@kya-os/checkpoint-nextjs 1.1.0 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +178 -0
- package/EDGE_RUNTIME_WASM_SETUP.md +4 -10
- package/README.md +13 -0
- package/bin/setup-edge-wasm.js +40 -32
- package/dist/api-client.d.mts +10 -10
- package/dist/api-client.d.ts +10 -10
- package/dist/create-middleware.d.mts +7 -2
- package/dist/create-middleware.d.ts +7 -2
- package/dist/edge/index.d.mts +3 -3
- package/dist/edge/index.d.ts +3 -3
- package/dist/edge/index.js +16 -3
- package/dist/edge/index.mjs +16 -3
- package/dist/edge-runtime-loader.d.mts +43 -18
- package/dist/edge-runtime-loader.d.ts +43 -18
- package/dist/edge-runtime-loader.js +101 -58
- package/dist/edge-runtime-loader.mjs +98 -59
- package/dist/edge-wasm-middleware.d.mts +28 -34
- package/dist/edge-wasm-middleware.d.ts +28 -34
- package/dist/edge-wasm-middleware.js +16 -306
- package/dist/edge-wasm-middleware.mjs +16 -307
- package/dist/index.js +3 -1
- package/dist/index.mjs +4 -2
- package/dist/nodejs-wasm-loader.d.mts +26 -9
- package/dist/nodejs-wasm-loader.d.ts +26 -9
- package/dist/nodejs-wasm-loader.js +21 -78
- package/dist/nodejs-wasm-loader.mjs +21 -74
- package/dist/session-tracker.d.mts +2 -2
- package/dist/session-tracker.d.ts +2 -2
- package/dist/session-tracker.js +3 -1
- package/dist/session-tracker.mjs +4 -2
- package/dist/wasm-middleware.d.mts +19 -3
- package/dist/wasm-middleware.d.ts +19 -3
- package/dist/wasm-middleware.js +32 -3
- package/dist/wasm-middleware.mjs +32 -4
- package/dist/wasm-setup.js +29 -81
- package/dist/wasm-setup.mjs +29 -76
- package/package.json +4 -4
- package/templates/middleware-wasm-100.ts +11 -3
- package/dist/.tsbuildinfo +0 -1
|
@@ -1,83 +1,30 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
1
|
+
// src/nodejs-wasm-loader.ts
|
|
2
|
+
var MIGRATION_ERROR = "`@kya-os/checkpoint-nextjs`'s `loadWasmNodejs` / `isNodejsRuntime` / `getWasmModule` / `isWasmInitialized` were deprecated in Phase-D.9a (legacy `agentshield-wasm` Rust crate retirement). The legacy `AgentDetector` class they fed is slated for deletion in AgentDetector-Deletion-2 (next minor). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs` \u2014 engine-backed via the Rust `kya-os-engine` crate, with automatic WASM loading via `@kya-os/checkpoint-wasm-runtime`. See packages/checkpoint-nextjs/README.md for the canonical recipe.";
|
|
3
|
+
var _nodejsWasmWarned = false;
|
|
4
|
+
function warnNodejsWasmDeprecated() {
|
|
5
|
+
if (_nodejsWasmWarned) return;
|
|
6
|
+
_nodejsWasmWarned = true;
|
|
7
|
+
if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
|
|
8
|
+
console.warn(`[Checkpoint] ${MIGRATION_ERROR}`);
|
|
9
|
+
}
|
|
10
|
+
function __resetNodejsWasmWarningForTests() {
|
|
11
|
+
_nodejsWasmWarned = false;
|
|
12
|
+
}
|
|
13
13
|
async function loadWasmNodejs() {
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
}
|
|
17
|
-
try {
|
|
18
|
-
const possiblePaths = [
|
|
19
|
-
// In node_modules (most likely)
|
|
20
|
-
path.join(
|
|
21
|
-
process.cwd(),
|
|
22
|
-
"node_modules",
|
|
23
|
-
"@kya-os",
|
|
24
|
-
"agentshield",
|
|
25
|
-
"dist",
|
|
26
|
-
"wasm",
|
|
27
|
-
"agentshield_wasm_bg.wasm"
|
|
28
|
-
),
|
|
29
|
-
// In project root (if user copied it)
|
|
30
|
-
