@nekzus/liop 1.2.0 → 2.0.0-alpha.1

package/dist/server/index.js

@@ -10,8 +10,9 @@ import { zodToJsonSchema } from "zod-to-json-schema";
 import { MeshNode } from "../mesh/node.js";
 import { LiopRpcServer } from "../rpc/server.js";
 import { log } from "../utils/logger.js";
+import { NerScanner } from "./ner-scanner.js";
 import { PII_PATTERNS, PII_PRESETS, PiiScanner } from "./pii.js";
-export { PII_PATTERNS, PII_PRESETS, PiiScanner };
+export { NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner };
 /**
  * When enabled, `payload` tools that are not LIOP v1 envelopes are passed through to the
  * registered handler unchanged (no worker extraction). Default off for strict protocol tests.
@@ -29,6 +30,10 @@ export class LiopServer {
     CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
     THROTTLE_THRESHOLD = 5;
     THROTTLE_COOLDOWN_MS = 60 * 1000; // 60 seconds
+    // [OWASP-A01] Sliding window rate limiter — prevents micro-query exfiltration
+    toolCallWindows = new Map();
+    toolCallMaxPerWindow;
+    toolCallWindowMs;
     tools = new Map();
     resources = new Map();
     prompts = new Map();
@@ -67,8 +72,10 @@ export class LiopServer {
         const compact = logic.replace(/\s+/g, " ");
         if (policy.enforceAggregationFirst) {
             const rowExtractionPatterns = [
-                /return\s+env\.records\b/i,
-                /return\s*\{[\s\S]*\b(accounts|patients|rows|records)\s*:\s*env\.records/i,
+                // Block raw record dumps but allow safe aggregation chains
+                // (.reduce, .length, .filter().length, .every, .some)
+                /return\s+env\.records(?!\s*\.\s*(?:reduce|length|filter|every|some|find)\b)/i,
+                /return\s*\{[\s\S]*\b(accounts|patients|rows|records)\s*:\s*env\.records(?!\s*\.\s*(?:reduce|length|filter)\b)/i,
             ];
             if (rowExtractionPatterns.some((p) => p.test(compact))) {
                 return "Preflight policy rejected: potential row-level export pattern detected.";
@@ -84,15 +91,29 @@ export class LiopServer {
             return null;
         const parsed = this.parseUnknownJson(output);
         if (policy.outputSchema) {
-            const schemaResult = policy.outputSchema.safeParse(parsed);
+            // SEC-HARDENING: Force strict mode on ZodObject schemas to prevent
+            // key aliasing bypasses via .passthrough(). However, respect schemas
+            // that explicitly use .catchall() — calling .strict() would override
+            // the catchall with ZodNever, destroying the developer's intent.
+            const effectiveSchema = (() => {
+                if (!(policy.outputSchema instanceof z.ZodObject)) {
+                    return policy.outputSchema;
+                }
+                const obj = policy.outputSchema;
+                // If schema has an explicit catchall (not ZodNever), respect it
+                if (!(obj._def.catchall instanceof z.ZodNever)) {
+                    return obj;
+                }
+                // Otherwise force strict to block unrecognized keys by default
+                return obj.strict();
+            })();
+            const schemaResult = effectiveSchema.safeParse(parsed);
             if (!schemaResult.success) {
-                // Include a truncated preview of the rejected value so the LLM can self-correct
-                const preview = typeof parsed === "string"
-                    ? parsed.slice(0, 200)
-                    : JSON.stringify(parsed).slice(0, 200);
+                // SEC-CRITICAL: Never expose rejected data in error messages.
