@claude-flow/security 3.0.0-alpha.1 → 3.0.0-alpha.11

package/dist/tool-output-guardrail.js

@@ -0,0 +1,257 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+const DEFAULT_POLICY = {
+    low: 'allow',
+    medium: 'flag',
+    high: 'redact',
+    critical: 'reject',
+};
+const DEFAULT_MAX_SCAN_BYTES = 1024 * 1024;
+/**
+ * Built-in pattern library. Ordered by severity (critical first) so the
+ * `highest` field reflects the worst category. Patterns are intentionally
+ * conservative — they target the explicit instruction-override / role-hijack
+ * shapes that show up in published indirect-injection corpora rather than
+ * general "suspicious looking" text.
+ */
+const BUILTIN_PATTERNS = [
+    // ── critical: instruction override + embedded system frames ──
+    {
+        label: 'ignore-previous-instructions',
+        // Allow optional filler words between the verb and the temporal keyword
+        // ("ignore the above", "disregard your earlier", "forget all prior").
+        regex: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+|the\s+|my\s+|your\s+|these\s+|those\s+)?(?:previous|prior|above|earlier|preceding|aforementioned)\s+(?:instructions?|prompts?|rules?|directives?)\b/gi,
+        severity: 'critical',
+        category: 'instruction-override',
+    },
+    {
+        label: 'chatml-frame',
+        regex: /<\|(?:im_start|im_end|system|assistant|user|endoftext)\|>/gi,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'llama-inst-frame',
+        regex: /\[\/?INST\]/g,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'exfiltrate-secret',
+        regex: /\b(?:exfiltrate|leak|send|post|upload|transmit)\b[^.\n]{0,80}\b(?:secret|token|api[-_\s]?keys?|password|credential|env\s+vars?)\b/gi,
+        severity: 'critical',
+        category: 'exfiltration',
+    },
+    // ── high: role hijack + jailbreak + system tags + bidi unicode ──
+    {
+        label: 'system-tag-injection',
+        regex: /<\/?system>/gi,
+        severity: 'high',
+        category: 'embedded-system',
+    },
+    {
+        label: 'role-hijack-you-are-now',
+        regex: /\byou\s+are\s+(?:now|actually|secretly)\s+(?:a|an|the)\s+/gi,
+        severity: 'high',
+        category: 'role-hijack',
+    },
+    {
+        label: 'jailbreak-dan',
+        regex: /\b(?:DAN(?:\s+mode)?|developer\s+mode|jailbreak\s+mode|do\s+anything\s+now)\b/gi,
+        severity: 'high',
+        category: 'jailbreak',
+    },
+    {
+        label: 'new-instructions-directive',
+        regex: /\b(?:new|updated|revised|additional)\s+(?:instructions?|task|directives?|objectives?)\s*[:.]/gi,
+        severity: 'high',
+        category: 'instruction-override',
+    },
+    {
+        label: 'bidi-override',
+        regex: /[‪-‮⁦-⁩]/g,
+        severity: 'high',
+        category: 'hidden-unicode',
+    },
+    // ── medium: softer role manipulation + tool spoofing ──
+    {
+        label: 'role-hijack-act-as',
+        regex: /\b(?:act|behave|pretend|role[-\s]?play)\s+as\s+(?:if\s+)?(?:a|an|the)\s+/gi,
+        severity: 'medium',
+        category: 'role-hijack',
+    },
+    {
+        label: 'tool-call-spoof',
+        regex: /\b(?:tool_call|function_call|mcp_tool)\s*[:=]\s*["'{]/gi,
+        severity: 'medium',
+        category: 'tool-spoofing',
+    },
+    // ── low: zero-width whitespace (common in copy-paste attacks) ──
+    {
+        label: 'zero-width-char',
+        regex: /[​-‍]/g,
+        severity: 'low',
+        category: 'hidden-unicode',
+    },
+];
+const SEVERITY_ORDER = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function snippet(text, idx, len) {
+    const start = Math.max(0, idx - 24);
+    const end = Math.min(text.length, idx + len + 24);
+    const head = start > 0 ? '…' : '';
+    const tail = end < text.length ? '…' : '';
+    return head + text.slice(start, end).replace(/\s+/g, ' ') + tail;
+}
+function maxSeverity(a, b) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[b]
+        ? (a === 'none' ? b : a)
+        : b;
+}
+export class ToolOutputGuardrail {
+    patterns;
+    policy;
+    maxScanBytes;
+    constructor(config = {}) {
+        this.patterns = [...BUILTIN_PATTERNS, ...(config.customPatterns ?? [])];
+        this.policy = { ...DEFAULT_POLICY, ...(config.policy ?? {}) };
+        this.maxScanBytes = config.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    }
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content) {
+        if (typeof content !== 'string') {
+            return { safe: true, findings: [], highest: 'none' };
+        }
+        let scanned = content;
+        const findings = [];
+        if (this.maxScanBytes > 0 && content.length > this.maxScanBytes) {
+            scanned = content.slice(0, this.maxScanBytes);
+            findings.push({
+                pattern: 'content-truncated',
+                severity: 'medium',
+                category: 'truncation',
+                position: this.maxScanBytes,
+                context: `(content truncated at ${this.maxScanBytes} bytes; ${content.length - this.maxScanBytes} bytes unscanned)`,
+            });
+        }
+        for (const { label, regex, severity, category } of this.patterns) {
+            // Clone the RegExp so that the global-flag lastIndex state doesn't
+            // leak between calls. Built-in patterns are immutable; user-supplied
+            // patterns are also defensively cloned.
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            let match;
+            while ((match = re.exec(scanned)) !== null) {
+                findings.push({
+                    pattern: label,
+                    severity,
+                    category,
+                    position: match.index,
+                    context: snippet(scanned, match.index, match[0].length),
+                });
+                // Defensive: zero-length match would loop forever
+                if (match[0].length === 0)
+                    re.lastIndex++;
+            }
+        }
+        let highest = 'none';
+        for (const f of findings)
+            highest = maxSeverity(highest, f.severity);
+        const action = highest === 'none' ? 'allow' : this.policy[highest];
+        const safe = action === 'allow' || action === 'flag';
+        return { safe, findings, highest };
+    }
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content) {
+        const result = this.scan(content);
+        const action = result.highest === 'none' ? 'allow' : this.policy[result.highest];
+        let outgoing = content;
+        if (action === 'redact') {
+            outgoing = this.redact(content, result.findings);
+        }
+        else if (action === 'reject') {
+            outgoing = '';
+        }
+        return { content: outgoing, result, action };
+    }
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    redact(content, findings) {
+        if (findings.length === 0)
+            return content;
+        // Build a single combined regex per pattern label to avoid replacing
+        // overlapping matches multiple times.
+        const labels = new Set(findings
+            .filter((f) => f.category !== 'truncation')
+            .map((f) => f.pattern));
+        let out = content;
+        for (const { label, regex } of this.patterns) {
+            if (!labels.has(label))
+                continue;
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            out = out.replace(re, `[REDACTED:${label}]`);
+        }
+        return out;
+    }
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export function createToolOutputGuardrail(config) {
+    return new ToolOutputGuardrail(config);
+}
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export function isToolOutputSafe(content) {
+    return createToolOutputGuardrail().scan(content).safe;
+}
+//# sourceMappingURL=tool-output-guardrail.js.map