path.join(process.cwd(), "agentshield_wasm_bg.wasm"),
|
|
31
|
-
// Relative to current file
|
|
32
|
-
path.join(
|
|
33
|
-
__dirname,
|
|
34
|
-
"..",
|
|
35
|
-
"..",
|
|
36
|
-
"..",
|
|
37
|
-
"agentshield",
|
|
38
|
-
"dist",
|
|
39
|
-
"wasm",
|
|
40
|
-
"agentshield_wasm_bg.wasm"
|
|
41
|
-
)
|
|
42
|
-
];
|
|
43
|
-
let wasmBuffer = null;
|
|
44
|
-
let loadedPath = null;
|
|
45
|
-
for (const wasmPath of possiblePaths) {
|
|
46
|
-
try {
|
|
47
|
-
if (fs.existsSync(wasmPath)) {
|
|
48
|
-
wasmBuffer = fs.readFileSync(wasmPath);
|
|
49
|
-
loadedPath = wasmPath;
|
|
50
|
-
break;
|
|
51
|
-
}
|
|
52
|
-
} catch (e) {
|
|
53
|
-
continue;
|
|
54
|
-
}
|
|
55
|
-
}
|
|
56
|
-
if (!wasmBuffer) {
|
|
57
|
-
console.warn("AgentShield: WASM file not found in any expected location");
|
|
58
|
-
return false;
|
|
59
|
-
}
|
|
60
|
-
const bytes = new Uint8Array(wasmBuffer);
|
|
61
|
-
wasmModule = await WebAssembly.compile(bytes);
|
|
62
|
-
setWasmModule(wasmModule);
|
|
63
|
-
wasmInitialized = true;
|
|
64
|
-
console.log(`\u2705 AgentShield: WASM loaded successfully from ${loadedPath} (Node.js runtime)`);
|
|
65
|
-
console.log("\u{1F510} Cryptographic verification enabled (95-100% confidence)");
|
|
66
|
-
return true;
|
|
67
|
-
} catch (error) {
|
|
68
|
-
console.warn("\u26A0\uFE0F AgentShield: Failed to load WASM in Node.js runtime:", error);
|
|
69
|
-
console.log("\u{1F4CA} Falling back to pattern detection (85% confidence)");
|
|
70
|
-
return false;
|
|
71
|
-
}
|
|
14
|
+
warnNodejsWasmDeprecated();
|
|
15
|
+
throw new Error(MIGRATION_ERROR);
|
|
72
16
|
}
|
|
73
17
|
function isNodejsRuntime() {
|
|
74
|
-
|
|
18
|
+
warnNodejsWasmDeprecated();
|
|
19
|
+
throw new Error(MIGRATION_ERROR);
|
|
75
20
|
}
|
|
76
21
|
function getWasmModule() {
|
|
77
|
-
|
|
22
|
+
warnNodejsWasmDeprecated();
|
|
23
|
+
throw new Error(MIGRATION_ERROR);
|
|
78
24
|
}
|
|
79
25
|
function isWasmInitialized() {
|
|
80
|
-
|
|
26
|
+
warnNodejsWasmDeprecated();
|
|
27
|
+
throw new Error(MIGRATION_ERROR);
|
|
81
28
|
}
|
|
82
29
|
|
|
83
|
-
export { getWasmModule, isNodejsRuntime, isWasmInitialized, loadWasmNodejs };
|
|
30
|
+
export { __resetNodejsWasmWarningForTests, getWasmModule, isNodejsRuntime, isWasmInitialized, loadWasmNodejs };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { NextRequest, NextResponse } from 'next/server';
|
|
2
|
-
import {
|
|
2
|
+
import { DetectionDetail } from '@kya-os/checkpoint-shared';
|
|
3
3
|
|
|
4
4
|
/**
|
|
5
5
|
* Edge-compatible session tracking for AI agents
|
|
@@ -25,7 +25,7 @@ declare class EdgeSessionTracker {
|
|
|
25
25
|
/**
|
|
26
26
|
* Track a new AI agent session
|
|
27
27
|
*/
|
|
28
|
-
track(_request: NextRequest, response: NextResponse, result:
|
|
28
|
+
track(_request: NextRequest, response: NextResponse, result: DetectionDetail): Promise<NextResponse>;
|
|
29
29
|
/**
|
|
30
30
|
* Check for existing AI agent session
|
|
31
31
|
*/
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { NextRequest, NextResponse } from 'next/server';
|
|
2
|
-
import {
|
|
2
|
+
import { DetectionDetail } from '@kya-os/checkpoint-shared';
|
|
3
3
|
|
|
4
4
|
/**
|
|
5
5
|
* Edge-compatible session tracking for AI agents
|
|
@@ -25,7 +25,7 @@ declare class EdgeSessionTracker {