+                // Only report the structural violation (unrecognized keys, type mismatches).
                 return `[LIOP] Output schema violation for ${toolName}: ${schemaResult.error.issues
                     .map((i) => `${i.path.join(".") || "<root>"} ${i.message}`)
-                    .join("; ")}. Rejected value: ${preview}. HINT: Use 'env.records' to access the dataset inside your logic.`;
+                    .join("; ")}. HINT: Your output must conform to the declared schema. Use 'env.records' to access the dataset and return only allowed fields.`;
             }
         }
         if (policy.enforceAggregationFirst &&
@@ -143,6 +164,14 @@ export class LiopServer {
         return this.unwrapForAggregationPolicyScan(joined);
     }
     violatesAggregationFirstPolicy(input, policyObj) {
+        const maxRows = typeof policyObj === "object" &&
+            typeof policyObj.maxOutputRows === "number"
+            ? policyObj.maxOutputRows
+            : 10;
+        const allowPrimitives = typeof policyObj === "object" &&
+            typeof policyObj.allowPrimitiveArrays === "boolean"
+            ? policyObj.allowPrimitiveArrays
+            : true;
         if (typeof input === "string") {
             const trimmed = input.trim();
             if ((trimmed.startsWith("{") && trimmed.endsWith("}")) ||
@@ -157,14 +186,6 @@ export class LiopServer {
             return false;
         }
         if (Array.isArray(input)) {
-            const maxRows = typeof policyObj === "object" &&
-                typeof policyObj.maxOutputRows === "number"
-                ? policyObj.maxOutputRows
-                : 10;
-            const allowPrimitives = typeof policyObj === "object" &&
-                typeof policyObj.allowPrimitiveArrays === "boolean"
-                ? policyObj.allowPrimitiveArrays
-                : true;
             if (input.length > 0 &&
                 input.every((item) => typeof item === "object" && item !== null)) {
                 // Treat tabular row export as non-aggregated leakage risk if above threshold.
@@ -182,6 +203,11 @@ export class LiopServer {
             return input.some((item) => this.violatesAggregationFirstPolicy(item, policyObj));
         }
         if (input && typeof input === "object") {
+            const keys = Object.keys(input);
+            // Treat flat dictionary with too many keys as non-aggregated leakage risk (Dynamic Key Bypass).
+            if (keys.length > maxRows) {
+                return true;
+            }
             return Object.values(input).some((value) => this.violatesAggregationFirstPolicy(value, policyObj));
         }
         return false;
@@ -189,6 +215,9 @@ export class LiopServer {
     constructor(serverInfo, config) {
         this.serverInfo = serverInfo;
         this.config = config;
+        const nerScanner = this.config?.security?.enableNerScanning
+            ? new NerScanner()
+            : null;
         this.piiScanner = new PiiScanner(this.config?.security?.piiPatterns ?? PII_PRESETS.GLOBAL_STRICT, this.config?.security?.forbiddenKeys ?? [
             "id",
             "name",
@@ -210,7 +239,15 @@ export class LiopServer {
             "token",
             "secret",
             "privateKey",
-        ]);
+        ], nerScanner);
+        // [OWASP-A01] Rate limit: config > env > default (30 calls/min)
+        const rlConfig = this.config?.security?.rateLimit;
+        this.toolCallWindowMs =
+            rlConfig?.windowMs ??
+                Number.parseInt(process.env.LIOP_RATE_LIMIT_WINDOW_MS ?? "60000", 10);
+        this.toolCallMaxPerWindow =
+            rlConfig?.maxPerWindow ??
+                Number.parseInt(process.env.LIOP_RATE_LIMIT_MAX ?? "30", 10);
         // Initialize Zero-Blocking Worker Pool for Heavy Cryptography & Sandboxing
         const isTS = import.meta.url.endsWith(".ts");
         const workerExt = isTS ? ".ts" : ".js";
@@ -239,6 +276,12 @@ export class LiopServer {
             maxQueue: "auto",
             taskQueue: new FixedQueue(),
             execArgv,
+            // [DoS Defense] Enforce hard memory ceiling per worker thread.
+            // Workers exceeding this limit are terminated by Node.js runtime.
+            resourceLimits: {
+                maxOldGenerationSizeMb: this.config?.workerPool?.maxHeapMb ??
