@neurosec/sentry 1.0.0

package/dist/skill-authz/skill-evaluator.js

@@ -0,0 +1,159 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillEvaluator = void 0;
+const os_1 = __importDefault(require("os"));
+const uuid_1 = require("uuid");
+const logger_1 = require("../logger");
+const audit_1 = require("../audit");
+class SkillEvaluator {
+    constructor(config, auditLogger) {
+        this.config = config;
+        this.pendingApprovals = new Map();
+        this.cache = new Map();
+        this.auditLogger = auditLogger ?? new audit_1.AuditLogger(config);
+    }
+    evaluate(request) {
+        const cacheKey = `${request.frameworkId}:${request.skillName}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached && Date.now() - (cached.duration * 1000) < Date.now()) {
+            return cached;
+        }
+        const riskScore = this.computeRiskScore(request);
+        let action;
+        let reason;
+        const needsApproval = this.config.skillAuthz.requireApproval.some(pattern => request.skillName.toLowerCase().includes(pattern.toLowerCase()));
+        if (needsApproval && this.config.enforcement.mode !== 'monitor') {
+            action = 'require_approval';
+            reason = `Skill '${request.skillName}' requires interactive approval`;
+        }
+        else if (riskScore >= 75 && this.config.enforcement.mode === 'enforce') {
+            action = 'deny';
+            reason = `Risk score ${riskScore}/100 exceeds threshold for '${request.skillName}'`;
+        }
+        else if (riskScore >= 50 && this.config.enforcement.mode === 'enforce') {
+            action = 'require_approval';
+            reason = `Risk score ${riskScore}/100 requires approval for '${request.skillName}'`;
+        }
+        else if (!this.config.skillAuthz.allowUnknown && !this.config.skillAuthz.requireApproval.some(p => request.skillName.includes(p))) {
+            action = 'deny';
+            reason = `Skill '${request.skillName}' is not in the allowlist`;
+        }
+        else {
+            action = 'allow';
+            reason = `Skill '${request.skillName}' authorized`;
+        }
+        if (this.config.enforcement.mode === 'monitor') {
+            action = 'allow';
+            reason = `[MONITOR] Would have: ${reason}`;
+        }
+        const decision = {
+            invocationId: request.invocationId,
+            action,
+            reason,
+            duration: 300,
+            redactArgs: riskScore >= 50 ? Object.keys(request.skillArgs) : undefined,
+        };
+        if (action === 'allow') {
+            this.cache.set(cacheKey, decision);
+        }
+        this.auditLogger.log({
+            id: (0, uuid_1.v4)(),
+            timestamp: Date.now(),
+            type: 'skill',
+            action: decision.action,
+            frameworkId: request.frameworkId,
+            frameworkName: request.frameworkId,
+            pid: request.agentPid,
+            reason: decision.reason,
+            detail: {
+                skillName: request.skillName,
+                riskScore,
+                invocationId: request.invocationId,
+            },
+            hostname: os_1.default.hostname(),
+        }).catch(err => {
+            logger_1.logger.error('Skill audit log failed', { err: err.message });
+        });
+        return decision;
+    }
+    approve(invocationId) {
+        const pending = this.pendingApprovals.get(invocationId);
+        if (!pending || pending.resolved || Date.now() > pending.expiresAt) {
+            return false;
+        }
+        pending.resolved = true;
+        pending.decision.action = 'allow';
+        pending.decision.reason = 'Approved by operator';
+        this.pendingApprovals.delete(invocationId);
+        return true;
+    }
+    deny(invocationId) {
+        const pending = this.pendingApprovals.get(invocationId);
+        if (!pending || pending.resolved)
+            return false;
+        pending.resolved = true;
+        pending.decision.action = 'deny';
+        pending.decision.reason = 'Denied by operator';
+        this.pendingApprovals.delete(invocationId);
+        return true;
+    }
+    getPendingApprovals() {
+        const result = [];
+        for (const [id, pending] of this.pendingApprovals) {
+            if (!pending.resolved && Date.now() < pending.expiresAt) {
+                result.push({
+                    invocationId: id,
