nemesis-shield 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fe007575d89dca3c4c77078c517dd4acd58b19ae65368325e730cfbe977473a5
-  data.tar.gz: a16c094ba7f5977a224aedbd236af7411632f5a1f104ff4a6751797c8bf245c4
+  metadata.gz: da20881bfecc4f9a945ef918909095b94f6b1174cf42461ac141cc36eedc4aef
+  data.tar.gz: '059fe7b53dadcffbe69aac805359ef11ee61884bdeb5ccacbfb633f2d95564f5'
 SHA512:
-  metadata.gz: 5bf4a5413932c7e3f0df3e16a0ad9b6b958b6e4d77f0a756f800c83db06eef88973bd29fe99e05a9a0c3dede8388ee33ce0b61cc64175691e6f9c74e0090f7cf
-  data.tar.gz: 3383a5c44388a9ce77181c6d20524740329acfd7b52ff2281c72f159fa516da797e16b0437e5b9fe0804de74d1e534c0b65b17db3b73b33af956e4edcae4505e
+  metadata.gz: d7c658daadf73fc9f2d6a70dbf0ff13ecdcd852561d88035f68a403e285e0850245a04f4094f5c6f50c1ea9330acd0371015bccaa9748cc5da2c7efd62f47411
+  data.tar.gz: 1d5b523c7a56a3a9f66b54294c1e4bf85aba7b51ba8ff8bbdbc9c832d5051abfa4e8b786af0d9685e021fcc79144ac4e29b05b76855a5222266f53df5e6aa458

data/README.md

@@ -1,11 +1,11 @@
-# Nemesis Shield — Ruby
+# Nemesis Shield - Ruby
 
 Native Ruby SDK for [Nemesis Shield](https://shield.nemesislabs.xyz). Learns your app's normal
 behavior; in **enforce mode BLOCKS off-baseline requests** (auth bypass, path traversal, scanners,
 unusual methods) before your app runs. One Rack middleware works with **Rails, Sinatra and any Rack
 app**. Positive-security, fail-open, privacy-preserving.
 
-**Rails** — `config/application.rb`:
+**Rails** - `config/application.rb`:
 ```ruby
 require "nemesis_shield"
 config.middleware.use NemesisShield::Middleware, token: ENV["NEMESIS_TOKEN"]
@@ -31,7 +31,7 @@ attacks blocked (403).
 
 ## LLM Guard (OWASP LLM Top 10)
 
-The same HashLR ML classifier every Nemesis Shield SDK ships — catches obfuscated/paraphrased prompt
+The same HashLR ML classifier every Nemesis Shield SDK ships - catches obfuscated/paraphrased prompt
 injection signature rules miss, scored identically in every language.
 
 ```ruby
@@ -47,7 +47,7 @@ Regex first, then ML. Blocks at ≥ 0.85 (high), flags at ≥ 0.45.
 
 ## Full coverage & safe-unlock
 
-**Mount it first / outermost** so *every* route is inspected (not just API routes — attackers hit any path):
+**Mount it first / outermost** so *every* route is inspected (not just API routes - attackers hit any path):
 
 ```
 use NemesisShield::Middleware, token: ENV["NEMESIS_TOKEN"]   # top of the Rack stack
@@ -61,7 +61,7 @@ use NemesisShield::Middleware, token: ENV["NEMESIS_TOKEN"]   # top of the Rack s
 export NEMESIS_SHIELD_BOOTSTRAP="/login,/admin,/healthz"
 ```
 
