@ebowwa/coder 0.7.63 → 0.7.64

package/dist/core/cognitive-security/index.d.ts

@@ -0,0 +1,751 @@
+/**
+ * Cognitive Security - Intent Module
+ *
+ * TypeScript bindings for the Rust cognitive security module.
+ * Provides intent preservation, alignment scoring, and corruption detection.
+ */
+export interface AgentIntent {
+    id: string;
+    version: number;
+    identity: AgentIdentity;
+    purpose: AgentPurpose;
+    principles: AgentPrinciples;
+    signature?: string;
+    createdAt: number;
+    signedBy?: string;
+}
+export interface AgentIdentity {
+    name: string;
+    description: string;
+    capabilities: string[];
+    constraints: string[];
+}
+export interface AgentPurpose {
+    goals: Goal[];
+    nonGoals: string[];
+    boundaries: Boundary[];
+}
+export interface AgentPrinciples {
+    values: string[];
+    priorities: string[];
+    forbidden: string[];
+}
+export interface Goal {
+    id: string;
+    description: string;
+    priority: "critical" | "high" | "medium" | "low";
+    measurable: boolean;
+    successCriteria?: string;
+}
+export interface Boundary {
+    id: string;
+    description: string;
+    enforcement: "never" | "require_approval" | "log_only";
+    domain: string;
+    pattern?: string;
+}
+export interface ActionContext {
+    actionType: string;
+    domain: string;
+    operation: string;
+    target?: string;
+    params?: Record<string, unknown>;
+    reasoning?: string;
+}
+export interface AlignmentResult {
+    score: number;
+    reasoning: string;
+    servesGoals: string[];
+    hindersGoals: string[];
+    boundaryConcerns: string[];
+    confidence: number;
+    shouldBlock: boolean;
+    requiresReview: boolean;
+}
+export interface IntegrityResult {
+    valid: boolean;
+    error?: string;
+    signatureValid: boolean;
+    contentIntact: boolean;
+    expired: boolean;
+}
+export interface IntentKeypair {
+    privateKey: string;
+    publicKey: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export interface BehaviorSnapshot {
+    timestamp: number;
+    actionCount: number;
+    alignmentDistribution: AlignmentDistribution;
+    actionsByDomain: DomainCount[];
+    actionsByType: TypeCount[];
+    boundaryViolations: number;
+    actionsBlocked: number;
+}
+export interface AlignmentDistribution {
+    mean: number;
+    variance: number;
+    min: number;
+    max: number;
+    belowThresholdCount: number;
+}
+export interface DomainCount {
+    domain: string;
+    count: number;
+}
+export interface TypeCount {
+    actionType: string;
+    count: number;
+}
+export interface CorruptionAnalysis {
+    riskScore: number;
+    indicators: CorruptionIndicator[];
+    recommendation: "continue" | "monitor" | "alert" | "pause" | "reset" | "investigate";
+    explanation: string;
+}
+export interface CorruptionIndicator {
+    indicatorType: string;
+    severity: string;
+    description: string;
+    evidence: string;
+}
+export interface DriftResult {
+    overallDrift: number;
+    driftFactors: DriftFactor[];
+    concernLevel: "none" | "low" | "medium" | "high" | "critical";
+}
+export interface DriftFactor {
+    factorType: string;
+    drift: number;
+    description: string;
+}
+/**
+ * Generate a new Ed25519 keypair for signing intents
+ */
+export declare function generateKeypair(): Promise<IntentKeypair>;
+/**
+ * Sign an agent intent with a private key
+ */
+export declare function signIntent(intent: AgentIntent, privateKey: string): Promise<AgentIntent>;
+/**
+ * Verify an intent's signature
+ */
+export declare function verifyIntent(intent: AgentIntent): Promise<IntegrityResult>;
+/**
+ * Hash an intent for comparison
+ */
+export declare function hashIntent(intent: AgentIntent): Promise<string>;
+/**
+ * Check if two intents are equivalent (ignoring signatures)
+ */
+export declare function intentsEquivalent(intent1: AgentIntent, intent2: AgentIntent): Promise<boolean>;
