@node9/policy-engine 2.16.1 → 2.17.0

package/dist/index.d.mts

@@ -402,6 +402,15 @@ interface ShellCommandAnalysis {
  */
 declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
 
+/**
+ * A destination a tool call will reach, whichever carrier declared it: a
+ * shell command (extractShellDestinations) or a tool argument
+ * (extractToolDestinations). The interface is still spelled ShellDestination
+ * where it lives (shell/index.ts, which is hashed by the extractor-version
+ * gate, so a rename there is not free); this is the name that says what the
+ * shape is for.
+ */
+type Destination = ShellDestination;
 interface EgressPolicy {
     /** Master switch. Default false — opt-in, like dlp.pii. */
     enabled: boolean;
@@ -431,7 +440,25 @@ interface EgressVerdict {
 declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
 /** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
 declare function hostMatches(host: string, pattern: string): boolean;
-/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+/**
+ * "Private" for the allowPrivate opt-in: loopback, RFC1918 and its IPv6
+ * analogue, the unspecified address, and the conventional local suffixes.
+ *
+ * The address half is classifySsrf's answer, so every spelling that file
+ * normalizes (brackets, zone id, IPv4-mapped IPv6) is one spelling here too.
+ * The old body had its own IPv4-only regexes and returned false for `[::1]`,
+ * which BLOCKED a local IPv6 dev server under allowPrivate (measured
+ * 2026-09-20; the shell extractor keeps the brackets, the declared-URL
+ * extractor strips them, and this function knew neither). Two parsers for
+ * one question is how that happens.
+ *
+ * NOT private here: link-local, multicast, the metadata endpoints. Those are
+ * the SSRF floor's tiers and allowPrivate must not be able to reach them;
+ * evaluateEgress documents that the floor runs first, and this function
+ * agrees with it rather than relying on it. CGNAT (100.64/10) is also out:
+ * a mesh-VPN peer is not everyone's private network, which is why the floor
+ * gave it its own tier; a Tailscale user lists the range in `allow`.
+ */
 declare function isPrivateHost(host: string): boolean;
 /**
  * Evaluate extracted destinations against the egress policy. Precedence per
@@ -441,7 +468,7 @@ declare function isPrivateHost(host: string): boolean;
  * first review; null if everything is allowed (or policy disabled / mode off).
  * Pure.
  */
-declare function evaluateEgress(dests: readonly ShellDestination[], policy: EgressPolicy): EgressVerdict | null;
+declare function evaluateEgress(dests: readonly Destination[], policy: EgressPolicy): EgressVerdict | null;
 
 interface PipeChainAnalysis {
     isPipeline: boolean;
@@ -610,16 +637,6 @@ declare function resolvePinned(matches: SmartRule[]): SmartRule | undefined;
  * Returns a reason string if dangerous, null if safe.
  */
 declare function checkDangerousSql(sql: string): string | null;
-/**
- * Stateless policy evaluation. Same waterfall as the original
- * proxy/src/policy/index.ts:evaluatePolicy, but config + context + I/O
- * hooks come in as parameters so this function works in any host.
- *
- * Returns 'allow' for ignored tools, the matched smart-rule verdict,
- * inline-execution review, eval-detection verdict, pipe-chain verdict,
- * provenance verdict, sandbox allow, dangerous-word review, or strict-mode
- * fallback. See the design doc for the full tier table.
- */
 declare function evaluatePolicy(config: PolicyConfig, toolName: string, args?: unknown, context?: PolicyContext, hooks?: PolicyHostHooks): Promise<PolicyVerdict>;
 /** Returns true when toolName matches the config's ignoredTools list. */
 declare function isIgnoredTool(toolName: string, config: PolicyConfig): boolean;
@@ -1446,6 +1463,25 @@ declare function ssrfFloor(tokens: ReadonlyArray<{
  * `[]` in a path means "every element of this array".
  */
 declare const DESTINATION_ARGS: ReadonlyMap<string, readonly string[]>;
+/**
+ * The hosts a non-shell tool call will reach, in the SAME shape the shell
+ * extractor produces, so both feed one evaluateEgress (G10).
+ *
+ * Measured 2026-09-20 on dev e748b4a, egress { mode: 'block', allow: [] }:
+ * `curl https://evil.example.com/` denied, the same URL through WebFetch, MCP
+ * fetch and browser navigate allowed. The allowlist was shell-only, and an
+ * agent that wants to exfiltrate does not need curl. The extraction below is
+ * what the floor above already does; the policy was never applied to it.
+ *
+ * Same closed table, same helpers, for the same reason: a tool is covered
+ * because it is LISTED, never because an argument looked like a URL. A tool
+ * not in DESTINATION_ARGS yields [] and is invisible to the egress policy,
+ * exactly as it is invisible to the floor. `binary` carries the tool name so
+ * the reason string and the audit row say which carrier it was.
+ *
+ * Never throws: this runs on the hook path for every tool call.
+ */
+declare function extractToolDestinations(toolName: string, args: unknown): Destination[];
 interface DestinationHit extends SsrfMatch {
     /** The path that carried it, for the message and the audit row. */
     argPath: string;
@@ -1465,4 +1501,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type Destination, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, extractToolDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -402,6 +402,15 @@ interface ShellCommandAnalysis {
  */
 declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
 