+                    skillName: pending.request.skillName,
+                    frameworkId: pending.request.frameworkId,
+                });
+            }
+        }
+        return result;
+    }
+    computeRiskScore(request) {
+        let score = 0;
+        const highRiskSkillNames = [
+            /exec/i, /shell/i, /bash/i, /terminal/i, /command/i,
+            /fs_|_fs_|filesystem|read_file|write_file|delete_file|remove_file/i,
+            /db_|_db_|database|query|execute_query/i,
+            /network|http|fetch|curl|wget|request|download/i,
+            /ssh|scp|rsync|sftp/i,
+            /sudo|su|chmod|chown|chattr/i,
+            /run|spawn|fork|exec/i,
+            /admin|root|privileged/i,
+            /eval/i,
+        ];
+        for (const pattern of highRiskSkillNames) {
+            if (pattern.test(request.skillName))
+                score += 20;
+        }
+        const argString = JSON.stringify(request.skillArgs).toLowerCase();
+        const dangerousPatterns = [
+            /rm\s+-rf/i, /mkfs/i, /dd\s+if/i,
+            /:\/\/[\w\.]+@/i,
+            /chmod\s+777/i, /chmod\s+755/i,
+            /\/etc\/(passwd|shadow|sudoers)/i,
+            /\/\.ssh\//i, /\/\.aws\//i, /\/\.config\/gcloud/i,
+            /\/var\/log\/auth/i,
+            /bash\s+-c/i,
+            /curl\s+.*\|/i,
+            /wget\s+.*-O\s*-/i,
+            /python\s+-c/i,
+        ];
+        for (const pattern of dangerousPatterns) {
+            if (pattern.test(argString))
+                score += 15;
+        }
+        const largePayloadThreshold = 100000;
+        const argSize = argString.length;
+        if (argSize > largePayloadThreshold) {
+            score += 10;
+        }
+        return Math.min(score, 100);
+    }
+}
+exports.SkillEvaluator = SkillEvaluator;
+//# sourceMappingURL=skill-evaluator.js.map

package/dist/skill-authz/skill-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-evaluator.js","sourceRoot":"","sources":["../../src/skill-authz/skill-evaluator.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,+BAAoC;AAGpC,sCAAmC;AACnC,oCAAuC;AAUvC,MAAa,cAAc;IAKzB,YACU,MAAoB,EAC5B,WAAyB;QADjB,WAAM,GAAN,MAAM,CAAc;QALtB,qBAAgB,GAAiC,IAAI,GAAG,EAAE,CAAC;QAC3D,UAAK,GAAoC,IAAI,GAAG,EAAE,CAAC;QAOzD,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,mBAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,OAA0B;QACjC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAoC,CAAC;QACzC,IAAI,MAAc,CAAC;QAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;QAEF,IAAI,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,GAAG,kBAAkB,CAAC;YAC5B,MAAM,GAAG,UAAU,OAAO,CAAC,SAAS,iCAAiC,CAAC;QACxE,CAAC;aAAM,IAAI,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,GAAG,MAAM,CAAC;YAChB,MAAM,GAAG,cAAc,SAAS,+BAA+B,OAAO,CAAC,SAAS,GAAG,CAAC;QACtF,CAAC;aAAM,IAAI,SAAS,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,GAAG,kBAAkB,CAAC;YAC5B,MAAM,GAAG,cAAc,SAAS,+BAA+B,OAAO,CAAC,SAAS,GAAG,CAAC;QACtF,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpI,MAAM,GAAG,MAAM,CAAC;YAChB,MAAM,GAAG,UAAU,OAAO,CAAC,SAAS,2BAA2B,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,OAAO,CAAC;YACjB,MAAM,GAAG,UAAU,OAAO,CAAC,SAAS,cAAc,CAAC;QACrD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,GAAG,OAAO,CAAC;YACjB,MAAM,GAAG,yBAAyB,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM;YACN,MAAM;YACN,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC;QAEF,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YACnB,EAAE,EAAE,IAAA,SAAM,GAAE;YACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ,CAAC,MAAa;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,WAAW;YAClC,GAAG,EAAE,OAAO,CAAC,QAAQ;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS;gBACT,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;YACD,QAAQ,EAAE,YAAE,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YACb,eAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,sBAAsB,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAoB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,oBAAoB,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB;QACjB,MAAM,MAAM,GAA4E,EAAE,CAAC;QAC3F,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,EAAE;oBAChB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;oBACpC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,OAA0B;QACjD,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,MAAM,kBAAkB,GAAG;YACzB