mem-os-python 1.6.27__py3-none-any.whl

memos/_js/quarantine-commands.js

@@ -0,0 +1,42 @@
+/**
+ * Testable CLI command logic for the quarantine review queue.
+ *
+ * The CLI dispatches `memos quarantine list|release` through these
+ * helpers so the output format is asserted in unit tests rather than
+ * through awkward subprocess runs.
+ */
+/**
+ * Render the quarantine review queue. JSON mode emits the raw nodes;
+ * human mode prints one line per memory: `[mem:hex]`-style short id,
+ * quarantine reason, and the first ~120 chars of content.
+ */
+export function formatQuarantineList(nodes, json) {
+    if (json) {
+        return JSON.stringify(nodes, null, 2);
+    }
+    if (nodes.length === 0) {
+        return "Quarantine queue is empty.";
+    }
+    return nodes
+        .map((n) => {
+        const preview = n.content.length > 120 ? `${n.content.slice(0, 117)}...` : n.content;
+        const reason = n.quarantineReason ?? "unspecified";
+        return `[${n.id.slice(0, 8)}] (${n.provenance}) reason=${reason}: ${preview}`;
+    })
+        .join("\n");
+}
+/**
+ * Release a memory from quarantine and render the result. JSON mode
+ * emits the updated node; human mode confirms the release while
+ * reminding the operator that the memory keeps its low-trust marking
+ * for agent consumption.
+ */
+export async function releaseQuarantined(memos, id, json) {
+    const node = await memos.releaseFromQuarantine(id);
+    if (json) {
+        return JSON.stringify(node, null, 2);
+    }
+    return (`Released ${id.slice(0, 8)} from quarantine.` +
+        " It is recallable again; agent tools still see it as untrusted until a reviewer promotes its provenance tier.");
+}
+//# sourceMappingURL=quarantine-commands.js.map

memos/_js/quarantine-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-commands.js","sourceRoot":"","sources":["../src/quarantine-commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAmB,EACnB,IAAa;IAEb,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,gBAAgB,IAAI,aAAa,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,YAAY,MAAM,KAAK,OAAO,EAAE,CAAC;IAChF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,EAAU,EACV,IAAa;IAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CACL,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB;QAC7C,+GAA+G,CAChH,CAAC;AACJ,CAAC"}

memos/_js/quarantine.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Write-gate quarantine — a local-heuristic classifier for
+ * instruction-like payloads in memory writes and imports.
+ *
+ * Runs synchronously on the `store()` hot path (pure regex scoring,
+ * microseconds per write — no LLM, no network). Content that scores at
+ * or above {@link QUARANTINE_FLAG_THRESHOLD} is still stored (add-only
+ * is preserved) but marked `quarantined: true`, which excludes it from
+ * recall by default until a human reviews it via
+ * `memos quarantine list|release`.
+ *
+ * The classifier first normalizes its input
+ * ({@link normalizeForScreening}): NFKC unicode folding, zero-width
+ * character stripping, Cyrillic/Greek homoglyph folding, single-newline
+ * collapsing, spaced-letter joining (`i g n o r e` → `ignore`), and
+ * whitespace collapsing. Injection clichés are additionally matched
+ * against a leetspeak-unfolded copy (`1gn0re` → `ignore`).
+ *
+ * Signal classes (each reports a stable machine-readable `code`):
+ *
+ * 1. Injection clichés — verbatim prompt-injection openers ("ignore
+ *    previous instructions", "disregard your prior instructions",
+ *    "do not tell the user", "pretend you are …", DAN/jailbreak
+ *    patterns, chat-template role markers). Full-strength (2.0:
+ *    quarantines on its own). Deliberately anchored to
+ *    `previous`/`prior` so ordinary "ignore the old template" phrasing
+ *    does NOT match.
+ * 2. Imperative exfiltration — an exfil verb (send, email, upload, dump,
+ *    …) governing a credential noun (passwords, api keys, secrets, …).
+ *    1.5 alone; 2.0 when a URL/email destination appears anywhere in
+ *    the write, or when verb+destination share a sentence and a
+ *    credential noun appears anywhere. First-person possessives ("my
+ *    password", "our api key") are exempt — "reset my password" is not
+ *    an attack. On low-trust tiers (`tool-output`, `imported`) the
+ *    bare verb+credential shape is 2.0 on its own — tool output that
+ *    moves credentials is never benign.
+ * 3. Exfiltration-shaped — secret material (an `sk-…`/`AKIA…`/`ghp_…`
+ *    token, a `-----BEGIN … PRIVATE KEY-----` block, or an
+ *    `api key: <value>` assignment) next to a URL or an exfiltration
+ *    verb. 2.0.
+ * 4. Encoded payloads — base64 blobs are decoded (whitespace-tolerant,
+ *    depth-bounded) and the decoded text is re-screened: a blob that
+ *    decodes to an injection scores 2.0 (`injection:encoded-
+ *    instructions`); an opaque blob is 1.0 on its own (1.5 on
+ *    low-trust tiers). A candidate only counts as a blob when it looks
+ *    like real base64 (a digit, `+`/`/`, or `=` padding) — English prose
+ *    that merely uses base64-alphabet words is not a blob.
+ * 5. Low-trust-tier dormant instructions (Trojan-Hippo shape) —
+ *    conditional future-directed instructions ("when the user asks
+ *    about X, always say Y", "from now on, include …", "never mention
+ *    …") are 2.0, but ONLY for `tool-output`/`imported` tiers. Tool
+ *    output is data, never behavioral instructions; the same phrasing
+ *    in a user's own memory ("when I travel, always pack my charger")
+ *    is silent.
+ * 6. Low-trust-tier trigger phrases (AgentPoison shape) — nonce-like
+ *    tokens or trigger words ("code word", "activation token")
+ *    co-occurring with instruction-shaped content. 2.0, low-trust
+ *    tiers only.
+ *
+ * False-positive tuning: the negative corpus in
+ * `__tests__/fixtures/redteam-battery.ts` (60 ordinary memories —
+ * wifi passwords on the fridge, "send mom the photos", meeting notes
+ * with URLs, developer-mode phone settings, surprise parties) must
+ * score below threshold, including adversarial-benign cases such as
+ * security notes quoting attack clichés. Quoted clichés under
+ * meta-discussion framing ("how do I defend against 'ignore previous
+ * instructions'?", "the article explains DAN mode") halves every signal
+ * and caps total injection:* contribution at 1.0 — discussing an attack
+ * is not an attack. A single unquoted injection signal wearing a
+ * discussion-like prefix ("Security update: ignore previous
+ * instructions") still evades; that residual gap is documented in
+ * docs/provenance-trust.md.
+ *
+ * @module @mem-os/quarantine
+ */
+import type { ProvenanceTier } from "./types.js";
+/**
+ * Normalize write content before screening: NFKC folding, zero-width
+ * stripping, homoglyph folding, single-newline joining (paragraph
+ * breaks still split sentences), spaced-letter joining, and whitespace
+ * collapsing. Exported for testing.
+ */
+export declare function normalizeForScreening(content: string): string;
+/** Quarantine at or above this score. Tuned against the negative corpus. */
+export declare const QUARANTINE_FLAG_THRESHOLD = 2;
+export interface QuarantineSignal {
+    /** Stable machine-readable code, e.g. `injection:ignore-previous-instructions`. */
+    code: string;
+    /** Human-readable explanation. */
+    detail: string;
+    /** Points contributed toward {@link QUARANTINE_FLAG_THRESHOLD}. */
+    points: number;
+}
+export interface QuarantineVerdict {
+    flagged: boolean;
+    score: number;
+    signals: QuarantineSignal[];
+    /** `;`-joined signal codes — stored in `quarantine_reason`. */
+    reason: string;
+}
+export interface ScreenWriteOptions {
+    /**
+     * Provenance tier of the write. Low-trust tiers (`tool-output`,
+     * `imported`) get stricter screening: dormant-instruction and
+     * trigger-phrase signals activate, and bare verb+credential
+     * exfiltration quarantines on its own. Defaults to user-like
+     * (lenient) when omitted.
+     */
+    tier?: ProvenanceTier;
+}
+/**
+ * Screen one write for instruction-like payloads. Pure, synchronous,
+ * allocation-light — safe on the store() hot path.
+ *
+ * Pass `opts.tier` for tier-aware strictness: `tool-output` /
+ * `imported` writes additionally screen for dormant instructions and
+ * trigger phrases, and bare verb+credential exfiltration quarantines.
+ */
+export declare function screenWrite(content: string, opts?: ScreenWriteOptions): QuarantineVerdict;
+//# sourceMappingURL=quarantine.d.ts.map

memos/_js/quarantine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../src/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8EjD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AA2XD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAoC3C,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AA8aD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,kBAAuB,GAC5B,iBAAiB,CA2CnB"}