@intutic/mcp-governance-proxy 2.1.0 → 2.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -18
- package/dist/agentTools.d.ts +68 -0
- package/dist/agentTools.d.ts.map +1 -0
- package/dist/agentTools.js +150 -0
- package/dist/agentTools.js.map +1 -0
- package/dist/anomaly/detectors.js +1 -1
- package/dist/anomaly/detectors.js.map +1 -1
- package/dist/anomaly/index.d.ts +2 -1
- package/dist/anomaly/index.d.ts.map +1 -1
- package/dist/anomaly/index.js.map +1 -1
- package/dist/approvalHold.d.ts +66 -0
- package/dist/approvalHold.d.ts.map +1 -0
- package/dist/approvalHold.js +143 -0
- package/dist/approvalHold.js.map +1 -0
- package/dist/budget.d.ts +133 -0
- package/dist/budget.d.ts.map +1 -0
- package/dist/budget.js +191 -0
- package/dist/budget.js.map +1 -0
- package/dist/config.d.ts +7 -2
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +2 -2
- package/dist/config.js.map +1 -1
- package/dist/daemon/healthMonitor.d.ts +2 -0
- package/dist/daemon/healthMonitor.d.ts.map +1 -1
- package/dist/daemon/healthMonitor.js +60 -27
- package/dist/daemon/healthMonitor.js.map +1 -1
- package/dist/daemon/index.d.ts +0 -2
- package/dist/daemon/index.d.ts.map +1 -1
- package/dist/daemon/index.js +0 -2
- package/dist/daemon/index.js.map +1 -1
- package/dist/daemon/instrumentation.d.ts +2 -2
- package/dist/daemon/instrumentation.js +2 -2
- package/dist/daemon/policyCache.d.ts +38 -3
- package/dist/daemon/policyCache.d.ts.map +1 -1
- package/dist/daemon/policyCache.js +64 -22
- package/dist/daemon/policyCache.js.map +1 -1
- package/dist/daemon/socketServer.d.ts +0 -1
- package/dist/daemon/socketServer.d.ts.map +1 -1
- package/dist/daemon/socketServer.js +0 -1
- package/dist/daemon/socketServer.js.map +1 -1
- package/dist/daemon/statusReporter.d.ts.map +1 -1
- package/dist/daemon/statusReporter.js +0 -1
- package/dist/daemon/statusReporter.js.map +1 -1
- package/dist/daemon/telemetryBatcher.d.ts.map +1 -1
- package/dist/daemon/telemetryBatcher.js +0 -1
- package/dist/daemon/telemetryBatcher.js.map +1 -1
- package/dist/daemonClient.d.ts.map +1 -1
- package/dist/daemonClient.js +0 -1
- package/dist/daemonClient.js.map +1 -1
- package/dist/dlp.d.ts +32 -3
- package/dist/dlp.d.ts.map +1 -1
- package/dist/dlp.js +116 -18
- package/dist/dlp.js.map +1 -1
- package/dist/dlpPii.d.ts +66 -0
- package/dist/dlpPii.d.ts.map +1 -0
- package/dist/dlpPii.js +235 -0
- package/dist/dlpPii.js.map +1 -0
- package/dist/emitter.d.ts +68 -10
- package/dist/emitter.d.ts.map +1 -1
- package/dist/emitter.js +29 -43
- package/dist/emitter.js.map +1 -1
- package/dist/guardedValkey.d.ts +40 -0
- package/dist/guardedValkey.d.ts.map +1 -0
- package/dist/guardedValkey.js +84 -0
- package/dist/guardedValkey.js.map +1 -0
- package/dist/httpJson.d.ts +19 -0
- package/dist/httpJson.d.ts.map +1 -0
- package/dist/httpJson.js +62 -0
- package/dist/httpJson.js.map +1 -0
- package/dist/identity.d.ts +27 -0
- package/dist/identity.d.ts.map +1 -0
- package/dist/identity.js +36 -0
- package/dist/identity.js.map +1 -0
- package/dist/injection.js +1 -1
- package/dist/interceptor.d.ts +135 -8
- package/dist/interceptor.d.ts.map +1 -1
- package/dist/interceptor.js +284 -45
- package/dist/interceptor.js.map +1 -1
- package/dist/policy.d.ts +105 -2
- package/dist/policy.d.ts.map +1 -1
- package/dist/policy.js +188 -40
- package/dist/policy.js.map +1 -1
- package/dist/proxy.d.ts +35 -11
- package/dist/proxy.d.ts.map +1 -1
- package/dist/proxy.js +183 -66
- package/dist/proxy.js.map +1 -1
- package/dist/refusals.d.ts +26 -0
- package/dist/refusals.d.ts.map +1 -0
- package/dist/refusals.js +43 -0
- package/dist/refusals.js.map +1 -0
- package/dist/registryObserver.d.ts +37 -0
- package/dist/registryObserver.d.ts.map +1 -0
- package/dist/registryObserver.js +70 -0
- package/dist/registryObserver.js.map +1 -0
- package/dist/session.d.ts +1 -1
- package/dist/session.js +1 -1
- package/dist/sessionScope.d.ts +1 -1
- package/dist/sessionScope.js +1 -1
- package/dist/sessionStore.d.ts +10 -23
- package/dist/sessionStore.d.ts.map +1 -1
- package/dist/sessionStore.js +17 -76
- package/dist/sessionStore.js.map +1 -1
- package/dist/version.d.ts +12 -0
- package/dist/version.d.ts.map +1 -0
- package/dist/version.js +13 -0
- package/dist/version.js.map +1 -0
- package/dist/wasm/context.d.ts +10 -0
- package/dist/wasm/context.d.ts.map +1 -1
- package/dist/wasm/context.js +27 -0
- package/dist/wasm/context.js.map +1 -1
- package/dist/wasm/hostImports.d.ts +3 -3
- package/dist/wasm/hostImports.d.ts.map +1 -1
- package/dist/wasm/hostImports.js +8 -7
- package/dist/wasm/hostImports.js.map +1 -1
- package/dist/wasm/loader.d.ts +8 -1
- package/dist/wasm/loader.d.ts.map +1 -1
- package/dist/wasm/loader.js +2 -0
- package/dist/wasm/loader.js.map +1 -1
- package/dist/wasm/referencedFiles.d.ts +29 -4
- package/dist/wasm/referencedFiles.d.ts.map +1 -1
- package/dist/wasm/referencedFiles.js +48 -21
- package/dist/wasm/referencedFiles.js.map +1 -1
- package/dist/wasm/runner.d.ts +106 -22
- package/dist/wasm/runner.d.ts.map +1 -1
- package/dist/wasm/runner.js +194 -74
- package/dist/wasm/runner.js.map +1 -1
- package/dist/wasm/watch.js +1 -1
- package/dist/wasm/worker.d.ts +10 -6
- package/dist/wasm/worker.d.ts.map +1 -1
- package/dist/wasm/worker.js +93 -9
- package/dist/wasm/worker.js.map +1 -1
- package/package.json +5 -4
- package/dist/toolPoison.d.ts +0 -32
- package/dist/toolPoison.d.ts.map +0 -1
- package/dist/toolPoison.js +0 -81
- package/dist/toolPoison.js.map +0 -1
- package/dist/wasm/fuel.d.ts +0 -35
- package/dist/wasm/fuel.d.ts.map +0 -1
- package/dist/wasm/fuel.js +0 -299
- package/dist/wasm/fuel.js.map +0 -1
- package/dist/wasm/memoryCap.d.ts +0 -21
- package/dist/wasm/memoryCap.d.ts.map +0 -1
- package/dist/wasm/memoryCap.js +0 -54
- package/dist/wasm/memoryCap.js.map +0 -1
- package/dist/wasm/wasmBinary.d.ts +0 -25
- package/dist/wasm/wasmBinary.d.ts.map +0 -1
- package/dist/wasm/wasmBinary.js +0 -100
- package/dist/wasm/wasmBinary.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"statusReporter.js","sourceRoot":"","sources":["../../src/daemon/statusReporter.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"statusReporter.js","sourceRoot":"","sources":["../../src/daemon/statusReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAA;AAEvD,MAAM,MAAM,GAAW,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAA;AAClF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAM,EAAE,CAAA;AAC7D,0EAA0E;AAC1E,sEAAsE;AACtE,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,YAAY,GAAK,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAA;AAChE,MAAM,SAAS,GAAQ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAA;AAE1F,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAC1C,IAAI,KAAK,GAA0C,IAAI,CAAA;AAEvD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAA;IAEhC,OAAO,OAAO,CAAC,GAAG,CAChB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACtE,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgB;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO;QACP,WAAW,EAAE,aAAa,EAAE;QAC5B,eAAe,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QAC5C,UAAU,EAAE,MAAM,sBAAsB,EAAE;QAC1C,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAEpD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QAClD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,aAAa,CAAC,IAAI,CAAC;aAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;aAChC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAC1G,CAAC,CAAC,CAAA;IACN,CAAC,CAAA;IAED,MAAM,EAAE,CAAA,CAAC,0EAA0E;IACnF,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,KAAK,EAAE,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,KAAK,GAAG,IAAI,CAAA;IAAC,CAAC;IACjD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"telemetryBatcher.d.ts","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"telemetryBatcher.d.ts","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAQ,MAAM,CAAA;IACnB,QAAQ,EAAK,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAI,MAAM,CAAA;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAMD,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAGnD;AAED,gFAAgF;AAChF,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAwED,2FAA2F;AAC3F,wBAAgB,YAAY,IAAI,IAAI,CAoDnC;AAED,mEAAmE;AACnE,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjD"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"telemetryBatcher.js","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"telemetryBatcher.js","sourceRoot":"","sources":["../../src/daemon/telemetryBatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,YAAY,CAAA;AAC9B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,IAAI,MAAO,WAAW,CAAA;AAC7B,OAAO,EAAE,MAAS,SAAS,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAEzD,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAiB,uBAAuB,CAAA;AAChG,MAAM,cAAc,GAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAmB,EAAE,CAAA;AAC3E,MAAM,QAAQ,GAAU,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5F,MAAM,aAAa,GAAK,GAAG,CAAA;AAC3B,MAAM,WAAW,GAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;AAEtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,wBAAwB,CAAA;AACpG,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE;IACnC,WAAW,EAAE,IAAI;IACjB,oBAAoB,EAAE,CAAC;CACxB,CAAC,CAAA;AAGF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;IAChC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAA;AAChG,CAAC,CAAC,CAAA;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;AAWvC,MAAM,IAAI,GAAgB,EAAE,CAAA;AAC5B,IAAI,UAAU,GAA0C,IAAI,CAAA;AAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;AAEtB,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa;QAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,MAAM,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAC3C,UAAU,GAAG,IAAI,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/C,CAAC;YAAS,CAAC;QACT,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,UAAU,GAAG,KAAK,CAAA;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,MAAM,IAAI,GAAK,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,MAAM,GAAG,GAAM,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IACzC,MAAM,GAAG,GAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAErC,MAAM,SAAS,GAAG,GAAkB,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM;YAC1E,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC7E,eAAe,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,EAAE;YACN,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,OAAO,EAAE,CAAA;;gBAChD,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,MAAM,SAAS,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAK;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;YACjD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA,CAAC,aAAa;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,SAAkB,EAAE,CAAC;YAC5B,qEAAqE;YACrE,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,WAAW,GAAG,SAAS,YAAY,KAAK;gBAC5C,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACzE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpG,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,yCAAyC,CAAC,CAAA;YAC9F,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY;IAC1B,sBAAsB;IACtB,MAAM,GAAG,GAAG,2BAA2B,QAAQ,EAAE,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;oBAC/D,qEAAqE;oBACrE,2DAA2D;oBAC3D,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACzE,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,oBAAoB;IACpB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACrF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,oEAAoE;oBACpE,iCAAiC;gBACnC,CAAC;YACH,CAAC;YACD,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAA;IAC5D,CAAC;IAED,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,yEAAyE;QACzE,0EAA0E;QAC1E,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAA;IACvF,CAAC,EAAE,QAAQ,CAAC,CAAA;IACZ,UAAU,CAAC,KAAK,EAAE,CAAA;AACpB,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,UAAU,EAAE,CAAC;QAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAAC,UAAU,GAAG,IAAI,CAAA;IAAC,CAAC;IAChE,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAA;AAC9F,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"daemonClient.d.ts","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"daemonClient.d.ts","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAiDZ"}
|
package/dist/daemonClient.js
CHANGED
package/dist/daemonClient.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"daemonClient.js","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"daemonClient.js","sourceRoot":"","sources":["../src/daemonClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAA;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE1B,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,MAAM;YACN,MAAM;SACP,CAAA;QAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,MAAM,IAAI,KAAK,CAAA;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;gBAC7B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;wBAC5B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;4BACd,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;wBACtC,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACrB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,GAAG,EAAE,CAAA;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,aAAa;QACb,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
|
package/dist/dlp.d.ts
CHANGED
|
@@ -1,12 +1,20 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* dlp.ts — DLP (Data Loss Prevention) argument scanner.
|
|
3
3
|
*
|
|
4
|
-
* Scans tool arguments
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Scans tool arguments for patterns that indicate credentials, secrets, PII,
|
|
5
|
+
* or destructive commands before allowing the tool call to proceed.
|
|
6
|
+
*
|
|
7
|
+
* PII is the validated detectors in `dlpPii.ts`, shared with the
|
|
8
|
+
* Rust proxy: card numbers, IBANs and SSNs on by default, email addresses and
|
|
9
|
+
* phone numbers off. The workspace's `piiDetectors` setting sets the actions
|
|
10
|
+
* it names, and `INTUTIC_MCP_DLP_DETECTORS` sets this machine's, which may
|
|
11
|
+
* only tighten the workspace's (see `setWorkspacePii`).
|
|
12
|
+
* Arguments are never rewritten, so any enabled detector — `redact` or
|
|
13
|
+
* `block` — blocks the call on the way in; on results both redact.
|
|
7
14
|
*
|
|
8
15
|
* @module
|
|
9
16
|
*/
|
|
17
|
+
import { type WorkspacePiiDetectors } from '@intutic/shared-types';
|
|
10
18
|
export interface DlpFinding {
|
|
11
19
|
pattern: string;
|
|
12
20
|
description: string;
|
|
@@ -22,6 +30,22 @@ export interface DlpScanResult {
|
|
|
22
30
|
* Returns the number dropped so the caller can log it.
|
|
23
31
|
*/
|
|
24
32
|
export declare function setDynamicPatterns(sources: readonly string[]): number;
|
|
33
|
+
/**
|
|
34
|
+
* Set the PII detectors' actions from an `INTUTIC_MCP_DLP_DETECTORS` value.
|
|
35
|
+
* Runs once at load from the environment; exported for tests. Returns the
|
|
36
|
+
* problems it ignored, which are also logged.
|
|
37
|
+
*/
|
|
38
|
+
export declare function configurePii(raw: string | undefined): string[];
|
|
39
|
+
/**
|
|
40
|
+
* Apply the workspace's `piiDetectors` setting as the policy last delivered
|
|
41
|
+
* it (`PolicyClient.getPiiDetectors`): the baseline for every detector it
|
|
42
|
+
* names, which `INTUTIC_MCP_DLP_DETECTORS` may only tighten — the rule the
|
|
43
|
+
* LLM proxy applies (`effectivePiiActions`). Called before each scan in both
|
|
44
|
+
* directions, like `setDynamicPatterns`. An unreadable setting scans with
|
|
45
|
+
* the local config alone; refusing the call instead under fail-closed is the
|
|
46
|
+
* interceptor's decision, not this scanner's.
|
|
47
|
+
*/
|
|
48
|
+
export declare function setWorkspacePii(setting: WorkspacePiiDetectors): void;
|
|
25
49
|
/**
|
|
26
50
|
* Redact every redactable-pattern match in a string.
|
|
27
51
|
*
|
|
@@ -37,6 +61,11 @@ export declare function redactText(text: string): {
|
|
|
37
61
|
/**
|
|
38
62
|
* Scan tool arguments for DLP findings.
|
|
39
63
|
*
|
|
64
|
+
* Value patterns (credentials, PII, workspace patterns) match the serialized
|
|
65
|
+
* arguments. Command patterns match each decoded string instead: in the JSON a
|
|
66
|
+
* newline is the two characters `\n`, so a command split across lines no
|
|
67
|
+
* longer had whitespace between its words.
|
|
68
|
+
*
|
|
40
69
|
* @param toolInput - The tool_input object from the MCP tools/call request
|
|
41
70
|
* @returns DLP scan result with any findings
|
|
42
71
|
*/
|
package/dist/dlp.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dlp.d.ts","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"dlp.d.ts","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAOL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAA;AAK9B,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AAgED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAgBrE;AAiBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM9D;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAGpE;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,CAuBrF;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CA0B/D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAGnE"}
|
package/dist/dlp.js
CHANGED
|
@@ -1,12 +1,22 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* dlp.ts — DLP (Data Loss Prevention) argument scanner.
|
|
3
3
|
*
|
|
4
|
-
* Scans tool arguments
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* Scans tool arguments for patterns that indicate credentials, secrets, PII,
|
|
5
|
+
* or destructive commands before allowing the tool call to proceed.
|
|
6
|
+
*
|
|
7
|
+
* PII is the validated detectors in `dlpPii.ts`, shared with the
|
|
8
|
+
* Rust proxy: card numbers, IBANs and SSNs on by default, email addresses and
|
|
9
|
+
* phone numbers off. The workspace's `piiDetectors` setting sets the actions
|
|
10
|
+
* it names, and `INTUTIC_MCP_DLP_DETECTORS` sets this machine's, which may
|
|
11
|
+
* only tighten the workspace's (see `setWorkspacePii`).
|
|
12
|
+
* Arguments are never rewritten, so any enabled detector — `redact` or
|
|
13
|
+
* `block` — blocks the call on the way in; on results both redact.
|
|
7
14
|
*
|
|
8
15
|
* @module
|
|
9
16
|
*/
|
|
17
|
+
import { DESTRUCTIVE_SQL_STATEMENTS, effectivePiiActions, hasPhrase, phraseText, } from '@intutic/shared-types';
|
|
18
|
+
import { PII_DETECTORS, findPii, parseLocalPiiActions } from './dlpPii.js';
|
|
19
|
+
import { createStderrLogger } from './stderrLog.js';
|
|
10
20
|
/**
|
|
11
21
|
* Compiled DLP patterns.
|
|
12
22
|
*
|
|
@@ -32,18 +42,18 @@ const DLP_PATTERNS = [
|
|
|
32
42
|
{ regex: /xoxb-[A-Za-z0-9-]{50,}/, description: 'Slack bot token', redactable: true },
|
|
33
43
|
{ regex: /xoxp-[A-Za-z0-9-]{50,}/, description: 'Slack user token', redactable: true },
|
|
34
44
|
{ regex: /AKIA[A-Z0-9]{16}/, description: 'AWS Access Key ID', redactable: true },
|
|
35
|
-
// PII. The Rust proxy's dlp.rs has carried an SSN pattern from the start;
|
|
36
|
-
// this scanner had none, so a tool result carrying one streamed into the
|
|
37
|
-
// agent's context unremarked. Same shape dlp.rs uses: grouped digits only —
|
|
38
|
-
// a bare 9-digit run matches phone numbers and IDs far too often.
|
|
39
|
-
{ regex: /\b\d{3}-\d{2}-\d{4}\b/, description: 'US Social Security Number', redactable: true },
|
|
40
45
|
// High-entropy strings that look like secrets (≥40 chars of hex or base64)
|
|
41
46
|
{ regex: /[0-9a-f]{40,}/, description: 'High-entropy hex string (possible secret)', redactable: true },
|
|
42
|
-
// Destructive
|
|
47
|
+
// Destructive commands — input-only, and matched against each decoded
|
|
48
|
+
// argument string (see scanToolInput). The SQL statements are the shared
|
|
49
|
+
// text rule (destructiveSql.ts in shared-types), the one the control plane's
|
|
50
|
+
// DLP reads too: it does not parse SQL, so a quoted mention
|
|
51
|
+
// (`SELECT 'drop table'`) is blocked as well, because quoting is also how a
|
|
52
|
+
// shell command carries the real thing (`psql -c 'DROP TABLE x'`).
|
|
43
53
|
{ regex: /rm\s+-rf?\s+\//, description: 'Destructive rm -rf / command', redactable: false },
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
{
|
|
54
|
+
// The destructive SQL statements are shared with the control plane's DLP
|
|
55
|
+
// (destructiveSql.ts in shared-types), matched bounded at both ends.
|
|
56
|
+
...DESTRUCTIVE_SQL_STATEMENTS.map(({ phrase, description }) => ({ phrase, description, redactable: false })),
|
|
47
57
|
// Private key material
|
|
48
58
|
{ regex: /-----BEGIN\s+(RSA\s+)?PRIVATE KEY-----/, description: 'PEM private key material', redactable: true },
|
|
49
59
|
{ regex: /-----BEGIN\s+EC\s+PRIVATE KEY-----/, description: 'EC private key material', redactable: true },
|
|
@@ -83,6 +93,42 @@ export function setDynamicPatterns(sources) {
|
|
|
83
93
|
function allPatterns() {
|
|
84
94
|
return dynamicPatterns.length ? [...DLP_PATTERNS, ...dynamicPatterns] : DLP_PATTERNS;
|
|
85
95
|
}
|
|
96
|
+
/** The detectors `INTUTIC_MCP_DLP_DETECTORS` names, with their actions. */
|
|
97
|
+
let localPii = {};
|
|
98
|
+
/** The workspace's `piiDetectors` setting, when the last policy carried one. */
|
|
99
|
+
let workspacePii = null;
|
|
100
|
+
let enabledPii = [];
|
|
101
|
+
function rebuildPii() {
|
|
102
|
+
const actions = effectivePiiActions(localPii, workspacePii);
|
|
103
|
+
enabledPii = PII_DETECTORS.filter((d) => actions[d.id] !== 'off');
|
|
104
|
+
}
|
|
105
|
+
/**
|
|
106
|
+
* Set the PII detectors' actions from an `INTUTIC_MCP_DLP_DETECTORS` value.
|
|
107
|
+
* Runs once at load from the environment; exported for tests. Returns the
|
|
108
|
+
* problems it ignored, which are also logged.
|
|
109
|
+
*/
|
|
110
|
+
export function configurePii(raw) {
|
|
111
|
+
const { configured, problems } = parseLocalPiiActions(raw);
|
|
112
|
+
localPii = configured;
|
|
113
|
+
rebuildPii();
|
|
114
|
+
if (problems.length)
|
|
115
|
+
createStderrLogger('mcp-proxy-dlp').warn({ problems }, 'DLP: PII detector settings ignored');
|
|
116
|
+
return problems;
|
|
117
|
+
}
|
|
118
|
+
configurePii(process.env['INTUTIC_MCP_DLP_DETECTORS']);
|
|
119
|
+
/**
|
|
120
|
+
* Apply the workspace's `piiDetectors` setting as the policy last delivered
|
|
121
|
+
* it (`PolicyClient.getPiiDetectors`): the baseline for every detector it
|
|
122
|
+
* names, which `INTUTIC_MCP_DLP_DETECTORS` may only tighten — the rule the
|
|
123
|
+
* LLM proxy applies (`effectivePiiActions`). Called before each scan in both
|
|
124
|
+
* directions, like `setDynamicPatterns`. An unreadable setting scans with
|
|
125
|
+
* the local config alone; refusing the call instead under fail-closed is the
|
|
126
|
+
* interceptor's decision, not this scanner's.
|
|
127
|
+
*/
|
|
128
|
+
export function setWorkspacePii(setting) {
|
|
129
|
+
workspacePii = setting.kind === 'set' ? setting.actions : null;
|
|
130
|
+
rebuildPii();
|
|
131
|
+
}
|
|
86
132
|
/**
|
|
87
133
|
* Redact every redactable-pattern match in a string.
|
|
88
134
|
*
|
|
@@ -94,34 +140,86 @@ function allPatterns() {
|
|
|
94
140
|
export function redactText(text) {
|
|
95
141
|
const findings = [];
|
|
96
142
|
let redacted = text;
|
|
97
|
-
for (const
|
|
98
|
-
if (!redactable)
|
|
143
|
+
for (const p of allPatterns()) {
|
|
144
|
+
if (!p.redactable || !('regex' in p))
|
|
99
145
|
continue;
|
|
146
|
+
const { regex, description } = p;
|
|
100
147
|
const global = new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g');
|
|
101
148
|
if (global.test(redacted)) {
|
|
102
149
|
findings.push({ pattern: regex.source, description });
|
|
103
150
|
redacted = redacted.replace(global, '[REDACTED_SECRET]');
|
|
104
151
|
}
|
|
105
152
|
}
|
|
153
|
+
// PII after the secret patterns, with the Rust proxy's placeholder for the
|
|
154
|
+
// category. Spans are replaced back to front so earlier ones stay valid.
|
|
155
|
+
for (const det of enabledPii) {
|
|
156
|
+
const spans = findPii(det, redacted);
|
|
157
|
+
if (!spans.length)
|
|
158
|
+
continue;
|
|
159
|
+
findings.push({ pattern: det.id, description: det.description });
|
|
160
|
+
for (const [start, end] of spans.reverse()) {
|
|
161
|
+
redacted = redacted.slice(0, start) + '[REDACTED_PII]' + redacted.slice(end);
|
|
162
|
+
}
|
|
163
|
+
}
|
|
106
164
|
return { redacted, findings };
|
|
107
165
|
}
|
|
166
|
+
/** Every string in the arguments, object keys included, as the tool receives it. */
|
|
167
|
+
function argumentStrings(value) {
|
|
168
|
+
const out = [];
|
|
169
|
+
const pending = [value];
|
|
170
|
+
while (pending.length > 0) {
|
|
171
|
+
const v = pending.pop();
|
|
172
|
+
if (typeof v === 'string') {
|
|
173
|
+
out.push(v);
|
|
174
|
+
}
|
|
175
|
+
else if (Array.isArray(v)) {
|
|
176
|
+
for (const item of v)
|
|
177
|
+
pending.push(item);
|
|
178
|
+
}
|
|
179
|
+
else if (v !== null && typeof v === 'object') {
|
|
180
|
+
for (const [key, item] of Object.entries(v)) {
|
|
181
|
+
out.push(key);
|
|
182
|
+
pending.push(item);
|
|
183
|
+
}
|
|
184
|
+
}
|
|
185
|
+
}
|
|
186
|
+
return out;
|
|
187
|
+
}
|
|
108
188
|
/**
|
|
109
189
|
* Scan tool arguments for DLP findings.
|
|
110
190
|
*
|
|
191
|
+
* Value patterns (credentials, PII, workspace patterns) match the serialized
|
|
192
|
+
* arguments. Command patterns match each decoded string instead: in the JSON a
|
|
193
|
+
* newline is the two characters `\n`, so a command split across lines no
|
|
194
|
+
* longer had whitespace between its words.
|
|
195
|
+
*
|
|
111
196
|
* @param toolInput - The tool_input object from the MCP tools/call request
|
|
112
197
|
* @returns DLP scan result with any findings
|
|
113
198
|
*/
|
|
114
199
|
export function scanToolInput(toolInput) {
|
|
115
|
-
// Serialize to string for pattern matching
|
|
116
200
|
const serialized = JSON.stringify(toolInput ?? {});
|
|
201
|
+
const strings = argumentStrings(toolInput);
|
|
117
202
|
const findings = [];
|
|
118
203
|
// The full set — floor plus workspace patterns — on the input direction too:
|
|
119
204
|
// a workspace pattern that blocked results but not the input that exfiltrates
|
|
120
205
|
// them would be scanning the wrong side.