|
|
|
25
25
|
/**
|
|
26
26
|
* Track a new AI agent session
|
|
27
27
|
*/
|
|
28
|
-
track(_request: NextRequest, response: NextResponse, result:
|
|
28
|
+
track(_request: NextRequest, response: NextResponse, result: DetectionDetail): Promise<NextResponse>;
|
|
29
29
|
/**
|
|
30
30
|
* Check for existing AI agent session
|
|
31
31
|
*/
|
package/dist/session-tracker.js
CHANGED
|
@@ -19,7 +19,9 @@ var EdgeSessionTracker = class {
|
|
|
19
19
|
*/
|
|
20
20
|
async track(_request, response, result) {
|
|
21
21
|
try {
|
|
22
|
-
|
|
22
|
+
const detectedName = result.detectedAgent?.name;
|
|
23
|
+
const isEnforceable = result.isAgent || result.isAiCrawler || checkpointShared.isKnownAiCrawler(detectedName);
|
|
24
|
+
if (!this.config.enabled || !isEnforceable) {
|
|
23
25
|
return response;
|
|
24
26
|
}
|
|
25
27
|
const sessionData = {
|
package/dist/session-tracker.mjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { isKnownAiCrawler } from '@kya-os/checkpoint-shared';
|
|
2
2
|
|
|
3
3
|
// src/session-tracker.ts
|
|
4
4
|
var EdgeSessionTracker = class {
|
|
@@ -17,7 +17,9 @@ var EdgeSessionTracker = class {
|
|
|
17
17
|
*/
|
|
18
18
|
async track(_request, response, result) {
|
|
19
19
|
try {
|
|
20
|
-
|
|
20
|
+
const detectedName = result.detectedAgent?.name;
|
|
21
|
+
const isEnforceable = result.isAgent || result.isAiCrawler || isKnownAiCrawler(detectedName);
|
|
22
|
+
if (!this.config.enabled || !isEnforceable) {
|
|
21
23
|
return response;
|
|
22
24
|
}
|
|
23
25
|
const sessionData = {
|
|
@@ -1,10 +1,21 @@
|
|
|
1
1
|
import { NextRequest, NextResponse } from 'next/server';
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
|
-
* WASM-enabled middleware for Next.js with
|
|
5
|
-
*
|
|
4
|
+
* WASM-enabled middleware for Next.js with Checkpoint.
|
|
5
|
+
*
|
|
6
|
+
* **Deprecation notice (AgentDetector-Deletion-1):**
|
|
7
|
+
* `createWasmAgentShieldMiddleware` is deprecated as of this patch and
|
|
8
|
+
* slated for removal in the next minor. It internally constructs a
|
|
9
|
+
* legacy `AgentDetector` and never actually uses the WASM instance for
|
|
10
|
+
* detection (the `wasmInstance` arg only bumps confidence by 15%).
|
|
11
|
+
* Stage 1 detection now lives in the Rust `kya-os-engine` (PDM-1
|
|
12
|
+
* #2560). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs`
|
|
13
|
+
* — engine-backed, runs the orchestrator including envelope
|
|
14
|
+
* verification.
|
|
6
15
|
*/
|
|
7
16
|
|
|
17
|
+
/** @internal — test-only reset for the one-shot warn latch. */
|
|
18
|
+
declare function __resetCreateWasmAgentShieldWarningForTests(): void;
|
|
8
19
|
interface WasmDetectionResult {
|
|
9
20
|
isAgent: boolean;
|
|
10
21
|
isAiCrawler?: boolean;
|
|
@@ -26,6 +37,11 @@ interface AgentShieldConfig {
|
|
|
26
37
|
};
|
|
27
38
|
}
|
|
28
39
|
/**
|
|
40
|
+
* @deprecated Wraps the legacy `AgentDetector` class. Will be removed
|
|
41
|
+
* in the next minor (AgentDetector-Deletion-2). Migrate to
|
|
42
|
+
* `withCheckpoint` from `@kya-os/checkpoint-nextjs` — engine-backed,
|
|
43
|
+
* runs the orchestrator including envelope verification.
|
|
44
|
+
*
|
|
29
45
|
* Create a WASM-enabled Checkpoint middleware (**pattern-detection only**).
|
|
30
46
|
*
|
|
31
47
|
* **This factory runs UA/header pattern matching only.** It does NOT
|
|
@@ -79,4 +95,4 @@ declare function createWasmAgentShieldMiddleware(config: AgentShieldConfig & {
|
|
|
79
95
|
*/
|
|
80
96
|
declare function instantiateWasm(wasmModule: WebAssembly.Module): Promise<WebAssembly.Instance>;
|
|
81
97
|
|
|
82
|
-
export { type AgentShieldConfig, type WasmDetectionResult, createWasmAgentShieldMiddleware, instantiateWasm };
|
|
98
|
+
export { type AgentShieldConfig, type WasmDetectionResult, __resetCreateWasmAgentShieldWarningForTests, createWasmAgentShieldMiddleware, instantiateWasm };
|
|
@@ -1,10 +1,21 @@
|
|
|
1
1
|
import { NextRequest, NextResponse } from 'next/server';
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
|
-
* WASM-enabled middleware for Next.js with
|
|
5
|
-
*
|
|
4
|
+
* WASM-enabled middleware for Next.js with Checkpoint.
|
|
5
|
+
*
|
|
6
|
+
* **Deprecation notice (AgentDetector-Deletion-1):**
|
|
7
|
+
* `createWasmAgentShieldMiddleware` is deprecated as of this patch and
|
|
8
|
+
* slated for removal in the next minor. It internally constructs a
|
|
9
|
+
* legacy `AgentDetector` and never actually uses the WASM instance for
|
|
10
|
+
* detection (the `wasmInstance` arg only bumps confidence by 15%).
|
|
11
|
+
* Stage 1 detection now lives in the Rust `kya-os-engine` (PDM-1
|
|
12
|
+
* #2560). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs`
|
|
13
|
+
* — engine-backed, runs the orchestrator including envelope
|
|
14
|
+
* verification.
|
|
6
15
|
*/
|
|
7
16
|
|
|
17
|
+
/** @internal — test-only reset for the one-shot warn latch. */
|
|
18
|
+
declare function __resetCreateWasmAgentShieldWarningForTests(): void;
|
|
8
19
|
interface WasmDetectionResult {
|
|
9
20
|
isAgent: boolean;
|
|
10
21
|
isAiCrawler?: boolean;
|
|
@@ -26,6 +37,11 @@ interface AgentShieldConfig {
|
|
|
26
37
|
};
|
|
27
38
|
}
|
|
28
39
|
/**
|
|
40
|
+
* @deprecated Wraps the legacy `AgentDetector` class. Will be removed
|
|
41
|
+
* in the next minor (AgentDetector-Deletion-2). Migrate to
|
|
42
|
+
* `withCheckpoint` from `@kya-os/checkpoint-nextjs` — engine-backed,
|
|
43
|
+
* runs the orchestrator including envelope verification.
|
|
44
|
+
*
|
|
29
45
|
* Create a WASM-enabled Checkpoint middleware (**pattern-detection only**).
|
|
30
46
|
*
|
|
31
47
|
* **This factory runs UA/header pattern matching only.** It does NOT
|
|
@@ -79,4 +95,4 @@ declare function createWasmAgentShieldMiddleware(config: AgentShieldConfig & {
|
|
|
79
95
|
*/
|
|
80
96
|
declare function instantiateWasm(wasmModule: WebAssembly.Module): Promise<WebAssembly.Instance>;
|
|
81
97
|
|
|
82
|
-
export { type AgentShieldConfig, type WasmDetectionResult, createWasmAgentShieldMiddleware, instantiateWasm };
|
|
98
|
+
export { type AgentShieldConfig, type WasmDetectionResult, __resetCreateWasmAgentShieldWarningForTests, createWasmAgentShieldMiddleware, instantiateWasm };
|
package/dist/wasm-middleware.js
CHANGED
|
@@ -2,10 +2,38 @@
|
|
|
2
2
|
|
|
3
3
|
var server = require('next/server');
|
|
4
4
|
var checkpoint = require('@kya-os/checkpoint');
|
|
5
|
-
var checkpointShared = require('@kya-os/checkpoint-shared');
|
|
6
5
|
|
|
7
6
|
// src/wasm-middleware.ts
|
|
7
|
+
|
|
8
|
+
// src/local-detection-gate.ts
|
|
9
|
+
function isDetectedAgentForLocalGate(result) {
|
|
10
|
+
return result.isAgent === true;
|
|
11
|
+
}
|
|
12
|
+
function evaluateLocalDetectionGate(result, config) {
|
|
13
|
+
if (!isDetectedAgentForLocalGate(result)) {
|
|
14
|
+
return { action: "allow", shouldNotify: false };
|
|
15
|
+
}
|
|
16
|
+
if ((result.confidence ?? 0) >= config.confidenceThreshold) {
|
|
17
|
+
return { action: config.defaultAction, shouldNotify: true };
|
|
18
|
+
}
|
|
19
|
+
return { action: "allow", shouldNotify: false };