-**Verify coverage** — in observe mode, hit a normal route, a param, and a scanner path, then confirm all three appear in the console (Activity / Behaviors):
+**Verify coverage** - in observe mode, hit a normal route, a param, and a scanner path, then confirm all three appear in the console (Activity / Behaviors):
 
 ```bash
 curl -s "http://localhost:8080/" >/dev/null

data/nemesis_shield.rb

@@ -1,6 +1,6 @@
-# Nemesis Shield — Sentinel SDK for Ruby (native: local shape + policy cache + inline blocking).
+# Nemesis Shield - Sentinel SDK for Ruby (native: local shape + policy cache + inline blocking).
 # Learns your app's normal behavior; in enforce mode blocks off-baseline requests (auth bypass, path
-# traversal, scanners, unusual methods) before your app runs. Works with any Rack app — Rails,
+# traversal, scanners, unusual methods) before your app runs. Works with any Rack app - Rails,
 # Sinatra, Hanami, raw Rack. Fail-open, privacy-preserving.
 #
 #   # Rails (config/application.rb):     config.middleware.use NemesisShield::Middleware, token: ENV["NEMESIS_TOKEN"]
@@ -12,7 +12,7 @@ require "thread"
 
 module NemesisShield
   DEFAULT_ENDPOINT = "https://shield.nemesislabs.xyz/api/v1/sketches".freeze
-  # Canonical value taxonomy — must match the shared engine (tokenize.ts) byte-for-byte so a Ruby
+  # Canonical value taxonomy - must match the shared engine (tokenize.ts) byte-for-byte so a Ruby
   # app and a Node/Python app produce identical shape hashes.
   UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/i
   EMAIL = /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/
@@ -29,6 +29,11 @@ module NemesisShield
   ALNUM = /\A[A-Za-z0-9]+\z/
   # A run of 7+ letters => reads like a word / route name, not an opaque id/token.
   WORD = /[A-Za-z]{7,}/
+  # A hostname path segment (network-zone routes like example.com, sub.example.co.uk) collapses to
+  # {domain}. Lookahead-free so it ports byte-identically to RE2 engines and matches the edge SDK.
+  DOMAIN = /\A([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,24}\z/i
+  # A digit, used to tell a generated composite id (inc_ip_1_2_3_4_178..) from a snake_case word.
+  DIGIT = /\d/
 
   module_function
 
@@ -43,7 +48,13 @@ module NemesisShield
       when "hex" then "{hex}"
       when "base64" then "{token}"
       when "alnum" then (seg.length >= 12 && seg !~ WORD) ? "{id}" : seg
-      else seg end
+      else
+        # Hostnames collapse to {domain}; underscored generated ids that carry a digit (or are very
+        # long) collapse to {id}. Kebab route names (iso-27001) have no underscore, so stay literal.
+        if seg =~ DOMAIN then "{domain}"
+        elsif seg.include?("_") && (seg =~ DIGIT || seg.length >= 20) then "{id}"
+        else seg end
+      end
     end.join("/")
     out.empty? ? "/" : out
   end

data/nemesis_shield_llm.rb

@@ -1,4 +1,4 @@
-# LLM Guard for Ruby — OWASP-LLM-Top-10 detection with the HashLR ML classifier shared across every
+# LLM Guard for Ruby - OWASP-LLM-Top-10 detection with the HashLR ML classifier shared across every
 # Nemesis Shield SDK. Feature buckets are fnv1a(feature) % dim (the same hash used for HTTP sketches),
 # so scores match every other language. Char n-grams over a canonicalized (de-leetspeaked, ASCII-alnum)
 # form catch obfuscation the regex layer misses.
@@ -9,7 +9,7 @@ require_relative "nemesis_shield"
 module NemesisShield
   module LLM
     MODEL = JSON.parse(File.read(File.join(__dir__, "ml_weights.json"))).freeze
-    DIM = MODEL["dim"] # feature space is fixed across versions — only weights/bias/thresholds swap
+    DIM = MODEL["dim"] # feature space is fixed across versions - only weights/bias/thresholds swap
     # Swappable model state (module ivars so refresh_model can hot-swap a newer published version).
     @bias = MODEL["bias"]
     @weights = MODEL["weights"]
@@ -73,8 +73,8 @@ module NemesisShield
     def verify_model_signature(raw, sig_b64)
       require "openssl"
       require "base64"
-      return true if MODEL_PUBLIC_KEY_HEX.empty? # no key pinned — version gate + HTTPS apply
-      return false if sig_b64.nil? || sig_b64.empty? # key pinned but bundle unsigned — reject
+      return true if MODEL_PUBLIC_KEY_HEX.empty? # no key pinned - version gate + HTTPS apply
+      return false if sig_b64.nil? || sig_b64.empty? # key pinned but bundle unsigned - reject
       pk = OpenSSL::PKey.new_raw_public_key("ED25519", [MODEL_PUBLIC_KEY_HEX].pack("H*"))
       pk.verify(nil, Base64.strict_decode64(sig_b64), raw)
     rescue StandardError

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nemesis-shield
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Autogon Inc.
@@ -48,6 +48,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.16
 specification_version: 4
-summary: Nemesis Shield — Sentinel SDK for Ruby (positive-security middleware + LLM
+summary: Nemesis Shield - Sentinel SDK for Ruby (positive-security middleware + LLM
   guard)
 test_files: []