@aion0/bastion 0.1.14 → 0.1.16

package/dist/plugins/builtin/rate-limiter.js

@@ -0,0 +1,248 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiterPlugin = createRateLimiterPlugin;
+const collector_js_1 = require("../../metrics/collector.js");
+const logger_js_1 = require("../../utils/logger.js");
+const log = (0, logger_js_1.createLogger)('rate-limiter');
+function getHourStart(now) {
+    const d = new Date(now);
+    d.setMinutes(0, 0, 0);
+    return d.getTime();
+}
+function getDayStart(now) {
+    const d = new Date(now);
+    d.setHours(0, 0, 0, 0);
+    return d.getTime();
+}
+function getMonthStart(now) {
+    const d = new Date(now);
+    d.setDate(1);
+    d.setHours(0, 0, 0, 0);
+    return d.getTime();
+}
+function createRateLimiterPlugin(db, getLiveConfig, eventBus) {
+    const now = Date.now();
+    const state = {
+        requestTimestamps: [],
+        costHour: 0,
+        tokensHour: 0,
+        hourStart: getHourStart(now),
+        costDay: 0,
+        dayStart: getDayStart(now),
+        costMonth: 0,
+        monthStart: getMonthStart(now),
+        recentBlocks: 0,
+    };
+    // Recover counters from DB on startup
+    try {
+        const hourAgo = new Date(state.hourStart).toISOString();
+        const dayAgo = new Date(state.dayStart).toISOString();
+        const monthAgo = new Date(state.monthStart).toISOString();
+        const hourRow = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost, COALESCE(SUM(input_tokens + output_tokens),0) as tokens FROM requests WHERE created_at >= ?`).get(hourAgo);
+        const dayRow = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM requests WHERE created_at >= ?`).get(dayAgo);
+        const monthRow = db.prepare(`SELECT COALESCE(SUM(cost_usd),0) as cost FROM requests WHERE created_at >= ?`).get(monthAgo);
+        state.costHour = hourRow.cost;
+        state.tokensHour = hourRow.tokens;
+        state.costDay = dayRow.cost;
+        state.costMonth = monthRow.cost;
+        log.info('Recovered rate-limiter counters from DB', {
+            costHour: state.costHour.toFixed(4),
+            tokensHour: state.tokensHour,
+            costDay: state.costDay.toFixed(4),
+            costMonth: state.costMonth.toFixed(4),
+        });
+    }
+    catch (err) {
+        log.warn('Failed to recover rate-limiter counters', { error: err.message });
+    }
+    function rollPeriods() {
+        const now = Date.now();
+        const newHourStart = getHourStart(now);
+        if (newHourStart > state.hourStart) {
+            state.costHour = 0;
+            state.tokensHour = 0;
+            state.hourStart = newHourStart;
+        }
+        const newDayStart = getDayStart(now);
+        if (newDayStart > state.dayStart) {
+            state.costDay = 0;
+            state.dayStart = newDayStart;
+        }
+        const newMonthStart = getMonthStart(now);
+        if (newMonthStart > state.monthStart) {
+            state.costMonth = 0;
+            state.monthStart = newMonthStart;
+        }
+    }
+    function cleanRpmWindow() {
+        const cutoff = Date.now() - 60_000;
+        state.requestTimestamps = state.requestTimestamps.filter(t => t > cutoff);
+        return state.requestTimestamps.length;
+    }
+    function checkWarning(cfg, type, current, limit) {
+        if (limit <= 0)
+            return;
+        const pct = current / limit;
+        if (pct >= cfg.warningThreshold && pct < 1.0) {
+            eventBus.emit('rate-limit:warning', { type, current, limit, percentage: pct });
+            log.warn('Rate limit warning', { type, current, limit, percentage: Math.round(pct * 100) + '%' });
+        }
+    }
+    // Public state accessor for dashboard API
+    function getState() {
+        rollPeriods();
+        const cfg = getLiveConfig();
+        const currentRpm = cleanRpmWindow();
+        const limits = {};
+        if (cfg.requestsPerMinute > 0) {
+            limits.requestsPerMinute = {
+                limit: cfg.requestsPerMinute,
+                current: currentRpm,
+                percentage: currentRpm / cfg.requestsPerMinute,
+            };
+        }
+        if (cfg.tokensPerHour > 0) {
+            limits.tokensPerHour = {
+                limit: cfg.tokensPerHour,
+                current: state.tokensHour,
+                percentage: state.tokensHour / cfg.tokensPerHour,
+            };
+        }
+        if (cfg.maxCostPerHour > 0) {
+            limits.maxCostPerHour = {
+                limit: cfg.maxCostPerHour,
+                current: state.costHour,
+                percentage: state.costHour / cfg.maxCostPerHour,
+            };
+        }
+        if (cfg.maxCostPerDay > 0) {
+            limits.maxCostPerDay = {
+                limit: cfg.maxCostPerDay,
+                current: state.costDay,
+                percentage: state.costDay / cfg.maxCostPerDay,
+            };
+        }
+        if (cfg.maxCostPerMonth > 0) {
+            limits.maxCostPerMonth = {
+                limit: cfg.maxCostPerMonth,
+                current: state.costMonth,
+                percentage: state.costMonth / cfg.maxCostPerMonth,
+            };
+        }
+        return { limits, action: cfg.action, recentBlocks: state.recentBlocks };
+    }
+    // Expose state via a property on the plugin object
+    const plugin = {
+        name: 'rate-limiter',
+        priority: 2, // After metrics-collector (1), before DLP (3) and threat-scorer (4)
+        version: '1.0.0',
+        apiVersion: 2,
+        source: 'builtin',
+        getState,
+        async onRequest(_context) {
+            rollPeriods();
+            const cfg = getLiveConfig();
+            // 1. Check RPM
+            const currentRpm = cleanRpmWindow();