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
206
|
+
let words = null;
|
|
207
|
+
for (const p of allPatterns()) {
|
|
208
|
+
let hit;
|
|
209
|
+
if ('phrase' in p) {
|
|
210
|
+
words ??= strings.map((s) => phraseText(s));
|
|
211
|
+
hit = words.some((w) => hasPhrase(w, p.phrase, true));
|
|
212
|
+
}
|
|
213
|
+
else {
|
|
214
|
+
hit = p.redactable ? p.regex.test(serialized) : strings.some((s) => p.regex.test(s));
|
|
124
215
|
}
|
|
216
|
+
if (hit) {
|
|
217
|
+
findings.push({ pattern: 'phrase' in p ? p.phrase : p.regex.source, description: p.description });
|
|
218
|
+
}
|
|
219
|
+
}
|
|
220
|
+
for (const det of enabledPii) {
|
|
221
|
+
if (findPii(det, serialized).length)
|
|
222
|
+
findings.push({ pattern: det.id, description: det.description });
|
|
125
223
|
}
|
|
126
224
|
return { hasFinding: findings.length > 0, findings };
|
|
127
225
|
}
|
package/dist/dlp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"dlp.js","sourceRoot":"","sources":["../src/dlp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,SAAS,EACT,UAAU,GAIX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAuBnD;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAiB;IACjC,oBAAoB;IACpB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IACzF,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE,UAAU,EAAE,IAAI,EAAE;IACnG,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,8BAA8B,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/F,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,EAAE;IACtF,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE;IACrF,EAAE,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,EAAE;IACtF,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE;IACjF,2EAA2E;IAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,2CAA2C,EAAE,UAAU,EAAE,IAAI,EAAE;IACtG,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4DAA4D;IAC5D,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE,UAAU,EAAE,KAAK,EAAE;IAC3F,yEAAyE;IACzE,qEAAqE;IACrE,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,uBAAuB;IACvB,EAAE,KAAK,EAAE,wCAAwC,EAAE,WAAW,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9G,EAAE,KAAK,EAAE,oCAAoC,EAAE,WAAW,EAAE,yBAAyB,EAAE,UAAU,EAAE,IAAI,EAAE;CAC1G,CAAA;AAED;;;;;;GAMG;AACH,IAAI,eAAe,GAAiB,EAAE,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0B;IAC3D,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC;gBACtB,WAAW,EAAE,0BAA0B,GAAG,EAAE;gBAC5C,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,eAAe,GAAG,QAAQ,CAAA;IAC1B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;AACtF,CAAC;AAED,2EAA2E;AAC3E,IAAI,QAAQ,GAAwB,EAAE,CAAA;AACtC,gFAAgF;AAChF,IAAI,YAAY,GAA+B,IAAI,CAAA;AACnD,IAAI,UAAU,GAA2B,EAAE,CAAA;AAE3C,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC3D,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAA;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC1D,QAAQ,GAAG,UAAU,CAAA;IACrB,UAAU,EAAE,CAAA;IACZ,IAAI,QAAQ,CAAC,MAAM;QAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACjH,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAA;AAEtD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAA8B;IAC5D,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,UAAU,EAAE,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YAAE,SAAQ;QAC9C,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAA;QACpG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAQ;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAChE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,CAAA;IAClC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,SAAkB;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAiB,EAAE,CAAA;IAEjC,6EAA6E;IAC7E,8EAA8E;IAC9E,yCAAyC;IACzC,IAAI,KAAK,GAAwB,IAAI,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,EAAE,CAAC;QAC9B,IAAI,GAAY,CAAA;QAChB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,KAAK,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3C,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,OAAO,uEAAuE,IAAI,EAAE,CAAA;AACtF,CAAC"}
|
package/dist/dlpPii.d.ts
ADDED
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* dlpPii.ts — validated PII detectors (card and IBAN checksums, SSN issued ranges).
|
|
3
|
+
*
|
|
4
|
+
* The TypeScript twin of the Rust proxy's `packages/proxy/src/dlp/pii.rs`.