+/**
+ * Score how well an action aligns with an intent
+ */
+export declare function scoreAlignment(action: ActionContext, intent: AgentIntent): Promise<AlignmentResult>;
+/**
+ * Batch score multiple actions against an intent
+ */
+export declare function batchScoreAlignment(actions: ActionContext[], intent: AgentIntent): Promise<AlignmentResult[]>;
+/**
+ * Check if any action in a sequence would violate intent
+ */
+export declare function checkSequenceViolations(actions: ActionContext[], intent: AgentIntent): Promise<number[]>;
+/**
+ * Load intent from a JSON file
+ */
+export declare function loadIntent(path: string): Promise<AgentIntent>;
+/**
+ * Save intent to a JSON file
+ */
+export declare function saveIntent(intent: AgentIntent, path: string): Promise<void>;
+/**
+ * Parse intent from JSON string
+ */
+export declare function parseIntent(json: string): Promise<AgentIntent>;
+/**
+ * Serialize intent to JSON string
+ */
+export declare function serializeIntent(intent: AgentIntent): Promise<string>;
+/**
+ * Validate intent structure
+ */
+export declare function validateIntent(intent: AgentIntent): Promise<ValidationResult>;
+/**
+ * Create a default data collector intent
+ */
+export declare function createDataCollectorIntent(name: string, description: string): Promise<AgentIntent>;
+/**
+ * Merge two intents (child overrides parent)
+ */
+export declare function mergeIntents(base: AgentIntent, override: AgentIntent): Promise<AgentIntent>;
+/**
+ * Analyze behavior for signs of intent corruption
+ */
+export declare function analyzeCorruption(snapshot: BehaviorSnapshot, intent: AgentIntent): Promise<CorruptionAnalysis>;
+/**
+ * Detect behavioral drift between two snapshots
+ */
+export declare function detectDrift(baseline: BehaviorSnapshot, current: BehaviorSnapshot): Promise<DriftResult>;
+/**
+ * Create an empty behavior snapshot
+ */
+export declare function createEmptySnapshot(): Promise<BehaviorSnapshot>;
+/**
+ * Update a snapshot with a new action result
+ */
+export declare function updateSnapshot(snapshot: BehaviorSnapshot, action: ActionContext, alignment: AlignmentResult): Promise<BehaviorSnapshot>;
+export type ActionType = "modify" | "execute" | "communicate" | "transfer" | "observe" | "create" | "delete";
+export type FlowDirection = "inbound" | "outbound" | "bidirectional";
+export interface ClassifiedAction {
+    id: string;
+    actionType: string;
+    domain: string;
+    operation: string;
+    target?: string;
+    flowDirection: string;
+    riskLevel: number;
+    hasSideEffects: boolean;
+    requiresApproval: boolean;
+    reasoning?: string;
+    timestamp: number;
+    metadata?: string;
+}
+export interface ActionValidationResult {
+    allowed: boolean;
+    classification?: ClassifiedAction;
+    reason: string;
+    violatedPolicy?: string;
+    approvalRequired: boolean;
+    approvalToken?: string;
+    alternatives: string[];
+    confidence: number;
+}
+export interface ActionPolicy {
+    id: string;
+    description: string;
+    actionTypes: string[];
+    domains: string[];
+    operations: string[];
+    effect: "allow" | "deny" | "require_approval";
+    priority: number;
+    conditions?: string;
+    enabled: boolean;
+}
+export interface ActionContextForValidation {
+    actionType: string;
+    domain: string;
+    operation: string;
+    target?: string;
+    params?: string;
+    reasoning?: string;
+    sessionId?: string;
+    parentActionId?: string;
+}
+export interface ApprovalRequest {
+    id: string;
+    actionId: string;
+    classification: ClassifiedAction;
+    context: ActionContextForValidation;
+    createdAt: number;
+    expiresAt: number;
+    status: "pending" | "approved" | "denied" | "cancelled";
+    decidedBy?: string;
+    decidedAt?: number;
+    reason?: string;
+    priority: number;
+    escalationLevel: number;
+}
+export interface ApprovalStats {
+    pendingCount: number;
+    approvedCount: number;
+    deniedCount: number;
+    cancelledCount: number;
+    totalProcessed: number;
+}
+export interface AuditEntry {
+    id: string;
+    sequence: number;
+    timestamp: number;
+    action: ClassifiedAction;
+    validation: ActionValidationResult;
+    executed: boolean;
+    executionResult?: string;
+    sessionId?: string;
+    agentId?: string;
+    correlationId?: string;
+    metadata?: string;
+}
+export interface AuditStats {
+    totalEntries: number;
+    blockedCount: number;
+    executedCount: number;
+    byActionType: {
+        actionType: string;
+        count: number;
+    }[];
+    byDomain: {
+        domain: string;
+        count: number;
+    }[];
+    firstTimestamp: number;
+    lastTimestamp: number;
+}
+export interface ActionRiskInfo {
+    actionType: string;
+    riskLevel: number;
+}
+export interface FileDomainConfig {
+    protectedPaths: string[];
+    readOnlyPaths: string[];
+    largeFileThreshold: number;
+}
+export interface NetworkDomainConfig {
+    allowedHosts: string[];
+    blockedHosts: string[];
+    requireApprovalExternal: boolean;
+}
+export interface ShellDomainConfig {
+    allowedCommands: string[];
+    blockedCommands: string[];
+    requireApproval: boolean;
+}
+/**
+ * Classify an operation into an action type
+ */
+export declare function classifyOperation(operation: string, domain: string, target?: string, reasoning?: string): Promise<ClassifiedAction>;
+/**
+ * Get all supported action types
+ */
+export declare function getActionTypes(): Promise<string[]>;
+/**
+ * Get risk levels for all action types
+ */
+export declare function getActionRiskLevels(): Promise<ActionRiskInfo[]>;
+/**
+ * Create a deny-all policy
+ */
+export declare function createDenyAllPolicy(): Promise<ActionPolicy>;
+/**
+ * Create an observe-only policy
+ */
+export declare function createObserveOnlyPolicy(): Promise<ActionPolicy>;
+/**
+ * Create a transfer approval policy
+ */
+export declare function createTransferApprovalPolicy(): Promise<ActionPolicy>;
+/**
+ * Create file domain configuration
+ */
+export declare function createFileDomainConfig(): Promise<FileDomainConfig>;
+/**
+ * Create network domain configuration
+ */
+export declare function createNetworkDomainConfig(): Promise<NetworkDomainConfig>;
+/**
+ * Create shell domain configuration
+ */
+export declare function createShellDomainConfig(): Promise<ShellDomainConfig>;
+export type SensitivityLevelType = "public" | "internal" | "confidential" | "secret" | "top_secret";
+export type DataCategoryType = "pii" | "financial" | "credentials" | "secrets" | "source_code" | "configuration" | "logs" | "user_content" | "system_data" | "network_data" | "generic";
+export interface ClassifiedData {
+    id: string;
+    sensitivity: string;
+    category: string;
+    source: string;
+    tags: string[];
+    can_log: boolean;
+    can_transmit: boolean;
+    can_store: boolean;
+    expires_at: number | null;
+    created_at: number;
+}
+export interface FlowRecord {
+    id: string;
+    data_id: string;
+    source_domain: string;
+    target_domain: string;
+    direction: string;
+    allowed: boolean;
+    reason: string;
+    policy_id: string | null;
+    session_id: string | null;
+    action_id: string | null;
+    timestamp: number;
+    data_hash: string;
+}
+export interface FlowValidationResult {
+    allowed: boolean;
+    reason: string;
+    applied_policy: string | null;
+    can_log: boolean;
+    can_transmit: boolean;
+    can_store: boolean;
+    transformations: string[];
+    confidence: number;
+    warnings: string[];
+    requireApproval?: boolean;
+}
+export interface FlowPolicy {
+    id: string;
+    description: string;
+    source_pattern: string;
+    target_pattern: string;
+    min_source_sensitivity: string | null;
+    max_target_sensitivity: string | null;
+    categories: string[];
+    effect: "allow" | "deny" | "transform" | "audit_only";
+    priority: number;
+    required_transforms: string[];
+    log_flow: boolean;
+    require_approval: boolean;
+    conditions: string | null;
+    enabled: boolean;
+}
+export interface FlowTrackerStats {
+    total_flows: number;
+    allowed_count: number;
+    blocked_count: number;
+    by_direction: {
+        direction: string;
+        count: number;
+    }[];
+    by_source_domain: {
+        domain: string;
+        count: number;
+    }[];
+    by_target_domain: {
+        domain: string;
+        count: number;
+    }[];
+    first_timestamp: number;
+    last_timestamp: number;
+}
+export interface DomainStats {
+    domain: string;
+    inbound_count: number;
+    outbound_count: number;
+    blocked_count: number;
+    by_sensitivity: Record<string, number>;
+}
+export type LeakType = "credential_exposure" | "pii_exposure" | "secret_key_exposure" | "internal_url_exposure" | "debug_info_leak" | "stack_trace_exposure" | "config_exposure" | "source_code_leak" | "encoded_smuggling" | "timing_channel" | "covert_channel";
+export type PreventionActionType = "allow" | "alert" | "block";
+export interface LeakDetection {
+    pattern_name: string;
+    leak_type: LeakType;
+    severity: number;
+    match_found: boolean;
+}
+export interface LeakCheckResult {
+    action: PreventionActionType;
+    detections: LeakDetection[];
+    channel_allowed: boolean;
+    checked_at: number;
+}
+export interface PreventionStatsResult {
+    total_checks: number;
+    blocked_count: number;
+    alert_count: number;
+    by_leak_type: Record<string, number>;
+}
+export type TaintSourceType = "user_input" | "file_system" | "network" | "environment" | "secrets" | "database" | "agent_generated" | "tool_output" | "memory" | "external";
+export type PropagationType = "assignment" | "parameter" | "return" | "concatenation" | "collection_inclusion" | "property" | "transformation" | "aggregation";
+export interface TaintSource {
+    id: string;
+    source_type: string;
+    sensitivity: string;
+    registered_at: number;
+    tags: string[];
+}
+export interface TaintedData {
+    id: string;
+    source_id: string;
+    data_hash: string;
+    sensitivity: string;
+    location: DataLocation;
+    propagated_from: string[];
+    tainted_at: number;
+    can_sanitize: boolean;
+    last_accessed: number;
+    access_count: number;
+}
+export interface DataLocation {
+    location_type: string;
+    identifier: string;
+    context: string | null;
+}
+export interface TaintPropagation {
+    id: string;
+    source_id: string;
+    target_id: string;
+    propagation_type: string;
+    operation: string;
+    timestamp: number;
+}
+export interface FlowDecision {
+    allowed: boolean;
+    reason: string;
+    requires_sanitization: boolean;
+}
+export interface TaintStatsResult {
+    total_sources: number;
+    total_tainted: number;
+    total_propagations: number;
+    by_source_type: Record<string, number>;
+    by_sensitivity: Record<string, number>;
+}
+/**
+ * Classify data based on content and source
+ */
+export declare function classifyData(content: string, source: string, tags: string[]): Promise<ClassifiedData>;
+/**
+ * Check if content contains sensitive data
+ */
+export declare function containsSensitiveData(content: string): Promise<boolean>;
+/**
+ * Redact sensitive content
+ */
+export declare function redactSensitive(content: string, replacement?: string): Promise<string>;
+/**
+ * Get sensitivity levels
+ */
+export declare function getSensitivityLevels(): Promise<SensitivityLevelInfo[]>;
+/**
+ * Get data categories
+ */
+export declare function getDataCategories(): Promise<DataCategoryInfo[]>;
+export interface SensitivityLevelInfo {
+    name: string;
+    value: number;
+    description: string;
+}
+export interface DataCategoryInfo {
+    name: string;
+    description: string;
+}
+/**
+ * Create a flow policy engine
+ */
+export declare function createFlowPolicyEngine(): Promise<FlowPolicyEngineHandle>;
+export interface FlowPolicyEngineHandle {
+    addPolicy(policy: FlowPolicy): void;
+    removePolicy(policyId: string): boolean;
+    evaluate(data: ClassifiedData, sourceDomain: string, targetDomain: string): FlowValidationResult;
+    listPolicies(): FlowPolicy[];
+    setDefaultAction(action: string): void;
+    setBlpMode(mode: string): void;
+}
+/**
+ * Create an allow-all flow policy
+ */
+export declare function createAllowAllFlowPolicy(): Promise<FlowPolicy>;
+/**
+ * Create a deny-all flow policy
+ */
+export declare function createDenyAllFlowPolicy(): Promise<FlowPolicy>;
+/**
+ * Create a strict flow policy
+ */
+export declare function createStrictFlowPolicy(): Promise<FlowPolicy>;
+/**
+ * Create a flow tracker
+ */
+export declare function createFlowTracker(): Promise<FlowTrackerHandle>;
+export interface FlowTrackerHandle {
+    record(data: ClassifiedData, sourceDomain: string, targetDomain: string, direction: string, validation: FlowValidationResult, sessionId: string | null, actionId: string | null): FlowRecord;
+    getFlow(flowId: string): FlowRecord | null;
+    getLineage(dataId: string): FlowRecord[];
+    bySource(domain: string): FlowRecord[];
+    byTarget(domain: string): FlowRecord[];
+    bySession(sessionId: string): FlowRecord[];
+    blocked(): FlowRecord[];
+    allowed(): FlowRecord[];
+    recent(limit: number): FlowRecord[];
+    stats(): FlowTrackerStats;
+    domainStats(domain: string): DomainStats | null;
+    count(): number;
+    clear(): void;
+    setMaxFlows(max: number): void;
+    exportJsonl(): string;
+}
+/**
+ * Create a leak prevention engine
+ */
+export declare function createLeakPrevention(): Promise<LeakPreventionHandle>;
+export interface LeakPreventionHandle {
+    check(content: string, channel: string): LeakCheckResult;
+    sanitize(content: string): string;
+    registerSensitive(data: string): void;
+    addChannel(channel: string): void;
+    removeChannel(channel: string): void;
+    setMode(mode: string): void;
+    stats(): PreventionStatsResult;
+    clearSensitive(): void;
+}
+/**
+ * Quick check content for leaks
+ */
+export declare function checkForLeaks(content: string, channel: string): Promise<LeakCheckResult>;
+/**
+ * Quick sanitize content
+ */
+export declare function sanitizeContent(content: string): Promise<string>;
+/**
+ * Create a taint tracker
+ */
+export declare function createTaintTracker(): Promise<TaintTrackerHandle>;
+export interface TaintTrackerHandle {
+    registerSource(sourceType: string, sensitivity: string, tags: string[]): string;
+    taint(sourceId: string, data: string, locationType: string, identifier: string): string | null;
+    propagate(sourceTaintId: string, newData: string, locationType: string, identifier: string, propagationType: string, operation: string): string | null;
+    canFlow(taintId: string, sink: string): FlowDecision;
+    isTainted(data: string): boolean;
+    getTaint(taintId: string): TaintedData | null;
+    stats(): TaintStatsResult;
+    clear(taintId: string): boolean;
+    clearAll(): void;
+}
+export interface ImmutableDirective {
+    id: string;
+    directiveType: string;
+    rule: string;
+    domain: string;
+    priority: number;
+    overridable: boolean;
+    createdAt: number;
+    expiresAt?: number;
+    createdBy: string;
+    signature?: string;
+    signedBy?: string;
+    ruleHash: string;
+}
+export interface DirectiveResult {
+    allowed: boolean;
+    requiresApproval: boolean;
+    violations: DirectiveViolation[];
+    approvalDirectives: string[];
+    denialReason?: string;
+}
+export interface DirectiveViolation {
+    directiveId: string;
+    directiveType: string;
+    reason: string;
+    severity: string;
+}
+export interface SignedAction {
+    id: string;
+    sequence: number;
+    sessionId: string;
+    tool: string;
+    domain: string;
+    actionType: string;
+    target?: string;
+    paramsHash: string;
+    timestamp: number;
+    intentId?: string;
+    signature: string;
+    signedBy: string;
+    prevHash?: string;
+    hash: string;
+}
+export interface ActionVerification {
+    signatureValid: boolean;
+    chainIntact: boolean;
+    hashValid: boolean;
+    intentVerified: boolean;
+    valid: boolean;
+    error?: string;
+}
+export interface BehavioralProfile {
+    agentId: string;
+    intentId?: string;
+    createdAt: number;
+    updatedAt: number;
+    totalActions: number;
+    actionTypes: Record<string, number>;
+    domains: Record<string, number>;
+    tools: Record<string, number>;
+    actionsPerMinute: number;
+    rateWindow: number;
+    commonSequences: SequencePattern[];
+    forbiddenAttempts: number;
+    approvalRequests: number;
+}
+export interface SequencePattern {
+    sequence: string[];
+    count: number;
+    lastSeen: number;
+}
+export interface DriftIndicator {
+    indicatorType: string;
+    severity: number;
+    description: string;
+    factor: string;
+    evidence: string[];
+}
+/**
+ * Create a directive store for immutable directives
+ */
+export declare function createDirectiveStore(): Promise<DirectiveStoreHandle>;
+/**
+ * Create an action signer for cryptographic action signing
+ */
+export declare function createActionSigner(privateKeyHex: string, sessionId: string): Promise<ActionSignerHandle>;
+/**
+ * Create a drift detector for behavioral analytics
+ */
+export declare function createDriftDetector(agentId: string, intentId?: string): Promise<DriftDetectorHandle>;
+/**
+ * Create default financial protection directives
+ */
+export declare function createDefaultFinancialDirectives(store: DirectiveStoreHandle): Promise<ImmutableDirective[]>;
+declare class DirectiveStoreHandle {
+    private directives;
+    setSigningKey(privateKeyHex: string): Promise<void>;
+    createDirective(directiveType: string, rule: string, domain: string, priority?: number, overridable?: boolean, createdBy?: string): Promise<ImmutableDirective>;
+    addDirective(directive: ImmutableDirective): Promise<void>;
+    evaluate(actionType: string, domain: string, target: string | null, params: string): Promise<DirectiveResult>;
+    private evaluateRule;
+    private hashRule;
+}
+declare class ActionSignerHandle {
+    private privateKey;
+    private _sessionId;
+    private _sequence;
+    private _lastHash;
+    private _intentId;
+    constructor(privateKey: string, sessionId: string);
+    setIntent(intentId: string): void;
+    sign(tool: string, domain: string, actionType: string, target: string | null, params: string): Promise<SignedAction>;
+    verify(action: SignedAction): Promise<ActionVerification>;
+    getSequence(): number;
+    getSessionId(): string;
+    get publicKey(): string;
+}
+/**
+ * Verify a signed action without needing a signer handle
+ */
+export declare function verifySignedAction(action: SignedAction, publicKeyHex: string): Promise<ActionVerification>;
+declare class DriftDetectorHandle {
+    private agentId;
+    private intentId;
+    private profile;
+    private recentActions;
+    private actionTimes;
+    private threshold;
+    constructor(agentId: string, intentId?: string);
+    record(action: SignedAction): void;
+    recordForbidden(): void;
+    recordApproval(): void;
+    detect(): DriftResult;
+    getProfile(): BehavioralProfile;
+    setThreshold(threshold: number): void;
+    getRecentActions(): SignedAction[];
+}
+export * from "./hooks.js";
+//# sourceMappingURL=index.d.ts.map