@goplus/agentguard 1.1.1 → 1.1.4

package/dist/runtime/evaluator.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateLocalAction = evaluateLocalAction;
+const index_js_1 = require("../action/index.js");
+const skill_js_1 = require("../types/skill.js");
+const redaction_js_1 = require("./redaction.js");
+function reason(code, severity, title, description, evidence) {
+    return {
+        code,
+        severity,
+        title,
+        description,
+        evidence: evidence === undefined ? undefined : (0, redaction_js_1.redactPreview)(evidence, 240),
+    };
+}
+async function evaluateLocalAction(policy, action) {
+    const customReasons = customPolicyReasons(policy, action);
+    const ossDecision = await evaluateWithOssActionScanner(policy, action);
+    const ossReasons = (ossDecision?.risk_tags || []).map((tag, index) => normalizeOssReason(tag, ossDecision?.evidence?.[index], action));
+    const reasons = (0, redaction_js_1.redactReasons)([...customReasons, ...ossReasons]);
+    const riskScore = riskScoreFor(reasons, ossDecision?.risk_level || 'safe');
+    const riskLevel = riskLevelFor(riskScore);
+    const decision = decisionFor(policy, reasons, riskLevel, ossDecision?.decision);
+    return {
+        actionId: `act_local_${Date.now()}_${process.pid}`,
+        decision: policy.mode === 'observe' && decision === 'block' ? 'warn' : decision,
+        riskScore,
+        riskLevel,
+        reasons,
+        policyVersion: policy.policyVersion || 'runtime-local-v0.1',
+    };
+}
+function customPolicyReasons(policy, action) {
+    const reasons = [];
+    const input = action.input || '';
+    const lower = input.toLowerCase();
+    if (action.actionType === 'shell') {
+        for (const pattern of policy.blockedCommandPatterns) {
+            if (matchesPattern(lower, pattern.toLowerCase())) {
+                reasons.push(reason('CUSTOM_BLOCKED_COMMAND', 'critical', 'Custom blocked command', 'The action matched a command pattern configured in runtime policy.', pattern));
+            }
+        }
+        for (const domain of policy.network.blockedDomains) {
+            if (domain && lower.includes(domain.toLowerCase())) {
+                reasons.push(reason('CUSTOM_BLOCKED_DOMAIN', 'high', 'Custom blocked domain', 'The action references a domain blocked by runtime policy.', domain));
+            }
+        }
+    }
+    if (action.actionType === 'file_read' || action.actionType === 'file_write') {
+        for (const pathPattern of policy.protectedPaths) {
+            if (matchesPath(input, pathPattern)) {
+                reasons.push(reason('SECRET_ACCESS', action.actionType === 'file_write' ? 'critical' : 'high', 'Protected path access', 'The agent attempted to access a path protected by runtime policy.', pathPattern));
+            }
+        }
+    }
+    if (action.actionType === 'deploy') {
+        reasons.push(reason('DEPLOYMENT_ACTION', 'high', 'Deployment action requires approval', 'Deployment actions can affect production systems and should be approved in cloud policy.', input));
+    }
+    return reasons;
+}
+async function evaluateWithOssActionScanner(policy, action) {
+    const mapped = mapRuntimeAction(action);
+    if (!mapped)
+        return null;
+    const registry = {
+        async lookup() {
+            return {
+                record: null,
+                effective_trust_level: 'trusted',
+                effective_capabilities: {
+                    ...skill_js_1.DEFAULT_CAPABILITY,
+                    exec: 'allow',
+                    network_allowlist: policy.network.approvalDomains,
+                    filesystem_allowlist: policy.protectedPaths,
+                },
+            };
+        },
+    };
+    const scanner = new index_js_1.ActionScanner({ registry: registry });
+    return scanner.decide({
+        actor: {
+            skill: {
+                id: action.sourceSkill || 'local-agent',
+                source: action.agentHost,
+                version_ref: 'runtime',
+                artifact_hash: '',
+            },
+        },
+        action: mapped,
+        context: {
+            session_id: action.sessionId,
+            user_present: true,