|
|
5
|
+
* Both read the same definition (`PII_DEFINITION` from
|
|
6
|
+
* `@intutic/shared-types`, a byte-identical copy of the proxy's
|
|
7
|
+
* `pii_detectors.json`) and implement its validators and boundary rule the
|
|
8
|
+
* same way; `packages/shared-types/fixtures/pii-detector-vectors.json` runs
|
|
9
|
+
* through both (`__tests__/dlpPii.test.ts`, `tests/pii_conformance_test.rs`).
|
|
10
|
+
* A change to a rule here needs the same change there, or the vectors fail on
|
|
11
|
+
* one side.
|
|
12
|
+
*
|
|
13
|
+
* The regex finds a candidate; the validator decides. Luhn plus the IIN table
|
|
14
|
+
* for cards, the country length table plus mod-97 for IBANs, the never-issued
|
|
15
|
+
* ranges for SSNs, structure for email, digit count for phone numbers.
|
|
16
|
+
*
|
|
17
|
+
* The boundary rule replaces `\b`, which means different things in the two
|
|
18
|
+
* engines. Neighbouring characters must not be ASCII letters, digits or `_`,
|
|
19
|
+
* except that a match right after a JSON escape (`\n`, `\r`, `\t`) counts as
|
|
20
|
+
* bounded — both scanners read JSON as sent. A match starting right after a
|
|
21
|
+
* backslash starts inside an escape and is rejected. `numeric` detectors
|
|
22
|
+
* also reject a match glued to more digits by `.` or `-` (a decimal fraction,
|
|
23
|
+
* a five-group serial). A rejected candidate resumes the search one character
|
|
24
|
+
* after its start, so a card number right after `12 ` is still found.
|
|
25
|
+
*
|
|
26
|
+
* @module
|
|
27
|
+
*/
|
|
28
|
+
import type { PiiDetectorId, PiiDetectorSettings } from '@intutic/shared-types';
|
|
29
|
+
export interface PiiDetector {
|
|
30
|
+
/** One of `PII_DETECTOR_IDS`, which shared-types holds equal to the definition's. */
|
|
31
|
+
id: PiiDetectorId;
|
|
32
|
+
category: string;
|
|
33
|
+
description: string;
|
|
34
|
+
/** Global flag: matched from `lastIndex`, which `findPii` sets. */
|
|
35
|
+
regex: RegExp;
|
|
36
|
+
numeric: boolean;
|
|
37
|
+
/** The accepted length of the span (a prefix of it), or null. */
|
|
38
|
+
validate: (span: string) => number | null;
|
|
39
|
+
}
|
|
40
|
+
/** Every PII detector, in definition order, whatever its configured action. */
|
|
41
|
+
export declare const PII_DETECTORS: readonly PiiDetector[];
|
|
42
|
+
/** Validated matches of one detector, as `[start, end)` UTF-16 ranges, in text order. */
|
|
43
|
+
export declare function findPii(det: PiiDetector, text: string): Array<[number, number]>;
|
|
44
|
+
/**
|
|
45
|
+
* Every detector over `text`, actions ignored, in definition order then text
|
|
46
|
+
* order — what the conformance vectors measure.
|
|
47
|
+
*/
|
|
48
|
+
export declare function detectPii(text: string): Array<{
|
|
49
|
+
id: string;
|
|
50
|
+
start: number;
|
|
51
|
+
end: number;
|
|
52
|
+
}>;
|
|
53
|
+
/**
|
|
54
|
+
* The detectors an `INTUTIC_MCP_DLP_DETECTORS` value names — a JSON object of
|
|
55
|
+
* detector id → `off` | `redact` | `block` — with their actions. Detectors it
|
|
56
|
+
* leaves out are not listed: they keep their defaults, or the workspace's
|
|
57
|
+
* action (`effectivePiiActions` in `@intutic/shared-types`). Never throws,
|
|
58
|
+
* like the other `INTUTIC_MCP_*` JSON settings: an unparseable value, an
|
|
59
|
+
* unknown id or an unknown action is reported in `problems` and that entry is
|
|
60
|
+
* left out, so it keeps its default, which for card, IBAN and SSN is on.
|
|
61
|
+
*/
|
|
62
|
+
export declare function parseLocalPiiActions(raw: string | undefined): {
|
|
63
|
+
configured: PiiDetectorSettings;
|
|
64
|
+
problems: string[];
|
|
65
|
+
};
|
|
66
|
+
//# sourceMappingURL=dlpPii.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"dlpPii.d.ts","sourceRoot":"","sources":["../src/dlpPii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAyB,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEtG,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,EAAE,EAAE,aAAa,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,iEAAiE;IACjE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;CAC1C;AA6GD,+EAA+E;AAC/E,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAW9C,CAAA;AAqBF,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmB/E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAMzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG;IAC7D,UAAU,EAAE,mBAAmB,CAAA;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAuBA"}
|