+            if (cfg.requestsPerMinute > 0) {
+                checkWarning(cfg, 'requestsPerMinute', currentRpm, cfg.requestsPerMinute);
+                if (currentRpm >= cfg.requestsPerMinute) {
+                    const reason = `Rate limit exceeded: ${currentRpm}/${cfg.requestsPerMinute} requests per minute`;
+                    state.recentBlocks++;
+                    eventBus.emit('rate-limit:exceeded', {
+                        type: 'requestsPerMinute', current: currentRpm, limit: cfg.requestsPerMinute, action: cfg.action,
+                    });
+                    if (cfg.action === 'block') {
+                        log.warn(reason);
+                        return { blocked: { reason } };
+                    }
+                    log.warn('Rate limit exceeded (warn mode)', { type: 'requestsPerMinute' });
+                }
+            }
+            // 2. Check tokens per hour
+            if (cfg.tokensPerHour > 0) {
+                checkWarning(cfg, 'tokensPerHour', state.tokensHour, cfg.tokensPerHour);
+                if (state.tokensHour >= cfg.tokensPerHour) {
+                    const reason = `Rate limit exceeded: ${state.tokensHour}/${cfg.tokensPerHour} tokens per hour`;
+                    state.recentBlocks++;
+                    eventBus.emit('rate-limit:exceeded', {
+                        type: 'tokensPerHour', current: state.tokensHour, limit: cfg.tokensPerHour, action: cfg.action,
+                    });
+                    if (cfg.action === 'block') {
+                        log.warn(reason);
+                        return { blocked: { reason } };
+                    }
+                    log.warn('Rate limit exceeded (warn mode)', { type: 'tokensPerHour' });
+                }
+            }
+            // 3. Check cost per hour
+            if (cfg.maxCostPerHour > 0) {
+                checkWarning(cfg, 'maxCostPerHour', state.costHour, cfg.maxCostPerHour);
+                if (state.costHour >= cfg.maxCostPerHour) {
+                    const reason = `Budget exceeded: $${state.costHour.toFixed(4)}/$${cfg.maxCostPerHour} per hour`;
+                    state.recentBlocks++;
+                    eventBus.emit('rate-limit:exceeded', {
+                        type: 'maxCostPerHour', current: state.costHour, limit: cfg.maxCostPerHour, action: cfg.action,
+                    });
+                    if (cfg.action === 'block') {
+                        log.warn(reason);
+                        return { blocked: { reason } };
+                    }
+                    log.warn('Budget exceeded (warn mode)', { type: 'maxCostPerHour' });
+                }
+            }
+            // 4. Check cost per day
+            if (cfg.maxCostPerDay > 0) {
+                checkWarning(cfg, 'maxCostPerDay', state.costDay, cfg.maxCostPerDay);
+                if (state.costDay >= cfg.maxCostPerDay) {
+                    const reason = `Budget exceeded: $${state.costDay.toFixed(4)}/$${cfg.maxCostPerDay} per day`;
+                    state.recentBlocks++;
+                    eventBus.emit('rate-limit:exceeded', {
+                        type: 'maxCostPerDay', current: state.costDay, limit: cfg.maxCostPerDay, action: cfg.action,
+                    });
+                    if (cfg.action === 'block') {
+                        log.warn(reason);
+                        return { blocked: { reason } };
+                    }
+                    log.warn('Budget exceeded (warn mode)', { type: 'maxCostPerDay' });
+                }
+            }
+            // 5. Check cost per month
+            if (cfg.maxCostPerMonth > 0) {
+                checkWarning(cfg, 'maxCostPerMonth', state.costMonth, cfg.maxCostPerMonth);
+                if (state.costMonth >= cfg.maxCostPerMonth) {
+                    const reason = `Budget exceeded: $${state.costMonth.toFixed(4)}/$${cfg.maxCostPerMonth} per month`;
+                    state.recentBlocks++;
+                    eventBus.emit('rate-limit:exceeded', {
+                        type: 'maxCostPerMonth', current: state.costMonth, limit: cfg.maxCostPerMonth, action: cfg.action,
+                    });
+                    if (cfg.action === 'block') {
+                        log.warn(reason);
+                        return { blocked: { reason } };
+                    }
+                    log.warn('Budget exceeded (warn mode)', { type: 'maxCostPerMonth' });
+                }
+            }
+            // Record timestamp for RPM window
+            state.requestTimestamps.push(Date.now());
+        },
+        async onResponseComplete(context) {
+            rollPeriods();
+            const metrics = (0, collector_js_1.extractMetrics)(context);
+            const totalTokens = metrics.inputTokens + metrics.outputTokens;
+            state.tokensHour += totalTokens;
+            state.costHour += metrics.costUsd;
+            state.costDay += metrics.costUsd;
+            state.costMonth += metrics.costUsd;
+            log.debug('Rate-limiter counters updated', {
+                cost: metrics.costUsd.toFixed(6),
+                tokens: totalTokens,
+                costHour: state.costHour.toFixed(4),
+                costDay: state.costDay.toFixed(4),
+                costMonth: state.costMonth.toFixed(4),
+            });
+        },
+    };
+    return plugin;
