@node9/policy-engine 2.13.0 → 2.14.0

package/dist/index.d.mts

@@ -207,6 +207,25 @@ declare function detectDangerousShellExec(command: string): 'block' | 'review' |
 /** @deprecated Use detectDangerousShellExec — kept for backwards compatibility */
 declare const detectDangerousEval: typeof detectDangerousShellExec;
 declare const FS_READ_TOOLS: Set<string>;
+/** How a copy verb's arguments are read. */
+interface CopyShape {
+    /**
+     *  allButLast   cp SRC... DEST         (GNU -t moves DEST into a flag: every slot is a source)
+     *  first        ln TARGET LINK
+     *  all          gzip -c FILE
+     *  archive      tar/zip/ar/7z: the inputs after the archive slot, in a WRITING mode
+     *  flagOperand  the source is a flag's operand: az ... upload -f SRC / --file SRC
+     */
+    source: 'allButLast' | 'first' | 'all' | 'archive' | 'flagOperand';
+    archive?: 'tar' | 'zip' | 'ar' | '7z';
+    /** flagOperand: the flags (short letter or long name) whose operand is the source. */
+    sourceFlags?: string[];
+    /** GNU `-t DIR` / `--target-directory`: the destination is in a flag. */
+    targetDirFlag?: boolean;
+    /** Flags whose operand is NEVER a source: a short LETTER ('i') or a long name ('--exclude'). */
+    skipFlags?: string[];
+}
+declare const COPY_VERBS: Record<string, CopyShape>;
 interface FsOpVerdict {
     ruleName: string;
     verdict: 'block' | 'review';
@@ -217,6 +236,7 @@ interface FsOpVerdict {
 declare const BASH_TOOL_NAMES: Set<string>;
 declare function isBashTool(toolName: string): boolean;
 declare const AST_FS_REGEX_RULES: Set<string>;
+declare const COMMAND_WRAPPERS: Set<string>;
 /**
  * Does `toolName` carry a shell command? True for BASH_TOOL_NAMES spellings and
  * for any tool whose toolInspection field is `command` (e.g. `terminal.execute`).
@@ -235,6 +255,11 @@ declare function isShellShapedTool(toolName: string, toolInspection?: Record<str
  * void them. An absent rule scope matches everything (callers' prior semantics).
  */
 declare function toolMatchesRule(toolName: string, ruleTool: string | string[] | undefined, toolInspection?: Record<string, string>): boolean;
+/** Strip leading wrappers/runners from a resolved arg list, returning the index
+ *  of the real command head. Handles `sudo -u www python3`, `env -u FOO python3`,
+ *  `timeout 5 python3`, `uv run python`, `conda run -n env python`,
+ *  `chroot /mnt python3`. */
+declare function unwrapCommandHead(words: (string | null)[]): number;
 /**
  * AST-aware inline-execution detector. Returns true when the command runs code
  * supplied on the command line, via stdin, or via a pipe into a bare
@@ -247,6 +272,29 @@ declare function detectInlineExec(command: string): boolean;
  * the tool-managed cache allow-list. Used to gate `rm -rf` on home paths.
  */
 declare function isProtectedHomePath(rawPath: string): boolean;
+/**
+ * Extract literal-text positional arguments from a CallExpr. Skips flags
+ * (anything starting with `-`) and ParamExp/CmdSubst (dynamic) parts. Returns
+ * the resolved string for each arg that is purely literal text.
+ */
+/** A resolved, non-flag argument and where it sits. */
+interface PositionedArg {
+    /** The resolved literal. */
+    value: string;
+    /** 0-based SLOT among non-flag words -- `cp SRC DEST`: SRC is 0, DEST is 1. */
+    index: number;
+    /** Absolute index in the resolved word list, for explainability. */
+    argv: number;
+    /** The flag immediately before this word (`ssh -i KEY`: '-i'), else null. */
+    afterFlag: string | null;
+}
+/**
+ * The positioned non-flag words of `words[from..to)`. A dynamic word (null)
+ * occupies no slot AND breaks the flag link -- `-v $SRC KEY` gives KEY no flag,
+ * because something unknowable sat between them. Its `.map(a => a.value)` is
+ * exactly the pre-stage-3 filter, which jail-position.spec.ts pins.
+ */
+declare function positionedArgs(words: (string | null)[], from?: number, to?: number): PositionedArg[];
 interface ShellDestination {
     /** Extracted hostname, lowercased (e.g. "evil.com", "10.0.0.5"). */
     host: string;
@@ -255,6 +303,7 @@ interface ShellDestination {
     /** The raw argument token the host came from (for UI / audit). */
     raw: string;
 }
+declare const NET_BINARIES: Set<string>;
 /**
  * Parse a destination host out of a single token. Handles scheme URLs
  * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
@@ -288,6 +337,12 @@ interface ShellDestToken {
  */
 declare function extractShellDestTokens(command: string): ShellDestToken[];
 declare function analyzeFsOperation(command: string): FsOpVerdict | null;
+/**
+ * One representative command per copy verb, for a gate test that DERIVES its
+ * rows from COPY_VERBS instead of keeping a second hand list (the trap the
+ * prescreen comment above describes). `src` is the path being copied out.
+ */
+declare function sampleCopyCommand(verb: string, src: string): string;
 interface ShellCommandAnalysis {
     /** First word of every CallExpr — the command names invoked. */
     actions: string[];
@@ -1196,7 +1251,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v14";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1207,7 +1262,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+declare const CANONICAL_EXTRACTOR_HASH = "8b5729fe236a195b";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1327,4 +1382,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, positionedArgs, previewArgs, redactText, resolvePinned, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -207,6 +207,25 @@ declare function detectDangerousShellExec(command: string): 'block' | 'review' |
 /** @deprecated Use detectDangerousShellExec — kept for backwards compatibility */
 declare const detectDangerousEval: typeof detectDangerousShellExec;
 declare const FS_READ_TOOLS: Set<string>;
+/** How a copy verb's arguments are read. */
+interface CopyShape {
+    /**
+     *  allButLast   cp SRC... DEST         (GNU -t moves DEST into a flag: every slot is a source)
+     *  first        ln TARGET LINK
+     *  all          gzip -c FILE
+     *  archive      tar/zip/ar/7z: the inputs after the archive slot, in a WRITING mode
+     *  flagOperand  the source is a flag's operand: az ... upload -f SRC / --file SRC
+     */
+    source: 'allButLast' | 'first' | 'all' | 'archive' | 'flagOperand';
+    archive?: 'tar' | 'zip' | 'ar' | '7z';
+    /** flagOperand: the flags (short letter or long name) whose operand is the source. */
+    sourceFlags?: string[];
+    /** GNU `-t DIR` / `--target-directory`: the destination is in a flag. */
+    targetDirFlag?: boolean;
+    /** Flags whose operand is NEVER a source: a short LETTER ('i') or a long name ('--exclude'). */
+    skipFlags?: string[];
+}
+declare const COPY_VERBS: Record<string, CopyShape>;
 interface FsOpVerdict {
     ruleName: string;
     verdict: 'block' | 'review';
@@ -217,6 +236,7 @@ interface FsOpVerdict {
 declare const BASH_TOOL_NAMES: Set<string>;
 declare function isBashTool(toolName: string): boolean;
 declare const AST_FS_REGEX_RULES: Set<string>;
+declare const COMMAND_WRAPPERS: Set<string>;
 /**
  * Does `toolName` carry a shell command? True for BASH_TOOL_NAMES spellings and
  * for any tool whose toolInspection field is `command` (e.g. `terminal.execute`).
@@ -235,6 +255,11 @@ declare function isShellShapedTool(toolName: string, toolInspection?: Record<str
  * void them. An absent rule scope matches everything (callers' prior semantics).
  */
 declare function toolMatchesRule(toolName: string, ruleTool: string | string[] | undefined, toolInspection?: Record<string, string>): boolean;
+/** Strip leading wrappers/runners from a resolved arg list, returning the index
+ *  of the real command head. Handles `sudo -u www python3`, `env -u FOO python3`,
+ *  `timeout 5 python3`, `uv run python`, `conda run -n env python`,
+ *  `chroot /mnt python3`. */
+declare function unwrapCommandHead(words: (string | null)[]): number;
 /**
  * AST-aware inline-execution detector. Returns true when the command runs code
  * supplied on the command line, via stdin, or via a pipe into a bare
@@ -247,6 +272,29 @@ declare function detectInlineExec(command: string): boolean;
  * the tool-managed cache allow-list. Used to gate `rm -rf` on home paths.
  */
 declare function isProtectedHomePath(rawPath: string): boolean;
+/**
+ * Extract literal-text positional arguments from a CallExpr. Skips flags
+ * (anything starting with `-`) and ParamExp/CmdSubst (dynamic) parts. Returns
+ * the resolved string for each arg that is purely literal text.
+ */
+/** A resolved, non-flag argument and where it sits. */
+interface PositionedArg {
+    /** The resolved literal. */
+    value: string;
+    /** 0-based SLOT among non-flag words -- `cp SRC DEST`: SRC is 0, DEST is 1. */
+    index: number;
+    /** Absolute index in the resolved word list, for explainability. */
+    argv: number;
+    /** The flag immediately before this word (`ssh -i KEY`: '-i'), else null. */
+    afterFlag: string | null;
+}
+/**
+ * The positioned non-flag words of `words[from..to)`. A dynamic word (null)
+ * occupies no slot AND breaks the flag link -- `-v $SRC KEY` gives KEY no flag,
+ * because something unknowable sat between them. Its `.map(a => a.value)` is
+ * exactly the pre-stage-3 filter, which jail-position.spec.ts pins.
+ */
+declare function positionedArgs(words: (string | null)[], from?: number, to?: number): PositionedArg[];
 interface ShellDestination {
     /** Extracted hostname, lowercased (e.g. "evil.com", "10.0.0.5"). */
     host: string;
@@ -255,6 +303,7 @@ interface ShellDestination {
     /** The raw argument token the host came from (for UI / audit). */
     raw: string;
 }
+declare const NET_BINARIES: Set<string>;
 /**
  * Parse a destination host out of a single token. Handles scheme URLs
  * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
@@ -288,6 +337,12 @@ interface ShellDestToken {
  */
 declare function extractShellDestTokens(command: string): ShellDestToken[];
 declare function analyzeFsOperation(command: string): FsOpVerdict | null;
+/**
+ * One representative command per copy verb, for a gate test that DERIVES its
+ * rows from COPY_VERBS instead of keeping a second hand list (the trap the
+ * prescreen comment above describes). `src` is the path being copied out.
+ */
+declare function sampleCopyCommand(verb: string, src: string): string;
 interface ShellCommandAnalysis {
     /** First word of every CallExpr — the command names invoked. */
     actions: string[];
@@ -1196,7 +1251,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v14";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1207,7 +1262,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+declare const CANONICAL_EXTRACTOR_HASH = "8b5729fe236a195b";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1327,4 +1382,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, positionedArgs, previewArgs, redactText, resolvePinned, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };