@guava-parity/guard-scanner 16.0.1 → 16.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -7
- package/README_ja.md +7 -7
- package/SECURITY.md +6 -6
- package/SKILL.md +7 -5
- package/dist/cli.cjs +2641 -2216
- package/dist/cli.d.cts +2 -0
- package/dist/cli.d.ts +2 -1
- package/dist/cli.mjs +2619 -2217
- package/dist/index.cjs +4616 -4253
- package/dist/index.d.cts +214 -0
- package/dist/index.d.ts +210 -13
- package/dist/index.mjs +4594 -4244
- package/dist/mcp-server.cjs +4161 -3752
- package/dist/mcp-server.d.cts +318 -0
- package/dist/mcp-server.d.ts +318 -1
- package/dist/mcp-server.mjs +4597 -4230
- package/dist/openclaw-plugin.cjs +4622 -4259
- package/dist/openclaw-plugin.mjs +4604 -4252
- package/dist/{types.d.mts → types.d.cts} +97 -2
- package/dist/types.d.ts +97 -2
- package/docs/data/benchmark-ledger.json +449 -19
- package/docs/data/corpus-metrics.json +1 -1
- package/docs/data/fp-ledger.json +2 -2
- package/docs/data/quality-contract.json +15 -5
- package/docs/generated/openclaw-upstream-status.json +13 -13
- package/docs/openclaw-continuous-compatibility-plan.md +1 -1
- package/docs/spec/capabilities.json +24 -6
- package/guard-scanner +1 -3
- package/openclaw-plugin.mts +3 -2
- package/openclaw.plugin.json +1 -1
- package/package.json +11 -8
- package/dist/cli.d.mts +0 -1
- package/dist/index.d.mts +0 -17
- package/dist/mcp-server.d.mts +0 -1
- /package/dist/{openclaw-plugin.d.mts → openclaw-plugin.d.cts} +0 -0
|
@@ -18,6 +18,89 @@ interface FindingEvidence {
|
|
|
18
18
|
owasp_asi?: string[];
|
|
19
19
|
protocol_surface?: string[];
|
|
20
20
|
}
|
|
21
|
+
interface ThreatCapabilitySet {
|
|
22
|
+
network: boolean;
|
|
23
|
+
exec: boolean;
|
|
24
|
+
fs_read: boolean;
|
|
25
|
+
fs_write: boolean;
|
|
26
|
+
env_access: boolean;
|
|
27
|
+
private_data_access: boolean;
|
|
28
|
+
untrusted_input: boolean;
|
|
29
|
+
external_communication: boolean;
|
|
30
|
+
}
|
|
31
|
+
interface CompoundedRisk {
|
|
32
|
+
id: string;
|
|
33
|
+
severity: Severity;
|
|
34
|
+
description: string;
|
|
35
|
+
triggered: boolean;
|
|
36
|
+
contributing_capabilities: string[];
|
|
37
|
+
}
|
|
38
|
+
interface LethalTrifectaAssessment {
|
|
39
|
+
triggered: boolean;
|
|
40
|
+
severity: Severity;
|
|
41
|
+
contributing_capabilities: string[];
|
|
42
|
+
rationale: string;
|
|
43
|
+
}
|
|
44
|
+
interface ContractClause {
|
|
45
|
+
id?: string;
|
|
46
|
+
tool?: string;
|
|
47
|
+
requires?: string;
|
|
48
|
+
condition?: string;
|
|
49
|
+
rationale?: string;
|
|
50
|
+
severity?: Severity;
|
|
51
|
+
}
|
|
52
|
+
interface ContractRecovery {
|
|
53
|
+
on_violation: "warn" | "block" | "revert_and_notify" | "notify";
|
|
54
|
+
message?: string;
|
|
55
|
+
}
|
|
56
|
+
interface ContractViolation {
|
|
57
|
+
id: string;
|
|
58
|
+
clause_type: "precondition" | "invariant" | "governance";
|
|
59
|
+
severity: Severity;
|
|
60
|
+
message: string;
|
|
61
|
+
blocking: boolean;
|
|
62
|
+
remediation: string;
|
|
63
|
+
}
|
|
64
|
+
interface SessionEvent {
|
|
65
|
+
toolName?: string;
|
|
66
|
+
params?: Record<string, unknown> | string;
|
|
67
|
+
text?: string;
|
|
68
|
+
role?: string;
|
|
69
|
+
ts?: string;
|
|
70
|
+
}
|
|
71
|
+
interface BehavioralSequence {
|
|
72
|
+
id: string;
|
|
73
|
+
severity: Severity;
|
|
74
|
+
description: string;
|
|
75
|
+
matched_event_count: number;
|
|
76
|
+
blocking: boolean;
|
|
77
|
+
evidence: string[];
|
|
78
|
+
}
|
|
79
|
+
interface PopulationMonitorEvent {
|
|
80
|
+
from: string;
|
|
81
|
+
to: string;
|
|
82
|
+
channel: string;
|
|
83
|
+
content?: string;
|
|
84
|
+
metadata?: Record<string, unknown>;
|
|
85
|
+
}
|
|
86
|
+
interface PopulationMonitorReport {
|
|
87
|
+
enabled: boolean;
|
|
88
|
+
anomalous: boolean;
|
|
89
|
+
score: number;
|
|
90
|
+
findings: Array<{
|
|
91
|
+
id: string;
|
|
92
|
+
severity: Severity;
|
|
93
|
+
description: string;
|
|
94
|
+
evidence: string[];
|
|
95
|
+
}>;
|
|
96
|
+
}
|
|
97
|
+
interface MetaGuardReport {
|
|
98
|
+
enabled: boolean;
|
|
99
|
+
evasion_resistance: number;
|
|
100
|
+
adversarial_precision: number | null;
|
|
101
|
+
adversarial_recall: number | null;
|
|
102
|
+
integrity_alerts: string[];
|
|
103
|
+
}
|
|
21
104
|
interface Finding {
|
|
22
105
|
schema_version?: string;
|
|
23
106
|
source?: "static" | "runtime";
|
|
@@ -82,7 +165,9 @@ interface ScanReport {
|
|
|
82
165
|
recommendations: Recommendation[];
|
|
83
166
|
layer_summary?: Array<Record<string, unknown>>;
|
|
84
167
|
owasp_asi_coverage?: Array<Record<string, unknown>>;
|
|
85
|
-
threat_model?:
|
|
168
|
+
threat_model?: ThreatModel;
|
|
169
|
+
population_monitor?: PopulationMonitorReport | null;
|
|
170
|
+
meta_guard?: MetaGuardReport | null;
|
|
86
171
|
iocVersion: string;
|
|
87
172
|
}
|
|
88
173
|
interface TextScanResult {
|
|
@@ -129,6 +214,8 @@ interface RuntimeDecision {
|
|
|
129
214
|
riskAmplificationReasons?: string[];
|
|
130
215
|
remediationSuggestion?: string | null;
|
|
131
216
|
policyDecision?: RuntimePolicyDecision | null;
|
|
217
|
+
contract_violations?: ContractViolation[];
|
|
218
|
+
behavioral_sequences?: BehavioralSequence[];
|
|
132
219
|
}
|
|
133
220
|
interface McpRequest {
|
|
134
221
|
method: string;
|
|
@@ -173,6 +260,10 @@ interface RuntimePolicyContract {
|
|
|
173
260
|
max_network_scope?: "none" | "internal-only" | "external-ok";
|
|
174
261
|
secret_bearing_context?: boolean;
|
|
175
262
|
memory_write_permission?: boolean;
|
|
263
|
+
preconditions?: ContractClause[];
|
|
264
|
+
invariants?: Array<string | ContractClause>;
|
|
265
|
+
governance?: Array<string | ContractClause>;
|
|
266
|
+
recovery?: ContractRecovery;
|
|
176
267
|
}
|
|
177
268
|
interface RuntimePolicyDecision {
|
|
178
269
|
action: "allow" | "block";
|
|
@@ -180,10 +271,14 @@ interface RuntimePolicyDecision {
|
|
|
180
271
|
policyId: string;
|
|
181
272
|
amplificationReasons: string[];
|
|
182
273
|
remediationSuggestion: string;
|
|
274
|
+
contractViolations?: ContractViolation[];
|
|
183
275
|
}
|
|
184
276
|
interface ThreatModel {
|
|
185
277
|
timestamp: string;
|
|
186
278
|
surface: Record<string, boolean>;
|
|
279
|
+
capabilities?: ThreatCapabilitySet;
|
|
280
|
+
compounded_risks?: CompoundedRisk[];
|
|
281
|
+
lethal_trifecta?: LethalTrifectaAssessment;
|
|
187
282
|
summary: string;
|
|
188
283
|
owasp_asi?: string[];
|
|
189
284
|
layer_summary?: Array<Record<string, unknown>>;
|
|
@@ -212,4 +307,4 @@ interface GuardScannerConstructor {
|
|
|
212
307
|
}
|
|
213
308
|
type ScanResult = SkillFindingResult;
|
|
214
309
|
|
|
215
|
-
export type { CapabilityMetrics, CustomRule, EvidenceSpan, Finding, FindingEvidence, GuardMode, GuardScannerConstructor, GuardScannerInstance, McpRequest, PluginConfig, QualityTargets, Recommendation, RuntimeAction, RuntimeCheckStats, RuntimeDecision, RuntimePolicyContract, RuntimePolicyDecision, SarifReport, ScanReport, ScanResult, ScanStats, ScannerOptions, Severity, SkillFindingResult, TextScanResult, ThreatModel, ThresholdBand };