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/plugins/builtin/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/plugins/builtin/rate-limiter.ts"],"names":[],"mappings":";;AA6DA,0DAkQC;AA7TD,6DAA4D;AAC5D,qDAAqD;AAGrD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,cAAc,CAAC,CAAC;AA8BzC,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAQD,SAAgB,uBAAuB,CACrC,EAAqB,EACrB,aAAsC,EACtC,QAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAe;QACxB,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC;QAC1B,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC;QAC9B,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAE1D,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,uIAAuI,CACxI,CAAC,GAAG,CAAC,OAAO,CAAqC,CAAC;QAEnD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,8EAA8E,CAC/E,CAAC,GAAG,CAAC,MAAM,CAAqB,CAAC;QAElC,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CACzB,8EAA8E,CAC/E,CAAC,GAAG,CAAC,QAAQ,CAAqB,CAAC;QAEpC,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;QAClC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;QAEhC,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,SAAS,WAAW;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,YAAY,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;YACnB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;YACrB,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC;QACjC,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,WAAW,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC/B,CAAC;QACD,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,aAAa,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC;QACnC,CAAC;IACH,CAAC;IAED,SAAS,cAAc;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACnC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;IACxC,CAAC;IAED,SAAS,YAAY,CAAC,GAAsB,EAAE,IAAY,EAAE,OAAe,EAAE,KAAa;QACxF,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO;QACvB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC;QAC5B,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,SAAS,QAAQ;QACf,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAA2E,EAAE,CAAC;QAE1F,IAAI,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,iBAAiB,GAAG;gBACzB,KAAK,EAAE,GAAG,CAAC,iBAAiB;gBAC5B,OAAO,EAAE,UAAU;gBACnB,UAAU,EAAE,UAAU,GAAG,GAAG,CAAC,iBAAiB;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,aAAa,GAAG;gBACrB,KAAK,EAAE,GAAG,CAAC,aAAa;gBACxB,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,aAAa;aACjD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,GAAG;gBACtB,KAAK,EAAE,GAAG,CAAC,cAAc;gBACzB,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,UAAU,EAAE,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,cAAc;aAChD,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,aAAa,GAAG;gBACrB,KAAK,EAAE,GAAG,CAAC,aAAa;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,aAAa;aAC9C,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,eAAe,GAAG;gBACvB,KAAK,EAAE,GAAG,CAAC,eAAe;gBAC1B,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,UAAU,EAAE,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,eAAe;aAClD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAkD;QAC5D,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,EAAE,oEAAoE;QACjF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS;QAEjB,QAAQ;QAER,KAAK,CAAC,SAAS,CAAC,QAAwB;YACtC,WAAW,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;YAE5B,eAAe;YACf,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAC9B,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC1E,IAAI,UAAU,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;oBACxC,MAAM,MAAM,GAAG,wBAAwB,UAAU,IAAI,GAAG,CAAC,iBAAiB,sBAAsB,CAAC;oBACjG,KAAK,CAAC,YAAY,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;wBACnC,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;qBACjG,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBAC1B,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxE,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;oBAC1C,MAAM,MAAM,GAAG,wBAAwB,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa,kBAAkB,CAAC;oBAC/F,KAAK,CAAC,YAAY,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;wBACnC,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;qBAC/F,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,IAAI,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACxE,IAAI,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;oBACzC,MAAM,MAAM,GAAG,qBAAqB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,cAAc,WAAW,CAAC;oBAChG,KAAK,CAAC,YAAY,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;wBACnC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;qBAC/F,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;gBAC1B,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBACrE,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,qBAAqB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,UAAU,CAAC;oBAC7F,KAAK,CAAC,YAAY,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;wBACnC,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;qBAC5F,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;gBAC5B,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC3E,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;oBAC3C,MAAM,MAAM,GAAG,qBAAqB,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,eAAe,YAAY,CAAC;oBACnG,KAAK,CAAC,YAAY,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;wBACnC,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;qBAClG,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjC,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,OAAgC;YACvD,WAAW,EAAE,CAAC;YAEd,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,OAAO,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;YAE/D,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC;YAChC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;YAClC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;YACjC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;YAEnC,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACzC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChC,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/plugins/builtin/threat-scorer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threat-scorer.d.ts","sourceRoot":"","sources":["../../../src/plugins/builtin/threat-scorer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAuC,MAAM,aAAa,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAS5D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AA4F3C,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,cAAc,GACvB,MAAM,CA4NR"}
+{"version":3,"file":"threat-scorer.d.ts","sourceRoot":"","sources":["../../../src/plugins/builtin/threat-scorer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAuC,MAAM,aAAa,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAS5D,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AA+F3C,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,cAAc,GACvB,MAAM,CAuOR"}

package/dist/plugins/builtin/threat-scorer.js

@@ -15,6 +15,7 @@ function getDefaults() {
         enabled: true,
         scoring: {
             piWeight: 30,
+            indirectPiWeight: 40,
             dlpWeight: 10,
             toolGuardWeights: { critical: 25, high: 15, medium: 5, low: 2 },
             toolChainWeight: 40,
@@ -34,6 +35,7 @@ function mergeConfig(config) {
         enabled: ti.enabled ?? defaults.enabled,
         scoring: {
             piWeight: ti.scoring?.piWeight ?? defaults.scoring.piWeight,
+            indirectPiWeight: ti.scoring?.indirectPiWeight ?? defaults.scoring.indirectPiWeight,
             dlpWeight: ti.scoring?.dlpWeight ?? defaults.scoring.dlpWeight,
             toolGuardWeights: {
                 critical: ti.scoring?.toolGuardWeights?.critical ?? defaults.scoring.toolGuardWeights.critical,
@@ -160,7 +162,17 @@ function createThreatScorerPlugin(config, db, eventBus) {
         const event = data;
         if (!event?.sessionId)
             return;
-        addPoints(event.sessionId, tiConfig.scoring.piWeight, 'pi', `pi:detected severity=${event.severity ?? 'unknown'}`);
+        // Only score direct (user-input) detections; indirect detections scored via pi:indirect-injection
+        const directCount = event.directCount ?? event.detections ?? 1;
+        if (directCount > 0) {
+            addPoints(event.sessionId, tiConfig.scoring.piWeight, 'pi', `pi:detected severity=${event.severity ?? 'unknown'}`);
+        }
+    });
+    eventBus.on('pi:indirect-injection', (data) => {
+        const event = data;
+        if (!event?.sessionId)
+            return;
+        addPoints(event.sessionId, tiConfig.scoring.indirectPiWeight, 'pi-indirect', `pi:indirect-injection detections=${event.detections ?? 1}`);
     });
     eventBus.on('dlp:finding', (data) => {
         const event = data;

package/dist/plugins/builtin/threat-scorer.js.map

@@ -1 +1 @@
-{"version":3,"file":"threat-scorer.js","sourceRoot":"","sources":["../../../src/plugins/builtin/threat-scorer.ts"],"names":[],"mappings":";;AAuGA,4DAgOC;AApUD,kFAAqF;AACrF,8FAAgG;AAChG,kGAAoG;AACpG,8EAAiF;AACjF,0EAAmE;AACnE,wEAAiE;AACjE,oEAA0F;AAC1F,qDAAqD;AAGrD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC;AAiC1C,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,EAAE;YACb,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC/D,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,GAAG;SACpB;QACD,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpD,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE;QAC/C,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,kBAAkB,CAAC;IAC9C,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QACvC,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ;YAC3D,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS;YAC9D,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ;gBAC9F,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI;gBAClF,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM;gBACxF,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG;aAChF;YACD,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,IAAI,QAAQ,CAAC,OAAO,CAAC,eAAe;YAChF,cAAc,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc;SAC9E;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ;YACjE,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI;YACrD,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ;SAClE;QACD,SAAS,EAAE;YACT,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO;YAC5D,aAAa,EAAE,EAAE,CAAC,SAAS,EAAE,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa;SAC/E;QACD,aAAa,EAAE;YACb,OAAO,EAAE,EAAE,CAAC,aAAa,EAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO;YACpE,UAAU,EAAE,EAAE,CAAC,aAAa,EAAE,UAAU,IAAI,QAAQ,CAAC,aAAa,CAAC,UAAU;SAC9E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,UAA2B;IAC9D,IAAI,KAAK,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,KAAK,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,wBAAwB,CACtC,MAAqB,EACrB,EAAqB,EACrB,QAAwB;IAExB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,yCAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,oDAA2B,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,IAAI,wDAA6B,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,qCAAoB,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAG,IAAI,iCAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,IAAI,+BAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,MAAM,UAAU,GAAoB,CAAC,GAAG,oCAAmB,CAAC,CAAC;IAE7D,SAAS,gBAAgB,CAAC,SAAiB;QACzC,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,sBAAsB;YACtB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAoB;oBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;oBAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;iBACjF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,UAAU,CAAC,KAAkB;QACpC,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;YAAE,OAAO;QACxD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;QAChE,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO;QAChC,wDAAwD;QACxD,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG;YAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,SAAiB,EAAE,WAAmB;QAC1F,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC1C,UAAU,CAAC,KAAK,CAAC,CAAC;QAElB,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;QACtB,KAAK,CAAC,UAAU,EAAE,CAAC;QACnB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE7D,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/B,gBAAgB;QAChB,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,CAAC;gBAChB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,aAAa,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;aACzD,CAAC,CAAC;YAEH,UAAU,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,KAAK;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBACvC,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG;gBAC1C,SAAS;aACV,CAAC,CAAC;YAEH,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACnC,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IAExB,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,IAA6D,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAC9B,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,IAA6H,CAAC;QAC5I,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAC9B,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;QAEvH,gEAAgE;QAChE,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CACxC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EACnD,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAC1C,CAAC;YACF,IAAI,CAAC;gBACH,cAAc,CAAC,MAAM,CAAC;oBACpB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;oBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;oBACvC,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,IAAa,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,IAID,CAAC;QACd,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClD,MAAM,MAAM,GAAI,OAAkC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QAC/E,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,KAAK,CAAC,QAAQ,IAAI,SAAS,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE5H,6DAA6D;QAC7D,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjD,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,EACtE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAExE,IAAI,CAAC;oBACH,mBAAmB,CAAC,MAAM,CAAC;wBACzB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;wBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;wBAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;wBACtB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;wBACvD,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;oBACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;oBACzB,QAAQ,EAAE,KAAK,CAAC,eAAe;oBAC/B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC,EAAE,yDAAyD;QACtE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS;QAEjB,KAAK,CAAC,SAAS,CAAC,OAAuB;YACrC,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO;YAE/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,CAAC;YAElB,2BAA2B;YAC3B,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEvC,6EAA6E;YAC7E,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;YACnC,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;YAEnC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC3E,IAAI,KAAK,EAAE,CAAC;wBACV,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAC9D,0BAA0B,KAAK,CAAC,WAAW,gBAAgB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;wBAClF,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,WAAW,EAAE,KAAK,CAAC,WAAW;yBAC/B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"threat-scorer.js","sourceRoot":"","sources":["../../../src/plugins/builtin/threat-scorer.ts"],"names":[],"mappings":";;AA0GA,4DA2OC;AAlVD,kFAAqF;AACrF,8FAAgG;AAChG,kGAAoG;AACpG,8EAAiF;AACjF,0EAAmE;AACnE,wEAAiE;AACjE,oEAA0F;AAC1F,qDAAqD;AAGrD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC;AAkC1C,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE;YACZ,gBAAgB,EAAE,EAAE;YACpB,SAAS,EAAE,EAAE;YACb,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC/D,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,GAAG;SACpB;QACD,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpD,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE;QAC/C,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,kBAAkB,CAAC;IAC9C,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QACvC,OAAO,EAAE;YACP,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ;YAC3D,gBAAgB,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB;YACnF,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS;YAC9D,gBAAgB,EAAE;gBAChB,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ;gBAC9F,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI;gBAClF,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM;gBACxF,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG;aAChF;YACD,eAAe,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,IAAI,QAAQ,CAAC,OAAO,CAAC,eAAe;YAChF,cAAc,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc;SAC9E;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ;YACjE,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI;YACrD,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ;SAClE;QACD,SAAS,EAAE;YACT,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO;YAC5D,aAAa,EAAE,EAAE,CAAC,SAAS,EAAE,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa;SAC/E;QACD,aAAa,EAAE;YACb,OAAO,EAAE,EAAE,CAAC,aAAa,EAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO;YACpE,UAAU,EAAE,EAAE,CAAC,aAAa,EAAE,UAAU,IAAI,QAAQ,CAAC,aAAa,CAAC,UAAU;SAC9E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,UAA2B;IAC9D,IAAI,KAAK,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,KAAK,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,KAAK,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,wBAAwB,CACtC,MAAqB,EACrB,EAAqB,EACrB,QAAwB;IAExB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,yCAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,oDAA2B,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,IAAI,wDAA6B,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,qCAAoB,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAG,IAAI,iCAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,IAAI,+BAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzE,qCAAqC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,MAAM,UAAU,GAAoB,CAAC,GAAG,oCAAmB,CAAC,CAAC;IAE7D,SAAS,gBAAgB,CAAC,SAAiB;QACzC,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,sBAAsB;YACtB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAoB;oBAClC,UAAU,EAAE,MAAM,CAAC,WAAW;oBAC9B,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;iBACjF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,UAAU,CAAC,KAAkB;QACpC,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC;YAAE,OAAO;QACxD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;QAChE,IAAI,cAAc,IAAI,CAAC;YAAE,OAAO;QAChC,wDAAwD;QACxD,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG;YAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,SAAiB,EAAE,WAAmB;QAC1F,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC1C,UAAU,CAAC,KAAK,CAAC,CAAC;QAElB,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;QACtB,KAAK,CAAC,UAAU,EAAE,CAAC;QACnB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE7D,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE/B,gBAAgB;QAChB,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,CAAC;gBAChB,UAAU,EAAE,SAAS;gBACrB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,aAAa,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;aACzD,CAAC,CAAC;YAEH,UAAU,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,KAAK;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBACvC,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG;gBAC1C,SAAS;aACV,CAAC,CAAC;YAEH,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACnC,SAAS;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IAExB,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAwG,CAAC;QACvH,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAC9B,kGAAkG;QAClG,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/D,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,IAAa,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,IAAkF,CAAC;QACjG,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAC9B,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,EACzE,oCAAoC,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,IAA6H,CAAC;QAC5I,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAC9B,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;QAEvH,gEAAgE;QAChE,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CACxC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EACnD,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAC1C,CAAC;YACF,IAAI,CAAC;gBACH,cAAc,CAAC,MAAM,CAAC;oBACpB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;oBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;oBAC3B,YAAY,EAAE,KAAK,CAAC,WAAW;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS;oBACvC,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,IAAa,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,IAID,CAAC;QACd,IAAI,CAAC,KAAK,EAAE,SAAS;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClD,MAAM,MAAM,GAAI,OAAkC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;QAC/E,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,KAAK,CAAC,QAAQ,IAAI,SAAS,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE5H,6DAA6D;QAC7D,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjD,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,EACtE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAExE,IAAI,CAAC;oBACH,mBAAmB,CAAC,MAAM,CAAC;wBACzB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;wBACvB,UAAU,EAAE,KAAK,CAAC,SAAS;wBAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;wBACtB,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;wBACvD,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE;oBAClC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;oBACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;oBACzB,QAAQ,EAAE,KAAK,CAAC,eAAe;oBAC/B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,CAAC,EAAE,yDAAyD;QACtE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,SAAS;QAEjB,KAAK,CAAC,SAAS,CAAC,OAAuB;YACrC,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO;YAE/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,CAAC;YAElB,2BAA2B;YAC3B,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7D,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEvC,6EAA6E;YAC7E,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;YACnC,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC;YAEnC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC3E,IAAI,KAAK,EAAE,CAAC;wBACV,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAC9D,0BAA0B,KAAK,CAAC,WAAW,gBAAgB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;wBAClF,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;4BAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,WAAW,EAAE,KAAK,CAAC,WAAW;yBAC/B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/plugins/builtin/tool-guard.d.ts

@@ -8,6 +8,13 @@ export interface ToolGuardConfig {
     alertMinSeverity: string;
     alertDesktop: boolean;
     alertWebhookUrl: string;
+    piEscalation?: {
+        enabled: boolean;
+        scoreThreshold: number;
+        overrideSeverity: string;
+        scope: 'session' | 'request';
+        ttlMinutes: number;
+    };
     /** Live getter — when provided, overrides static fields for hot-reload */
     getLiveConfig?: () => {
         action: string;
@@ -16,5 +23,16 @@ export interface ToolGuardConfig {
         alertMinSeverity: string;
     };
 }
+export interface PiEscalationEntry {
+    sessionId: string;
+    score: number;
+    label: string;
+    overrideSeverity: string;
+    escalatedAt: number;
+}
+export declare function getPiEscalations(): PiEscalationEntry[];
+export declare function resetPiEscalation(sessionId: string): boolean;
+export declare function resetAllPiEscalations(): number;
+export declare function getPiEscalationCount(): number;
 export declare function createToolGuardPlugin(db: Database.Database, config: ToolGuardConfig, eventBus?: import('../event-bus.js').PluginEventBus): Plugin;
 //# sourceMappingURL=tool-guard.d.ts.map

package/dist/plugins/builtin/tool-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-guard.d.ts","sourceRoot":"","sources":["../../../src/plugins/builtin/tool-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAMP,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAI3C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClH;AAqFD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,iBAAiB,EAAE,cAAc,GAAG,MAAM,CAiOjJ"}
+{"version":3,"file":"tool-guard.d.ts","sourceRoot":"","sources":["../../../src/plugins/builtin/tool-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAMP,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAI3C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClH;AAID,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAeD,wBAAgB,gBAAgB,IAAI,iBAAiB,EAAE,CAGtD;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAI9C;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAqFD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,iBAAiB,EAAE,cAAc,GAAG,MAAM,CAmVjJ"}

package/dist/plugins/builtin/tool-guard.js

@@ -1,5 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPiEscalations = getPiEscalations;
+exports.resetPiEscalation = resetPiEscalation;
+exports.resetAllPiEscalations = resetAllPiEscalations;
+exports.getPiEscalationCount = getPiEscalationCount;
 exports.createToolGuardPlugin = createToolGuardPlugin;
 const tool_calls_js_1 = require("../../storage/repositories/tool-calls.js");
 const tool_guard_rules_js_1 = require("../../storage/repositories/tool-guard-rules.js");
@@ -7,8 +11,37 @@ const audit_log_js_1 = require("../../storage/repositories/audit-log.js");
 const extractor_js_1 = require("../../tool-guard/extractor.js");
 const rules_js_1 = require("../../tool-guard/rules.js");
 const alert_js_1 = require("../../tool-guard/alert.js");
+const plugin_events_js_1 = require("../../storage/repositories/plugin-events.js");
 const logger_js_1 = require("../../utils/logger.js");
 const log = (0, logger_js_1.createLogger)('tool-guard');
+const piEscalationMap = new Map();
+let piEscalationTtlMs = 30 * 60000;
+function cleanExpiredPiEscalations() {
+    if (piEscalationTtlMs <= 0)
+        return;
+    const now = Date.now();
+    for (const [key, entry] of piEscalationMap) {
+        if (now - entry.escalatedAt > piEscalationTtlMs) {
+            piEscalationMap.delete(key);
+        }
+    }
+}
+function getPiEscalations() {
+    cleanExpiredPiEscalations();
+    return Array.from(piEscalationMap.values());
+}
+function resetPiEscalation(sessionId) {
+    return piEscalationMap.delete(sessionId);
+}
+function resetAllPiEscalations() {
+    const count = piEscalationMap.size;
+    piEscalationMap.clear();
+    return count;
+}
+function getPiEscalationCount() {
+    cleanExpiredPiEscalations();
+    return piEscalationMap.size;
+}
 function analyzeToolCalls(body, isStreaming, rules) {
     const toolCalls = (0, extractor_js_1.extractToolCalls)(body, isStreaming);
     return toolCalls.map(tc => ({
@@ -80,23 +113,124 @@ function createToolGuardPlugin(db, config, eventBus) {
     const repo = new tool_calls_js_1.ToolCallsRepository(db);
     const rulesRepo = new tool_guard_rules_js_1.ToolGuardRulesRepository(db);
     const auditRepo = new audit_log_js_1.AuditLogRepository(db);
+    const pluginEventsRepo = new plugin_events_js_1.PluginEventsRepository(db);
     // Seed built-in rules on first init (INSERT OR IGNORE preserves user toggles)
     rulesRepo.seedBuiltins(rules_js_1.BUILTIN_RULES);
+    // ── PI Escalation setup ──
+    const piCfg = config.piEscalation;
+    if (piCfg) {
+        piEscalationTtlMs = (piCfg.ttlMinutes ?? 30) * 60000;
+    }
+    if (piCfg?.enabled && eventBus) {
+        eventBus.on('pi:detected', (data) => {
+            const ev = data;
+            if (!ev.sessionId)
+                return;
+            if ((ev.score ?? 0) < (piCfg.scoreThreshold ?? 0.8))
+                return;
+            const entry = {
+                sessionId: ev.sessionId,
+                score: ev.score ?? 0,
+                label: ev.label ?? 'injection',
+                overrideSeverity: piCfg.overrideSeverity ?? 'medium',
+                escalatedAt: Date.now(),
+            };
+            piEscalationMap.set(ev.sessionId, entry);
+            log.warn('PI escalation triggered', { sessionId: ev.sessionId, score: ev.score, override: entry.overrideSeverity });
+            // Audit log to plugin_events table
+            try {
+                pluginEventsRepo.insertEvent('tool-guard', ev.requestId ?? null, {
+                    type: 'pi-escalation',
+                    severity: entry.overrideSeverity,
+                    rule: 'pi-escalation',
+                    detail: `PI score ${ev.score?.toFixed(2)} >= ${piCfg.scoreThreshold} → blockMinSeverity override to ${entry.overrideSeverity} (scope=${piCfg.scope})`,
+                });
+            }
+            catch (err) {
+                log.warn('Failed to write PI escalation audit', { error: err.message });
+            }
+            eventBus.emit('toolguard:pi-escalation', {
+                sessionId: ev.sessionId,
+                score: ev.score,
+                label: ev.label,
+                overrideSeverity: entry.overrideSeverity,