package/dist/tool-output-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.js","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwEH,MAAM,cAAc,GAAqD;IACvE,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAKjB;IACH,gEAAgE;IAChE;QACE,KAAK,EAAE,8BAA8B;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,KAAK,EAAE,wMAAwM;QAC/M,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,qIAAqI;QAC5I,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;KACzB;IAED,mEAAmE;IACnE;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,iFAAiF;QACxF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,gGAAgG;QACvG,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,gBAAgB;KAC3B;IAED,yDAAyD;IACzD;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;KAC1B;IAED,kEAAkE;IAClE;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,gBAAgB;KAC3B;CACF,CAAC;AAEF,MAAM,cAAc,GAA+C;IACjE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,CAA6B,EAAE,CAAoB;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAiD;IACzD,MAAM,CAAmD;IACzD,YAAY,CAAS;IAEtC,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,OAAO,EAAE,yBAAyB,IAAI,CAAC,YAAY,WAAW,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,mBAAmB;aACpH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjE,mEAAmE;YACnE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,KAAK,CAAC,KAAK;oBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAC;gBACH,kDAAkD;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAA+B,MAAM,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QAErD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAK5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAe,EAAE,QAA4B;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAE1C,qEAAqE;QACrE,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QAEF,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,yBAAyB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/node_modules-incomplete-release-test/.vite/vitest/da39a3ee5e6b4b0d3255bfef95601890afd80709/results.json