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU;YACnD,mEAAmE;YACnE,wCAAwC;YACxC,gDAAgD;YAChD,qBAAqB;YACrB,6BAA6B;YAC7B,sBAAsB;YACtB,wBAAwB;YACxB,OAAO;SACR,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,iBAAiB,GAAG;YACxB,WAAW,EAAE,OAAO,EAAE,UAAU;YAChC,gBAAgB;YAChB,cAAc,EAAE,cAAc;YAC9B,iCAAiC;YACjC,YAAY,EAAE,YAAY,EAAE,qBAAqB;YACjD,mBAAmB;YACnB,YAAY;YACZ,cAAc;YACd,kBAAkB;YAClB,cAAc;SACf,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,KAAK,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,qBAAqB,GAAG,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC;QACjC,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACpC,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;CACF;AAtKD,wCAsKC"}

package/dist/skill-authz/skill-scanner.d.ts

@@ -0,0 +1,18 @@
+import { TaggedProcess } from '../types';
+import { SentryConfig } from '../config';
+interface DetectedSkill {
+    frameworkId: string;
+    frameworkName: string;
+    pid: number;
+    skills: SkillDefinition[];
+}
+interface SkillDefinition {
+    name: string;
+    source: string;
+    sourceType: 'mcp' | 'openai_function' | 'langchain_tool' | 'manifest' | 'inferred';
+    args?: Record<string, unknown>;
+    invocationCount: number;
+}
+export declare function scanSkills(config: SentryConfig, taggedProcesses: TaggedProcess[]): Promise<DetectedSkill[]>;
+export {};
+//# sourceMappingURL=skill-scanner.d.ts.map

package/dist/skill-authz/skill-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scanner.d.ts","sourceRoot":"","sources":["../../src/skill-authz/skill-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAiBjH"}

package/dist/skill-authz/skill-scanner.js

@@ -0,0 +1,169 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanSkills = scanSkills;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const logger_1 = require("../logger");
+async function scanSkills(config, taggedProcesses) {
+    const results = [];
+    for (const proc of taggedProcesses) {
+        const skills = await detectSkillsForProcess(proc, config);
+        if (skills.length > 0) {
+            results.push({
+                frameworkId: proc.frameworkId,
+                frameworkName: proc.frameworkName,
+                pid: proc.pid,
+                skills,
+            });
+        }
+    }
+    logger_1.logger.info('Skill scan complete', { processesWithSkills: results.length });
+    return results;
+}
+async function detectSkillsForProcess(proc, config) {
+    const skills = [];
+    // 1. Scan env vars for skill/tool definitions
+    try {
+        const envContent = await promises_1.default.readFile(`/proc/${proc.pid}/environ`, 'utf8');
+        const envVars = envContent.split('\u0000').filter(Boolean);
+        for (const envVar of envVars) {
+            const [key, value] = envVar.split('=');
+            if (!key || !value)
+                continue;
+            if (/MCP_SERVER/i.test(key)) {
+                skills.push({
+                    name: `mcp:${value.slice(0, 80)}`,
+                    source: 'env',
+                    sourceType: 'mcp',
+                    invocationCount: 0,
+                });
+            }
+            if (/TOOL|SKILL|FUNCTION/i.test(key) && /openai|anthropic|langchain/i.test(value)) {
+                skills.push({
+                    name: key,
+                    source: value.slice(0, 120),
+                    sourceType: 'inferred',
+                    invocationCount: 0,
+                });
+            }
+        }
+    }
+    catch {
+        // /proc not available
+    }
+    // 2. Scan manifests
+    for (const sourcePath of config.discovery.sourcePaths) {
+        try {
+            const mcpConfigPath = path_1.default.join(sourcePath, 'mcp.json');
+            const content = await promises_1.default.readFile(mcpConfigPath, 'utf8').catch(() => null);
+            if (content) {
+                try {
+                    const parsed = JSON.parse(content);
+                    const servers = parsed.mcpServers;
+                    if (servers && typeof servers === 'object') {
+                        for (const [serverName] of Object.entries(servers)) {
+                            skills.push({
+                                name: serverName,
+                                source: mcpConfigPath,
+                                sourceType: 'mcp',
+                                invocationCount: 0,
+                            });
+                        }
+                    }
+                    const tools = parsed.tools;
+                    if (Array.isArray(tools)) {
+                        for (const tool of tools) {
+                            if (tool && typeof tool === 'object') {
+                                skills.push({
+                                    name: String(tool.name ?? ''),
+                                    source: mcpConfigPath,
+                                    sourceType: 'mcp',
+                                    args: tool.parameters,
+                                    invocationCount: 0,
+                                });
+                            }
+                        }
+                    }
+                }
+                catch {
+                    // Parse error
+                }
+            }
+            const claudeConfigPath = path_1.default.join(sourcePath, 'claude_desktop_config.json');
+            const claudeContent = await promises_1.default.readFile(claudeConfigPath, 'utf8').catch(() => null);
+            if (claudeContent) {
+                try {
+                    const parsed = JSON.parse(claudeContent);
+                    const servers = parsed.mcpServers;
+                    if (servers && typeof servers === 'object') {
+                        for (const [serverName] of Object.entries(servers)) {
+                            skills.push({
+                                name: serverName,
+                                source: claudeConfigPath,
+                                sourceType: 'mcp',
+                                invocationCount: 0,
+                            });
+                        }
+                    }
+                }
+                catch {
+                    // Parse error
+                }
+            }
+            // Check agents.yaml (CrewAI etc.)
+            const agentsPath = path_1.default.join(sourcePath, 'agents.yaml');
+            await promises_1.default.access(agentsPath).then(async () => {
+                const content = await promises_1.default.readFile(agentsPath, 'utf8');
+                const toolMatch = content.match(/tools:\s*\n(\s+- \w[^\n]*\n?)+/g);
+                if (toolMatch) {
+                    for (const block of toolMatch) {
+                        const toolNames = block.match(/-\s+(\w+)/g);
+                        if (toolNames) {
+                            for (const t of toolNames) {
+                                skills.push({
+                                    name: t.replace(/^-\s+/, ''),
+                                    source: agentsPath,
+                                    sourceType: 'manifest',
+                                    invocationCount: 0,
+                                });
+                            }
+                        }
+                    }
+                }
+            }).catch(() => { });
+        }
+        catch {
+            // Path not accessible
+        }
+    }
+    // 3. Check process cmdline for tool-related patterns
+    try {
+        const cmdline = await promises_1.default.readFile(`/proc/${proc.pid}/cmdline`, 'utf8');
+        const cmd = cmdline.replace(/\u0000/g, ' ');
+        const toolIndicators = [
+            { pattern: /--tool\s+(\w+)/gi, type: 'langchain_tool' },
+            { pattern: /--function\s+(\w+)/gi, type: 'openai_function' },
+            { pattern: /--mcp-server\s+(\S+)/gi, type: 'mcp' },
+        ];
+        for (const { pattern, type } of toolIndicators) {
+            let match;
+            const re = new RegExp(pattern.source, 'gi');
+            while ((match = re.exec(cmd)) !== null) {
+                skills.push({
+                    name: match[1],
+                    source: cmd.slice(0, 100),
+                    sourceType: type,
+                    invocationCount: 0,
+                });
+            }
+        }
+    }
+    catch {
+        // /proc not available
+    }
+    return skills;
+}
+//# sourceMappingURL=skill-scanner.js.map

package/dist/skill-authz/skill-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scanner.js","sourceRoot":"","sources":["../../src/skill-authz/skill-scanner.ts"],"names":[],"mappings":";;;;;AAqBA,gCAiBC;AAtCD,2DAA6B;AAC7B,gDAAwB;AAGxB,sCAAmC;AAiB5B,KAAK,UAAU,UAAU,CAAC,MAAoB,EAAE,eAAgC;IACrF,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAmB,EAAE,MAAoB;IAC7E,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,SAAS;YAE7B,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;oBACjC,MAAM,EAAE,KAAK;oBACb,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC3B,UAAU,EAAE,UAAU;oBACtB,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;oBAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;oBAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3C,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;4BAC9E,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,UAAU;gCAChB,MAAM,EAAE,aAAa;gCACrB,UAAU,EAAE,KAAK;gCACjB,eAAe,EAAE,CAAC;6BACnB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;4BACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gCACrC,MAAM,CAAC,IAAI,CAAC;oCACV,IAAI,EAAE,MAAM,CAAE,IAAgC,CAAC,IAAI,IAAI,EAAE,CAAC;oCAC1D,MAAM,EAAE,aAAa;oCACrB,UAAU,EAAE,KAAK;oCACjB,IAAI,EAAG,IAAgC,CAAC,UAAiD;oCACzF,eAAe,EAAE,CAAC;iCACnB,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;YACH,CAAC;YAED,MAAM,gBAAgB,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;YAC7E,MAAM,aAAa,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACpF,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAA4B,CAAC;oBACpE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;oBAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC3C,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;4BAC9E,MAAM,CAAC,IAAI,CAAC;gCACV,IAAI,EAAE,UAAU;gCAChB,MAAM,EAAE,gBAAgB;gCACxB,UAAU,EAAE,KAAK;gCACjB,eAAe,EAAE,CAAC;6BACnB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACxD,MAAM,kBAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC1C,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACnE,IAAI,SAAS,EAAE,CAAC;oBACd,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;wBAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;wBAC5C,IAAI,SAAS,EAAE,CAAC;4BACd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gCAC1B,MAAM,CAAC,IAAI,CAAC;oCACV,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oCAC5B,MAAM,EAAE,UAAU;oCAClB,UAAU,EAAE,UAAU;oCACtB,eAAe,EAAE,CAAC;iCACnB,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5C,MAAM,cAAc,GAAG;YACrB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAyB,EAAE;YAChE,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAA0B,EAAE;YACrE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,KAAc,EAAE;SAC5D,CAAC;QAEF,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,cAAc,EAAE,CAAC;YAC/C,IAAI,KAA6B,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACzB,UAAU,EAAE,IAAI;oBAChB,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,18 @@
+import { SentryConfig } from './config';
+import { TaggedProcess, EnforcementDecision, SentryStatus } from './types';
+export declare class TelemetryReporter {
+    private config;
+    private getStatus;
+    private getTaggedProcesses;
+    private getRecentDecisions;
+    private getPolicyVersion;
+    private heartbeatTimer;
+    private lastSyncAt;
+    constructor(config: SentryConfig, getStatus: () => SentryStatus, getTaggedProcesses: () => TaggedProcess[], getRecentDecisions: () => EnforcementDecision[], getPolicyVersion: () => string);
+    start(): void;
+    stop(): void;
+    getLastSyncAt(): string | null;
+    private sendHeartbeat;
+    private apiRequest;
+}
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAoB3E,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,gBAAgB;IAR1B,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAAuB;gBAG/B,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,YAAY,EAC7B,kBAAkB,EAAE,MAAM,aAAa,EAAE,EACzC,kBAAkB,EAAE,MAAM,mBAAmB,EAAE,EAC/C,gBAAgB,EAAE,MAAM,MAAM;IAGxC,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAOZ,aAAa,IAAI,MAAM,GAAG,IAAI;YAIhB,aAAa;YAmCb,UAAU;CAuCzB"}

package/dist/telemetry.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelemetryReporter = void 0;
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const logger_1 = require("./logger");
+class TelemetryReporter {
+    constructor(config, getStatus, getTaggedProcesses, getRecentDecisions, getPolicyVersion) {
+        this.config = config;
+        this.getStatus = getStatus;
+        this.getTaggedProcesses = getTaggedProcesses;
+        this.getRecentDecisions = getRecentDecisions;
+        this.getPolicyVersion = getPolicyVersion;
+        this.heartbeatTimer = null;
+        this.lastSyncAt = null;
+    }
+    start() {