+            env: 'dev',
+            time: new Date().toISOString(),
+            initiating_skill: action.sourceSkill,
+        },
+    });
+}
+function mapRuntimeAction(action) {
+    if (action.actionType === 'shell') {
+        return { type: 'exec_command', data: { command: action.input, cwd: action.cwd } };
+    }
+    if (action.actionType === 'file_read') {
+        return { type: 'read_file', data: { path: action.input } };
+    }
+    if (action.actionType === 'file_write') {
+        return { type: 'write_file', data: { path: action.input } };
+    }
+    if (action.actionType === 'network' || action.actionType === 'browser') {
+        return { type: 'network_request', data: { method: 'GET', url: action.input } };
+    }
+    return null;
+}
+function normalizeOssReason(tag, evidence, action) {
+    const evidenceText = evidence?.match || evidence?.description || action.input;
+    if (tag === 'DANGEROUS_COMMAND') {
+        return reason('DESTRUCTIVE_COMMAND', 'critical', 'Dangerous command', 'The local OSS runtime detected a dangerous command.', evidenceText);
+    }
+    if (tag === 'SENSITIVE_DATA_ACCESS' || tag === 'SENSITIVE_ENV_VAR') {
+        return reason('SECRET_ACCESS', 'high', 'Sensitive data access', 'The local OSS runtime detected access to sensitive data.', evidenceText);
+    }
+    if (tag === 'WEBHOOK_EXFIL' || tag === 'CRITICAL_SECRET_EXFIL' || tag === 'POTENTIAL_SECRET_EXFIL') {
+        return reason('DATA_EXFILTRATION', tag === 'CRITICAL_SECRET_EXFIL' ? 'critical' : 'high', 'Potential data exfiltration', 'The local OSS runtime detected exfiltration risk.', evidenceText);
+    }
+    if (tag === 'NETWORK_COMMAND' || tag === 'UNTRUSTED_DOMAIN') {
+        return reason('NETWORK_RISK', 'medium', 'Network action', 'The local OSS runtime detected network activity.', evidenceText);
+    }
+    if (tag === 'SHELL_INJECTION_RISK') {
+        return reason('SHELL_INJECTION_RISK', 'medium', 'Shell metacharacters', 'The local OSS runtime detected shell metacharacters.', evidenceText);
+    }
+    return reason(tag, 'medium', tag.replace(/_/g, ' ').toLowerCase(), 'The local OSS runtime detected a risky action.', evidenceText);
+}
+function decisionFor(policy, reasons, riskLevel, ossDecision) {
+    for (const item of reasons) {
+        const decision = policyDecisionFor(item.code, policy);
+        if (decision)
+            return decision;
+    }
+    if (ossDecision === 'deny')
+        return riskLevel === 'critical' ? 'block' : 'require_approval';
+    if (ossDecision === 'confirm')
+        return 'require_approval';
+    if (reasons.length > 0)
+        return 'warn';
+    return 'allow';
+}
+function policyDecisionFor(code, policy) {
+    if (code === 'CUSTOM_BLOCKED_COMMAND' || code === 'DESTRUCTIVE_COMMAND')
+        return policy.decisions.destructiveCommand;
+    if (code === 'REMOTE_CODE_EXECUTION')
+        return policy.decisions.remoteCodeExecution;
+    if (code === 'CUSTOM_BLOCKED_DOMAIN' || code === 'DATA_EXFILTRATION')
+        return policy.decisions.dataExfiltration;
+    if (code === 'SECRET_ACCESS')
+        return policy.decisions.secretAccess;
+    if (code === 'DEPLOYMENT_ACTION')
+        return policy.decisions.deployAction;
+    return null;
+}
+function riskScoreFor(reasons, ossRiskLevel) {
+    if (reasons.some((item) => item.severity === 'critical') || ossRiskLevel === 'critical')
+        return 95;
+    if (reasons.some((item) => item.severity === 'high') || ossRiskLevel === 'high')
+        return 55;
+    if (reasons.some((item) => item.severity === 'medium') || ossRiskLevel === 'medium')
+        return 20;
+    if (reasons.length > 0 || ossRiskLevel === 'low')
+        return reasons.length > 0 ? 5 : 0;
+    return 0;
+}
+function riskLevelFor(score) {
+    if (score >= 90)
+        return 'critical';
+    if (score >= 55)
+        return 'high';
+    if (score >= 20)
+        return 'medium';
+    if (score > 0)
+        return 'low';
+    return 'safe';
+}
+function matchesPattern(input, pattern) {
+    if (!pattern)
+        return false;
+    if (input.includes(pattern))
+        return true;
+    const compact = pattern.replace(/\s*\.\.\.\s*/g, ' ');
+    return compact !== pattern && input.includes(compact);
+}
+function matchesPath(input, pattern) {
+    if (!pattern)
+        return false;
+    const normalizedInput = input.replace(/\\/g, '/');
+    const needle = pattern.replace(/\\/g, '/').replace(/\*\*/g, '').replace(/\*/g, '');
+    return Boolean(needle) && normalizedInput.includes(needle);
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/runtime/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/runtime/evaluator.ts"],"names":[],"mappings":";;AA8BA,kDAsBC;AApDD,iDAAmD;AACnD,gDAAuD;AAWvD,iDAA8D;AAE9D,SAAS,MAAM,CACb,IAAY,EACZ,QAAyB,EACzB,KAAa,EACb,WAAmB,EACnB,QAAkB;IAElB,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,WAAW;QACX,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,4BAAa,EAAC,QAAQ,EAAE,GAAG,CAAC;KAC5E,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,MAA8B,EAC9B,MAAqB;IAErB,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACnE,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAChE,CAAC;IACF,MAAM,OAAO,GAAG,IAAA,4BAAa,EAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEhF,OAAO;QACL,QAAQ,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE;QAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC/E,SAAS;QACT,SAAS;QACT,OAAO;QACP,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,oBAAoB;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA8B,EAAE,MAAqB;IAChF,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAElC,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACpD,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,wBAAwB,EACxB,UAAU,EACV,wBAAwB,EACxB,oEAAoE,EACpE,OAAO,CACR,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACnD,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,uBAAuB,EACvB,MAAM,EACN,uBAAuB,EACvB,2DAA2D,EAC3D,MAAM,CACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAC5E,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,eAAe,EACf,MAAM,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EACxD,uBAAuB,EACvB,mEAAmE,EACnE,WAAW,CACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,mBAAmB,EACnB,MAAM,EACN,qCAAqC,EACrC,0FAA0F,EAC1F,KAAK,CACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAA8B,EAC9B,MAAqB;IAErB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,QAAQ,GAAG;QACf,KAAK,CAAC,MAAM;YACV,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,qBAAqB,EAAE,SAAS;gBAChC,sBAAsB,EAAE;oBACtB,GAAG,6BAAkB;oBACrB,IAAI,EAAE,OAAgB;oBACtB,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe;oBACjD,oBAAoB,EAAE,MAAM,CAAC,cAAc;iBAC5C;aACF,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,wBAAa,CAAC,EAAE,QAAQ,EAAE,QAAiB,EAAE,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE;YACL,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,aAAa;gBACvC,MAAM,EAAE,MAAM,CAAC,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,aAAa,EAAE,EAAE;aAClB;SACF;QACD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,YAAY,EAAE,IAAI;YAClB,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,gBAAgB,EAAE,MAAM,CAAC,WAAW;SACrC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAqB;IAC7C,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,QAAoC,EAAE,MAAqB;IAClG,MAAM,YAAY,GAAG,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC;IAC9E,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,qBAAqB,EAAE,UAAU,EAAE,mBAAmB,EAAE,qDAAqD,EAAE,YAAY,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,GAAG,KAAK,uBAAuB,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,0DAA0D,EAAE,YAAY,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,uBAAuB,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;QACnG,OAAO,MAAM,CAAC,mBAAmB,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,6BAA6B,EAAE,mDAAmD,EAAE,YAAY,CAAC,CAAC;IAC9L,CAAC;IACD,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kDAAkD,EAAE,YAAY,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,sDAAsD,EAAE,YAAY,CAAC,CAAC;IAChJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,gDAAgD,EAAE,YAAY,CAAC,CAAC;AACrI,CAAC;AAED,SAAS,WAAW,CAClB,MAA8B,EAC9B,OAAuB,EACvB,SAA2B,EAC3B,WAAoB;IAEpB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC3F,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAA8B;IACrE,IAAI,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC;IACpH,IAAI,IAAI,KAAK,uBAAuB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC;IAClF,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC;IAC/G,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC;IACnE,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,YAA8B;IAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,YAAY,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACnG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,YAAY,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC3F,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,YAAY,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAe;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/runtime/policy.d.ts

@@ -0,0 +1,12 @@
+import type { EffectiveRuntimePolicy } from './types.js';
+export declare function getDefaultEffectiveRuntimePolicy(): EffectiveRuntimePolicy;
+export declare function loadCachedPolicy(cachePath: string): EffectiveRuntimePolicy | null;
+export declare function saveCachedPolicy(cachePath: string, policy: EffectiveRuntimePolicy): void;
+export declare function resolveRuntimePolicy(options: {
+    cachePath: string;
+    fetchPolicy?: () => Promise<EffectiveRuntimePolicy | null>;
+}): Promise<{
+    policy: EffectiveRuntimePolicy;
+    source: 'cloud' | 'cache' | 'default';
+}>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/runtime/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/runtime/policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,wBAAgB,gCAAgC,IAAI,sBAAsB,CAuCzE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAOjF;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAGxF;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC5D,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC,CAgBrF"}

package/dist/runtime/policy.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultEffectiveRuntimePolicy = getDefaultEffectiveRuntimePolicy;
+exports.loadCachedPolicy = loadCachedPolicy;
+exports.saveCachedPolicy = saveCachedPolicy;
+exports.resolveRuntimePolicy = resolveRuntimePolicy;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+function getDefaultEffectiveRuntimePolicy() {
+    return {
+        policyVersion: 'runtime-local-v0.1',
+        mode: 'balanced',
+        decisions: {
+            destructiveCommand: 'block',
+            remoteCodeExecution: 'block',
+            dataExfiltration: 'block',
+            secretAccess: 'require_approval',
+            deployAction: 'require_approval',
+        },
+        protectedPaths: [
+            '~/.ssh/**',
+            '~/.aws/**',
+            '~/.config/**/credentials*',
+            '**/.env*',
+            '**/*private-key*',
+            '**/*seed*',
+        ],
+        blockedCommandPatterns: [
+            'rm -rf /',
+            'curl ... | bash',
+            'wget ... | sh',
+            'base64 -d | bash',
+            'git push --force',
+        ],
+        allowedCommandPatterns: [],
+        approvalActionTypes: ['file_read', 'file_write', 'deploy'],
+        network: {
+            defaultOutbound: 'warn',
+            blockedDomains: [
+                'discord.com/api/webhooks',
+                'hooks.slack.com/services',
+                'api.telegram.org/bot',
+            ],
+            approvalDomains: [],
+        },
+        updatedAt: new Date(0).toISOString(),
+    };
+}
+function loadCachedPolicy(cachePath) {
+    try {
+        if (!(0, node_fs_1.existsSync)(cachePath))
+            return null;
+        return JSON.parse((0, node_fs_1.readFileSync)(cachePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function saveCachedPolicy(cachePath, policy) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(cachePath), { recursive: true });
+    (0, node_fs_1.writeFileSync)(cachePath, `${JSON.stringify(policy, null, 2)}\n`);
+}
+async function resolveRuntimePolicy(options) {
+    if (options.fetchPolicy) {
+        try {
+            const cloudPolicy = await options.fetchPolicy();
+            if (cloudPolicy) {
+                saveCachedPolicy(options.cachePath, cloudPolicy);
+                return { policy: cloudPolicy, source: 'cloud' };
+            }
+        }
+        catch {
+            // Fall through to cache/default.
+        }
+    }
+    const cached = loadCachedPolicy(options.cachePath);
+    if (cached)
+        return { policy: cached, source: 'cache' };
+    return { policy: getDefaultEffectiveRuntimePolicy(), source: 'default' };
+}
+//# sourceMappingURL=policy.js.map

package/dist/runtime/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/runtime/policy.ts"],"names":[],"mappings":";;AAIA,4EAuCC;AAED,4CAOC;AAED,4CAGC;AAED,oDAmBC;AA9ED,qCAA6E;AAC7E,yCAAoC;AAGpC,SAAgB,gCAAgC;IAC9C,OAAO;QACL,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE;YACT,kBAAkB,EAAE,OAAO;YAC3B,mBAAmB,EAAE,OAAO;YAC5B,gBAAgB,EAAE,OAAO;YACzB,YAAY,EAAE,kBAAkB;YAChC,YAAY,EAAE,kBAAkB;SACjC;QACD,cAAc,EAAE;YACd,WAAW;YACX,WAAW;YACX,2BAA2B;YAC3B,UAAU;YACV,kBAAkB;YAClB,WAAW;SACZ;QACD,sBAAsB,EAAE;YACtB,UAAU;YACV,iBAAiB;YACjB,eAAe;YACf,kBAAkB;YAClB,kBAAkB;SACnB;QACD,sBAAsB,EAAE,EAAE;QAC1B,mBAAmB,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC;QAC1D,OAAO,EAAE;YACP,eAAe,EAAE,MAAM;YACvB,cAAc,EAAE;gBACd,0BAA0B;gBAC1B,0BAA0B;gBAC1B,sBAAsB;aACvB;YACD,eAAe,EAAE,EAAE;SACpB;QACD,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC;QACH,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAA2B,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,SAAiB,EAAE,MAA8B;IAChF,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,IAAA,uBAAa,EAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,OAG1C;IACC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3E,CAAC"}

package/dist/runtime/protect.d.ts

@@ -0,0 +1,22 @@
+import type { AgentGuardConfig } from '../config.js';
+import type { RuntimeAgentHost, RuntimeAuditEvent, RuntimeActionType, RuntimeDecision } from './types.js';
+export interface ProtectOptions {
+    config: AgentGuardConfig;
+    rawInput?: unknown;
+    stdinText?: string;
+    agentHost?: RuntimeAgentHost;
+    actionType?: RuntimeActionType;
+    toolName?: string;
+    sessionId?: string;
+    decisionMode?: 'local-first' | 'cloud';
+}
+export interface ProtectResult {
+    decision: RuntimeDecision;
+    event: RuntimeAuditEvent;
+    approvalId?: string | null;
+    policySource: 'cloud' | 'cache' | 'default' | 'cloud-decision';
+}
+export declare function protectAction(options: ProtectOptions): Promise<ProtectResult | null>;
+export declare function formatProtectResult(result: ProtectResult, json?: boolean): string;
+export declare function exitCodeForDecision(decision: RuntimeDecision): number;
+//# sourceMappingURL=protect.d.ts.map

package/dist/runtime/protect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.d.ts","sourceRoot":"","sources":["../../src/runtime/protect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD,OAAO,KAAK,EAAiB,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;CAChE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAiD1F;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,UAAQ,GAAG,MAAM,CA0B/E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAErE"}

package/dist/runtime/protect.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.protectAction = protectAction;
+exports.formatProtectResult = formatProtectResult;
+exports.exitCodeForDecision = exitCodeForDecision;
+const node_process_1 = require("node:process");
+const client_js_1 = require("../cloud/client.js");
+const audit_js_1 = require("./audit.js");
+const evaluator_js_1 = require("./evaluator.js");
+const policy_js_1 = require("./policy.js");
+async function protectAction(options) {
+    const action = buildRuntimeAction(options);
+    if (!action.input)
+        return null;
+    const client = new client_js_1.AgentGuardCloudClient(options.config);
+    if (client.connected) {
+        await (0, audit_js_1.flushEventSpool)(options.config.eventSpoolPath, (events) => client.ingestEvents(events)).catch(() => undefined);
+    }
+    let decision;
+    let policySource;
+    if (options.decisionMode === 'cloud' && client.connected) {
+        decision = await client.evaluateAction(action);
+        policySource = 'cloud-decision';
+    }
+    else {
+        const { policy, source } = await (0, policy_js_1.resolveRuntimePolicy)({
+            cachePath: options.config.policyCachePath,
+            fetchPolicy: client.connected ? () => client.fetchEffectivePolicy() : undefined,
+        });
+        decision = await (0, evaluator_js_1.evaluateLocalAction)(policy, action);
+        policySource = source;
+    }
+    const event = {
+        ...action,
+        actionId: decision.actionId,
+        decision: decision.decision,
+        riskScore: decision.riskScore,
+        riskLevel: decision.riskLevel,
+        reasons: decision.reasons,
+        policyVersion: decision.policyVersion,
+        metadata: {
+            ...(action.metadata || {}),
+            evaluation: policySource === 'cloud-decision' ? 'cloud' : 'local-oss',
+            policySource,
+        },
+    };
+    (0, audit_js_1.writeAuditLog)(options.config.auditPath, event);
+    let approvalId;
+    if (client.connected && policySource !== 'cloud-decision') {
+        await client.ingestEvents([event]).catch(() => (0, audit_js_1.spoolEvent)(options.config.eventSpoolPath, event));
+    }
+    if (client.connected && decision.decision === 'require_approval') {
+        approvalId = await client.createApproval(event).catch(() => null);
+    }
+    return { decision, event, approvalId, policySource };
+}
+function formatProtectResult(result, json = false) {
+    if (json) {
+        return JSON.stringify({
+            decision: publicDecision(result.decision.decision),
+            cloudDecision: result.decision.decision,
+            actionId: result.decision.actionId,
+            riskScore: result.decision.riskScore,
+            riskLevel: result.decision.riskLevel,
+            reasons: result.decision.reasons,
+            approvalId: result.approvalId,
+            policySource: result.policySource,
+        }, null, 2);
+    }
+    const reasonCount = result.decision.reasons.length;
+    if (result.decision.decision === 'block') {
+        return `BLOCKED by AgentGuard (action: ${result.decision.actionId}, risk: ${result.decision.riskScore}/100, level: ${result.decision.riskLevel}, reasons: ${reasonCount}).`;
+    }
+    if (result.decision.decision === 'require_approval') {
+        const approval = result.approvalId ? `approval: ${result.approvalId}, ` : '';
+        return `CONFIRM required by AgentGuard (${approval}action: ${result.decision.actionId}, risk: ${result.decision.riskScore}/100, level: ${result.decision.riskLevel}, reasons: ${reasonCount}).`;
+    }
+    if (result.decision.decision === 'warn') {
+        return `WARN from AgentGuard (action: ${result.decision.actionId}, risk: ${result.decision.riskScore}/100, level: ${result.decision.riskLevel}, reasons: ${reasonCount}).`;
+    }
+    return 'ALLOW by AgentGuard.';
+}
+function exitCodeForDecision(decision) {
+    return decision.decision === 'block' || decision.decision === 'require_approval' ? 2 : 0;
+}
+function publicDecision(decision) {
+    return decision === 'require_approval' ? 'confirm' : decision;
+}
+function buildRuntimeAction(options) {
+    const raw = parseRawInput(options.rawInput, options.stdinText);
+    const envActionType = process.env.AGENTGUARD_ACTION_TYPE;
+    const envAgentHost = process.env.AGENTGUARD_AGENT_HOST;
+    const toolName = options.toolName || process.env.AGENTGUARD_TOOL_NAME || pickToolName(raw);
+    const actionType = options.actionType || envActionType || mapToolToRuntimeAction(toolName, raw);
+    return {
+        sessionId: options.sessionId || process.env.AGENTGUARD_SESSION_ID || pickSessionId(raw),
+        agentHost: options.agentHost || envAgentHost || 'claude-code',
+        actionType,
+        toolName,
+        input: process.env.TOOL_INPUT || pickInput(raw, actionType),
+        cwd: pickCwd(raw),
+        sourceSkill: pickSourceSkill(raw),
+        metadata: { rawProtocol: raw ? 'stdin-json' : 'env' },
+    };
+}
+function parseRawInput(rawInput, stdinText) {
+    if (rawInput && typeof rawInput === 'object')
+        return rawInput;
+    const text = stdinText?.trim();
+    if (!text)
+        return null;
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' ? parsed : null;
+    }
+    catch {
+        return { content: text };
+    }
+}
+function pickToolName(raw) {
+    if (!raw)
+        return 'Tool';
+    return String(raw.tool_name || raw.toolName || raw.name || 'Tool');
+}
+function mapToolToRuntimeAction(toolName, raw) {
+    const lower = toolName.toLowerCase();
+    if (toolName === 'Bash' || lower.includes('shell') || lower.includes('exec'))
+        return 'shell';
+    if (toolName === 'Read' || lower.includes('read'))
+        return 'file_read';
+    if (['Write', 'Edit', 'MultiEdit'].includes(toolName) || lower.includes('write'))
+        return 'file_write';
+    if (lower.includes('web') || lower.includes('browser'))
+        return 'network';
+    if (raw?.actionType && typeof raw.actionType === 'string')
+        return raw.actionType;
+    return 'other';
+}
+function pickInput(raw, actionType) {
+    if (!raw)
+        return '';
+    if (typeof raw.input === 'string')
+        return raw.input;
+    if (typeof raw.content === 'string')
+        return raw.content;
+    const toolInput = (raw.tool_input || raw.toolInput || raw.params);
+    if (toolInput && typeof toolInput === 'object') {
+        if (actionType === 'shell' && typeof toolInput.command === 'string')
+            return toolInput.command;
+        const filePath = toolInput.file_path || toolInput.path;
+        if ((actionType === 'file_read' || actionType === 'file_write') && typeof filePath === 'string')
+            return filePath;
+        const url = toolInput.url || toolInput.query;
+        if (typeof url === 'string')
+            return url;
+        return JSON.stringify(toolInput);
+    }
+    return JSON.stringify(raw);
+}
+function pickSessionId(raw) {
+    const sessionId = raw?.session_id || raw?.sessionId;
+    return typeof sessionId === 'string' ? sessionId : `sess_local_${Date.now()}`;
+}
+function pickCwd(raw) {
+    const value = raw?.cwd;
+    return typeof value === 'string' ? value : (0, node_process_1.cwd)();
+}
+function pickSourceSkill(raw) {
+    const value = raw?.sourceSkill || raw?.initiating_skill;
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=protect.js.map

package/dist/runtime/protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/runtime/protect.ts"],"names":[],"mappings":";;AA0BA,sCAiDC;AAED,kDA0BC;AAED,kDAEC;AA3GD,+CAAmC;AACnC,kDAA2D;AAE3D,yCAAwE;AACxE,iDAAqD;AACrD,2CAAmD;AAqB5C,KAAK,UAAU,aAAa,CAAC,OAAuB;IACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,iCAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAA,0BAAe,EAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvH,CAAC;IAED,IAAI,QAAyB,CAAC;IAC9B,IAAI,YAA2C,CAAC;IAChD,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzD,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/C,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gCAAoB,EAAC;YACpD,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe;YACzC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS;SAChF,CAAC,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,kCAAmB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,YAAY,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAsB;QAC/B,GAAG,MAAM;QACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,QAAQ,EAAE;YACR,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC1B,UAAU,EAAE,YAAY,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YACrE,YAAY;SACb;KACF,CAAC;IAEF,IAAA,wBAAa,EAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE/C,IAAI,UAAqC,CAAC;IAC1C,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,KAAK,gBAAgB,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAA,qBAAU,EAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACjE,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAqB,EAAE,IAAI,GAAG,KAAK;IACrE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAClC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,kCAAkC,MAAM,CAAC,QAAQ,CAAC,QAAQ,WAAW,MAAM,CAAC,QAAQ,CAAC,SAAS,gBAAgB,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc,WAAW,IAAI,CAAC;IAC9K,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,mCAAmC,QAAQ,WAAW,MAAM,CAAC,QAAQ,CAAC,QAAQ,WAAW,MAAM,CAAC,QAAQ,CAAC,SAAS,gBAAgB,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc,WAAW,IAAI,CAAC;IAClM,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,iCAAiC,MAAM,CAAC,QAAQ,CAAC,QAAQ,WAAW,MAAM,CAAC,QAAQ,CAAC,SAAS,gBAAgB,MAAM,CAAC,QAAQ,CAAC,SAAS,cAAc,WAAW,IAAI,CAAC;IAC7K,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,SAAgB,mBAAmB,CAAC,QAAyB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,cAAc,CAAC,QAAqC;IAC3D,OAAO,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAuD,CAAC;IAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqD,CAAC;IACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEhG,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,aAAa,CAAC,GAAG,CAAC;QACvF,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY,IAAI,aAAa;QAC7D,UAAU;QACV,QAAQ;QACR,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QACjB,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC;QACjC,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB,EAAE,SAAkB;IAC1D,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAmC,CAAC;IACzF,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAmC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,GAAmC;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7F,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IACtG,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,GAAG,EAAE,UAAU,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,UAA+B,CAAC;IACtG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,GAAmC,EAAE,UAA6B;IACnF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAwC,CAAC;IACzG,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,IAAI,UAAU,KAAK,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC;QAC9F,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACjH,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,GAAmC;IACxD,MAAM,SAAS,GAAG,GAAG,EAAE,UAAU,IAAI,GAAG,EAAE,SAAS,CAAC;IACpD,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CAAC,GAAmC;IAClD,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,kBAAG,GAAE,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,GAAmC;IAC1D,MAAM,KAAK,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,gBAAgB,CAAC;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/runtime/redaction.d.ts

@@ -0,0 +1,6 @@
+import type { PolicyReason } from './types.js';
+export declare function redactText(value: unknown): string;
+export declare function redactPreview(value: unknown, maxLength?: number): string;
+export declare function redactReasons(reasons: PolicyReason[]): PolicyReason[];
+export declare function redactMetadata(value: Record<string, unknown> | undefined, maxKeys?: number): Record<string, unknown>;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/runtime/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/runtime/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2B/C,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMjD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAO,GAAG,MAAM,CAEtE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CASrE;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,OAAO,SAAK,GACX,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/runtime/redaction.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactText = redactText;
+exports.redactPreview = redactPreview;
+exports.redactReasons = redactReasons;
+exports.redactMetadata = redactMetadata;
+const REDACTED = '[REDACTED]';
+const SECRET_VALUE_PATTERN = /(?:token|api[_-]?key|secret|password|passwd|authorization|access[_-]?key|client[_-]?secret)=([^&\s'"`]+)/gi;
+const SENSITIVE_KEY_PATTERN = /(?:token|api[_-]?key|secret|password|passwd|authorization|access[_-]?key|client[_-]?secret|signature|sig)/i;
+const REDACTION_PATTERNS = [
+    [/\bag_live_[A-Za-z0-9_-]{12,}\b/g, () => REDACTED],
+    [/\bsk-or-v1-[A-Za-z0-9_-]{12,}\b/g, () => REDACTED],
+    [/\bsk-[A-Za-z0-9_-]{12,}\b/g, () => REDACTED],
+    [/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/gi, () => `Bearer ${REDACTED}`],
+    [
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+        () => REDACTED,
+    ],
+    [
+        SECRET_VALUE_PATTERN,
+        (match) => {
+            const [key] = match.split('=');
+            return `${key}=${REDACTED}`;
+        },
+    ],
+];
+function redactText(value) {
+    let redacted = String(value ?? '');
+    for (const [pattern, replacement] of REDACTION_PATTERNS) {
+        redacted = redacted.replace(pattern, replacement);
+    }
+    return redactUrlSecrets(redacted);
+}
+function redactPreview(value, maxLength = 2000) {
+    return redactText(value).slice(0, maxLength);
+}
+function redactReasons(reasons) {
+    return reasons.map((reason) => ({
+        ...reason,
+        code: redactPreview(reason.code, 120),
+        title: redactPreview(reason.title, 240),
+        description: redactPreview(reason.description, 500),
+        evidence: reason.evidence ? redactPreview(reason.evidence, 240) : reason.evidence,
+        remediation: reason.remediation ? redactPreview(reason.remediation, 500) : reason.remediation,
+    }));
+}
+function redactMetadata(value, maxKeys = 25) {
+    if (!value)
+        return {};
+    const result = {};
+    for (const [key, item] of Object.entries(value).slice(0, maxKeys)) {
+        result[redactPreview(key, 120)] = SENSITIVE_KEY_PATTERN.test(key)
+            ? REDACTED
+            : redactUnknown(item, 0);
+    }
+    return result;
+}
+function redactUnknown(value, depth) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string')
+        return redactPreview(value, 500);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value)) {
+        if (depth >= 2)
+            return '[REDACTED_OBJECT]';
+        return value.slice(0, 25).map((item) => redactUnknown(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        if (depth >= 2)
+            return '[REDACTED_OBJECT]';
+        const result = {};
+        for (const [key, item] of Object.entries(value).slice(0, 25)) {
+            result[redactPreview(key, 120)] = SENSITIVE_KEY_PATTERN.test(key)
+                ? REDACTED
+                : redactUnknown(item, depth + 1);
+        }
+        return result;
+    }
+    return redactPreview(String(value), 500);
+}
+function redactUrlSecrets(value) {
+    return value.replace(/https?:\/\/[^\s'"`<>]+/gi, (rawUrl) => {
+        try {
+            const url = new URL(rawUrl);
+            for (const key of [...url.searchParams.keys()]) {
+                if (SENSITIVE_KEY_PATTERN.test(key)) {
+                    url.searchParams.set(key, REDACTED);
+                }
+            }
+            if (url.username)
+                url.username = REDACTED;
+            if (url.password)
+                url.password = REDACTED;
+            return url.toString();
+        }
+        catch {
+            return rawUrl;
+        }
+    });
+}
+//# sourceMappingURL=redaction.js.map