+/**
+ * A destination a tool call will reach, whichever carrier declared it: a
+ * shell command (extractShellDestinations) or a tool argument
+ * (extractToolDestinations). The interface is still spelled ShellDestination
+ * where it lives (shell/index.ts, which is hashed by the extractor-version
+ * gate, so a rename there is not free); this is the name that says what the
+ * shape is for.
+ */
+type Destination = ShellDestination;
 interface EgressPolicy {
     /** Master switch. Default false — opt-in, like dlp.pii. */
     enabled: boolean;
@@ -431,7 +440,25 @@ interface EgressVerdict {
 declare const DEFAULT_EGRESS_ALLOWLIST: readonly string[];
 /** Glob host match: "*" = any, "*.x" = apex x + any subdomain, else exact. */
 declare function hostMatches(host: string, pattern: string): boolean;
-/** localhost / loopback / RFC1918 / link-local-ish — never a real exfil target. */
+/**
+ * "Private" for the allowPrivate opt-in: loopback, RFC1918 and its IPv6
+ * analogue, the unspecified address, and the conventional local suffixes.
+ *
+ * The address half is classifySsrf's answer, so every spelling that file
+ * normalizes (brackets, zone id, IPv4-mapped IPv6) is one spelling here too.
+ * The old body had its own IPv4-only regexes and returned false for `[::1]`,
+ * which BLOCKED a local IPv6 dev server under allowPrivate (measured
+ * 2026-09-20; the shell extractor keeps the brackets, the declared-URL
+ * extractor strips them, and this function knew neither). Two parsers for
+ * one question is how that happens.
+ *
+ * NOT private here: link-local, multicast, the metadata endpoints. Those are
+ * the SSRF floor's tiers and allowPrivate must not be able to reach them;
+ * evaluateEgress documents that the floor runs first, and this function
+ * agrees with it rather than relying on it. CGNAT (100.64/10) is also out:
+ * a mesh-VPN peer is not everyone's private network, which is why the floor
+ * gave it its own tier; a Tailscale user lists the range in `allow`.
+ */
 declare function isPrivateHost(host: string): boolean;
 /**
  * Evaluate extracted destinations against the egress policy. Precedence per
@@ -441,7 +468,7 @@ declare function isPrivateHost(host: string): boolean;
  * first review; null if everything is allowed (or policy disabled / mode off).
  * Pure.
  */
-declare function evaluateEgress(dests: readonly ShellDestination[], policy: EgressPolicy): EgressVerdict | null;
+declare function evaluateEgress(dests: readonly Destination[], policy: EgressPolicy): EgressVerdict | null;
 
 interface PipeChainAnalysis {
     isPipeline: boolean;
@@ -610,16 +637,6 @@ declare function resolvePinned(matches: SmartRule[]): SmartRule | undefined;
  * Returns a reason string if dangerous, null if safe.
  */
 declare function checkDangerousSql(sql: string): string | null;
-/**
- * Stateless policy evaluation. Same waterfall as the original
- * proxy/src/policy/index.ts:evaluatePolicy, but config + context + I/O
- * hooks come in as parameters so this function works in any host.
- *
- * Returns 'allow' for ignored tools, the matched smart-rule verdict,
- * inline-execution review, eval-detection verdict, pipe-chain verdict,
- * provenance verdict, sandbox allow, dangerous-word review, or strict-mode
- * fallback. See the design doc for the full tier table.
- */
 declare function evaluatePolicy(config: PolicyConfig, toolName: string, args?: unknown, context?: PolicyContext, hooks?: PolicyHostHooks): Promise<PolicyVerdict>;
 /** Returns true when toolName matches the config's ignoredTools list. */
 declare function isIgnoredTool(toolName: string, config: PolicyConfig): boolean;
@@ -1446,6 +1463,25 @@ declare function ssrfFloor(tokens: ReadonlyArray<{
  * `[]` in a path means "every element of this array".
  */
 declare const DESTINATION_ARGS: ReadonlyMap<string, readonly string[]>;
+/**
+ * The hosts a non-shell tool call will reach, in the SAME shape the shell
+ * extractor produces, so both feed one evaluateEgress (G10).
+ *
+ * Measured 2026-09-20 on dev e748b4a, egress { mode: 'block', allow: [] }:
+ * `curl https://evil.example.com/` denied, the same URL through WebFetch, MCP
+ * fetch and browser navigate allowed. The allowlist was shell-only, and an
+ * agent that wants to exfiltrate does not need curl. The extraction below is
+ * what the floor above already does; the policy was never applied to it.
+ *
+ * Same closed table, same helpers, for the same reason: a tool is covered
+ * because it is LISTED, never because an argument looked like a URL. A tool
+ * not in DESTINATION_ARGS yields [] and is invisible to the egress policy,
+ * exactly as it is invisible to the floor. `binary` carries the tool name so
+ * the reason string and the audit row say which carrier it was.
+ *
+ * Never throws: this runs on the hook path for every tool call.
+ */
+declare function extractToolDestinations(toolName: string, args: unknown): Destination[];
 interface DestinationHit extends SsrfMatch {
     /** The path that carried it, for the message and the audit row. */
     argPath: string;
@@ -1465,4 +1501,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COPY_VERBS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type Destination, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, MAX_BLAST_PATH, NET_BINARIES, PATTERN_VERB_NAMES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type PositionedArg, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, extractToolDestinations, fileOperandFlagsOf, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, patternShapeOf, positionedArgs, previewArgs, redactText, resolvePinned, safeMessage, sampleCopyCommand, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, stripControlChars, stripTerminalEscapes, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };