@panguard-ai/panguard-guard 1.7.2 → 1.7.3

package/dist/dashboard/dashboard.html

@@ -1521,9 +1521,9 @@
                 <div class="welcome-step-h">Join collective defense</div>
                 <div class="welcome-step-b">
                   Optionally let the attacks Guard blocks here help draft new open rules for everyone —
-                  and get the community's new rules back sooner. Shares only a rule ID and a one-way
-                  hash; <strong>never your prompts, code, files, keys, IP, or hostname</strong>. Off
-                  until you turn it on.
+                  and get the community's new rules back sooner. Shares only the matched rule ID(s),
+                  attack category, a coarse region, and a truncated IP; <strong>never your prompts,
+                  code, files, secrets, paths, or hostname</strong>. Off until you turn it on.
                 </div>
                 <button type="button" class="btn btn-secondary btn-sm" data-goto="tcloud">
                   Open Threat Cloud &rarr;
@@ -2104,9 +2104,9 @@
               <div class="cd-box">
                 <div class="cd-box-title">What is shared (and what is never shared)</div>
                 <ul class="cd-list">
-                  <li>Shared: the matched rule ID, a one-way hash of the payload, and the source type.</li>
-                  <li>Never shared: your prompts, code, file contents, keys, IP address, or hostname.</li>
-                  <li>A random install ID only — raw samples never leave this machine.</li>
+                  <li>Shared: the matched rule ID(s), attack category + MITRE technique, a coarse country region, and a truncated IP (last two octets zeroed).</li>
+                  <li>Never shared: your prompts, code, file contents, secrets, file paths, hostname, or username.</li>
+                  <li>A stable random install ID links your own submissions (pseudonymous) — raw samples never leave this machine.</li>
                 </ul>
               </div>
             </div>
@@ -3790,10 +3790,10 @@
         if (!isOn) {
           var ok = window.confirm(
             'Turn on collective defense?\n\n' +
-              'When Guard blocks an attack on this machine, it will share an anonymized signature ' +
-              '(the matched rule ID + a one-way hash of the payload + the source type) with the ATR ' +
-              'network.\n\nNever shared: your prompts, code, file contents, keys, IP address, or ' +
-              'hostname.\n\nYou can turn this off anytime.'
+              'When Guard blocks an attack on this machine, it will share a minimal signature ' +
+              '(the matched rule ID + attack category + a coarse region + a truncated IP) with the ATR ' +
+              'network.\n\nNever shared: your prompts, code, file contents, secrets, file paths, ' +
+              'hostname, or username.\n\nYou can turn this off anytime.'
           );
           if (!ok) return;
         }

package/dist/threat-cloud/seal.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Sealed Threat-Cloud contributions — endpoint upload encryption (P1).
+ *
+ * Encrypts an outbound contribution to PanGuard's ingest PUBLIC key so ONLY the
+ * ingest private-key holder (kept in KMS, never in the client) can read it — not
+ * PanGuard's relay, not a TLS-termination middlebox, not a self-hosted relay
+ * operator who lacks the key. This is end-to-end / client-side encryption on TOP
+ * of TLS, closing the gap that the upload was previously plaintext-to-our-server.
+ *
+ * Construction: JWE (RFC 7516) with ECDH-ES key agreement over X25519 (RFC 8037)
+ * + A256GCM content encryption — a standard, audited primitive available via the
+ * already-bundled `jose` dependency (no new crypto dependency, no homemade crypto).
+ * ECDH-ES derives the content key from a FRESH ephemeral key per message, so the
+ * envelope carries NO sender identity (anonymous sender) — supporting the
+ * unlinkable-by-default goal.
+ *
+ * Trust root = the ingest keypair. The PUBLIC half is bundled + pinned here (safe
+ * to ship in the open-source client). The PRIVATE half lives in KMS and is NEVER
+ * present in the client, so a client provably cannot decrypt its own contribution
+ * — a property a customer can verify (see `pga tc --show-sample-upload`).
+ *
+ * @module @panguard-ai/panguard-guard/threat-cloud/seal
+ */
+import { type JWK } from 'jose';
+export interface IngestKey {
+    /** Key id carried in the JWE header so the server selects the matching private key. */
+    readonly kid: string;
+    /** X25519 public key (OKP/X25519 JWK). Public — safe to bundle. NEVER a private key. */
+    readonly publicJwk: JWK;
+    /** Rotation window (ISO 8601). A key is active when notBefore <= now < notAfter. */
+    readonly notBefore: string;
+    readonly notAfter: string;
+}
+export interface SealedEnvelope {
+    readonly v: 1;
+    readonly alg: 'ECDH-ES+A256GCM';
+    readonly kid: string;
+    /** Compact JWE — decryptable only by the ingest private key (in KMS). */
+    readonly jwe: string;
+}
+/**
+ * Bundled + pinned ingest public keys. POPULATE from the KMS-provisioned public key
+ * before enabling sealed upload wiring (P1b). Multiple entries allow flag-day-free
+ * rotation: publish the next key's validity window ahead of cutover so old + new
+ * clients both seal to a key the server can still open during the overlap.
+ *
+ * SECURITY: only X25519 PUBLIC keys belong here. A private key must NEVER appear in
+ * this file or anywhere in the open-source client.
+ */
+export declare const INGEST_KEYS: readonly IngestKey[];
+/**
+ * Pick the ingest key valid at `now` (newest eligible wins, so a freshly-rotated
+ * key is preferred during an overlap window). Returns null if none configured/valid.
+ */
+export declare function activeIngestKey(now?: Date, keys?: readonly IngestKey[]): IngestKey | null;
+/** Seal a payload to a specific ingest public key. Exported for tests + explicit use. */
+export declare function sealToIngestKey(payload: unknown, key: IngestKey): Promise<SealedEnvelope>;
+/**
+ * Seal a payload to the currently-active bundled ingest key. Returns null when NO
+ * ingest key is configured/valid. Callers MUST treat null as "do not upload" — never
+ * fall back to plaintext — so a key misconfiguration can never leak cleartext.
+ */
+export declare function sealForIngest(payload: unknown, now?: Date): Promise<SealedEnvelope | null>;
+/** True when a usable ingest key is bundled, so the upload path can require sealing. */
+export declare function sealingAvailable(now?: Date): boolean;
+//# sourceMappingURL=seal.d.ts.map

package/dist/threat-cloud/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/threat-cloud/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAA6B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3D,MAAM,WAAW,SAAS;IACxB,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAQ3C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,IAAiB,EACtB,IAAI,GAAE,SAAS,SAAS,EAAgB,GACvC,SAAS,GAAG,IAAI,CAKlB;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAM/F;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAEhE"}

package/dist/threat-cloud/seal.js

@@ -0,0 +1,77 @@
+/**
+ * Sealed Threat-Cloud contributions — endpoint upload encryption (P1).
+ *
+ * Encrypts an outbound contribution to PanGuard's ingest PUBLIC key so ONLY the
+ * ingest private-key holder (kept in KMS, never in the client) can read it — not
+ * PanGuard's relay, not a TLS-termination middlebox, not a self-hosted relay
+ * operator who lacks the key. This is end-to-end / client-side encryption on TOP
+ * of TLS, closing the gap that the upload was previously plaintext-to-our-server.
+ *
+ * Construction: JWE (RFC 7516) with ECDH-ES key agreement over X25519 (RFC 8037)
+ * + A256GCM content encryption — a standard, audited primitive available via the
+ * already-bundled `jose` dependency (no new crypto dependency, no homemade crypto).
+ * ECDH-ES derives the content key from a FRESH ephemeral key per message, so the
+ * envelope carries NO sender identity (anonymous sender) — supporting the
+ * unlinkable-by-default goal.
+ *
+ * Trust root = the ingest keypair. The PUBLIC half is bundled + pinned here (safe
+ * to ship in the open-source client). The PRIVATE half lives in KMS and is NEVER
+ * present in the client, so a client provably cannot decrypt its own contribution
+ * — a property a customer can verify (see `pga tc --show-sample-upload`).
+ *
+ * @module @panguard-ai/panguard-guard/threat-cloud/seal
+ */
+import { CompactEncrypt, importJWK } from 'jose';
+/**
+ * Bundled + pinned ingest public keys. POPULATE from the KMS-provisioned public key
+ * before enabling sealed upload wiring (P1b). Multiple entries allow flag-day-free
+ * rotation: publish the next key's validity window ahead of cutover so old + new
+ * clients both seal to a key the server can still open during the overlap.
+ *
+ * SECURITY: only X25519 PUBLIC keys belong here. A private key must NEVER appear in
+ * this file or anywhere in the open-source client.
+ */
+export const INGEST_KEYS = [
+// Example (replace `x` with the real KMS-provisioned public key, then ship):
+// {
+//   kid: 'ingest-2026-07',
+//   publicJwk: { kty: 'OKP', crv: 'X25519', x: '<base64url-public>' },
+//   notBefore: '2026-07-01T00:00:00Z',
+//   notAfter: '2027-07-01T00:00:00Z',
+// },
+];
+/**
+ * Pick the ingest key valid at `now` (newest eligible wins, so a freshly-rotated
+ * key is preferred during an overlap window). Returns null if none configured/valid.
+ */
+export function activeIngestKey(now = new Date(), keys = INGEST_KEYS) {
+    const t = now.getTime();
+    const eligible = keys.filter((k) => Date.parse(k.notBefore) <= t && t < Date.parse(k.notAfter));
+    if (eligible.length === 0)
+        return null;
+    return eligible.reduce((a, b) => (Date.parse(b.notBefore) > Date.parse(a.notBefore) ? b : a));
+}
+/** Seal a payload to a specific ingest public key. Exported for tests + explicit use. */
+export async function sealToIngestKey(payload, key) {
+    const pub = await importJWK(key.publicJwk, 'ECDH-ES');
+    const jwe = await new CompactEncrypt(new TextEncoder().encode(JSON.stringify(payload)))
+        .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM', kid: key.kid })
+        .encrypt(pub);
+    return { v: 1, alg: 'ECDH-ES+A256GCM', kid: key.kid, jwe };
+}
+/**
+ * Seal a payload to the currently-active bundled ingest key. Returns null when NO
+ * ingest key is configured/valid. Callers MUST treat null as "do not upload" — never
+ * fall back to plaintext — so a key misconfiguration can never leak cleartext.
+ */
+export async function sealForIngest(payload, now = new Date()) {
+    const key = activeIngestKey(now);
+    if (!key)
+        return null;
+    return sealToIngestKey(payload, key);
+}
+/** True when a usable ingest key is bundled, so the upload path can require sealing. */
+export function sealingAvailable(now = new Date()) {
+    return activeIngestKey(now) !== null;
+}
+//# sourceMappingURL=seal.js.map

package/dist/threat-cloud/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/threat-cloud/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAoB3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAyB;AAC/C,6EAA6E;AAC7E,IAAI;AACJ,2BAA2B;AAC3B,uEAAuE;AACvE,uCAAuC;AACvC,sCAAsC;AACtC,KAAK;CACN,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAY,IAAI,IAAI,EAAE,EACtB,OAA6B,WAAW;IAExC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAc;IACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;SACpF,kBAAkB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SACpE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,MAAY,IAAI,IAAI,EAAE;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panguard-ai/panguard-guard",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -42,13 +42,13 @@
     "js-yaml": "^4.1.0",
     "ws": "^8.21.0",
     "zod": "^3.24.0",
-    "@panguard-ai/atr": "1.7.2",
-    "@panguard-ai/panguard-mcp": "1.7.2",
-    "@panguard-ai/core": "1.7.2",
-    "@panguard-ai/scan-core": "1.7.2",
-    "@panguard-ai/panguard-skill-auditor": "1.7.2",
-    "@panguard-ai/panguard-trap": "1.7.2",
-    "@panguard-ai/security-hardening": "1.7.2"
+    "@panguard-ai/atr": "1.7.3",
+    "@panguard-ai/panguard-skill-auditor": "1.7.3",
+    "@panguard-ai/panguard-mcp": "1.7.3",
+    "@panguard-ai/panguard-trap": "1.7.3",
+    "@panguard-ai/security-hardening": "1.7.3",
+    "@panguard-ai/scan-core": "1.7.3",
+    "@panguard-ai/core": "1.7.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",