.js';
 import { getSalienceDistribution } from '../memory/metrics.js';
 import { getDatabase } from '../database/init.js';
 import { resolveProject } from '../context/project-context.js';
+import { guardReadBySensitivity, guardContextSummary } from '../defence/trust/read-guard.js';
 // Input schema for getting context
 export const getContextSchema = z.object({
     project: z.string().optional().describe('Project to get context for'),
@@ -29,12 +30,18 @@ export async function executeGetContext(input) {
         // Resolve project (auto-detect if not provided)
         const resolvedProject = resolveProject(input.project);
         const projectFilter = resolvedProject ?? undefined;
+        // Read guard: get_context is a SHARED-CONTEXT bootstrap surface that feeds
+        // the prompt, so strip RESTRICTED + quarantined for everyone (matching the
+        // .mjs prompt hooks) but keep INTERNAL project context available — a
+        // sensitivity guard, not the per-caller own-only ACL, so a low-trust
+        // subagent isn't blacked out from the context it needs. Owner-specific
+        // RESTRICTED retrieval is the explicit get_memory tool's job.
         // Generate context summary
-        const summary = await generateContextSummary(projectFilter);
+        const summary = guardContextSummary(await generateContextSummary(projectFilter));
         // If there's a query, also get specifically relevant memories
         let relevantMemories = [];
         if (input.query) {
-            relevantMemories = await getSuggestedContext(input.query, projectFilter, 5);
+            relevantMemories = guardReadBySensitivity(await getSuggestedContext(input.query, projectFilter, 5));
         }
         // Format based on requested format
         let context;
@@ -133,7 +140,10 @@ export async function executeStartSession(input) {
         const resolvedProject = resolveProject(input.project);
         const projectFilter = resolvedProject ?? undefined;
         const { sessionId, context } = await startSession(projectFilter);
-        const formattedContext = formatContextSummary(context);
+        // Read guard: start_session is a shared-context bootstrap surface (sibling of
+        // get_context) — strip RESTRICTED + quarantined before formatting so the
+        // session preamble never leaks credential-class memories.
+        const formattedContext = formatContextSummary(guardContextSummary(context));
         return {
             success: true,
             sessionId,
@@ -257,7 +267,8 @@ export function executeExport(input) {
         // Resolve project (auto-detect if not provided)
         const resolvedProject = resolveProject(input.project);
         const projectFilter = resolvedProject ?? undefined;
-        const data = exportMemories(projectFilter);
+        // Read ACL: filter the bulk dump to rows this caller may read.
+        const data = exportMemories(projectFilter, input.source);
         const memories = JSON.parse(data);
         return {
             success: true,

package/dist/tools/recall.d.ts

@@ -4,6 +4,7 @@
  * Search and retrieve memories using semantic search and filters.
  */
 import { z } from 'zod';
+import { getRelatedMemories } from '../memory/store.js';
 import { Memory } from '../memory/types.js';
 import type { DefenceSource } from '../defence/types.js';
 export declare const recallSchema: z.ZodObject<{
@@ -114,3 +115,17 @@ export declare function executeGetMemory(input: {
     memory?: Memory;
     error?: string;
 };
+/**
+ * Execute the get_related tool — related memories, ACL-filtered.
+ *
+ * Related links can cross trust/sensitivity boundaries, so the same read ACL
+ * applies: a caller only sees related memories it is permitted to read.
+ */
+export declare function executeGetRelated(input: {
+    id: number;
+    source?: DefenceSource;
+}): {
+    success: boolean;
+    related?: ReturnType<typeof getRelatedMemories>;
+    error?: string;
+};

package/dist/tools/recall.js

@@ -4,11 +4,12 @@
  * Search and retrieve memories using semantic search and filters.
  */
 import { z } from 'zod';
-import { searchMemories, recallWithEmbeddings, accessMemory, getRecentMemories, getHighPriorityMemories } from '../memory/store.js';
+import { searchMemories, recallWithEmbeddings, accessMemory, getRecentMemories, getHighPriorityMemories, getRelatedMemories } from '../memory/store.js';
 import { formatTimeSinceAccess } from '../memory/decay.js';
 import { MemoryNotFoundError, formatErrorForMcp } from '../errors.js';
 import { resolveProject } from '../context/project-context.js';
 import { memoryFreshnessWarning } from '../memory/staleness.js';
+import { guardReadMemories, guardReadMemory } from '../defence/trust/read-guard.js';
 const sourceSchema = z.object({
     type: z.enum(['user', 'cli', 'hook', 'email', 'web', 'agent', 'file', 'api', 'tool_response']),
     identifier: z.string(),
@@ -99,6 +100,11 @@ export async function executeRecall(input) {
                 }
                 break;
         }
+        // Read ACL: drop quarantined + rows this caller may not read (RESTRICTED
+        // isolation / own-only for low trust). Belt-and-braces — the recent/important
+        // store helpers + search already apply access control, but this keeps every
+        // recall mode uniform and never reinforces a row the caller can't see.
+        memories = guardReadMemories(memories, source);
         // Access each memory to reinforce it
         memories = memories.map(m => accessMemory(m.id, undefined, source) || m);
         // v4.0.0: Append staleness warnings to old memories
@@ -180,14 +186,36 @@ export const getMemorySchema = z.object({
 export function executeGetMemory(input) {
     try {
         const memory = accessMemory(input.id, undefined, input.source);
-        if (!memory) {
+        // Read ACL: a caller that may not read this memory gets a not-found, never
+        // the content (don't reveal existence of RESTRICTED / other-source rows).
+        const allowed = guardReadMemory(memory, input.source);
+        if (!allowed) {
             const error = new MemoryNotFoundError(input.id);
             return {
                 success: false,
                 error: error.toUserMessage(),
             };
         }
-        return { success: true, memory };
+        return { success: true, memory: allowed };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: formatErrorForMcp(error),
+        };
+    }
+}
+/**
+ * Execute the get_related tool — related memories, ACL-filtered.
+ *
+ * Related links can cross trust/sensitivity boundaries, so the same read ACL
+ * applies: a caller only sees related memories it is permitted to read.
+ */
+export function executeGetRelated(input) {
+    try {
+        const related = getRelatedMemories(input.id);
+        const allowedIds = new Set(guardReadMemories(related.map((r) => r.memory), input.source).map((m) => m.id));
+        return { success: true, related: related.filter((r) => allowedIds.has(r.memory.id)) };
     }
     catch (error) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shieldcortex",
-  "version": "4.36.0",
+  "version": "4.38.0",
   "description": "Trustworthy memory and security for AI agents. Recall debugging, review queue, OpenClaw session capture, and memory poisoning defence for Claude Code, Codex, OpenClaw, LangChain, and MCP agents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",