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
// src/wasm-middleware.ts
|
|
23
|
+
var _createWasmAgentShieldWarned = false;
|
|
24
|
+
function warnCreateWasmAgentShieldDeprecated() {
|
|
25
|
+
if (_createWasmAgentShieldWarned) return;
|
|
26
|
+
_createWasmAgentShieldWarned = true;
|
|
27
|
+
if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
|
|
28
|
+
console.warn(
|
|
29
|
+
"[Checkpoint] createWasmAgentShieldMiddleware is deprecated and will be removed in the next minor. It wraps the legacy AgentDetector class; Stage 1 detection now lives in the Rust kya-os-engine (PDM-1). Migrate to `withCheckpoint` from @kya-os/checkpoint-nextjs \u2014 engine-backed and runs envelope verification. See packages/checkpoint-nextjs/CHANGELOG.md for the recipe."
|
|
30
|
+
);
|
|
31
|
+
}
|
|
32
|
+
function __resetCreateWasmAgentShieldWarningForTests() {
|
|
33
|
+
_createWasmAgentShieldWarned = false;
|
|
34
|
+
}
|
|
8
35
|
function createWasmAgentShieldMiddleware(config) {
|
|
36
|
+
warnCreateWasmAgentShieldDeprecated();
|
|
9
37
|
const {
|
|
10
38
|
onAgentDetected,
|
|
11
39
|
blockOnHighConfidence = false,
|
|
@@ -45,11 +73,11 @@ function createWasmAgentShieldMiddleware(config) {
|
|
|
45
73
|
// Updated to 0-100 scale (was 0.7)
|
|
46
74
|
timestamp: result.timestamp instanceof Date ? result.timestamp.toISOString() : new Date(result.timestamp).toISOString()
|
|
47
75
|
};
|
|
48
|
-
const decision =
|
|
76
|
+
const decision = evaluateLocalDetectionGate(enhancedResult, {
|
|
49
77
|
confidenceThreshold,
|
|
50
78
|
defaultAction: blockOnHighConfidence ? "block" : "allow"
|
|
51
79
|
});
|
|
52
|
-
if (onAgentDetected &&
|
|
80
|
+
if (onAgentDetected && isDetectedAgentForLocalGate(enhancedResult)) {
|
|
53
81
|
await onAgentDetected(enhancedResult);
|
|
54
82
|
}
|
|
55
83
|
if (decision.action === "block") {
|
|
@@ -92,5 +120,6 @@ async function instantiateWasm(wasmModule) {
|
|
|
92
120
|
}
|
|
93
121
|
}
|
|
94
122
|
|
|
123
|
+
exports.__resetCreateWasmAgentShieldWarningForTests = __resetCreateWasmAgentShieldWarningForTests;
|
|
95
124
|
exports.createWasmAgentShieldMiddleware = createWasmAgentShieldMiddleware;
|
|
96
125
|
exports.instantiateWasm = instantiateWasm;
|
package/dist/wasm-middleware.mjs
CHANGED
|
@@ -1,9 +1,37 @@
|
|
|
1
1
|
import { NextResponse } from 'next/server';
|
|
2
2
|
import { AgentDetector } from '@kya-os/checkpoint';
|
|
3
|
-
import { evaluateEnforcement, shouldEnforce } from '@kya-os/checkpoint-shared';
|
|
4
3
|
|
|
5
4
|
// src/wasm-middleware.ts
|
|
5
|
+
|
|
6
|
+
// src/local-detection-gate.ts
|
|
7
|
+
function isDetectedAgentForLocalGate(result) {
|
|
8
|
+
return result.isAgent === true;
|
|
9
|
+
}
|
|
10
|
+
function evaluateLocalDetectionGate(result, config) {
|
|
11
|
+
if (!isDetectedAgentForLocalGate(result)) {
|
|
12
|
+
return { action: "allow", shouldNotify: false };
|
|
13
|
+
}
|
|
14
|
+
if ((result.confidence ?? 0) >= config.confidenceThreshold) {
|
|
15
|
+
return { action: config.defaultAction, shouldNotify: true };
|
|
16
|
+
}
|
|
17
|
+
return { action: "allow", shouldNotify: false };
|
|
18
|
+
}
|
|
19
|
+
|
|
20
|
+
// src/wasm-middleware.ts
|
|
21
|
+
var _createWasmAgentShieldWarned = false;
|
|
22
|
+
function warnCreateWasmAgentShieldDeprecated() {
|
|
23
|
+
if (_createWasmAgentShieldWarned) return;
|
|
24
|
+
_createWasmAgentShieldWarned = true;
|
|
25
|
+
if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
|
|
26
|
+
console.warn(
|
|
27
|
+
"[Checkpoint] createWasmAgentShieldMiddleware is deprecated and will be removed in the next minor. It wraps the legacy AgentDetector class; Stage 1 detection now lives in the Rust kya-os-engine (PDM-1). Migrate to `withCheckpoint` from @kya-os/checkpoint-nextjs \u2014 engine-backed and runs envelope verification. See packages/checkpoint-nextjs/CHANGELOG.md for the recipe."
|
|
28
|
+
);
|
|
29
|
+
}
|
|
30
|
+
function __resetCreateWasmAgentShieldWarningForTests() {
|
|
31
|
+
_createWasmAgentShieldWarned = false;
|
|
32
|
+
}
|
|
6
33
|
function createWasmAgentShieldMiddleware(config) {
|
|
34
|
+
warnCreateWasmAgentShieldDeprecated();
|
|
7
35
|
const {
|
|
8
36
|
onAgentDetected,
|
|
9
37
|
blockOnHighConfidence = false,
|
|
@@ -43,11 +71,11 @@ function createWasmAgentShieldMiddleware(config) {
|
|
|
43
71
|
// Updated to 0-100 scale (was 0.7)
|
|
44
72
|
timestamp: result.timestamp instanceof Date ? result.timestamp.toISOString() : new Date(result.timestamp).toISOString()
|
|
45
73
|
};
|
|
46
|
-
const decision =
|
|
74
|
+
const decision = evaluateLocalDetectionGate(enhancedResult, {
|
|
47
75
|
confidenceThreshold,
|
|
48
76
|
defaultAction: blockOnHighConfidence ? "block" : "allow"
|
|
49
77
|
});
|
|
50
|
-
if (onAgentDetected &&
|
|
78
|
+
if (onAgentDetected && isDetectedAgentForLocalGate(enhancedResult)) {
|
|
51
79
|
await onAgentDetected(enhancedResult);
|
|
52
80
|
}
|
|
53
81
|
if (decision.action === "block") {
|
|
@@ -90,4 +118,4 @@ async function instantiateWasm(wasmModule) {
|
|
|
90
118
|
}
|
|
91
119
|
}
|
|
92
120
|
|
|
93
|
-
export { createWasmAgentShieldMiddleware, instantiateWasm };
|
|
121
|
+
export { __resetCreateWasmAgentShieldWarningForTests, createWasmAgentShieldMiddleware, instantiateWasm };
|
package/dist/wasm-setup.js
CHANGED
|
@@ -1,14 +1,5 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
var fs = require('fs');
|
|
4
|
-
var path = require('path');
|
|
5
|
-
var checkpoint = require('@kya-os/checkpoint');
|
|
6
|
-
|
|
7
|
-
function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
|
|
8
|
-
|
|
9
|
-
var fs__default = /*#__PURE__*/_interopDefault(fs);
|
|
10
|
-
var path__default = /*#__PURE__*/_interopDefault(path);
|
|
11
|
-
|
|
12
3
|
var __defProp = Object.defineProperty;
|
|
13
4
|
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
14
5
|
var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
|
|
@@ -28,94 +19,51 @@ var __export = (target, all) => {
|
|
|
28
19
|
// src/nodejs-wasm-loader.ts
|
|
29
20
|
var nodejs_wasm_loader_exports = {};
|
|
30
21
|
__export(nodejs_wasm_loader_exports, {
|
|
22
|
+
__resetNodejsWasmWarningForTests: () => __resetNodejsWasmWarningForTests,
|
|
31
23
|
getWasmModule: () => getWasmModule,
|
|
32
24
|
isNodejsRuntime: () => isNodejsRuntime,
|
|
33
25
|
isWasmInitialized: () => isWasmInitialized,
|
|
34
26
|
loadWasmNodejs: () => loadWasmNodejs
|
|
35
27
|
});
|
|
28
|
+
function warnNodejsWasmDeprecated() {
|
|
29
|
+
if (_nodejsWasmWarned) return;
|
|
30
|
+
_nodejsWasmWarned = true;
|
|
31
|
+
if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
|
|
32
|
+
console.warn(`[Checkpoint] ${MIGRATION_ERROR}`);
|
|
33
|
+
}
|
|
34
|
+
function __resetNodejsWasmWarningForTests() {
|
|
35
|
+
_nodejsWasmWarned = false;
|
|
36
|
+
}
|
|
36
37
|
async function loadWasmNodejs() {
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
}
|
|
40
|
-
try {
|
|
41
|
-
const possiblePaths = [
|
|
42
|
-
// In node_modules (most likely)
|
|
43
|
-
path__default.default.join(
|
|
44
|
-
process.cwd(),
|
|
45
|
-
"node_modules",
|
|
46
|
-
"@kya-os",
|
|
47
|
-
"agentshield",
|
|
48
|
-
"dist",
|
|
49
|
-
"wasm",
|
|
50
|
-
"agentshield_wasm_bg.wasm"
|
|
51
|
-
),
|
|
52
|
-
// In project root (if user copied it)
|
|
53
|
-
path__default.default.join(process.cwd(), "agentshield_wasm_bg.wasm"),
|
|
54
|
-
// Relative to current file
|
|
55
|
-
path__default.default.join(
|
|
56
|
-
__dirname,
|
|
57
|
-
"..",
|
|
58
|
-
"..",
|
|
59
|
-
"..",
|
|
60
|
-
"agentshield",
|
|
61
|
-
"dist",
|
|
62
|
-
"wasm",
|
|
63
|
-
"agentshield_wasm_bg.wasm"
|
|
64
|
-
)
|
|
65
|
-
];
|
|
66
|
-
let wasmBuffer = null;
|
|
67
|
-
let loadedPath = null;
|
|
68
|
-
for (const wasmPath of possiblePaths) {
|
|
69
|
-
try {
|
|
70
|
-
if (fs__default.default.existsSync(wasmPath)) {
|
|
71
|
-
wasmBuffer = fs__default.default.readFileSync(wasmPath);
|
|
72
|
-
loadedPath = wasmPath;
|
|
73
|
-
break;
|
|
74
|
-
}
|
|
75
|
-
} catch (e) {
|
|
76
|
-
continue;
|
|
77
|
-
}
|
|
78
|
-
}
|
|
79
|
-
if (!wasmBuffer) {
|
|
80
|
-
console.warn("AgentShield: WASM file not found in any expected location");
|
|
81
|
-
return false;
|
|
82
|
-
}
|
|
83
|
-
const bytes = new Uint8Array(wasmBuffer);
|
|
84
|
-
wasmModule = await WebAssembly.compile(bytes);
|
|
85
|
-
checkpoint.setWasmModule(wasmModule);
|
|
86
|
-
wasmInitialized = true;
|
|
87
|
-
console.log(`\u2705 AgentShield: WASM loaded successfully from ${loadedPath} (Node.js runtime)`);
|
|
88
|
-
console.log("\u{1F510} Cryptographic verification enabled (95-100% confidence)");
|
|
89
|
-
return true;
|
|
90
|
-
} catch (error) {
|
|
91
|
-
console.warn("\u26A0\uFE0F AgentShield: Failed to load WASM in Node.js runtime:", error);
|
|
92
|
-
console.log("\u{1F4CA} Falling back to pattern detection (85% confidence)");
|
|
93
|
-
return false;
|
|
94
|
-
}
|
|
38
|
+
warnNodejsWasmDeprecated();
|
|
39
|
+
throw new Error(MIGRATION_ERROR);
|
|
95
40
|
}
|
|
96
41
|
function isNodejsRuntime() {
|
|
97
|
-
|
|
42
|
+
warnNodejsWasmDeprecated();
|
|
43
|
+
throw new Error(MIGRATION_ERROR);
|
|
98
44
|
}
|
|
99
45
|
function getWasmModule() {
|
|
100
|
-
|
|
46
|
+
warnNodejsWasmDeprecated();
|
|
47
|
+
throw new Error(MIGRATION_ERROR);
|
|
101
48
|
}
|
|
102
49
|
function isWasmInitialized() {
|
|
103
|
-
|
|
50
|
+
warnNodejsWasmDeprecated();
|
|
51
|
+
throw new Error(MIGRATION_ERROR);
|
|
104
52
|
}
|
|
105
|
-
var
|
|
53
|
+
var MIGRATION_ERROR, _nodejsWasmWarned;
|
|
106
54
|
var init_nodejs_wasm_loader = __esm({
|
|
107
55
|
"src/nodejs-wasm-loader.ts"() {
|
|
