@yadsh/dsh-prompt-firewall 0.2.1 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/compatibility.json +3 -9
- package/lib/audit.js +20 -18
- package/lib/audit.js.map +1 -1
- package/lib/client/index.js +23 -17
- package/lib/client/index.js.map +1 -1
- package/lib/client/sections.js +115 -34
- package/lib/client/sections.js.map +1 -1
- package/lib/client/styles.js +1 -1
- package/lib/client/styles.js.map +1 -1
- package/lib/client.js +2 -2
- package/lib/client.js.map +1 -1
- package/lib/config.js +26 -20
- package/lib/config.js.map +1 -1
- package/lib/firewall.js +34 -27
- package/lib/firewall.js.map +1 -1
- package/lib/index.js +42 -38
- package/lib/index.js.map +1 -1
- package/lib/metrics.js +5 -5
- package/lib/metrics.js.map +1 -1
- package/lib/presets.js +9 -9
- package/lib/presets.js.map +1 -1
- package/lib/rules.js +36 -35
- package/lib/rules.js.map +1 -1
- package/lib/typert.host.js +9 -9
- package/lib/typert.remote-client.js +2 -2
- package/lib/types/audit.d.ts +1 -1
- package/lib/types/client/index.d.ts +1 -1
- package/lib/types/client/sections.d.ts +2 -2
- package/lib/types/config.d.ts +2 -2
- package/lib/types/firewall.d.ts +4 -4
- package/lib/types/index.d.ts +12 -12
- package/lib/types/metrics.d.ts +7 -7
- package/lib/types/presets.d.ts +1 -1
- package/lib/types/rules.d.ts +1 -1
- package/lib/types/types.d.ts +7 -7
- package/package.json +5 -3
package/lib/config.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import z from
|
|
2
|
-
import { getPreset } from
|
|
1
|
+
import z from "@deepseek-ai/schemastery";
|
|
2
|
+
import { getPreset } from "./presets.js";
|
|
3
3
|
export const DEFAULT_AUDIT_CONFIG = Object.freeze({
|
|
4
4
|
enabled: true,
|
|
5
5
|
logAllowed: false,
|
|
@@ -14,7 +14,7 @@ export const DEFAULT_METRICS_CONFIG = Object.freeze({
|
|
|
14
14
|
});
|
|
15
15
|
export const DEFAULT_CONFIG = Object.freeze({
|
|
16
16
|
enabled: true,
|
|
17
|
-
mode:
|
|
17
|
+
mode: "blocklist",
|
|
18
18
|
blockedSections: Object.freeze([]),
|
|
19
19
|
allowedSections: Object.freeze([]),
|
|
20
20
|
blockedPrefixes: Object.freeze([]),
|
|
@@ -23,7 +23,7 @@ export const DEFAULT_CONFIG = Object.freeze({
|
|
|
23
23
|
allowedPatterns: Object.freeze([]),
|
|
24
24
|
protectedSections: Object.freeze([]),
|
|
25
25
|
protectCoreSections: true,
|
|
26
|
-
unknownPluginPolicy:
|
|
26
|
+
unknownPluginPolicy: "allow",
|
|
27
27
|
audit: DEFAULT_AUDIT_CONFIG,
|
|
28
28
|
metrics: DEFAULT_METRICS_CONFIG,
|
|
29
29
|
});
|
|
@@ -34,8 +34,8 @@ export const ConfigSchema = z.object({
|
|
|
34
34
|
enabled: z.boolean().default(true),
|
|
35
35
|
// Keep preset-owned fields absent until resolveConfig(). Applying schema
|
|
36
36
|
// defaults here would make `preset: strict` look explicitly overridden.
|
|
37
|
-
mode: z.union([
|
|
38
|
-
preset: z.union([
|
|
37
|
+
mode: z.union(["off", "audit", "blocklist", "allowlist"]),
|
|
38
|
+
preset: z.union(["clean", "strict", "audit-only"]),
|
|
39
39
|
blockedSections: stringList.default([]),
|
|
40
40
|
allowedSections: stringList.default([]),
|
|
41
41
|
blockedPrefixes: stringList.default([]),
|
|
@@ -44,8 +44,9 @@ export const ConfigSchema = z.object({
|
|
|
44
44
|
allowedPatterns: stringList.default([]),
|
|
45
45
|
protectedSections: stringList.default([]),
|
|
46
46
|
protectCoreSections: z.boolean().default(true),
|
|
47
|
-
unknownPluginPolicy: z.union([
|
|
48
|
-
audit: z
|
|
47
|
+
unknownPluginPolicy: z.union(["allow", "block"]),
|
|
48
|
+
audit: z
|
|
49
|
+
.object({
|
|
49
50
|
enabled: z.boolean().default(true),
|
|
50
51
|
logAllowed: z.boolean().default(false),
|
|
51
52
|
logBlocked: z.boolean().default(true),
|
|
@@ -53,15 +54,18 @@ export const ConfigSchema = z.object({
|
|
|
53
54
|
previewChars: z.number().step(1).min(0).default(160),
|
|
54
55
|
historySize: z.number().step(1).min(0).default(100),
|
|
55
56
|
highlightNewSections: z.boolean().default(true),
|
|
56
|
-
})
|
|
57
|
-
|
|
57
|
+
})
|
|
58
|
+
.default(DEFAULT_AUDIT_CONFIG),
|
|
59
|
+
metrics: z
|
|
60
|
+
.object({
|
|
58
61
|
enabled: z.boolean().default(true),
|
|
59
|
-
})
|
|
62
|
+
})
|
|
63
|
+
.default(DEFAULT_METRICS_CONFIG),
|
|
60
64
|
});
|
|
61
65
|
function mergeList(preset, configured) {
|
|
62
66
|
const result = [...new Set([...(preset ?? []), ...(configured ?? [])])];
|
|
63
|
-
if (result.some(value => value.length === 0)) {
|
|
64
|
-
throw new TypeError(
|
|
67
|
+
if (result.some((value) => value.length === 0)) {
|
|
68
|
+
throw new TypeError("firewall rules must not contain empty strings");
|
|
65
69
|
}
|
|
66
70
|
return Object.freeze(result);
|
|
67
71
|
}
|
|
@@ -70,7 +74,9 @@ export function resolveConfig(config = {}) {
|
|
|
70
74
|
const resolved = {
|
|
71
75
|
enabled: config.enabled ?? DEFAULT_CONFIG.enabled,
|
|
72
76
|
mode: (config.mode ?? preset.mode ?? DEFAULT_CONFIG.mode),
|
|
73
|
-
...(config.preset === undefined
|
|
77
|
+
...(config.preset === undefined
|
|
78
|
+
? {}
|
|
79
|
+
: { preset: config.preset }),
|
|
74
80
|
blockedSections: mergeList(preset.blockedSections, config.blockedSections),
|
|
75
81
|
allowedSections: mergeList(preset.allowedSections, config.allowedSections),
|
|
76
82
|
blockedPrefixes: mergeList(preset.blockedPrefixes, config.blockedPrefixes),
|
|
@@ -78,12 +84,12 @@ export function resolveConfig(config = {}) {
|
|
|
78
84
|
blockedPatterns: mergeList(preset.blockedPatterns, config.blockedPatterns),
|
|
79
85
|
allowedPatterns: mergeList(preset.allowedPatterns, config.allowedPatterns),
|
|
80
86
|
protectedSections: mergeList(preset.protectedSections, config.protectedSections),
|
|
81
|
-
protectCoreSections: config.protectCoreSections
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
unknownPluginPolicy: (config.unknownPluginPolicy
|
|
85
|
-
|
|
86
|
-
|
|
87
|
+
protectCoreSections: config.protectCoreSections ??
|
|
88
|
+
preset.protectCoreSections ??
|
|
89
|
+
DEFAULT_CONFIG.protectCoreSections,
|
|
90
|
+
unknownPluginPolicy: (config.unknownPluginPolicy ??
|
|
91
|
+
preset.unknownPluginPolicy ??
|
|
92
|
+
DEFAULT_CONFIG.unknownPluginPolicy),
|
|
87
93
|
audit: Object.freeze({
|
|
88
94
|
...DEFAULT_AUDIT_CONFIG,
|
|
89
95
|
...preset.audit,
|
package/lib/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,0BAA0B,
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,MAAM,CAAC,MAAM,oBAAoB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACvE,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,KAAK;IACjB,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,KAAK;IACrB,YAAY,EAAE,GAAG;IACjB,WAAW,EAAE,GAAG;IAChB,oBAAoB,EAAE,IAAI;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAiC,MAAM,CAAC,MAAM,CAAC;IACxE,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,WAAW;IACjB,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACpC,mBAAmB,EAAE,IAAI;IACzB,mBAAmB,EAAE,OAAO;IAC5B,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,sBAAsB;CAChC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACzC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAE3C,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAA4B,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;IAC3D,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,iBAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;IACzD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChD,CAAC;SACD,OAAO,CAAC,oBAAmC,CAAC;IAC/C,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC;SACD,OAAO,CAAC,sBAAuC,CAAC;CACpD,CAAC,CAAC;AAEH,SAAS,SAAS,CAChB,MAAqC,EACrC,UAAyC;IAEzC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAM,GAAyB,EAAE;IAEjC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO;QACjD,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAiB;QACzE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAwB,EAAE,CAAC;QAChD,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC;QAC1E,iBAAiB,EAAE,SAAS,CAC1B,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,iBAAiB,CACzB;QACD,mBAAmB,EACjB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,mBAAmB;YAC1B,cAAc,CAAC,mBAAmB;QACpC,mBAAmB,EAAE,CAAC,MAAM,CAAC,mBAAmB;YAC9C,MAAM,CAAC,mBAAmB;YAC1B,cAAc,CAAC,mBAAmB,CAAwB;QAC5D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,oBAAoB;YACvB,GAAG,MAAM,CAAC,KAAK;YACf,GAAG,MAAM,CAAC,KAAK;SAChB,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,sBAAsB;YACzB,GAAG,MAAM,CAAC,OAAO;YACjB,GAAG,MAAM,CAAC,OAAO;SAClB,CAAC;KACoC,CAAC;IAEzC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC"}
|
package/lib/firewall.js
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
|
-
import { AuditStore, createAuditResult } from
|
|
2
|
-
import { compileRules, evaluateSection } from
|
|
1
|
+
import { AuditStore, createAuditResult } from "./audit.js";
|
|
2
|
+
import { compileRules, evaluateSection } from "./rules.js";
|
|
3
3
|
function errorMessage(error) {
|
|
4
4
|
return error instanceof Error ? error.message : String(error);
|
|
5
5
|
}
|
|
6
6
|
function validateAssembly(assembly) {
|
|
7
7
|
if (!Array.isArray(assembly.sections))
|
|
8
|
-
throw new TypeError(
|
|
8
|
+
throw new TypeError("prompt assembly sections must be an array");
|
|
9
9
|
for (const section of assembly.sections) {
|
|
10
|
-
if (typeof section.name !==
|
|
11
|
-
throw new TypeError(
|
|
10
|
+
if (typeof section.name !== "string" || section.name.length === 0) {
|
|
11
|
+
throw new TypeError("prompt section name must be a non-empty string");
|
|
12
12
|
}
|
|
13
|
-
if (typeof section.text !==
|
|
13
|
+
if (typeof section.text !== "string") {
|
|
14
14
|
throw new TypeError(`prompt section "${section.name}" text must be a string`);
|
|
15
15
|
}
|
|
16
16
|
}
|
|
@@ -26,23 +26,27 @@ function logAudit(audit, config, logger) {
|
|
|
26
26
|
// Observability failures must not affect prompt policy.
|
|
27
27
|
}
|
|
28
28
|
};
|
|
29
|
-
safeLog(
|
|
30
|
-
|
|
29
|
+
safeLog("info", `[prompt-firewall] assembled prompt: ${audit.totalSections} sections, ` +
|
|
30
|
+
`${audit.charsBefore} chars, ~${audit.estimatedTokensBefore} estimated tokens`);
|
|
31
31
|
for (const section of audit.sections) {
|
|
32
|
-
if (section.decision ===
|
|
33
|
-
safeLog(
|
|
34
|
-
|
|
35
|
-
|
|
32
|
+
if (section.decision === "blocked" && config.audit.logBlocked) {
|
|
33
|
+
safeLog("warn", `[prompt-firewall] BLOCK ${section.name}: ${section.reason}, ` +
|
|
34
|
+
`${section.chars} chars, ~${section.estimatedTokens} estimated tokens` +
|
|
35
|
+
(section.preview === undefined
|
|
36
|
+
? ""
|
|
37
|
+
: `, preview=${JSON.stringify(section.preview)}`));
|
|
36
38
|
}
|
|
37
|
-
else if (section.decision !==
|
|
38
|
-
safeLog(
|
|
39
|
-
|
|
40
|
-
|
|
39
|
+
else if (section.decision !== "blocked" && config.audit.logAllowed) {
|
|
40
|
+
safeLog("info", `[prompt-firewall] ${section.decision.toUpperCase()} ${section.name}: ${section.reason}, ` +
|
|
41
|
+
`${section.chars} chars, ~${section.estimatedTokens} estimated tokens` +
|
|
42
|
+
(section.preview === undefined
|
|
43
|
+
? ""
|
|
44
|
+
: `, preview=${JSON.stringify(section.preview)}`));
|
|
41
45
|
}
|
|
42
46
|
}
|
|
43
47
|
if (audit.blockedSections > 0) {
|
|
44
|
-
safeLog(
|
|
45
|
-
|
|
48
|
+
safeLog("info", `[prompt-firewall] result: removed ${audit.blockedSections} sections, ` +
|
|
49
|
+
`${audit.charsRemoved} chars, ~${audit.estimatedTokensRemoved} estimated tokens`);
|
|
46
50
|
}
|
|
47
51
|
}
|
|
48
52
|
/**
|
|
@@ -54,25 +58,28 @@ export function applyFirewall(assembly, options) {
|
|
|
54
58
|
validateAssembly(assembly);
|
|
55
59
|
const { config } = options;
|
|
56
60
|
const rules = options.evaluate === undefined ? compileRules(config) : undefined;
|
|
57
|
-
const evaluator = options.evaluate ?? (section => evaluateSection(section, rules));
|
|
61
|
+
const evaluator = options.evaluate ?? ((section) => evaluateSection(section, rules));
|
|
58
62
|
const sections = assembly.sections;
|
|
59
|
-
const complete = sections.some(section => section.complete === true);
|
|
60
|
-
const decisions = sections.map(section =>
|
|
61
|
-
? { action:
|
|
62
|
-
: evaluator(section))
|
|
63
|
-
const audit = createAuditResult(sections, decisions, config.audit, complete ?
|
|
63
|
+
const complete = sections.some((section) => section.complete === true);
|
|
64
|
+
const decisions = sections.map((section) => complete
|
|
65
|
+
? { action: "allow", reason: "complete-prompt-bypass" }
|
|
66
|
+
: evaluator(section));
|
|
67
|
+
const audit = createAuditResult(sections, decisions, config.audit, complete ? "complete prompt detected" : undefined);
|
|
64
68
|
if (config.audit.enabled)
|
|
65
69
|
options.auditStore?.record(audit);
|
|
66
70
|
if (config.metrics.enabled)
|
|
67
71
|
options.metrics?.record(audit);
|
|
68
72
|
logAudit(audit, config, options.logger);
|
|
69
|
-
if (!config.enabled ||
|
|
73
|
+
if (!config.enabled ||
|
|
74
|
+
config.mode === "off" ||
|
|
75
|
+
config.mode === "audit" ||
|
|
76
|
+
complete)
|
|
70
77
|
return assembly;
|
|
71
|
-
if (!decisions.some(decision => decision.action ===
|
|
78
|
+
if (!decisions.some((decision) => decision.action === "block"))
|
|
72
79
|
return assembly;
|
|
73
80
|
return {
|
|
74
81
|
...assembly,
|
|
75
|
-
sections: assembly.sections.filter((_, index) => decisions[index]?.action !==
|
|
82
|
+
sections: assembly.sections.filter((_, index) => decisions[index]?.action !== "block"),
|
|
76
83
|
};
|
|
77
84
|
}
|
|
78
85
|
catch (error) {
|
package/lib/firewall.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../src/firewall.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,
|
|
1
|
+
{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../src/firewall.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAmB3D,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,SAAS,CACjB,mBAAmB,OAAO,CAAC,IAAI,yBAAyB,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,KAA2C,EAC3C,MAAoC,EACpC,MAAkC;IAElC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO;IAC1D,MAAM,OAAO,GAAG,CAAC,KAAsB,EAAE,OAAe,EAAQ,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CACL,MAAM,EACN,uCAAuC,KAAK,CAAC,aAAa,aAAa;QACrE,GAAG,KAAK,CAAC,WAAW,YAAY,KAAK,CAAC,qBAAqB,mBAAmB,CACjF,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,CACL,MAAM,EACN,2BAA2B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI;gBAC5D,GAAG,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,mBAAmB;gBACtE,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CACtD,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACrE,OAAO,CACL,MAAM,EACN,qBAAqB,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI;gBACxF,GAAG,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,eAAe,mBAAmB;gBACtE,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CACL,MAAM,EACN,qCAAqC,KAAK,CAAC,eAAe,aAAa;YACrE,GAAG,KAAK,CAAC,YAAY,YAAY,KAAK,CAAC,sBAAsB,mBAAmB,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAwB,EACxB,OAA6B;IAE7B,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,SAAS,GACb,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,KAAM,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA6B,CAAC;QAExD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,QAAQ;YACN,CAAC,CAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAY;YAClE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CACvB,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,CAC7B,QAAQ,EACR,SAAS,EACT,MAAM,CAAC,KAAK,EACZ,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAClD,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAExC,IACE,CAAC,MAAM,CAAC,OAAO;YACf,MAAM,CAAC,IAAI,KAAK,KAAK;YACrB,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,QAAQ;YAER,OAAO,QAAQ,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC;YAC5D,OAAO,QAAQ,CAAC;QAElB,OAAO;YACL,GAAG,QAAQ;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CACnD;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,KAAK,CACnB,+DAA+D,YAAY,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
|
package/lib/index.js
CHANGED
|
@@ -32,25 +32,25 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
|
|
|
32
32
|
if (target) Object.defineProperty(target, contextIn.name, descriptor);
|
|
33
33
|
done = true;
|
|
34
34
|
};
|
|
35
|
-
import { Context } from
|
|
36
|
-
import { Remote, TypertRemoteService } from
|
|
37
|
-
import { createHostLoggerSink, getPluginLogger, } from
|
|
38
|
-
import { AuditStore } from
|
|
39
|
-
import { ConfigSchema, resolveConfig } from
|
|
40
|
-
import { applyFirewall } from
|
|
41
|
-
import { FirewallMetrics } from
|
|
42
|
-
import { compileRules, evaluateSection } from
|
|
43
|
-
export * from
|
|
44
|
-
export * from
|
|
45
|
-
export * from
|
|
46
|
-
export * from
|
|
47
|
-
export * from
|
|
48
|
-
export * from
|
|
49
|
-
export * from
|
|
35
|
+
import { Context } from "@deepseek-ai/cordis";
|
|
36
|
+
import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
|
|
37
|
+
import { createHostLoggerSink, getPluginLogger, } from "@yadsh/dsh-plugin-log";
|
|
38
|
+
import { AuditStore } from "./audit.js";
|
|
39
|
+
import { ConfigSchema, resolveConfig } from "./config.js";
|
|
40
|
+
import { applyFirewall } from "./firewall.js";
|
|
41
|
+
import { FirewallMetrics } from "./metrics.js";
|
|
42
|
+
import { compileRules, evaluateSection } from "./rules.js";
|
|
43
|
+
export * from "./audit.js";
|
|
44
|
+
export * from "./config.js";
|
|
45
|
+
export * from "./firewall.js";
|
|
46
|
+
export * from "./metrics.js";
|
|
47
|
+
export * from "./presets.js";
|
|
48
|
+
export * from "./rules.js";
|
|
49
|
+
export * from "./types.js";
|
|
50
50
|
/** Cordis plugin ID. */
|
|
51
|
-
export const name =
|
|
52
|
-
export const inject = [
|
|
53
|
-
export const PROMPT_FIREWALL_SETTINGS_NAMESPACE =
|
|
51
|
+
export const name = "prompt-firewall";
|
|
52
|
+
export const inject = ["systemPrompt"];
|
|
53
|
+
export const PROMPT_FIREWALL_SETTINGS_NAMESPACE = "prompt-firewall";
|
|
54
54
|
export const Config = ConfigSchema;
|
|
55
55
|
/** DSH Host plugin, public firewall service, and browser Remote owner. */
|
|
56
56
|
let PromptFirewall = (() => {
|
|
@@ -61,8 +61,8 @@ let PromptFirewall = (() => {
|
|
|
61
61
|
return class PromptFirewall extends _classSuper {
|
|
62
62
|
static {
|
|
63
63
|
const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
|
|
64
|
-
_inspect_decorators = [Remote(
|
|
65
|
-
_setSectionPolicy_decorators = [Remote(
|
|
64
|
+
_inspect_decorators = [Remote("inspect")];
|
|
65
|
+
_setSectionPolicy_decorators = [Remote("setSectionPolicy")];
|
|
66
66
|
__esDecorate(this, null, _inspect_decorators, { kind: "method", name: "inspect", static: false, private: false, access: { has: obj => "inspect" in obj, get: obj => obj.inspect }, metadata: _metadata }, null, _instanceExtraInitializers);
|
|
67
67
|
__esDecorate(this, null, _setSectionPolicy_decorators, { kind: "method", name: "setSectionPolicy", static: false, private: false, access: { has: obj => "setSectionPolicy" in obj, get: obj => obj.setSectionPolicy }, metadata: _metadata }, null, _instanceExtraInitializers);
|
|
68
68
|
if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
|
|
@@ -77,38 +77,42 @@ let PromptFirewall = (() => {
|
|
|
77
77
|
metrics = new FirewallMetrics();
|
|
78
78
|
logger;
|
|
79
79
|
constructor(ctx, config = {}) {
|
|
80
|
-
super(ctx,
|
|
80
|
+
super(ctx, "promptFirewall", { namespace: "promptFirewall" });
|
|
81
81
|
this.logger = getPluginLogger({
|
|
82
|
-
pluginId:
|
|
83
|
-
console:
|
|
82
|
+
pluginId: "dsh-prompt-firewall",
|
|
83
|
+
console: "trace",
|
|
84
84
|
consoleSink: createHostLoggerSink(ctx.logger),
|
|
85
85
|
});
|
|
86
|
-
ctx.effect(() => async () => this.logger.close(),
|
|
86
|
+
ctx.effect(() => async () => this.logger.close(), "dsh-prompt-firewall.logger");
|
|
87
87
|
this.entryConfig = structuredClone(config);
|
|
88
88
|
this.configSource = () => this.entryConfig;
|
|
89
89
|
this.resolvedConfig = resolveConfig(config);
|
|
90
90
|
this.compiledRules = compileRules(this.resolvedConfig);
|
|
91
91
|
this.audits = new AuditStore(this.resolvedConfig.audit.historySize, this.resolvedConfig.audit.highlightNewSections);
|
|
92
|
-
ctx.inject([
|
|
92
|
+
ctx.inject(["settings"], (settingsCtx) => {
|
|
93
93
|
settingsCtx.settings.installSection(ctx, PROMPT_FIREWALL_SETTINGS_NAMESPACE, ConfigSchema, this.entryConfig, {
|
|
94
|
-
setSource: current => {
|
|
95
|
-
|
|
94
|
+
setSource: (current) => {
|
|
95
|
+
this.configSource = current;
|
|
96
|
+
},
|
|
97
|
+
onChange: () => {
|
|
98
|
+
this.reloadRules();
|
|
99
|
+
},
|
|
96
100
|
});
|
|
97
101
|
});
|
|
98
102
|
// Cordis has registration order plus `prepend`, not numeric priorities.
|
|
99
103
|
// Prepending makes this wrapper call downstream contributors first and
|
|
100
104
|
// apply policy while their final result unwinds back through this listener.
|
|
101
|
-
ctx.on(
|
|
105
|
+
ctx.on("system-prompt/assemble", async (_assembly, _context, next) => {
|
|
102
106
|
const result = await next();
|
|
103
107
|
return applyFirewall(result, {
|
|
104
108
|
config: this.resolvedConfig,
|
|
105
109
|
auditStore: this.audits,
|
|
106
110
|
metrics: this.metrics,
|
|
107
111
|
logger: this.logger,
|
|
108
|
-
evaluate: section => evaluateSection(section, this.compiledRules),
|
|
112
|
+
evaluate: (section) => evaluateSection(section, this.compiledRules),
|
|
109
113
|
});
|
|
110
114
|
}, { prepend: true });
|
|
111
|
-
this.logger.info(
|
|
115
|
+
this.logger.info("plugin.ready", {
|
|
112
116
|
enabled: this.resolvedConfig.enabled,
|
|
113
117
|
mode: this.resolvedConfig.mode,
|
|
114
118
|
});
|
|
@@ -142,21 +146,21 @@ let PromptFirewall = (() => {
|
|
|
142
146
|
}
|
|
143
147
|
async setSectionPolicy(name, policy, expectedRevision) {
|
|
144
148
|
if (name.length === 0)
|
|
145
|
-
throw new TypeError(
|
|
146
|
-
const settings = this.ctx.get(
|
|
149
|
+
throw new TypeError("section name must be non-empty");
|
|
150
|
+
const settings = this.ctx.get("settings");
|
|
147
151
|
if (settings === undefined) {
|
|
148
|
-
throw new Error(
|
|
152
|
+
throw new Error("prompt-firewall settings are unavailable; mount a DSH settings provider");
|
|
149
153
|
}
|
|
150
154
|
const current = this.configSource();
|
|
151
|
-
const without = (values) => (
|
|
155
|
+
const without = (values) => (values ?? []).filter((value) => value !== name);
|
|
152
156
|
const allowedSections = without(current.allowedSections);
|
|
153
157
|
const blockedSections = without(current.blockedSections);
|
|
154
158
|
const protectedSections = without(current.protectedSections);
|
|
155
|
-
if (policy ===
|
|
159
|
+
if (policy === "allow")
|
|
156
160
|
allowedSections.push(name);
|
|
157
|
-
else if (policy ===
|
|
161
|
+
else if (policy === "block")
|
|
158
162
|
blockedSections.push(name);
|
|
159
|
-
else if (policy ===
|
|
163
|
+
else if (policy === "protect")
|
|
160
164
|
protectedSections.push(name);
|
|
161
165
|
await settings.update(PROMPT_FIREWALL_SETTINGS_NAMESPACE, {
|
|
162
166
|
allowedSections,
|
|
@@ -171,7 +175,7 @@ let PromptFirewall = (() => {
|
|
|
171
175
|
this.resolvedConfig = resolveConfig(this.configSource());
|
|
172
176
|
this.compiledRules = compileRules(this.resolvedConfig);
|
|
173
177
|
this.audits.configure(this.resolvedConfig.audit.historySize, this.resolvedConfig.audit.highlightNewSections);
|
|
174
|
-
this.logger.info(
|
|
178
|
+
this.logger.info("firewall.rules.reloaded", {
|
|
175
179
|
enabled: this.resolvedConfig.enabled,
|
|
176
180
|
mode: this.resolvedConfig.mode,
|
|
177
181
|
});
|
package/lib/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAM9C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,oBAAoB,EACpB,eAAe,GAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAa3D,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAS3B,wBAAwB;AACxB,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AACtC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,kCAAkC,GAAG,iBAAiB,CAAC;AAGpE,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC;AAEnC,0EAA0E;IAC7D,cAAc;sBACjB,mBAAmB;;;;iBADhB,cACX,SAAQ,WAAmB;;;mCAgG1B,MAAM,CAAC,SAAS,CAAC;4CAcjB,MAAM,CAAC,kBAAkB,CAAC;YAb3B,wKAAA,OAAO,6DAON;YAOD,mMAAM,gBAAgB,6DAoCrB;;;QAhJD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;QAEZ,WAAW,GAPjB,mDAAc,CAO0B;QAC3C,YAAY,CAA6B;QACzC,cAAc,CAA+B;QAC7C,aAAa,CAAC;QACL,MAAM,CAAa;QACnB,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,CAAe;QAEtC,YAAY,GAAY,EAAE,MAAM,GAAyB,EAAE;YACzD,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;gBAC5B,QAAQ,EAAE,qBAAqB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;aAC9C,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EACrC,4BAA4B,CAC7B,CAAC;YACF,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAC1B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EACrC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,oBAAoB,CAC/C,CAAC;YAEF,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvC,WAAW,CAAC,QAAQ,CAAC,cAAc,CACjC,GAAG,EACH,kCAAkC,EAClC,YAAY,EACZ,IAAI,CAAC,WAAW,EAChB;oBACE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;wBACrB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;oBAC9B,CAAC;oBACD,QAAQ,EAAE,GAAG,EAAE;wBACb,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,CAAC;iBACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,wEAAwE;YACxE,uEAAuE;YACvE,4EAA4E;YAC5E,GAAG,CAAC,EAAE,CACJ,wBAAwB,EACxB,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAA2B,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,OAAO,aAAa,CAAC,MAAM,EAAE;oBAC3B,MAAM,EAAE,IAAI,CAAC,cAAc;oBAC3B,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC/B,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO;gBACpC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,WAAW;YACT,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAED,cAAc;YACZ,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,gBAAgB;YACd,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,CAAC;QAED,UAAU;YACR,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,CAAC;QAED,SAAS;YACP,OAAO,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC;QAED,wEAAwE;QAExE,OAAO;YACL,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE;gBACxB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;gBACxB,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;gBACtC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;aAC3B,CAAC;QACJ,CAAC;QAED,eAAe,CAAC,OAAyB;YACvC,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QAGD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,MAAqB,EACrB,gBAAyB;YAEzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACnB,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAY,EAAE,CAClE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;YACnD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,OAAO;gBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9C,IAAI,MAAM,KAAK,OAAO;gBAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACnD,IAAI,MAAM,KAAK,SAAS;gBAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE5D,MAAM,QAAQ,CAAC,MAAM,CACnB,kCAAkC,EAClC;gBACE,eAAe;gBACf,eAAe;gBACf,iBAAiB;aAClB,EACD,gBAAgB,CACjB,CAAC;YACF,wEAAwE;YACxE,gFAAgF;YAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QAED,WAAW;YACT,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CACnB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EACrC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,oBAAoB,CAC/C,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC1C,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO;gBACpC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI;aAC/B,CAAC,CAAC;QACL,CAAC;;;SAjKU,cAAc;AAoK3B,eAAe,cAAc,CAAC"}
|
package/lib/metrics.js
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
export const METRIC_NAMES = Object.freeze({
|
|
2
|
-
requestsTotal:
|
|
3
|
-
sectionsTotal:
|
|
4
|
-
sectionsBlockedTotal:
|
|
5
|
-
charsRemovedTotal:
|
|
6
|
-
estimatedTokensRemovedTotal:
|
|
2
|
+
requestsTotal: "dsh_prompt_firewall_requests_total",
|
|
3
|
+
sectionsTotal: "dsh_prompt_firewall_sections_total",
|
|
4
|
+
sectionsBlockedTotal: "dsh_prompt_firewall_sections_blocked_total",
|
|
5
|
+
charsRemovedTotal: "dsh_prompt_firewall_chars_removed_total",
|
|
6
|
+
estimatedTokensRemovedTotal: "dsh_prompt_firewall_estimated_tokens_removed_total",
|
|
7
7
|
});
|
|
8
8
|
const ZERO_SNAPSHOT = Object.freeze({
|
|
9
9
|
requestsTotal: 0,
|
package/lib/metrics.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,oCAAoC;IACnD,aAAa,EAAE,oCAAoC;IACnD,oBAAoB,EAAE,4CAA4C;IAClE,iBAAiB,EAAE,yCAAyC;IAC5D,2BAA2B,EACzB,oDAAoD;CAC9C,CAAC,CAAC;AAKZ,MAAM,aAAa,GAA4C,MAAM,CAAC,MAAM,CAAC;IAC3E,aAAa,EAAE,CAAC;IAChB,aAAa,EAAE,CAAC;IAChB,oBAAoB,EAAE,CAAC;IACvB,iBAAiB,EAAE,CAAC;IACpB,2BAA2B,EAAE,CAAC;CAC/B,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,OAAO,eAAe;IAClB,QAAQ,GAAkC,EAAE,GAAG,aAAa,EAAE,CAAC;IAEvE,MAAM,CAAC,MAAyB;QAC9B,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,MAAM,CAAC,eAAe,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,2BAA2B,IAAI,MAAM,CAAC,sBAAsB,CAAC;IAC7E,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,aAAa;QACX,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YACzD,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YACzD,CAAC,YAAY,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;YACvE,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YACjE,CAAC,YAAY,CAAC,2BAA2B,CAAC,EACxC,IAAI,CAAC,QAAQ,CAAC,2BAA2B;SAC5C,CAAC,CAAC;IACL,CAAC;CACF"}
|
package/lib/presets.js
CHANGED
|
@@ -1,20 +1,20 @@
|
|
|
1
1
|
export const CLEAN_BLOCKED_SECTIONS = Object.freeze([
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
2
|
+
"plugin:dsh-liangshen",
|
|
3
|
+
"plugin:dsh-ssh",
|
|
4
|
+
"plugin:task-board",
|
|
5
|
+
"plugin:dsh-desktop-launcher",
|
|
6
6
|
]);
|
|
7
7
|
export const PRESETS = Object.freeze({
|
|
8
8
|
clean: Object.freeze({
|
|
9
|
-
mode:
|
|
9
|
+
mode: "blocklist",
|
|
10
10
|
blockedSections: [...CLEAN_BLOCKED_SECTIONS],
|
|
11
11
|
}),
|
|
12
12
|
strict: Object.freeze({
|
|
13
|
-
mode:
|
|
14
|
-
unknownPluginPolicy:
|
|
13
|
+
mode: "allowlist",
|
|
14
|
+
unknownPluginPolicy: "block",
|
|
15
15
|
}),
|
|
16
|
-
|
|
17
|
-
mode:
|
|
16
|
+
"audit-only": Object.freeze({
|
|
17
|
+
mode: "audit",
|
|
18
18
|
}),
|
|
19
19
|
});
|
|
20
20
|
export function getPreset(name) {
|
package/lib/presets.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"presets.js","sourceRoot":"","sources":["../src/presets.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,sBAAsB;IACtB,gBAAgB;IAChB,mBAAmB;IACnB,6BAA6B;CACrB,CAAC,
|
|
1
|
+
{"version":3,"file":"presets.js","sourceRoot":"","sources":["../src/presets.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,sBAAsB;IACtB,gBAAgB;IAChB,mBAAmB;IACnB,6BAA6B;CACrB,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,OAAO,GAEhB,MAAM,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW;QACjB,eAAe,EAAE,CAAC,GAAG,sBAAsB,CAAC;KAC7C,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,WAAW;QACjB,mBAAmB,EAAE,OAAO;KAC7B,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CACvB,IAAgC;IAEhC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC"}
|