@@ -0,0 +1 @@
+{"version":"4.1.8","results":[[":__tests__/unit/safe-executor.test.ts",{"duration":26.96230000000014,"failed":false}],[":__tests__/acceptance/security-compliance.test.ts",{"duration":22.170500000000175,"failed":false}],[":__tests__/integration/security-flow.test.ts",{"duration":23.362300000000005,"failed":false}],[":__tests__/unit/path-validator.test.ts",{"duration":17.86850000000004,"failed":false}],[":__tests__/input-validator.test.ts",{"duration":0,"failed":true}],[":__tests__/tool-output-guardrail.test.ts",{"duration":16.48720000000003,"failed":false}],[":__tests__/unit/password-hasher.test.ts",{"duration":18.27260000000001,"failed":false}],[":__tests__/token-generator.test.ts",{"duration":2249.9557000000004,"failed":false}],[":__tests__/credential-generator.test.ts",{"duration":198.3424,"failed":false}],[":__tests__/unit/token-generator.test.ts",{"duration":58.08860000000004,"failed":false}],[":__tests__/plugin-integrity-verifier.test.ts",{"duration":73.71760000000017,"failed":false}],[":__tests__/path-validator.test.ts",{"duration":107.07299999999987,"failed":true}],[":__tests__/unit/credential-generator.test.ts",{"duration":32.75569999999993,"failed":false}],[":__tests__/safe-executor.test.ts",{"duration":1064.0791,"failed":true}],[":__tests__/password-hasher.test.ts",{"duration":0,"failed":true}],[":__tests__/authorization-propagator.test.ts",{"duration":14.032600000000002,"failed":false}],[":__tests__/oauth-pkce.test.ts",{"duration":6.764699999999948,"failed":false}],[":__tests__/keychain-adapter.test.ts",{"duration":15.831800000000044,"failed":false}],[":__tests__/oauth-export-surface.test.ts",{"duration":0,"failed":true}],[":__tests__/oauth-browser.test.ts",{"duration":4.83480000000003,"failed":false}]]}

package/package.json

@@ -1,28 +1,33 @@
-{
-  "name": "@claude-flow/security",
-  "version": "3.0.0-alpha.1",
-  "type": "module",
-  "description": "Security module - CVE fixes, input validation, path security",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": "./dist/index.js",
-    "./*": "./dist/*.js"
-  },
-  "scripts": {
-    "test": "vitest run",
-    "build": "tsc"
-  },
-  "dependencies": {
-    "bcrypt": "^5.1.1",
-    "zod": "^3.22.0"
-  },
-  "devDependencies": {
-    "@types/bcrypt": "^5.0.2",
-    "vitest": "^1.0.0"
-  },
-  "publishConfig": {
-    "access": "public",
-    "tag": "v3alpha"
-  }
-}
+{
+  "name": "@claude-flow/security",
+  "version": "3.0.0-alpha.11",
+  "type": "module",
+  "description": "Security module - CVE fixes, input validation, path security",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "test:oauth-surface": "vitest run __tests__/oauth-export-surface.test.ts __tests__/oauth-pkce.test.ts __tests__/oauth-browser.test.ts",
+    "build": "tsc && node scripts/verify-oauth-exports.mjs",
+    "prepublishOnly": "npm run build && npm run test:oauth-surface"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^2.1.0",
+    "bcryptjs": "^3.0.3",
+    "zod": "^3.22.0"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "1.3.0"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v3alpha"
+  }
+}

package/scripts/verify-oauth-exports.mjs

@@ -0,0 +1,29 @@
+/**
+ * Release and CI guard for the OAuth surface consumed by `ruflo auth`.
+ * This deliberately imports the built package entry point, rather than
+ * source files, so a stale or incomplete npm artifact cannot pass.
+ */
+const security = await import('../dist/index.js');
+
+const requiredFunctions = [
+  'authorizeUrl',
+  'exchangeCode',
+  'refreshToken',
+  'exchangeManualCode',
+  'generatePkce',
+  'openBrowser',
+  'createKeychainAdapter',
+];
+const requiredClasses = ['CallbackServer', 'OAuthError'];
+
+const missing = [
+  ...requiredFunctions.filter((name) => typeof security[name] !== 'function'),
+  ...requiredClasses.filter((name) => typeof security[name] !== 'function'),
+  ...(typeof security.OOB_REDIRECT_URI === 'string' ? [] : ['OOB_REDIRECT_URI']),
+];
+
+if (missing.length > 0) {
+  throw new Error(`@claude-flow/security is missing required OAuth exports: ${missing.join(', ')}`);
+}
+
+console.log(`OAuth export surface verified (${requiredFunctions.length + requiredClasses.length + 1} exports)`);