@medusasec/sensitive-spans 0.1.0

package/dist/receipts.js

@@ -0,0 +1,173 @@
+// Receipts — a per-endpoint, hash-chained, signed record of agent activity.
+//
+// Every receipt carries the previous receipt's hash and a strictly increasing
+// sequence number, and is signed with an ECDSA P-256 key that never leaves
+// the endpoint (non-extractable, generated in the service worker). The
+// dashboard verifies the chain with the public key the endpoint publishes,
+// so a gap, a reorder, or an edited row is detectable after the fact.
+//
+// Receipts never contain prompt text or file contents — only actor, action,
+// host, verdict/outcome and category counts.
+//
+// Pure/portable pieces (canonicalize, hashing, chain verification) take the
+// crypto primitives as arguments so the same code runs in the service worker,
+// in node tests, and (ported) in the dashboard.
+
+export const RECEIPT_VERSION = 1;
+export const SIG_ALG = "ES256"; // ECDSA P-256 / SHA-256
+
+/** Deterministic JSON: sorted keys, no undefined, no whitespace. */
+export function canonicalize(v) {
+  if (v === undefined) return "null";
+  if (v === null || typeof v !== "object") return JSON.stringify(v);
+  if (Array.isArray(v)) return "[" + v.map(canonicalize).join(",") + "]";
+  const keys = Object.keys(v).filter((k) => v[k] !== undefined).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalize(v[k])).join(",") + "}";
+}
+
+export function bytesToHex(buf) {
+  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+export function b64url(buf) {
+  const bytes = new Uint8Array(buf);
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+export function b64urlDecode(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - (s.length % 4));
+  const bin = atob(String(s).replace(/-/g, "+").replace(/_/g, "/") + pad);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+export async function sha256Hex(str, subtle = globalThis.crypto?.subtle) {
+  const data = new TextEncoder().encode(str);
+  return bytesToHex(await subtle.digest("SHA-256", data));
+}
+
+/** Strip the fields that are computed over the body. */
+export function receiptBody(r) {
+  const { hash, sig, ...body } = r || {};
+  void hash; void sig;
+  return body;
+}
+
+export async function hashReceiptBody(body, subtle) {
+  return sha256Hex(canonicalize(body), subtle);
+}
+
+/** Key id = first 16 hex of sha256(canonical public JWK). */
+export async function keyIdFromJwk(jwk, subtle) {
+  const pub = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  return (await sha256Hex(canonicalize(pub), subtle)).slice(0, 16);
+}
+
+export async function generateKeypair(subtle = globalThis.crypto?.subtle) {
+  return subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+}
+
+export function makeSigner(privateKey, subtle = globalThis.crypto?.subtle) {
+  return async (hashHex) => {
+    const sig = await subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, new TextEncoder().encode(hashHex));
+    return b64url(sig);
+  };
+}
+
+export async function makeVerifier(pubJwk, subtle = globalThis.crypto?.subtle) {
+  const key = await subtle.importKey("jwk", { kty: pubJwk.kty, crv: pubJwk.crv, x: pubJwk.x, y: pubJwk.y }, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+  return async (hashHex, sigB64url) => {
+    try {
+      return await subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, b64urlDecode(sigB64url), new TextEncoder().encode(hashHex));
+    } catch {
+      return false;
+    }
+  };
+}
+
+/**
+ * Build the next receipt in a chain.
+ * @param {object} entry   {endpoint, session, actor, action, host, verdict, outcome, categories, detail}
+ * @param {object} chain   {seq, prev}  — state before this receipt
+ * @param {object} keys    {sign(hashHex)→b64url, kid}
+ */
+export async function makeReceipt(entry, chain, keys, subtle = globalThis.crypto?.subtle, now = () => new Date().toISOString()) {
+  const body = {
+    v: RECEIPT_VERSION,
+    seq: (Number(chain?.seq) || 0) + 1,
+    prev: chain?.prev || null,
+    kid: keys.kid,
+    ts: now(),
+    ...sanitizeEntry(entry),
+  };
+  const hash = await hashReceiptBody(body, subtle);
+  const sig = await keys.sign(hash);
+  return { ...body, hash, sig };
+}
+
+// Whitelist the entry fields so a caller can never smuggle prompt text in.
+export function sanitizeEntry(e) {
+  const out = {};
+  const s = (v, n = 200) => (v == null ? null : String(v).slice(0, n));
+  out.endpoint = s(e?.endpoint, 80);
+  out.session = s(e?.session, 64);
+  out.action = s(e?.action, 40);
+  out.host = s(e?.host, 253);
+  if (e?.verdict != null) out.verdict = s(e.verdict, 20);
+  if (e?.outcome != null) out.outcome = s(e.outcome, 20);
+  if (e?.categories && typeof e.categories === "object") {
+    const c = {};
+    for (const [k, v] of Object.entries(e.categories)) {
+      const n = Number(v);
+      if (Number.isFinite(n) && n > 0) c[String(k).toLowerCase().slice(0, 32)] = n;
+    }
+    out.categories = c;
+  }
+  if (e?.actor && typeof e.actor === "object") {
+    out.actor = {
+      kind: s(e.actor.kind, 20),
+      agent: e.actor.agent ? { id: s(e.actor.agent.id, 64), key: s(e.actor.agent.key, 64), label: s(e.actor.agent.label, 80) } : null,
+      confidence: s(e.actor.confidence, 10),
+      evidence: Array.isArray(e.actor.evidence) ? e.actor.evidence.slice(0, 8).map((x) => s(x, 40)) : [],
+    };
+  }
+  if (e?.detail && typeof e.detail === "object") {
+    const d = {};
+    for (const [k, v] of Object.entries(e.detail).slice(0, 12)) {
+      if (typeof v === "number" || typeof v === "boolean") d[s(k, 32)] = v;
+      else if (typeof v === "string") d[s(k, 32)] = v.slice(0, 120);
+    }
+    out.detail = d;
+  }
+  return out;
+}
+
+/**
+ * Verify a chain: recomputed hashes, prev links, monotonic seq, signatures.
+ * `verify(hashHex, sig)` → boolean. Returns {ok, checked, errors:[{seq,reason}]}.
+ */
+export async function verifyReceipts(receipts, verify, subtle = globalThis.crypto?.subtle) {
+  const list = [...(receipts || [])].sort((a, b) => (a.seq || 0) - (b.seq || 0));
+  const errors = [];
+  let prev = null;
+  for (const r of list) {
+    const body = receiptBody(r);
+    const hash = await hashReceiptBody(body, subtle);
+    if (hash !== r.hash) errors.push({ seq: r.seq, reason: "hash_mismatch" });
+    if (prev) {
+      if (r.prev !== prev.hash) errors.push({ seq: r.seq, reason: "broken_link" });
+      if (r.seq !== prev.seq + 1) errors.push({ seq: r.seq, reason: r.seq === prev.seq ? "duplicate_seq" : "gap" });
+    }
+    if (verify) {
+      // Verify over the RECOMPUTED hash: a tampered body with its original
+      // hash/sig pair must fail here too, not only on the hash comparison.
+      const ok = await verify(hash, r.sig);
+      if (!ok) errors.push({ seq: r.seq, reason: "bad_signature" });
+    }
+    prev = r;
+  }
+  return { ok: errors.length === 0, checked: list.length, errors };
+}

package/dist/webmcp-inventory.js

@@ -0,0 +1,64 @@
+// WebMCP inventory — what tools do pages expose to agents, and which get called?
+//
+// Chrome's WebMCP origin trial lets a page register typed tools for agents via
+// navigator.modelContext / document.modelContext .registerTool(). The
+// MAIN-world probe in netguard.js wraps that call and reports registrations
+// and executions to the service worker. This module holds the pure parts:
+// normalizing tool records, deduping per host, and shaping the telemetry.
+
+export function normalizeTool(t) {
+  if (!t || typeof t !== "object") return null;
+  const name = String(t.name || "").slice(0, 80);
+  if (!name) return null;
+  return {
+    name,
+    description: String(t.description || "").slice(0, 200),
+    params: Array.isArray(t.params) ? t.params.map((p) => String(p).slice(0, 40)).slice(0, 20) : [],
+    readOnly: t.readOnly === true,
+  };
+}
+
+/** Merge a registration into a per-host list (by name; newest description wins). */
+export function mergeTools(existing, incoming) {
+  const out = new Map((existing || []).map((t) => [t.name, t]));
+  for (const raw of incoming || []) {
+    const t = normalizeTool(raw);
+    if (t) out.set(t.name, t);
+  }
+  return [...out.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** Stable fingerprint of a tool set, so unchanged inventories are not re-sent. */
+export function toolsFingerprint(tools) {
+  return (tools || []).map((t) => `${t.name}|${t.params.join(",")}|${t.readOnly ? "r" : "w"}`).join(";");
+}
+
+export function toolsEvent(host, tools) {
+  return {
+    message_type: "webmcp_tools",
+    rule_name: "webmcp_tools",
+    verdict: "allow",
+    tool_name: host || null,
+    reason: `${tools.length} WebMCP tool${tools.length === 1 ? "" : "s"} registered`,
+    metadata: { client: "browser-extension", host: host || "", tools, count: tools.length },
+  };
+}
+
+export function toolCallEvent({ host, name, actor, gate, blocked, receipt, session_id }) {
+  return {
+    message_type: "webmcp_call",
+    rule_name: blocked ? "agent_gate_tool_call" : "webmcp_call",
+    verdict: blocked ? "block" : "allow",
+    tool_name: host || null,
+    reason: blocked ? `agent tool call "${name}" denied by policy` : `agent tool call "${name}"`,
+    metadata: {
+      client: "browser-extension",
+      host: host || "",
+      tool: String(name || "").slice(0, 80),
+      ...(actor ? { actor } : {}),
+      ...(gate ? { agent_gate: { action: gate.action, kind: "tool_call" } } : {}),
+      ...(receipt ? { receipt } : {}),
+      ...(session_id ? { session_id } : {}),
+    },
+  };
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@medusasec/sensitive-spans",
+  "version": "0.1.0",
+  "description": "Dependency-free browser-side primitives from the Medusa extension: sensitive-span detection with measured precision guards, actor attribution (human vs. agent), actor-aware policy, pseudonymization, and signed receipt chains.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node build.mjs",
+    "test": "node build.mjs && node --test test.mjs",
+    "prepublishOnly": "node build.mjs && node --test test.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/joshmaster2165/medusa-agent.git",
+    "directory": "packages/sensitive-spans"
+  },
+  "keywords": [
+    "dlp",
+    "pii",
+    "secrets",
+    "prompt-injection",
+    "ai-agents",
+    "browser-agents",
+    "webmcp",
+    "receipts",
+    "attribution"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/joshmaster2165/medusa-agent/tree/main/packages/sensitive-spans",
+  "bugs": {
+    "url": "https://github.com/joshmaster2165/medusa-agent/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}