@clawdstrike/openclaw 0.1.3 → 0.2.2

package/dist/guards/patch-integrity.js

@@ -3,133 +3,133 @@
  *
  * Detects dangerous code patterns in patches and file writes.
  */
-import { BaseGuard } from './types.js';
+import { BaseGuard } from "./types.js";
 /**
  * Built-in dangerous pattern detection
  */
 const DANGEROUS_PATTERNS = [
     // Shell injection patterns
     {
-        name: 'curl_pipe_bash',
+        name: "curl_pipe_bash",
         pattern: /curl\s+[^|]*\|\s*(bash|sh|zsh)/gi,
-        severity: 'critical',
-        description: 'Curl piped to shell execution',
+        severity: "critical",
+        description: "Curl piped to shell execution",
     },
     {
-        name: 'wget_pipe_bash',
+        name: "wget_pipe_bash",
         pattern: /wget\s+[^|]*\|\s*(bash|sh|zsh)/gi,
-        severity: 'critical',
-        description: 'Wget piped to shell execution',
+        severity: "critical",
+        description: "Wget piped to shell execution",
     },
     // Dangerous command patterns
     {
-        name: 'rm_rf_root',
+        name: "rm_rf_root",
         pattern: /rm\s+(-rf?|--recursive)\s+[/\\]/gi,
-        severity: 'critical',
-        description: 'Recursive removal from root',
+        severity: "critical",
+        description: "Recursive removal from root",
     },
     {
-        name: 'fork_bomb',
+        name: "fork_bomb",
         pattern: /:\(\)\{\s*:\|:&\s*\};:/g,
-        severity: 'critical',
-        description: 'Fork bomb',
+        severity: "critical",
+        description: "Fork bomb",
     },
     {
-        name: 'dd_disk_wipe',
+        name: "dd_disk_wipe",
         pattern: /dd\s+if=\/dev\/(zero|random|urandom)\s+of=\/dev\//gi,
-        severity: 'critical',
-        description: 'DD disk wipe command',
+        severity: "critical",
+        description: "DD disk wipe command",
     },
     // Dangerous JavaScript patterns
     {
-        name: 'eval_usage',
+        name: "eval_usage",
         pattern: /\beval\s*\([^)]*\)/gi,
-        severity: 'high',
-        description: 'Eval function usage',
+        severity: "high",
+        description: "Eval function usage",
     },
     {
-        name: 'new_function',
+        name: "new_function",
         pattern: /new\s+Function\s*\([^)]*\)/gi,
-        severity: 'high',
-        description: 'new Function constructor',
+        severity: "high",
+        description: "new Function constructor",
     },
     {
-        name: 'document_write',
+        name: "document_write",
         pattern: /document\.write\s*\([^)]*\)/gi,
-        severity: 'medium',
-        description: 'document.write usage',
+        severity: "medium",
+        description: "document.write usage",
     },
     {
-        name: 'inner_html_assignment',
+        name: "inner_html_assignment",
         pattern: /\.innerHTML\s*=/gi,
-        severity: 'medium',
-        description: 'innerHTML assignment (XSS risk)',
+        severity: "medium",
+        description: "innerHTML assignment (XSS risk)",
     },
     // Dangerous Python patterns
     {
-        name: 'python_exec',
+        name: "python_exec",
         pattern: /\bexec\s*\([^)]*\)/gi,
-        severity: 'high',
-        description: 'Python exec usage',
+        severity: "high",
+        description: "Python exec usage",
     },
     {
-        name: 'python_compile',
+        name: "python_compile",
         pattern: /\bcompile\s*\([^)]*,\s*[^)]*,\s*['"]exec['"]\)/gi,
-        severity: 'high',
-        description: 'Python compile with exec mode',
+        severity: "high",
+        description: "Python compile with exec mode",
     },
     {
-        name: 'python_subprocess_shell',
+        name: "python_subprocess_shell",
         pattern: /subprocess\.(call|run|Popen)\s*\([^)]*shell\s*=\s*True/gi,
-        severity: 'high',
-        description: 'Subprocess with shell=True',
+        severity: "high",
+        description: "Subprocess with shell=True",
     },
     {
-        name: 'python_os_system',
+        name: "python_os_system",
         pattern: /os\.system\s*\([^)]*\)/gi,
-        severity: 'high',
-        description: 'os.system usage',
+        severity: "high",
+        description: "os.system usage",
     },
     // Environment manipulation
     {
-        name: 'env_manipulation',
+        name: "env_manipulation",
         pattern: /process\.env\.[A-Z_]+\s*=\s*['"][^'"]+['"]/gi,
-        severity: 'medium',
-        description: 'Environment variable manipulation',
+        severity: "medium",
+        description: "Environment variable manipulation",
     },
     // Credential patterns in code
     {
-        name: 'hardcoded_password',
+        name: "hardcoded_password",
         pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/gi,
-        severity: 'high',
-        description: 'Hardcoded password',
+        severity: "high",
+        description: "Hardcoded password",
     },
     {
-        name: 'hardcoded_secret',
+        name: "hardcoded_secret",
         pattern: /(?:secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
-        severity: 'high',
-        description: 'Hardcoded secret/API key',
+        severity: "high",
+        description: "Hardcoded secret/API key",
     },
     // File permission changes
     {
-        name: 'chmod_777',
+        name: "chmod_777",
         pattern: /chmod\s+(?:777|a\+rwx)/gi,
-        severity: 'medium',
-        description: 'Overly permissive chmod',
+        severity: "medium",
+        description: "Overly permissive chmod",
     },
     // Network exfiltration patterns
     {
-        name: 'base64_encode_pipe',
+        name: "base64_encode_pipe",
         pattern: /base64\s*[^|]*\|\s*(?:curl|wget|nc)/gi,
-        severity: 'high',
-        description: 'Base64 encoded data exfiltration',
+        severity: "high",
+        description: "Base64 encoded data exfiltration",
     },
     // SQL injection patterns
     {
-        name: 'sql_concat',
+        name: "sql_concat",
         pattern: /(?:SELECT|INSERT|UPDATE|DELETE|DROP)\s+[^;]*\+\s*[a-zA-Z_]+/gi,
-        severity: 'medium',
-        description: 'Potential SQL injection (string concatenation)',
+        severity: "medium",
+        description: "Potential SQL injection (string concatenation)",
     },
 ];
 /**
@@ -142,10 +142,10 @@ export class PatchIntegrityGuard extends BaseGuard {
         this.patterns = [...DANGEROUS_PATTERNS, ...additionalPatterns];
     }
     name() {
-        return 'patch_integrity';
+        return "patch_integrity";
     }
     handles() {
-        return ['patch_apply', 'file_write', 'command_exec'];
+        return ["patch_apply", "file_write", "command_exec"];
     }
     async check(event, policy) {
         return this.checkSync(event, policy);
@@ -154,18 +154,18 @@ export class PatchIntegrityGuard extends BaseGuard {
         const data = event.data;
         let contentToCheck;
         // Get content to check based on event type
-        if (data.type === 'patch') {
+        if (data.type === "patch") {
             contentToCheck = data.patchContent;
         }
-        else if (data.type === 'command') {
-            contentToCheck = `${data.command} ${data.args.join(' ')}`;
+        else if (data.type === "command") {
+            contentToCheck = `${data.command} ${data.args.join(" ")}`;
             // Also check against denied patterns from policy
             const deniedPatterns = policy.execution?.denied_patterns ?? [];
             for (const pattern of deniedPatterns) {
                 try {
-                    const regex = new RegExp(pattern, 'gi');
+                    const regex = new RegExp(pattern, "gi");
                     if (regex.test(contentToCheck)) {
-                        return this.deny(`Command matches denied pattern: ${pattern}`, 'high');
+                        return this.deny(`Command matches denied pattern: ${pattern}`, "high");
                     }
                 }
                 catch {
@@ -180,7 +180,7 @@ export class PatchIntegrityGuard extends BaseGuard {
         const detected = this.detectDangerousPatterns(contentToCheck);
         if (detected.length > 0) {
             const highestSeverity = this.getHighestSeverity(detected);
-            const patternNames = detected.map((p) => p.name).join(', ');
+            const patternNames = detected.map((p) => p.name).join(", ");
             return this.deny(`Detected dangerous patterns: ${patternNames}`, highestSeverity);
         }
         return this.allow();
@@ -205,11 +205,10 @@ export class PatchIntegrityGuard extends BaseGuard {
      * Get the highest severity from detected patterns
      */
     getHighestSeverity(patterns) {
-        const severityOrder = ['low', 'medium', 'high', 'critical'];
-        let highest = 'low';
+        const severityOrder = ["low", "medium", "high", "critical"];
+        let highest = "low";
         for (const pattern of patterns) {
-            if (severityOrder.indexOf(pattern.severity) >
-                severityOrder.indexOf(highest)) {
+            if (severityOrder.indexOf(pattern.severity) > severityOrder.indexOf(highest)) {
                 highest = pattern.severity;
             }
         }

package/dist/guards/patch-integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"patch-integrity.js","sourceRoot":"","sources":["../../src/guards/patch-integrity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;GAEG;AACH,MAAM,kBAAkB,GAAuB;IAC7C,2BAA2B;IAC3B;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;IAED,6BAA6B;IAC7B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,WAAW;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sBAAsB;KACpC;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,iCAAiC;KAC/C;IAED,4BAA4B;IAC5B;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,iBAAiB;KAC/B;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mCAAmC;KACjD;IAED,8BAA8B;IAC9B;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IAED,0BAA0B;IAC1B;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yBAAyB;KACvC;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kCAAkC;KAChD;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,gDAAgD;KAC9D;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACxC,QAAQ,CAAqB;IAErC,YAAY,qBAAyC,EAAE;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,IAAI;QACF,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,KAAkB,EAAE,MAAc;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,cAAkC,CAAC;QAEvC,2CAA2C;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,cAAc,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAE1D,iDAAiD;YACjD,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,EAAE,eAAe,IAAI,EAAE,CAAC;YAC/D,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACxC,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC/B,OAAO,IAAI,CAAC,IAAI,CACd,mCAAmC,OAAO,EAAE,EAC5C,MAAM,CACP,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;QAE9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE5D,OAAO,IAAI,CAAC,IAAI,CACd,gCAAgC,YAAY,EAAE,EAC9C,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAe;QACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,yBAAyB;YACzB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,QAA4B;QAE5B,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;QAErE,IAAI,OAAO,GAAmC,KAAK,CAAC;QAEpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IACE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAC9B,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"patch-integrity.js","sourceRoot":"","sources":["../../src/guards/patch-integrity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;GAEG;AACH,MAAM,kBAAkB,GAAuB;IAC7C,2BAA2B;IAC3B;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;IAED,6BAA6B;IAC7B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,mCAAmC;QAC5C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6BAA6B;KAC3C;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,WAAW;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,sBAAsB;KACpC;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,iCAAiC;KAC/C;IAED,4BAA4B;IAC5B;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,0DAA0D;QACnE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4BAA4B;KAC1C;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,iBAAiB;KAC/B;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,mCAAmC;KACjD;IAED,8BAA8B;IAC9B;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,sDAAsD;QAC/D,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IAED,0BAA0B;IAC1B;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yBAAyB;KACvC;IAED,gCAAgC;IAChC;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,kCAAkC;KAChD;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,gDAAgD;KAC9D;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACxC,QAAQ,CAAqB;IAErC,YAAY,qBAAyC,EAAE;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,IAAI;QACF,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,KAAkB,EAAE,MAAc;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,cAAkC,CAAC;QAEvC,2CAA2C;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,cAAc,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAE1D,iDAAiD;YACjD,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,EAAE,eAAe,IAAI,EAAE,CAAC;YAC/D,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACxC,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,mCAAmC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;oBACzE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;QAE9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE5D,OAAO,IAAI,CAAC,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAe;QACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,yBAAyB;YACzB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,QAA4B;QACrD,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;QAErE,IAAI,OAAO,GAAmC,KAAK,CAAC;QAEpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7E,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/guards/secret-leak.d.ts

@@ -3,8 +3,8 @@
  *
  * Detects and blocks exposure of secrets in tool outputs and patches.
  */
-import type { PolicyEvent, Policy, GuardResult, EventType, SecretPattern } from '../types.js';
-import { BaseGuard } from './types.js';
+import type { EventType, GuardResult, Policy, PolicyEvent, SecretPattern } from "../types.js";
+import { BaseGuard } from "./types.js";
 /**
  * SecretLeakGuard - detects and blocks secret exposure
  */

package/dist/guards/secret-leak.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-leak.d.ts","sourceRoot":"","sources":["../../src/guards/secret-leak.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,MAAM,EACN,WAAW,EACX,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA2KvC;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;IAC5C,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,kBAAkB,GAAE,aAAa,EAAO;IAKpD,IAAI,IAAI,MAAM;IAId,OAAO,IAAI,SAAS,EAAE;IAIhB,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIrE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW;IAiC3D;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE;IAkB/C;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAsB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}
+{"version":3,"file":"secret-leak.d.ts","sourceRoot":"","sources":["../../src/guards/secret-leak.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA4KvC;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;IAC5C,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,kBAAkB,GAAE,aAAa,EAAO;IAKpD,IAAI,IAAI,MAAM;IAId,OAAO,IAAI,SAAS,EAAE;IAIhB,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIrE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW;IA8B3D;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE;IAkB/C;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAsB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAa3B"}

package/dist/guards/secret-leak.js

@@ -3,161 +3,161 @@
  *
  * Detects and blocks exposure of secrets in tool outputs and patches.
  */
-import { BaseGuard } from './types.js';
+import { BaseGuard } from "./types.js";
 /**
  * Built-in secret detection patterns
  */
 const SECRET_PATTERNS = [
     // AWS Keys
     {
-        name: 'aws_access_key',
+        name: "aws_access_key",
         pattern: /AKIA[0-9A-Z]{16}/g,
-        severity: 'critical',
-        description: 'AWS Access Key ID',
+        severity: "critical",
+        description: "AWS Access Key ID",
     },
     {
-        name: 'aws_secret_key',
+        name: "aws_secret_key",
         pattern: /[A-Za-z0-9/+=]{40}/g,
-        severity: 'critical',
-        description: 'AWS Secret Access Key',
+        severity: "critical",
+        description: "AWS Secret Access Key",
     },
     // GitHub Tokens
     {
-        name: 'github_pat',
+        name: "github_pat",
         pattern: /ghp_[A-Za-z0-9]{36}/g,
-        severity: 'critical',
-        description: 'GitHub Personal Access Token',
+        severity: "critical",
+        description: "GitHub Personal Access Token",
     },
     {
-        name: 'github_oauth',
+        name: "github_oauth",
         pattern: /gho_[A-Za-z0-9]{36}/g,
-        severity: 'critical',
-        description: 'GitHub OAuth Token',
+        severity: "critical",
+        description: "GitHub OAuth Token",
     },
     {
-        name: 'github_app_token',
+        name: "github_app_token",
         pattern: /ghu_[A-Za-z0-9]{36}/g,
-        severity: 'critical',
-        description: 'GitHub App User Token',
+        severity: "critical",
+        description: "GitHub App User Token",
     },
     {
-        name: 'github_fine_grained',
+        name: "github_fine_grained",
         pattern: /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/g,
-        severity: 'critical',
-        description: 'GitHub Fine-grained PAT',
+        severity: "critical",
+        description: "GitHub Fine-grained PAT",
     },
     // OpenAI Keys
     {
-        name: 'openai_api_key',
+        name: "openai_api_key",
         pattern: /sk-[A-Za-z0-9]{48}/g,
-        severity: 'critical',
-        description: 'OpenAI API Key',
+        severity: "critical",
+        description: "OpenAI API Key",
     },
     {
-        name: 'openai_project_key',
+        name: "openai_project_key",
         pattern: /sk-proj-[A-Za-z0-9]{48}/g,
-        severity: 'critical',
-        description: 'OpenAI Project API Key',
+        severity: "critical",
+        description: "OpenAI Project API Key",
     },
     // Anthropic Keys
     {
-        name: 'anthropic_api_key',
+        name: "anthropic_api_key",
         pattern: /sk-ant-[A-Za-z0-9]{32,}/g,
-        severity: 'critical',
-        description: 'Anthropic API Key',
+        severity: "critical",
+        description: "Anthropic API Key",
     },
     // Google Cloud
     {
-        name: 'google_api_key',
+        name: "google_api_key",
         pattern: /AIza[0-9A-Za-z\-_]{35}/g,
-        severity: 'critical',
-        description: 'Google API Key',
+        severity: "critical",
+        description: "Google API Key",
     },
     {
-        name: 'gcp_service_account',
+        name: "gcp_service_account",
         pattern: /"type":\s*"service_account"/g,
-        severity: 'high',
-        description: 'GCP Service Account JSON',
+        severity: "high",
+        description: "GCP Service Account JSON",
     },
     // Private Keys
     {
-        name: 'private_key_rsa',
+        name: "private_key_rsa",
         pattern: /-----BEGIN RSA PRIVATE KEY-----/g,
-        severity: 'critical',
-        description: 'RSA Private Key',
+        severity: "critical",
+        description: "RSA Private Key",
     },
     {
-        name: 'private_key_openssh',
+        name: "private_key_openssh",
         pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
-        severity: 'critical',
-        description: 'OpenSSH Private Key',
+        severity: "critical",
+        description: "OpenSSH Private Key",
     },
     {
-        name: 'private_key_ec',
+        name: "private_key_ec",
         pattern: /-----BEGIN EC PRIVATE KEY-----/g,
-        severity: 'critical',
-        description: 'EC Private Key',
+        severity: "critical",
+        description: "EC Private Key",
     },
     {
-        name: 'private_key_generic',
+        name: "private_key_generic",
         pattern: /-----BEGIN PRIVATE KEY-----/g,
-        severity: 'critical',
-        description: 'Private Key',
+        severity: "critical",
+        description: "Private Key",
     },
     // Stripe
     {
-        name: 'stripe_secret_key',
+        name: "stripe_secret_key",
         pattern: /sk_live_[A-Za-z0-9]{24,}/g,
-        severity: 'critical',
-        description: 'Stripe Live Secret Key',
+        severity: "critical",
+        description: "Stripe Live Secret Key",
     },
     {
-        name: 'stripe_test_key',
+        name: "stripe_test_key",
         pattern: /sk_test_[A-Za-z0-9]{24,}/g,
-        severity: 'medium',
-        description: 'Stripe Test Secret Key',
+        severity: "medium",
+        description: "Stripe Test Secret Key",
     },
     // Stripe Restricted Key
     {
-        name: 'stripe_restricted_key',
+        name: "stripe_restricted_key",
         pattern: /rk_live_[A-Za-z0-9]{24,}/g,
-        severity: 'critical',
-        description: 'Stripe Live Restricted Key',
+        severity: "critical",
+        description: "Stripe Live Restricted Key",
     },
     // Slack
     {
-        name: 'slack_token',
+        name: "slack_token",
         pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-        severity: 'high',
-        description: 'Slack Token',
+        severity: "high",
+        description: "Slack Token",
     },
     // Azure Key Vault
     {
-        name: 'azure_key_vault_token',
+        name: "azure_key_vault_token",
         pattern: /azure[_-]?(?:key[_-]?vault|kv)[_-]?(?:secret|token|key)(?:'|")?\s*[:=]\s*(?:'|")?[A-Za-z0-9+/=_-]{32,}/gi,
-        severity: 'critical',
-        description: 'Azure Key Vault Secret',
+        severity: "critical",
+        description: "Azure Key Vault Secret",
     },
     // GitLab Personal Access Token
     {
-        name: 'gitlab_pat',
+        name: "gitlab_pat",
         pattern: /glpat-[A-Za-z0-9_-]{20,}/g,
-        severity: 'critical',
-        description: 'GitLab Personal Access Token',
+        severity: "critical",
+        description: "GitLab Personal Access Token",
     },
     // Generic high-entropy (likely secrets)
     {
-        name: 'jwt_token',
+        name: "jwt_token",
         pattern: /eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,
-        severity: 'high',
-        description: 'JWT Token',
+        severity: "high",
+        description: "JWT Token",
     },
     // Database URLs with credentials
     {
-        name: 'database_url',
+        name: "database_url",
         pattern: /(?:postgres|mysql|mongodb|redis):\/\/[^:]+:[^@]+@/g,
-        severity: 'critical',
-        description: 'Database URL with credentials',
+        severity: "critical",
+        description: "Database URL with credentials",
     },
 ];
 /**
@@ -170,10 +170,10 @@ export class SecretLeakGuard extends BaseGuard {
         this.patterns = [...SECRET_PATTERNS, ...additionalPatterns];
     }
     name() {
-        return 'secret_leak';
+        return "secret_leak";
     }
     handles() {
-        return ['patch_apply', 'tool_call'];
+        return ["patch_apply", "tool_call"];
     }
     async check(event, policy) {
         return this.checkSync(event, policy);
@@ -182,13 +182,13 @@ export class SecretLeakGuard extends BaseGuard {
         const data = event.data;
         let contentToCheck;
         // Get content to check based on event type
-        if (data.type === 'patch') {
+        if (data.type === "patch") {
             contentToCheck = data.patchContent;
         }
-        else if (data.type === 'tool') {
+        else if (data.type === "tool") {
             // Check tool result for secrets
             contentToCheck =
-                typeof data.result === 'string' ? data.result : JSON.stringify(data.result ?? '');
+                typeof data.result === "string" ? data.result : JSON.stringify(data.result ?? "");
         }
         if (!contentToCheck) {
             return this.allow();
@@ -197,7 +197,7 @@ export class SecretLeakGuard extends BaseGuard {
         const detected = this.detectSecrets(contentToCheck);
         if (detected.length > 0) {
             const highestSeverity = this.getHighestSeverity(detected);
-            const secretNames = detected.map((s) => s.name).join(', ');
+            const secretNames = detected.map((s) => s.name).join(", ");
             return this.deny(`Detected potential secrets in output: ${secretNames}`, highestSeverity);
         }
         return this.allow();
@@ -229,9 +229,9 @@ export class SecretLeakGuard extends BaseGuard {
             redacted = redacted.replace(pattern.pattern, (match) => {
                 // Show first 4 chars and last 4 chars, redact the middle
                 if (match.length > 12) {
-                    return match.slice(0, 4) + '[REDACTED]' + match.slice(-4);
+                    return match.slice(0, 4) + "[REDACTED]" + match.slice(-4);
                 }
-                return '[REDACTED]';
+                return "[REDACTED]";
             });
             // Reset again after replace
             pattern.pattern.lastIndex = 0;
@@ -242,11 +242,10 @@ export class SecretLeakGuard extends BaseGuard {
      * Get the highest severity from detected patterns
      */
     getHighestSeverity(patterns) {
-        const severityOrder = ['low', 'medium', 'high', 'critical'];
-        let highest = 'low';
+        const severityOrder = ["low", "medium", "high", "critical"];
+        let highest = "low";
         for (const pattern of patterns) {
-            if (severityOrder.indexOf(pattern.severity) >
-                severityOrder.indexOf(highest)) {
+            if (severityOrder.indexOf(pattern.severity) > severityOrder.indexOf(highest)) {
                 highest = pattern.severity;
             }
         }

package/dist/guards/secret-leak.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-leak.js","sourceRoot":"","sources":["../../src/guards/secret-leak.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;GAEG;AACH,MAAM,eAAe,GAAoB;IACvC,WAAW;IACX;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uBAAuB;KACrC;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yBAAyB;KACvC;IAED,cAAc;IACd;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IAED,iBAAiB;IACjB;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;KACjC;IAED,eAAe;IACf;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IAED,eAAe;IACf;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iBAAiB;KAC/B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,aAAa;KAC3B;IAED,SAAS;IACT;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,wBAAwB;KACtC;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4BAA4B;KAC1C;IAED,QAAQ;IACR;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,aAAa;KAC3B;IAED,kBAAkB;IAClB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,0GAA0G;QACnH,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IAED,+BAA+B;IAC/B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8BAA8B;KAC5C;IAED,wCAAwC;IACxC;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uDAAuD;QAChE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,WAAW;KACzB;IAED,iCAAiC;IACjC;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IACpC,QAAQ,CAAkB;IAElC,YAAY,qBAAsC,EAAE;QAClD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,KAAkB,EAAE,OAAe;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,cAAkC,CAAC;QAEvC,2CAA2C;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,gCAAgC;YAChC,cAAc;gBACZ,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAEpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE3D,OAAO,IAAI,CAAC,IAAI,CACd,yCAAyC,WAAW,EAAE,EACtD,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,yBAAyB;YACzB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAe;QACpB,IAAI,QAAQ,GAAG,OAAO,CAAC;QAEvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrD,yDAAyD;gBACzD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,QAAyB;QAEzB,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;QAErE,IAAI,OAAO,GAAmC,KAAK,CAAC;QAEpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IACE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAC9B,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"secret-leak.js","sourceRoot":"","sources":["../../src/guards/secret-leak.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;GAEG;AACH,MAAM,eAAe,GAAoB;IACvC,WAAW;IACX;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uBAAuB;KACrC;IAED,gBAAgB;IAChB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yBAAyB;KACvC;IAED,cAAc;IACd;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IAED,iBAAiB;IACjB;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,mBAAmB;KACjC;IAED,eAAe;IACf;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0BAA0B;KACxC;IAED,eAAe;IACf;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,iBAAiB;KAC/B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,iCAAiC;QAC1C,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,gBAAgB;KAC9B;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,8BAA8B;QACvC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,aAAa;KAC3B;IAED,SAAS;IACT;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,wBAAwB;KACtC;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4BAA4B;KAC1C;IAED,QAAQ;IACR;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,+BAA+B;QACxC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,aAAa;KAC3B;IAED,kBAAkB;IAClB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wBAAwB;KACtC;IAED,+BAA+B;IAC/B;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,2BAA2B;QACpC,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,8BAA8B;KAC5C;IAED,wCAAwC;IACxC;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uDAAuD;QAChE,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,WAAW;KACzB;IAED,iCAAiC;IACjC;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oDAAoD;QAC7D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,+BAA+B;KAC7C;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,SAAS;IACpC,QAAQ,CAAkB;IAElC,YAAY,qBAAsC,EAAE;QAClD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,MAAc;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,KAAkB,EAAE,OAAe;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,cAAkC,CAAC;QAEvC,2CAA2C;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,gCAAgC;YAChC,cAAc;gBACZ,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAEpD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE3D,OAAO,IAAI,CAAC,IAAI,CAAC,yCAAyC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAED,yBAAyB;YACzB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAe;QACpB,IAAI,QAAQ,GAAG,OAAO,CAAC;QAEvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,oBAAoB;YACpB,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE9B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrD,yDAAyD;gBACzD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,QAAyB;QAClD,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;QAErE,IAAI,OAAO,GAAmC,KAAK,CAAC;QAEpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7E,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/guards/types.d.ts

@@ -3,7 +3,7 @@
  *
  * Type definitions for the guard system.
  */
-import type { PolicyEvent, Policy, GuardResult, EventType } from '../types.js';
+import type { EventType, GuardResult, Policy, PolicyEvent } from "../types.js";
 /**
  * Guard interface - modular policy enforcement
  */
@@ -37,7 +37,7 @@ export declare abstract class BaseGuard implements Guard {
     /**
      * Helper to create a deny result
      */
-    protected deny(reason: string, severity?: GuardResult['severity']): GuardResult;
+    protected deny(reason: string, severity?: GuardResult["severity"]): GuardResult;
     /**
      * Helper to create a warn result
      */