+                    Number.parseInt(process.env.LIOP_WORKER_MAX_HEAP_MB ?? "64", 10),
+            },
         });
         // [Token Economy] Auto-register LIOP protocol spec as a single Resource.
         // This centralizes the envelope documentation that was previously
@@ -568,6 +611,37 @@ Protocol Adherence is mandatory for successful execution.`,
         this.logicCache.clear();
         log.info("[LIOP-SDK] AST Security Cache cleared by Admin.");
     }
+    /**
+     * Sliding window rate limiter for tool call frequency.
+     * Prevents micro-query exfiltration attacks where an attacker
+     * makes hundreds of individually-legitimate calls to reconstruct
+     * the full dataset field by field. (OWASP A01)
+     */
+    checkToolCallRateLimit(toolName) {
+        const now = Date.now();
+        const windowMs = this.toolCallWindowMs;
+        const maxPerWindow = this.toolCallMaxPerWindow;
+        const window = this.toolCallWindows.get(toolName) || [];
+        // Evict expired timestamps outside the sliding window
+        const active = window.filter((t) => now - t < windowMs);
+        if (active.length >= maxPerWindow) {
+            const retryAfterSec = Math.ceil((active[0] + windowMs - now) / 1000);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `LIOP_RATE_LIMITED: Too many calls to ${toolName}. ` +
+                            `Max ${maxPerWindow} per ${windowMs / 1000}s window. ` +
+                            `Retry after ${retryAfterSec}s.`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+        active.push(now);
+        this.toolCallWindows.set(toolName, active);
+        return null;
+    }
     /**
      * Emulates calling a tool (used locally or via LIOPMcpBridge)
      */
@@ -576,6 +650,10 @@ Protocol Adherence is mandatory for successful execution.`,
         if (!entry) {
             throw new Error(`Tool not found: ${request.name}`);
         }
+        // [OWASP-A01] Rate limiting: prevent micro-query exfiltration
+        const rateLimitResult = this.checkToolCallRateLimit(request.name);
+        if (rateLimitResult)
+            return rateLimitResult;
         try {
             // Validate inputs natively with Zod before execution
             const parsedArgs = entry.schema.parse(request.arguments || {});
@@ -813,10 +891,11 @@ Protocol Adherence is mandatory for successful execution.`,
                     ]);
                     const aggregationViolation = this.violatesAggregationFirstPolicy(this.unwrapForAggregationPolicyScan(finalOutput));
                     if (violation || aggregationViolation) {
-                        const reason = violation ||
-                            "Aggregation-First Policy Violation: row-level export blocked. HINT: Use .reduce() to produce a flat {key:value} object. Do NOT use .map() to create arrays of objects.";
-                        log.info(`[LIOP-RPC] Secure egress blocked in gRPC stream: ${reason}`);
-                        response.semantic_evidence = `[LIOP] Egress Security Violation. Output blocked due to policy enforcement (${reason}).`;
+                        // SEC-CRITICAL: Log details server-side, never expose to caller
+                        const internalReason = violation || "Aggregation-First Policy Violation";
+                        log.info(`[LIOP-RPC] Secure egress blocked in gRPC stream: ${internalReason}`);
+                        response.semantic_evidence =
+                            "[LIOP] Egress Security Violation. Output blocked due to policy enforcement.";
                         response.is_error = true;
                     }
                     call.write(response, () => {
@@ -825,10 +904,16 @@ Protocol Adherence is mandatory for successful execution.`,
                 }
                 catch (error) {
                     const e = error;
-                    log.error(`[LIOP-RPC] Execution Error: ${e.message}`);
+                    const isDev = process.env.NODE_ENV === "development" ||
+                        process.env.NODE_ENV === "test";
+                    const detail = e.message || String(error);
+                    log.error(`[LIOP-RPC] Execution Error: ${detail}`);
+                    const errorMessage = isDev
+                        ? `Execution Error: ${detail}`
+                        : "[LIOP] Execution Failed. The injected logic violated runtime constraints or encountered a fatal error.";
                     // Send error response before closing, avoiding "stream closed without results"
                     const errorResponse = {
-                        semantic_evidence: `Execution Error: ${e.message}`,
+                        semantic_evidence: errorMessage,
                         cryptographic_proof: Buffer.from(""),
                         zk_receipt: Buffer.from(""),
                         is_error: true,
@@ -881,9 +966,20 @@ Protocol Adherence is mandatory for successful execution.`,
                 : undefined;
             const policyViolation = this.validateOutputPolicy(toolName || "unknown_tool", workerResponse.output, toolPolicy);
             if (policyViolation) {
+                // SEC-CRITICAL: Log details server-side, never expose to caller in Production
                 log.info(`[LIOP-SDK] Output policy blocked for ${toolName || "unknown_tool"}: ${policyViolation}`);
+                const isDev = process.env.NODE_ENV === "development" ||
+                    process.env.NODE_ENV === "test";
+                const errorMessage = isDev
+                    ? policyViolation
+                    : "[LIOP] Egress Security Violation. Output blocked due to policy enforcement. HINT: Return only aggregated, non-PII results using .reduce() to produce a flat {key:value} object with allowed schema fields.";
                 return {
-                    content: [{ type: "text", text: `[LIOP] ${policyViolation}` }],
+                    content: [
+                        {
+                            type: "text",
+                            text: errorMessage,
+                        },
+                    ],
                     isError: true,
                 };
             }
@@ -891,14 +987,21 @@ Protocol Adherence is mandatory for successful execution.`,
             const violation = this.piiScanner.scan(content);
             const aggregationViolation = this.violatesAggregationFirstPolicy(workerResponse.output);
             if (violation || aggregationViolation) {
-                const reason = violation ||
-                    "Aggregation-First Policy Violation: row-level export blocked. HINT: Use .reduce() to produce a flat {key:value} object. Do NOT use .map() to create arrays of objects.";
-                log.info(`[LIOP-SDK] Secure egress blocked in local execution: ${reason}`);
+                // SEC-CRITICAL: Log the specific violation reason server-side only.
+                // Never expose detection details (entity names, matched values) to the caller in Production.
+                const internalReason = violation ||
+                    "Aggregation-First Policy Violation: Output blocked due to dynamic flat-key policy enforcement.";
+                log.info(`[LIOP-SDK] Secure egress blocked in local execution: ${internalReason}`);
+                const isDev = process.env.NODE_ENV === "development" ||
+                    process.env.NODE_ENV === "test";
+                const errorMessage = isDev
+                    ? `[LIOP] Egress Security Violation: ${internalReason}`
+                    : "[LIOP] Egress Security Violation. Output blocked due to policy enforcement. HINT: Return only aggregated, non-PII results using .reduce() to produce a flat {key:value} object with allowed schema fields.";
                 return {
                     content: [
                         {
                             type: "text",
-                            text: `[LIOP] Egress Security Violation. Output blocked due to policy enforcement (${reason}).`,
+                            text: errorMessage,
                         },
                     ],
                     isError: true,
@@ -908,11 +1011,18 @@ Protocol Adherence is mandatory for successful execution.`,
         }
         catch (error) {
             const e = error;
+            const isDev = process.env.NODE_ENV === "development" ||
+                process.env.NODE_ENV === "test";
+            const detail = e.message || String(error);
+            log.error(`[LIOP-SDK] WorkerPool Execution Fault: ${detail}`);
+            const errorMessage = isDev
+                ? `WorkerPoolError: ${detail}`
+                : "[LIOP] Execution Failed. The injected logic violated runtime constraints or encountered a fatal error.";
             return {
                 content: [
                     {
                         type: "text",
-                        text: `WorkerPoolError: ${e.message || String(error)}`,
+                        text: errorMessage,
                     },
                 ],
                 isError: true,

package/dist/server/ner-scanner.d.ts

@@ -0,0 +1,29 @@
+/** Single named entity detected by the NER scanner. */
+export interface NerEntity {
+    type: "person" | "place" | "organization";
+    text: string;
+}
+/** Result of an NER scan operation. */
+export interface NerScanResult {
+    detected: boolean;
+    entities: NerEntity[];
+}
+/**
+ * Scans text content for named entities that may represent PII.
+ * Uses `compromise/three` for person, place, and organization detection.
+ *
+ * Designed for egress filtering — optimized for recall over precision
+ * to ensure sensitive data does not leak through aliased output keys.
+ */
+export declare class NerScanner {
+    /**
+     * Scans a single string value for named entities.
+     * Returns detected entities if the text contains recognizable PII.
+     */
+    scan(text: string): NerScanResult;
+    /**
+     * Recursively scans all string values within an object/array.
+     * Stops at the first detection for performance (fail-fast).
+     */
+    scanDeep(input: unknown, seen?: WeakSet<object>): NerScanResult;
+}

package/dist/server/ner-scanner.js

@@ -0,0 +1,141 @@
+/**
+ * LIOP NER Content Scanner (The Shield V3 — Named Entity Recognition Layer)
+ *
+ * Lightweight NER scanner using `compromise` NLP for detecting
+ * person names, places, and organizations in free-text output values.
+ *
+ * This layer operates AFTER the regex-based PII scanner and
+ * catches entities that lack a deterministic format pattern
+ * (e.g., "Evelyn Reed" cannot be detected by regex).
+ *
+ * Architecture: opt-in per-server via `enableNerScanning: true`.
+ * Performance: ~10ms for typical SDK output sizes (< 10KB).
+ *
+ * @see https://github.com/spencermountain/compromise
+ */
+import nlp from "compromise/three";
+/**
+ * Medical/pharmaceutical vocabulary safelist.
+ * These terms are tagged as #Medication to prevent the NER
+ * from misclassifying them as person/organization names.
+ * Extends progressively — add terms as false positives arise.
+ */
+const MEDICAL_VOCABULARY = {
+    aspirin: "Medication",
+    lisinopril: "Medication",
+    metformin: "Medication",
+    amlodipine: "Medication",
+    atorvastatin: "Medication",
+    omeprazole: "Medication",
+    losartan: "Medication",
+    simvastatin: "Medication",
+    levothyroxine: "Medication",
+    ibuprofen: "Medication",
+    acetaminophen: "Medication",
+    amoxicillin: "Medication",
+    ciprofloxacin: "Medication",
+    prednisone: "Medication",
+    warfarin: "Medication",
+    insulin: "Medication",
+    hydrochlorothiazide: "Medication",
+    gabapentin: "Medication",
+    albuterol: "Medication",
+    pantoprazole: "Medication",
+    // Generic clinical terms
+    hypertension: "Condition",
+    diabetes: "Condition",
+    bronchitis: "Condition",
+    pneumonia: "Condition",
+    asthma: "Condition",
+};
+// Register medical vocabulary BEFORE any scan operations.
+// compromise's addWords() overrides the default classification,
+// preventing these terms from being tagged as #Person or #Organization.
+nlp.addWords(MEDICAL_VOCABULARY);
+// Minimum string length to attempt NER analysis.
+// Shorter strings are unlikely to contain meaningful named entities.
+const MIN_TEXT_LENGTH = 4;
+// Pattern to identify strings that are purely numeric/symbolic (skip NER)
+const NON_TEXT_PATTERN = /^[\d\s.,:;!?()[\]{}<>@#$%^&*+=|\\/"'`~_-]+$/;
+/**
+ * Scans text content for named entities that may represent PII.
+ * Uses `compromise/three` for person, place, and organization detection.
+ *
+ * Designed for egress filtering — optimized for recall over precision
+ * to ensure sensitive data does not leak through aliased output keys.
+ */
+export class NerScanner {
+    /**
+     * Scans a single string value for named entities.
+     * Returns detected entities if the text contains recognizable PII.
+     */
+    scan(text) {
+        if (text.length < MIN_TEXT_LENGTH || NON_TEXT_PATTERN.test(text)) {
+            return { detected: false, entities: [] };
+        }
+        const doc = nlp(text);
+        const entities = [];
+        const people = doc.people().out("array");
+        for (const person of people) {
+            const trimmed = person.trim();
+            if (trimmed.length >= MIN_TEXT_LENGTH) {
+                entities.push({ type: "person", text: trimmed });
+            }
+        }
+        const places = doc.places().out("array");
+        for (const place of places) {
+            const trimmed = place.trim();
+            if (trimmed.length >= MIN_TEXT_LENGTH) {
+                entities.push({ type: "place", text: trimmed });
+            }
+        }
+        const orgs = doc.organizations().out("array");
+        for (const org of orgs) {
+            const trimmed = org.trim();
+            if (trimmed.length >= MIN_TEXT_LENGTH) {
+                entities.push({ type: "organization", text: trimmed });
+            }
+        }
+        return {
+            detected: entities.length > 0,
+            entities,
+        };
+    }
+    /**
+     * Recursively scans all string values within an object/array.
+     * Stops at the first detection for performance (fail-fast).
+     */
+    scanDeep(input, seen = new WeakSet()) {
+        if (input === null || input === undefined) {
+            return { detected: false, entities: [] };
+        }
+        if (typeof input === "string") {
+            return this.scan(input);
+        }
+        if (typeof input === "object") {
+            if (seen.has(input)) {
+                return { detected: false, entities: [] };
+            }
+            seen.add(input);
+            const values = Array.isArray(input)
+                ? input
+                : Object.values(input);
+            const allEntities = [];
+            for (const value of values) {
+                const result = this.scanDeep(value, seen);
+                if (result.detected) {
+                    allEntities.push(...result.entities);
+                    // Fail-fast: return immediately on first person detection
+                    if (result.entities.some((e) => e.type === "person")) {
+                        return { detected: true, entities: allEntities };
+                    }
+                }
+            }
+            return {
+                detected: allEntities.length > 0,
+                entities: allEntities,
+            };
+        }
+        return { detected: false, entities: [] };
+    }
+}

package/dist/server/pii.d.ts

@@ -30,11 +30,37 @@ export declare const PII_PRESETS: {
 export declare class PiiScanner {
     private patterns;
     private forbiddenKeysSet;
-    constructor(patterns?: PiiRule[], forbiddenKeys?: string[]);
+    private nerScanner;
+    /**
+     * Safelist of keys that contain forbidden substrings but are NOT PII.
+     * Prevents false positives from fuzzy matching (e.g., "grid" contains "id").
+     */
+    private static readonly KEY_SAFELIST;
+    /**
+     * Short forbidden tokens (< 4 chars) that require boundary-aware matching.
+     * Uses regex boundary detection to avoid false positives.
+     */
+    private shortTokenBoundaryPatterns;
+    /**
+     * Long forbidden tokens (>= 4 chars) that use substring containment.
+     */
+    private longForbiddenTokens;
+    constructor(patterns?: PiiRule[], forbiddenKeys?: string[], nerScanner?: import("./ner-scanner.js").NerScanner | null);
     /**
      * Scans any input (string, object, array) for PII violations.
      * Returns the pattern/rule name that triggered the violation, or null if safe.
+     *
+     * Detection pipeline (fail-fast):
+     *   1. Exact key match (O(1) Set lookup)
+     *   2. Fuzzy key match (boundary detection for short tokens, substring for long)
+     *   3. Regex/algorithmic pattern match on string values
+     *   4. NER content scan on string values (if enabled)
      */
     scan(input: unknown, seen?: WeakSet<object>): string | null;
+    /**
+     * Checks a key against fuzzy matching rules.
+     * Short tokens use boundary-aware regex; long tokens use substring containment.
+     */
+    private checkKeyFuzzy;
     private checkString;
 }