+                scope: piCfg.scope,
+            });
+        });
+        // Indirect injection always escalates (external data injection is inherently high risk)
+        eventBus.on('pi:indirect-injection', (data) => {
+            const ev = data;
+            if (!ev.sessionId)
+                return;
+            const entry = {
+                sessionId: ev.sessionId,
+                score: ev.maxScore ?? 0,
+                label: 'indirect-injection',
+                overrideSeverity: piCfg.overrideSeverity ?? 'medium',
+                escalatedAt: Date.now(),
+            };
+            piEscalationMap.set(ev.sessionId, entry);
+            log.warn('PI indirect-injection escalation triggered', { sessionId: ev.sessionId, score: ev.maxScore, detections: ev.detections });
+            try {
+                pluginEventsRepo.insertEvent('tool-guard', null, {
+                    type: 'pi-indirect-escalation',
+                    severity: entry.overrideSeverity,
+                    rule: 'pi-indirect-escalation',
+                    detail: `Indirect injection detected in tool_result (score ${(ev.maxScore ?? 0).toFixed(2)}, ${ev.detections ?? 1} detections) → blockMinSeverity override to ${entry.overrideSeverity}`,
+                });
+            }
+            catch (err) {
+                log.warn('Failed to write PI indirect escalation audit', { error: err.message });
+            }
+            eventBus.emit('toolguard:pi-escalation', {
+                sessionId: ev.sessionId,
+                score: ev.maxScore,
+                label: 'indirect-injection',
+                overrideSeverity: entry.overrideSeverity,
+                scope: piCfg.scope,
+            });
+        });
+    }
     // Live config readers — support hot-reload from Dashboard
     const getAction = () => config.getLiveConfig ? config.getLiveConfig().action : config.action;
     const getRecordAll = () => config.getLiveConfig ? config.getLiveConfig().recordAll : config.recordAll;
     const getBlockMinSeverity = () => config.getLiveConfig ? config.getLiveConfig().blockMinSeverity : config.blockMinSeverity;
     const getAlertMinSeverity = () => config.getLiveConfig ? config.getLiveConfig().alertMinSeverity : config.alertMinSeverity;
-    /** Get effective blockMinSeverity for a request context (uses threat-scorer's _threatLevel) */
+    // Severity rank for comparison (lower rank = more strict)
+    const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1 };
+    /** Get effective blockMinSeverity for a request context.
+     *  Combines threat-scorer path and PI escalation path, taking the stricter (lower rank) of the two. */
     function getEffectiveBlockMinSeverity(context) {
+        // Path 1: threat-level based escalation
+        let threatSeverity;
         const threatLevel = context._threatLevel;
         if (threatLevel === 'critical')
-            return 'low'; // Block all severities
-        if (threatLevel === 'high')
-            return 'medium'; // Block medium+
-        if (threatLevel === 'elevated')
-            return 'high'; // Block high+
-        return getBlockMinSeverity();
+            threatSeverity = 'low';
+        else if (threatLevel === 'high')
+            threatSeverity = 'medium';
+        else if (threatLevel === 'elevated')
+            threatSeverity = 'high';
+        else
+            threatSeverity = getBlockMinSeverity();
+        // Path 2: PI escalation
+        if (piCfg?.enabled && context.sessionId) {
+            cleanExpiredPiEscalations();
+            const piEntry = piEscalationMap.get(context.sessionId);
+            if (piEntry) {
+                const piSeverity = piEntry.overrideSeverity;
+                const piRank = SEVERITY_RANK[piSeverity] ?? 99;
+                const threatRank = SEVERITY_RANK[threatSeverity] ?? 99;
+                if (piRank < threatRank) {
+                    context._piEscalated = true;
+                    context._piEscalationOverride = piSeverity;
+                    return piSeverity;
+                }
+                // Even if threat path is stricter, mark PI escalation as active
+                context._piEscalated = true;
+                context._piEscalationOverride = piSeverity;
+            }
+        }
+        return threatSeverity;
     }
     function getAlertConfig() {
         return {
@@ -179,7 +313,7 @@ function createToolGuardPlugin(db, config, eventBus) {
             const rules = rulesRepo.getEnabled();
             context._toolGuardRules = rules;
             const effectiveBlockMin = getEffectiveBlockMinSeverity(context);
-            log.debug('onRequest', { action: getAction(), recordAll: getRecordAll(), isStreaming: context.isStreaming, effectiveBlockMin, threatLevel: context._threatLevel });
+            log.debug('onRequest', { action: getAction(), recordAll: getRecordAll(), isStreaming: context.isStreaming, effectiveBlockMin, threatLevel: context._threatLevel, piEscalated: context._piEscalated });
             if (getAction() === 'block' && context.isStreaming) {
                 context._toolGuardStreamBlock = effectiveBlockMin;
             }
@@ -276,6 +410,12 @@ function createToolGuardPlugin(db, config, eventBus) {
             catch (err) {
                 log.warn('Tool guard processing failed', { error: err.message });
             }
+            finally {
+                // Request-scope PI escalation: remove after this request completes
+                if (piCfg?.enabled && piCfg.scope === 'request' && context.request.sessionId && context.request._piEscalated) {
+                    piEscalationMap.delete(context.request.sessionId);
+                }
+            }
         },
     };
 }