@claude-flow/security 3.0.0-alpha.7 → 3.0.0-alpha.9

package/dist/plugins/integrity-verifier.js

@@ -0,0 +1,186 @@
+/**
+ * PluginIntegrityVerifier — install-layer security for plugin supply chain.
+ *
+ * Implements P1 of ADR-145 (ruvnet/ruflo#2254): Stage-1 Ed25519 signature
+ * verification at `plugins install`. Stage-2 (semantic-intent scan against
+ * SCH attacks) lands in P2; per-namespace write ACLs land in P3-P4.
+ *
+ * Threat model
+ * ------------
+ * Ruflo's plugin install path fetches manifests from IPFS via Pinata with
+ * NO signature verification and NO intent analysis. Two attacks land today:
+ *
+ *   - DDIPE (arXiv:2604.03081): malicious logic embedded in plugin docs and
+ *     config templates. 11.6-33.5% bypass rate across 4 frameworks/5 models;
+ *     2.5% evade both detection and alignment. Stage-1 signing blocks the
+ *     static-payload variants.
+ *
+ *   - SCH (arXiv:2605.14460): malicious intent wrapped as natural-language
+ *     "compliance rules" in plugin descriptions. The agent generates the
+ *     harmful code at runtime — no static payload exists. 77.67% breach
+ *     success, 0.00% scanner detection. Stage-2 (P2) catches this; Stage-1
+ *     does not.
+ *
+ * Scope (P1)
+ * ----------
+ * - Ed25519 signature verification of a detached signature over the manifest.
+ * - Trust-anchor allowlist: the publisher's signing key fingerprint must be
+ *   in `trust-anchors.json`, gated on CODEOWNERS review.
+ * - Backwards compatible: default mode is warn-only. `CLAUDE_FLOW_STRICT_PLUGINS=true`
+ *   makes verification a hard gate.
+ *
+ * Non-goals (P1)
+ * --------------
+ * - Semantic intent scan (SCH defence). Lands in P2 with a pattern-rule
+ *   fallback for environments without LLM credentials.
+ * - Sandboxing the plugin runtime. Orthogonal blast-radius concern.
+ *
+ * Reference: ADR-145, arXiv:2605.14460 (SCH), arXiv:2604.03081 (DDIPE),
+ * arXiv:2604.16548 (Mnemonic Sovereignty survey).
+ */
+import { createHash } from 'node:crypto';
+import * as nodeCrypto from 'node:crypto';
+/**
+ * Canonical JSON serialisation for hashing. Deterministic key ordering at
+ * every nesting level. Pure; identical input → identical output bytes.
+ */
+export function canonicalize(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(canonicalize).join(',') + ']';
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalize(obj[k])).join(',') + '}';
+}
+/** Hex-encoded SHA-256 of the canonical-JSON manifest. */
+export function hashManifest(manifest) {
+    return createHash('sha256').update(canonicalize(manifest)).digest('hex');
+}
+/** Short fingerprint for telemetry — first 16 hex chars of the key. */
+export function fingerprint(publicKey) {
+    return publicKey.slice(0, 16);
+}
+/**
+ * Find the trust anchor that vouches for a manifest. Returns the matched
+ * anchor (with anchor.publicKey === signer.publicKey) or null.
+ *
+ * Scope-matching uses a minimal glob: `*` at the end of the scope string
+ * matches any suffix. Empty/missing scope matches every plugin id.
+ */
+export function findAnchor(anchors, pluginId, signerPublicKey, now) {
+    for (const a of anchors) {
+        if (a.publicKey !== signerPublicKey)
+            continue;
+        if (a.expiresAt && new Date(a.expiresAt).getTime() <= now)
+            continue;
+        if (!a.scope || a.scope === '*' || a.scope === pluginId)
+            return a;
+        if (a.scope.endsWith('*') && pluginId.startsWith(a.scope.slice(0, -1)))
+            return a;
+    }
+    return null;
+}
+/**
+ * `PluginIntegrityVerifier` — Stage-1 verifier (signature + trust anchor).
+ *
+ * Pure-ish: holds the trust-anchor list and clock, no other state. Safe to
+ * construct per-invocation or share.