108
|
-
|
|
109
|
-
|
|
56
|
+
MIGRATION_ERROR = "`@kya-os/checkpoint-nextjs`'s `loadWasmNodejs` / `isNodejsRuntime` / `getWasmModule` / `isWasmInitialized` were deprecated in Phase-D.9a (legacy `agentshield-wasm` Rust crate retirement). The legacy `AgentDetector` class they fed is slated for deletion in AgentDetector-Deletion-2 (next minor). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs` \u2014 engine-backed via the Rust `kya-os-engine` crate, with automatic WASM loading via `@kya-os/checkpoint-wasm-runtime`. See packages/checkpoint-nextjs/README.md for the canonical recipe.";
|
|
57
|
+
_nodejsWasmWarned = false;
|
|
110
58
|
}
|
|
111
59
|
});
|
|
112
60
|
|
|
113
61
|
// src/wasm-setup.ts
|
|
114
|
-
var
|
|
62
|
+
var wasmInitialized = false;
|
|
115
63
|
var initPromise = null;
|
|
116
64
|
var initAttempted = false;
|
|
117
65
|
async function setupWasm() {
|
|
118
|
-
if (
|
|
66
|
+
if (wasmInitialized) {
|
|
119
67
|
return;
|
|
120
68
|
}
|
|
121
69
|
if (initPromise) {
|
|
@@ -131,7 +79,7 @@ async function doSetupWasm() {
|
|
|
131
79
|
initAttempted = true;
|
|
132
80
|
try {
|
|
133
81
|
if (typeof process !== "undefined" && process.env.NODE_ENV === "test") {
|
|
134
|
-
|
|
82
|
+
wasmInitialized = true;
|
|
135
83
|
return;
|
|
136
84
|
}
|
|
137
85
|
const isNodejs = typeof process !== "undefined" && typeof __require !== "undefined" && process.env.NEXT_RUNTIME === "nodejs";
|
|
@@ -139,7 +87,7 @@ async function doSetupWasm() {
|
|
|
139
87
|
try {
|
|
140
88
|
const { loadWasmNodejs: loadWasmNodejs2 } = await Promise.resolve().then(() => (init_nodejs_wasm_loader(), nodejs_wasm_loader_exports));
|
|
141
89
|
const loaded = await loadWasmNodejs2();
|
|
142
|
-
|
|
90
|
+
wasmInitialized = true;
|
|
143
91
|
if (loaded) {
|
|
144
92
|
console.log("\u{1F680} AgentShield: Running with full WASM support (Node.js runtime)");
|
|
145
93
|
} else {
|
|
@@ -150,7 +98,7 @@ async function doSetupWasm() {
|
|
|
150
98
|
console.warn("\u26A0\uFE0F AgentShield: Node.js WASM loader failed:", error);
|
|
151
99
|
}
|
|
152
100
|
}
|
|
153
|
-
|
|
101
|
+
wasmInitialized = true;
|
|
154
102
|
if (process.env.NEXT_RUNTIME === "edge") {
|
|
155
103
|
console.log(
|
|
156
104
|
"\u26A1 AgentShield: Edge Runtime detected - using pattern detection (85% confidence)"
|
|
@@ -158,14 +106,14 @@ async function doSetupWasm() {
|
|
|
158
106
|
console.log("\u2705 AgentShield: Ready for AI agent detection");
|
|
159
107
|
}
|
|
160
108
|
} catch (error) {
|
|
161
|
-
|
|
109
|
+
wasmInitialized = true;
|
|
162
110
|
}
|
|
163
111
|
}
|
|
164
112
|
function isWasmInitialized2() {
|
|
165
|
-
return
|
|
113
|
+
return wasmInitialized;
|
|
166
114
|
}
|
|
167
115
|
function resetWasmState() {
|
|
168
|
-
|
|
116
|
+
wasmInitialized = false;
|
|
169
117
|
initPromise = null;
|
|
170
118
|
}
|
|
171
119
|
|