+        this.sendHeartbeat().catch(() => { });
+        this.heartbeatTimer = setInterval(() => this.sendHeartbeat().catch(err => logger_1.logger.warn('Telemetry heartbeat failed', { err: err.message })), this.config.neurosec.heartbeatIntervalMs);
+        logger_1.logger.info('Telemetry reporter started', { intervalMs: this.config.neurosec.heartbeatIntervalMs });
+    }
+    stop() {
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = null;
+        }
+    }
+    getLastSyncAt() {
+        return this.lastSyncAt;
+    }
+    async sendHeartbeat() {
+        if (!this.config.neurosec.endpoint)
+            return;
+        const status = this.getStatus();
+        const processes = this.getTaggedProcesses();
+        const decisions = this.getRecentDecisions();
+        const payload = {
+            hostId: this.config.sentry.hostId,
+            orgId: this.config.neurosec.orgId,
+            timestamp: Date.now(),
+            status,
+            processes: processes.map(p => ({
+                pid: p.pid,
+                frameworkId: p.frameworkId,
+                frameworkName: p.frameworkName,
+                sandboxed: p.sandboxed,
+                profileName: p.sandboxProfileName,
+                confidence: p.confidence,
+            })),
+            recentDecisions: decisions.slice(-20),
+            policyVersion: this.getPolicyVersion(),
+        };
+        try {
+            await this.apiRequest('POST', '/api/v1/sentry/heartbeat', payload);
+            this.lastSyncAt = new Date().toISOString();
+            logger_1.logger.debug('Telemetry sent', { processes: payload.processes.length });
+        }
+        catch (err) {
+            logger_1.logger.warn('Telemetry send failed (NeuroSec may be unreachable)', {
+                err: err.message,
+            });
+        }
+    }
+    async apiRequest(method, path, body) {
+        return new Promise((resolve, reject) => {
+            const url = new URL(path, this.config.neurosec.endpoint);
+            const isHttps = url.protocol === 'https:';
+            const lib = isHttps ? https_1.default : http_1.default;
+            const bodyStr = JSON.stringify(body);
+            const options = {
+                hostname: url.hostname,
+                port: url.port || (isHttps ? 443 : 80),
+                path: url.pathname,
+                method,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(bodyStr).toString(),
+                    'X-Sentry-Host-Id': this.config.sentry.hostId,
+                    'X-Sentry-Org-Id': this.config.neurosec.orgId,
+                },
+                timeout: 10000,
+            };
+            const req = lib.request(options, res => {
+                let data = '';
+                res.on('data', chunk => { data += chunk; });
+                res.on('end', () => {
+                    try {
+                        resolve(JSON.parse(data));
+                    }
+                    catch {
+                        resolve(data);
+                    }
+                });
+            });
+            req.on('error', reject);
+            req.on('timeout', () => { req.destroy(); reject(new Error('Request timed out')); });
+            req.write(bodyStr);
+            req.end();
+        });
+    }
+}
+exports.TelemetryReporter = TelemetryReporter;
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AACxB,kDAA0B;AAG1B,qCAAkC;AAmBlC,MAAa,iBAAiB;IAI5B,YACU,MAAoB,EACpB,SAA6B,EAC7B,kBAAyC,EACzC,kBAA+C,EAC/C,gBAA8B;QAJ9B,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAoB;QAC7B,uBAAkB,GAAlB,kBAAkB,CAAuB;QACzC,uBAAkB,GAAlB,kBAAkB,CAA6B;QAC/C,qBAAgB,GAAhB,gBAAgB,CAAc;QARhC,mBAAc,GAA0C,IAAI,CAAC;QAC7D,eAAU,GAAkB,IAAI,CAAC;IAQtC,CAAC;IAEJ,KAAK;QACH,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,WAAW,CAC/B,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,EACnH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CACzC,CAAC;QACF,eAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE5C,MAAM,OAAO,GAAqB;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;YACjC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,WAAW,EAAE,CAAC,CAAC,kBAAkB;gBACjC,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;YACH,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;SACvC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,eAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACjE,GAAG,EAAG,GAAa,CAAC,OAAO;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;QAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,eAAK,CAAC,CAAC,CAAC,cAAI,CAAC;YAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,OAAO,GAAwB;gBACnC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;oBACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;oBAC7C,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK;iBAC9C;gBACD,OAAO,EAAE,KAAK;aACf,CAAC;YAEF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACrC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC5B,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA1GD,8CA0GC"}