+ */
+export class PluginIntegrityVerifier {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify a signed manifest. Returns the verification status; the caller
+     * decides what to do with `signature-missing` / `manifest-hash-mismatch`
+     * etc. based on its strict-mode policy.
+     */
+    async verify(signed) {
+        const now = (this.config.now ?? Date.now)();
+        const pluginId = signed.manifest?.id ?? '<unknown>';
+        if (!signed.signature || !signed.publicKey) {
+            return { status: 'signature-missing', pluginId, ts: now };
+        }
+        // Re-hash the manifest and compare to the signed hash.
+        const recomputed = hashManifest(signed.manifest);
+        if (recomputed !== signed.manifestHash) {
+            return {
+                status: 'manifest-hash-mismatch',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+                detail: `expected ${signed.manifestHash}, got ${recomputed}`,
+            };
+        }
+        // Find a trust anchor that vouches for this signer + plugin.
+        const anchor = findAnchor(this.config.trustAnchors.anchors, pluginId, signed.publicKey, now);
+        if (!anchor) {
+            return {
+                status: 'unknown-signer',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+            };
+        }
+        // Ed25519 verify. Probe @noble/ed25519 (already a workspace dep); fall
+        // back to the failure status if it isn't resolvable in this environment
+        // (mirrors verify.mjs's #1880 precondition pattern).
+        const ed = await loadEd25519();
+        if (!ed) {
+            return {
+                status: 'signature-invalid',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+                detail: '@noble/ed25519 not available — cannot verify',
+            };
+        }
+        // Required by @noble/ed25519 v2 for sync sha512.
+        if (!ed.etc.sha512Sync) {
+            ed.etc.sha512Sync = (...m) => {
+                const h = nodeCrypto.createHash('sha512');
+                for (const x of m)
+                    h.update(x);
+                return h.digest();
+            };
+        }
+        let ok = false;
+        try {
+            const sigBytes = hexToBytes(signed.signature);
+            const msgBytes = hexToBytes(signed.manifestHash);
+            const pubBytes = hexToBytes(signed.publicKey);
+            ok = await ed.verify(sigBytes, msgBytes, pubBytes);
+        }
+        catch {
+            ok = false;
+        }
+        if (!ok) {
+            return {
+                status: 'signature-invalid',
+                pluginId,
+                signerFingerprint: fingerprint(signed.publicKey),
+                ts: now,
+            };
+        }
+        return { status: 'pass', pluginId, signerFingerprint: fingerprint(signed.publicKey), ts: now };
+    }
+}
+// ─── helpers ────────────────────────────────────────────────────────────
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length >>> 1);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+    return out;
+}
+async function loadEd25519() {
+    try {
+        const mod = await import('@noble/ed25519');
+        return mod;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=integrity-verifier.js.map

package/dist/plugins/integrity-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-verifier.js","sourceRoot":"","sources":["../../src/plugins/integrity-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAmE1C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC7F,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,OAAmC,EACnC,QAAgB,EAChB,eAAuB,EACvB,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,eAAe;YAAE,SAAS;QAC9C,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG;YAAE,SAAS;QACpE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAA4B;QACvC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,CAAC;QAEpD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5D,CAAC;QAED,uDAAuD;QACvD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,UAAU,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,wBAAwB;gBAChC,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;gBACP,MAAM,EAAE,YAAY,MAAM,CAAC,YAAY,SAAS,UAAU,EAAE;aAC7D,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;aACR,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;gBACP,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACvB,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAc,EAAE;gBACrD,MAAM,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,EAAE,GAAG,KAAK,CAAC;QACb,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChD,EAAE,EAAE,GAAG;aACR,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACjG,CAAC;CACF;AAED,2EAA2E;AAE3E,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3C,OAAO,GAA8B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/tool-output-guardrail.d.ts

@@ -0,0 +1,126 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+export type InjectionSeverity = 'low' | 'medium' | 'high' | 'critical';
+export type InjectionCategory = 'instruction-override' | 'role-hijack' | 'exfiltration' | 'jailbreak' | 'hidden-unicode' | 'embedded-system' | 'tool-spoofing' | 'truncation';
+export interface InjectionFinding {
+    /** Short label for the matched pattern (stable identifier for telemetry). */
+    pattern: string;
+    /** Risk weight assigned to this pattern. */
+    severity: InjectionSeverity;
+    /** Category for downstream classification + OWASP mapping. */
+    category: InjectionCategory;
+    /** Char offset of the first match in the scanned content. */
+    position: number;
+    /** Up to 80 chars of surrounding context for human triage (redacted in `sanitized`). */
+    context: string;
+}
+export interface GuardrailResult {
+    /** True iff no findings, or all findings under the `flag` policy threshold. */
+    safe: boolean;
+    /** Findings in the order they were detected. */
+    findings: InjectionFinding[];
+    /** Highest severity observed; `none` if findings is empty. */
+    highest: InjectionSeverity | 'none';
+}
+export type GuardrailAction = 'allow' | 'flag' | 'redact' | 'reject';
+export interface GuardrailConfig {
+    /**
+     * Per-severity action.
+     * Defaults:
+     *   low      → allow
+     *   medium   → flag
+     *   high     → redact
+     *   critical → reject
+     *
+     * `allow`  — content passes through unchanged, no logging required.
+     * `flag`   — content passes through; caller SHOULD log + monitor.
+     * `redact` — matched substrings replaced with `[REDACTED:<pattern>]`.
+     * `reject` — caller MUST drop the content and treat the tool call
+     *            as failed (signal the agent that the tool returned an
+     *            unsafe payload rather than letting the payload through).
+     */
+    policy?: Partial<Record<InjectionSeverity, GuardrailAction>>;
+    /** Add domain-specific patterns without subclassing. */
+    customPatterns?: Array<{
+        label: string;
+        regex: RegExp;
+        severity: InjectionSeverity;
+        category: InjectionCategory;
+    }>;
+    /**
+     * Maximum bytes of content to scan. Beyond this, the tail is ignored and
+     * a `truncation` finding is added at `medium`. Default: 1 MiB.
+     * Set to 0 to disable truncation (scan everything; slower on huge blobs).
+     */
+    maxScanBytes?: number;
+}
+export declare class ToolOutputGuardrail {
+    private readonly patterns;
+    private readonly policy;
+    private readonly maxScanBytes;
+    constructor(config?: GuardrailConfig);
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content: string): GuardrailResult;
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content: string): {
+        content: string;
+        result: GuardrailResult;
+        action: GuardrailAction;
+    };
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    private redact;
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export declare function createToolOutputGuardrail(config?: GuardrailConfig): ToolOutputGuardrail;
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export declare function isToolOutputSafe(content: string): boolean;
+//# sourceMappingURL=tool-output-guardrail.d.ts.map

package/dist/tool-output-guardrail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.d.ts","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvE,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,aAAa,GACb,cAAc,GACd,WAAW,GACX,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,YAAY,CAAC;AAEjB,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC;IACd,gDAAgD;IAChD,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;IAE7D,wDAAwD;IACxD,cAAc,CAAC,EAAE,KAAK,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,iBAAiB,CAAC;KAC7B,CAAC,CAAC;IAEH;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAiID,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmD;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,MAAM,GAAE,eAAoB;IAMxC;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe;IA+CtC;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;QAC/B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,EAAE,eAAe,CAAC;KACzB;IAgBD;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAmBf;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,mBAAmB,CAEvF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/tool-output-guardrail.js

@@ -0,0 +1,257 @@
+/**
+ * ToolOutputGuardrail — semantic screening of content returned by MCP tool
+ * calls, memory reads, and external API responses before that content enters
+ * agent reasoning. Closes the OWASP ASI01 (Agent Goal Hijacking) gap
+ * identified in ruvnet/ruflo#2149 / ADR-131.
+ *
+ * Threat model
+ * ------------
+ * Attackers embed malicious instructions in content the agent retrieves
+ * autonomously (web page, MCP tool response, memory entry). An LLM cannot
+ * reliably distinguish instructions from data once both are in the prompt.
+ * System-level per-boundary guardrails are the only category with
+ * sub-millisecond latency and no model dependency (arXiv:2601.17548,
+ * Jan 2026 systematic review).
+ *
+ * Scope
+ * -----
+ * - Detection only — does NOT modify the running prompt; callers decide
+ *   what action to take (allow, flag, redact, reject) via `scanAndEnforce`.
+ * - Synchronous pattern match — designed for <1ms p99 on typical tool
+ *   responses (≤32KB). Large content is capped at `maxScanBytes` and the
+ *   truncation itself is reported as a low-severity finding.
+ * - Pure-function shape — no I/O, no async, no model calls. Safe to invoke
+ *   in hot paths (every MCP tool result, every memory read).
+ *
+ * Non-goals
+ * ---------
+ * - Not a replacement for input validation at HTTP/CLI boundaries
+ *   (InputValidator handles that). This is the *content* boundary.
+ * - Not a model-based classifier. False-positive rate is bounded by
+ *   pattern specificity; tune via `customPatterns` and `policy`.
+ *
+ * Reference: ADR-131, OpenAI Agents SDK ToolGuardrail API (March 2025).
+ */
+const DEFAULT_POLICY = {
+    low: 'allow',
+    medium: 'flag',
+    high: 'redact',
+    critical: 'reject',
+};
+const DEFAULT_MAX_SCAN_BYTES = 1024 * 1024;
+/**
+ * Built-in pattern library. Ordered by severity (critical first) so the
+ * `highest` field reflects the worst category. Patterns are intentionally
+ * conservative — they target the explicit instruction-override / role-hijack
+ * shapes that show up in published indirect-injection corpora rather than
+ * general "suspicious looking" text.
+ */
+const BUILTIN_PATTERNS = [
+    // ── critical: instruction override + embedded system frames ──
+    {
+        label: 'ignore-previous-instructions',
+        // Allow optional filler words between the verb and the temporal keyword
+        // ("ignore the above", "disregard your earlier", "forget all prior").
+        regex: /\b(?:ignore|disregard|forget)\s+(?:all\s+|any\s+|the\s+|my\s+|your\s+|these\s+|those\s+)?(?:previous|prior|above|earlier|preceding|aforementioned)\s+(?:instructions?|prompts?|rules?|directives?)\b/gi,
+        severity: 'critical',
+        category: 'instruction-override',
+    },
+    {
+        label: 'chatml-frame',
+        regex: /<\|(?:im_start|im_end|system|assistant|user|endoftext)\|>/gi,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'llama-inst-frame',
+        regex: /\[\/?INST\]/g,
+        severity: 'critical',
+        category: 'embedded-system',
+    },
+    {
+        label: 'exfiltrate-secret',
+        regex: /\b(?:exfiltrate|leak|send|post|upload|transmit)\b[^.\n]{0,80}\b(?:secret|token|api[-_\s]?keys?|password|credential|env\s+vars?)\b/gi,
+        severity: 'critical',
+        category: 'exfiltration',
+    },
+    // ── high: role hijack + jailbreak + system tags + bidi unicode ──
+    {
+        label: 'system-tag-injection',
+        regex: /<\/?system>/gi,
+        severity: 'high',
+        category: 'embedded-system',
+    },
+    {
+        label: 'role-hijack-you-are-now',
+        regex: /\byou\s+are\s+(?:now|actually|secretly)\s+(?:a|an|the)\s+/gi,
+        severity: 'high',
+        category: 'role-hijack',
+    },
+    {
+        label: 'jailbreak-dan',
+        regex: /\b(?:DAN(?:\s+mode)?|developer\s+mode|jailbreak\s+mode|do\s+anything\s+now)\b/gi,
+        severity: 'high',
+        category: 'jailbreak',
+    },
+    {
+        label: 'new-instructions-directive',
+        regex: /\b(?:new|updated|revised|additional)\s+(?:instructions?|task|directives?|objectives?)\s*[:.]/gi,
+        severity: 'high',
+        category: 'instruction-override',
+    },
+    {
+        label: 'bidi-override',
+        regex: /[‪-‮⁦-⁩]/g,
+        severity: 'high',
+        category: 'hidden-unicode',
+    },
+    // ── medium: softer role manipulation + tool spoofing ──
+    {
+        label: 'role-hijack-act-as',
+        regex: /\b(?:act|behave|pretend|role[-\s]?play)\s+as\s+(?:if\s+)?(?:a|an|the)\s+/gi,
+        severity: 'medium',
+        category: 'role-hijack',
+    },
+    {
+        label: 'tool-call-spoof',
+        regex: /\b(?:tool_call|function_call|mcp_tool)\s*[:=]\s*["'{]/gi,
+        severity: 'medium',
+        category: 'tool-spoofing',
+    },
+    // ── low: zero-width whitespace (common in copy-paste attacks) ──
+    {
+        label: 'zero-width-char',
+        regex: /[​-‍]/g,
+        severity: 'low',
+        category: 'hidden-unicode',
+    },
+];
+const SEVERITY_ORDER = {
+    none: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+function snippet(text, idx, len) {
+    const start = Math.max(0, idx - 24);
+    const end = Math.min(text.length, idx + len + 24);
+    const head = start > 0 ? '…' : '';
+    const tail = end < text.length ? '…' : '';
+    return head + text.slice(start, end).replace(/\s+/g, ' ') + tail;
+}
+function maxSeverity(a, b) {
+    return SEVERITY_ORDER[a] >= SEVERITY_ORDER[b]
+        ? (a === 'none' ? b : a)
+        : b;
+}
+export class ToolOutputGuardrail {
+    patterns;
+    policy;
+    maxScanBytes;
+    constructor(config = {}) {
+        this.patterns = [...BUILTIN_PATTERNS, ...(config.customPatterns ?? [])];
+        this.policy = { ...DEFAULT_POLICY, ...(config.policy ?? {}) };
+        this.maxScanBytes = config.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
+    }
+    /**
+     * Pure scan — no side effects, no content modification. Useful when the
+     * caller wants to log findings but cannot drop the content (e.g. read-only
+     * audit mode).
+     */
+    scan(content) {
+        if (typeof content !== 'string') {
+            return { safe: true, findings: [], highest: 'none' };
+        }
+        let scanned = content;
+        const findings = [];
+        if (this.maxScanBytes > 0 && content.length > this.maxScanBytes) {
+            scanned = content.slice(0, this.maxScanBytes);
+            findings.push({
+                pattern: 'content-truncated',
+                severity: 'medium',
+                category: 'truncation',
+                position: this.maxScanBytes,
+                context: `(content truncated at ${this.maxScanBytes} bytes; ${content.length - this.maxScanBytes} bytes unscanned)`,
+            });
+        }
+        for (const { label, regex, severity, category } of this.patterns) {
+            // Clone the RegExp so that the global-flag lastIndex state doesn't
+            // leak between calls. Built-in patterns are immutable; user-supplied
+            // patterns are also defensively cloned.
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            let match;
+            while ((match = re.exec(scanned)) !== null) {
+                findings.push({
+                    pattern: label,
+                    severity,
+                    category,
+                    position: match.index,
+                    context: snippet(scanned, match.index, match[0].length),
+                });
+                // Defensive: zero-length match would loop forever
+                if (match[0].length === 0)
+                    re.lastIndex++;
+            }
+        }
+        let highest = 'none';
+        for (const f of findings)
+            highest = maxSeverity(highest, f.severity);
+        const action = highest === 'none' ? 'allow' : this.policy[highest];
+        const safe = action === 'allow' || action === 'flag';
+        return { safe, findings, highest };
+    }
+    /**
+     * Scan + enforce policy. Returns the content to pass forward (possibly
+     * redacted or empty) plus the scan result and the action that was taken.
+     * Callers should treat `reject` as "drop the tool result and signal an
+     * error" — do NOT silently substitute empty content.
+     */
+    scanAndEnforce(content) {
+        const result = this.scan(content);
+        const action = result.highest === 'none' ? 'allow' : this.policy[result.highest];
+        let outgoing = content;
+        if (action === 'redact') {
+            outgoing = this.redact(content, result.findings);
+        }
+        else if (action === 'reject') {
+            outgoing = '';
+        }
+        return { content: outgoing, result, action };
+    }
+    /**
+     * Replace each non-truncation finding's matched substring with
+     * `[REDACTED:<pattern>]`. Truncation findings have no substring to redact
+     * (their `position` is a length, not an offset into the content) and are
+     * skipped. Idempotent for already-redacted strings.
+     */
+    redact(content, findings) {
+        if (findings.length === 0)
+            return content;
+        // Build a single combined regex per pattern label to avoid replacing
+        // overlapping matches multiple times.
+        const labels = new Set(findings
+            .filter((f) => f.category !== 'truncation')
+            .map((f) => f.pattern));
+        let out = content;
+        for (const { label, regex } of this.patterns) {
+            if (!labels.has(label))
+                continue;
+            const re = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
+            out = out.replace(re, `[REDACTED:${label}]`);
+        }
+        return out;
+    }
+}
+/** Convenience factory that returns a guardrail with the default policy. */
+export function createToolOutputGuardrail(config) {
+    return new ToolOutputGuardrail(config);
+}
+/**
+ * One-shot helper for callers that just want a yes/no answer without
+ * constructing a guardrail. Uses the default policy.
+ */
+export function isToolOutputSafe(content) {
+    return createToolOutputGuardrail().scan(content).safe;
+}
+//# sourceMappingURL=tool-output-guardrail.js.map

package/dist/tool-output-guardrail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-output-guardrail.js","sourceRoot":"","sources":["../src/tool-output-guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwEH,MAAM,cAAc,GAAqD;IACvE,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAKjB;IACH,gEAAgE;IAChE;QACE,KAAK,EAAE,8BAA8B;QACrC,wEAAwE;QACxE,sEAAsE;QACtE,KAAK,EAAE,wMAAwM;QAC/M,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,qIAAqI;QAC5I,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;KACzB;IAED,mEAAmE;IACnE;QACE,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,iBAAiB;KAC5B;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,6DAA6D;QACpE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,iFAAiF;QACxF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,gGAAgG;QACvG,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,sBAAsB;KACjC;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,gBAAgB;KAC3B;IAED,yDAAyD;IACzD;QACE,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,4EAA4E;QACnF,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,yDAAyD;QAChE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;KAC1B;IAED,kEAAkE;IAClE;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,gBAAgB;KAC3B;CACF,CAAC;AAEF,MAAM,cAAc,GAA+C;IACjE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,CAA6B,EAAE,CAAoB;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,QAAQ,CAAiD;IACzD,MAAM,CAAmD;IACzD,YAAY,CAAS;IAEtC,YAAY,SAA0B,EAAE;QACtC,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,mBAAmB;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,OAAO,EAAE,yBAAyB,IAAI,CAAC,YAAY,WAAW,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,mBAAmB;aACpH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjE,mEAAmE;YACnE,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,KAAK;oBACd,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,KAAK,CAAC,KAAK;oBACrB,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAC;gBACH,kDAAkD;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAA+B,MAAM,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QAErD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAAe;QAK5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,OAAe,EAAE,QAA4B;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAE1C,qEAAqE;QACrE,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;aAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CACzB,CAAC;QAEF,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACjG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,yBAAyB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/package.json

@@ -1,27 +1,27 @@
-{
-  "name": "@claude-flow/security",
-  "version": "3.0.0-alpha.7",
-  "type": "module",
-  "description": "Security module - CVE fixes, input validation, path security",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": "./dist/index.js",
-    "./*": "./dist/*.js"
-  },
-  "scripts": {
-    "test": "vitest run",
-    "build": "tsc"
-  },
-  "dependencies": {
-    "bcryptjs": "^3.0.3",
-    "zod": "^3.22.0"
-  },
-  "devDependencies": {
-    "vitest": "^4.0.16"
-  },
-  "publishConfig": {
-    "access": "public",
-    "tag": "v3alpha"
-  }
-}
+{
+  "name": "@claude-flow/security",
+  "version": "3.0.0-alpha.9",
+  "type": "module",
+  "description": "Security module - CVE fixes, input validation, path security",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*.js"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "build": "tsc"
+  },
+  "dependencies": {
+    "bcryptjs": "^3.0.3",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "vitest": "^4.0.16"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "v3alpha"
+  }
+}