|
|
310
|
+
export type { BehavioralSequence, CapabilityMetrics, CompoundedRisk, ContractClause, ContractRecovery, ContractViolation, CustomRule, EvidenceSpan, Finding, FindingEvidence, GuardMode, GuardScannerConstructor, GuardScannerInstance, LethalTrifectaAssessment, McpRequest, MetaGuardReport, PluginConfig, PopulationMonitorEvent, PopulationMonitorReport, QualityTargets, Recommendation, RuntimeAction, RuntimeCheckStats, RuntimeDecision, RuntimePolicyContract, RuntimePolicyDecision, SarifReport, ScanReport, ScanResult, ScanStats, ScannerOptions, SessionEvent, Severity, SkillFindingResult, TextScanResult, ThreatCapabilitySet, ThreatModel, ThresholdBand };
|
package/dist/types.d.ts
CHANGED
|
@@ -18,6 +18,89 @@ interface FindingEvidence {
|
|
|
18
18
|
owasp_asi?: string[];
|
|
19
19
|
protocol_surface?: string[];
|
|
20
20
|
}
|
|
21
|
+
interface ThreatCapabilitySet {
|
|
22
|
+
network: boolean;
|
|
23
|
+
exec: boolean;
|
|
24
|
+
fs_read: boolean;
|
|
25
|
+
fs_write: boolean;
|
|
26
|
+
env_access: boolean;
|
|
27
|
+
private_data_access: boolean;
|
|
28
|
+
untrusted_input: boolean;
|
|
29
|
+
external_communication: boolean;
|
|
30
|
+
}
|
|
31
|
+
interface CompoundedRisk {
|
|
32
|
+
id: string;
|
|
33
|
+
severity: Severity;
|
|
34
|
+
description: string;
|
|
35
|
+
triggered: boolean;
|
|
36
|
+
contributing_capabilities: string[];
|
|
37
|
+
}
|
|
38
|
+
interface LethalTrifectaAssessment {
|
|
39
|
+
triggered: boolean;
|
|
40
|
+
severity: Severity;
|
|
41
|
+
contributing_capabilities: string[];
|
|
42
|
+
rationale: string;
|
|
43
|
+
}
|
|
44
|
+
interface ContractClause {
|
|
45
|
+
id?: string;
|
|
46
|
+
tool?: string;
|
|
47
|
+
requires?: string;
|
|
48
|
+
condition?: string;
|
|
49
|
+
rationale?: string;
|
|
50
|
+
severity?: Severity;
|
|
51
|
+
}
|
|
52
|
+
interface ContractRecovery {
|
|
53
|
+
on_violation: "warn" | "block" | "revert_and_notify" | "notify";
|
|
54
|
+
message?: string;
|
|
55
|
+
}
|
|
56
|
+
interface ContractViolation {
|
|
57
|
+
id: string;
|
|
58
|
+
clause_type: "precondition" | "invariant" | "governance";
|
|
59
|
+
severity: Severity;
|
|
60
|
+
message: string;
|
|
61
|
+
blocking: boolean;
|
|
62
|
+
remediation: string;
|
|
63
|
+
}
|
|
64
|
+
interface SessionEvent {
|
|
65
|
+
toolName?: string;
|
|
66
|
+
params?: Record<string, unknown> | string;
|
|
67
|
+
text?: string;
|
|
68
|
+
role?: string;
|
|
69
|
+
ts?: string;
|
|
70
|
+
}
|
|
71
|
+
interface BehavioralSequence {
|
|
72
|
+
id: string;
|
|
73
|
+
severity: Severity;
|
|
74
|
+
description: string;
|
|
75
|
+
matched_event_count: number;
|
|
76
|
+
blocking: boolean;
|
|
77
|
+
evidence: string[];
|
|
78
|
+
}
|
|
79
|
+
interface PopulationMonitorEvent {
|
|
80
|
+
from: string;
|
|
81
|
+
to: string;
|
|
82
|
+
channel: string;
|
|
83
|
+
content?: string;
|
|
84
|
+
metadata?: Record<string, unknown>;
|
|
85
|
+
}
|
|
86
|
+
interface PopulationMonitorReport {
|
|
87
|
+
enabled: boolean;
|
|
88
|
+
anomalous: boolean;
|
|
89
|
+
score: number;
|
|
90
|
+
findings: Array<{
|
|
91
|
+
id: string;
|
|
92
|
+
severity: Severity;
|
|
93
|
+
description: string;
|
|
94
|
+
evidence: string[];
|
|
95
|
+
}>;
|
|
96
|
+
}
|
|
97
|
+
interface MetaGuardReport {
|
|
98
|
+
enabled: boolean;
|
|
99
|
+
evasion_resistance: number;
|
|
100
|
+
adversarial_precision: number | null;
|
|
101
|
+
adversarial_recall: number | null;
|
|
102
|
+
integrity_alerts: string[];
|
|
103
|
+
}
|
|
21
104
|
interface Finding {
|
|
22
105
|
schema_version?: string;
|
|
23
106
|
source?: "static" | "runtime";
|
|
@@ -82,7 +165,9 @@ interface ScanReport {
|
|
|
82
165
|
recommendations: Recommendation[];
|
|
83
166
|
layer_summary?: Array<Record<string, unknown>>;
|
|
84
167
|
owasp_asi_coverage?: Array<Record<string, unknown>>;
|
|
85
|
-
threat_model?:
|
|
168
|
+
threat_model?: ThreatModel;
|
|
169
|
+
population_monitor?: PopulationMonitorReport | null;
|
|
170
|
+
meta_guard?: MetaGuardReport | null;
|
|
86
171
|
iocVersion: string;
|
|
87
172
|
}
|
|
88
173
|
interface TextScanResult {
|
|
@@ -129,6 +214,8 @@ interface RuntimeDecision {
|
|
|
129
214
|
riskAmplificationReasons?: string[];
|
|
130
215
|
remediationSuggestion?: string | null;
|
|
131
216
|
policyDecision?: RuntimePolicyDecision | null;
|
|
217
|
+
contract_violations?: ContractViolation[];
|
|
218
|
+
behavioral_sequences?: BehavioralSequence[];
|
|
132
219
|
}
|
|
133
220
|
interface McpRequest {
|
|
134
221
|
method: string;
|
|
@@ -173,6 +260,10 @@ interface RuntimePolicyContract {
|
|
|
173
260
|
max_network_scope?: "none" | "internal-only" | "external-ok";
|
|
174
261
|
secret_bearing_context?: boolean;
|
|
175
262
|
memory_write_permission?: boolean;
|
|
263
|
+
preconditions?: ContractClause[];
|
|
264
|
+
invariants?: Array<string | ContractClause>;
|
|
265
|
+
governance?: Array<string | ContractClause>;
|
|
266
|
+
recovery?: ContractRecovery;
|
|
176
267
|
}
|
|
177
268
|
interface RuntimePolicyDecision {
|
|
178
269
|
action: "allow" | "block";
|
|
@@ -180,10 +271,14 @@ interface RuntimePolicyDecision {
|
|
|
180
271
|
policyId: string;
|
|
181
272
|
amplificationReasons: string[];
|
|
182
273
|
remediationSuggestion: string;
|
|
274
|
+
contractViolations?: ContractViolation[];
|
|
183
275
|
}
|
|
184
276
|
interface ThreatModel {
|
|
185
277
|
timestamp: string;
|
|
186
278
|
surface: Record<string, boolean>;
|
|
279
|
+
capabilities?: ThreatCapabilitySet;
|
|
280
|
+
compounded_risks?: CompoundedRisk[];
|
|
281
|
+
lethal_trifecta?: LethalTrifectaAssessment;
|
|
187
282
|
summary: string;
|
|
188
283
|
owasp_asi?: string[];
|
|
189
284
|
layer_summary?: Array<Record<string, unknown>>;
|
|
@@ -212,4 +307,4 @@ interface GuardScannerConstructor {
|
|
|
212
307
|
}
|
|
213
308
|
type ScanResult = SkillFindingResult;
|
|
214
309
|
|
|
215
|
-
export type { CapabilityMetrics, CustomRule, EvidenceSpan, Finding, FindingEvidence, GuardMode, GuardScannerConstructor, GuardScannerInstance, McpRequest, PluginConfig, QualityTargets, Recommendation, RuntimeAction, RuntimeCheckStats, RuntimeDecision, RuntimePolicyContract, RuntimePolicyDecision, SarifReport, ScanReport, ScanResult, ScanStats, ScannerOptions, Severity, SkillFindingResult, TextScanResult, ThreatModel, ThresholdBand };
|
|
310
|
+
export type { BehavioralSequence, CapabilityMetrics, CompoundedRisk, ContractClause, ContractRecovery, ContractViolation, CustomRule, EvidenceSpan, Finding, FindingEvidence, GuardMode, GuardScannerConstructor, GuardScannerInstance, LethalTrifectaAssessment, McpRequest, MetaGuardReport, PluginConfig, PopulationMonitorEvent, PopulationMonitorReport, QualityTargets, Recommendation, RuntimeAction, RuntimeCheckStats, RuntimeDecision, RuntimePolicyContract, RuntimePolicyDecision, SarifReport, ScanReport, ScanResult, ScanStats, ScannerOptions, SessionEvent, Severity, SkillFindingResult, TextScanResult, ThreatCapabilitySet, ThreatModel, ThresholdBand };
|