package/dist/types.d.ts

@@ -0,0 +1,127 @@
+export type EnforcementMode = 'monitor' | 'enforce' | 'quarantine';
+export type Platform = 'linux' | 'darwin' | 'unknown';
+export interface TaggedProcess {
+    pid: number;
+    ppid: number;
+    frameworkId: string;
+    frameworkName: string;
+    command: string;
+    exePath: string;
+    confidence: number;
+    envKeys: string[];
+    discoveredAt: number;
+    sandboxed: boolean;
+    sandboxProfileName: string | null;
+    uid: number;
+    gid: number;
+}
+export interface SandboxProfile {
+    name: string;
+    frameworkIds: string[];
+    allowedSyscalls: string[];
+    blockedSyscalls: string[];
+    fsRules: FsRule[];
+    networkRules: NetworkRule[];
+    retainedCapabilities: string[];
+    cpuMax: string;
+    memoryMax: string;
+    pidMax: number;
+    blockedCapabilities: string[];
+}
+export interface FsRule {
+    path: string;
+    permissions: 'r' | 'w' | 'rw' | 'rx' | 'rwx' | 'none';
+}
+export interface NetworkRule {
+    direction: 'egress' | 'ingress';
+    host?: string;
+    port?: number;
+    cidr?: string;
+    action: 'allow' | 'deny';
+}
+export interface SkillRule {
+    id: string;
+    frameworkId: string;
+    skillName: string;
+    action: 'allow' | 'deny' | 'require_approval';
+    riskThreshold?: number;
+    argumentPatterns?: string[];
+}
+export interface SkillAuthzRequest {
+    agentPid: number;
+    frameworkId: string;
+    skillName: string;
+    skillArgs: Record<string, unknown>;
+    invocationId: string;
+    timestamp: number;
+}
+export interface SkillAuthzDecision {
+    invocationId: string;
+    action: 'allow' | 'deny' | 'require_approval';
+    reason: string;
+    duration: number;
+    redactArgs?: string[];
+}
+export interface FileAccessEvent {
+    pid: number;
+    processPath: string;
+    targetPath: string;
+    operation: 'read' | 'write' | 'execute' | 'delete' | 'chmod';
+    frameworkId: string | null;
+    decision: 'allow' | 'deny';
+    timestamp: number;
+}
+export interface NetworkEvent {
+    pid: number;
+    direction: 'egress' | 'ingress';
+    destIp: string;
+    destPort: number;
+    hostname: string | null;
+    frameworkId: string | null;
+    decision: 'allow' | 'deny';
+    timestamp: number;
+}
+export interface SyscallEvent {
+    pid: number;
+    syscall: string;
+    details: Record<string, string | number | undefined>;
+    frameworkId: string | null;
+    decision: 'allow' | 'deny' | 'alert';
+    timestamp: number;
+}
+export interface EnforcementDecision {
+    id: string;
+    type: 'file_access' | 'network' | 'syscall' | 'skill' | 'process';
+    action: 'allow' | 'deny' | 'quarantine';
+    reason: string;
+    frameworkId: string | null;
+    pid: number;
+    detail: Record<string, unknown>;
+    timestamp: number;
+}
+export interface AuditEntry {
+    id: string;
+    timestamp: number;
+    type: EnforcementDecision['type'];
+    action: EnforcementDecision['action'];
+    frameworkId: string | null;
+    frameworkName: string | null;
+    pid: number;
+    reason: string;
+    detail: Record<string, unknown>;
+    hostname: string;
+}
+export interface SentryStatus {
+    version: string;
+    uptime: number;
+    mode: EnforcementMode;
+    policyVersion: string;
+    taggedProcesses: number;
+    sandboxedProcesses: number;
+    decisionsTotal: number;
+    decisionsDenied: number;
+    lastSyncAt: string | null;
+    platform: Platform;
+}
+export declare const AGENT_SANDBOX_PROFILES: SandboxProfile[];
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;AAEnE,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,kBAAkB,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAClE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB,EAAE,cAAc,EA4MlD,CAAC"}