agent-threat-rules 3.5.8 → 3.5.9

package/README.md

@@ -13,7 +13,7 @@ AI Agent 威脅偵測規則的開放格式
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-ATR%20Scan-2ea44f?style=flat-square&logo=github)](https://github.com/marketplace/actions/atr-scan)
 [![License: MIT](https://img.shields.io/badge/license-MIT-brightgreen?style=flat-square)](LICENSE)
 [![DOI](https://img.shields.io/badge/DOI-10.5281%2Fzenodo.19178002-blue?style=flat-square)](https://doi.org/10.5281/zenodo.19178002)
-[![Rules](https://img.shields.io/badge/rules-747-blue?style=flat-square)](#5-specification)
+[![Rules](https://img.shields.io/badge/rules-751-blue?style=flat-square)](#5-specification)
 [![Categories](https://img.shields.io/badge/categories-10-blue?style=flat-square)](#7-coverage)
 [![OWASP Agentic](https://img.shields.io/badge/OWASP_Agentic_Top_10-10%2F10-brightgreen?style=flat-square)](#7-coverage)
 [![SAFE-MCP](https://img.shields.io/badge/SAFE--MCP-91.8%25-brightgreen?style=flat-square)](#7-coverage)

package/dist/adapters/nemoclaw-preflight.d.ts

@@ -0,0 +1,102 @@
+/**
+ * NemoClaw / OpenShell supply-chain pre-flight scanner (ATR Seam B).
+ *
+ * Scans an agent bundle — SKILL.md skills and MCP server configs — BEFORE it is
+ * provisioned into a NemoClaw/OpenShell sandbox, and returns a gate verdict:
+ *   exit 0 = pass        (all targets scanned, nothing at/above threshold)
+ *   exit 1 = block       (a rule at/above the threshold matched)
+ *   exit 2 = incomplete  (could not fully scan — oversized/unreadable/symlink/
+ *                         too many files) OR internal error
+ *
+ * It is FAIL-CLOSED: because this is the only pre-deployment barrier, an
+ * incomplete scan is never reported as a pass. A skipped file (too large to
+ * scan, unreadable, a symlink, or beyond the file cap) yields an "incomplete"
+ * verdict the caller must treat as a gate failure, not a clean result.
+ *
+ * This is the pre-deployment counterpart to the runtime content filter
+ * (openshell-filter): the filter inspects L7 traffic at run time; this inspects
+ * the skill / MCP supply chain at provision time — a gap neither OpenShell's
+ * capability policy nor a runtime guard covers.
+ *
+ * Why MCP configs specifically: OpenShell/NemoClaw run OpenClaw/Hermes agents
+ * that load skills and register MCP servers (.mcp.json, .cursor/mcp.json,
+ * .claude/settings.json, ...). Malicious server definitions (stdio RCE, unauth
+ * registration, SymJack symlink-config redirection) are a content-level attack
+ * surface ATR has rules for. The `atr scan` CLI treats .json as MCP *events*;
+ * this scans MCP *config* files as content, which is the missing path.
+ *
+ * Symlinks are never followed (cycle-safe, version-consistent across the
+ * supported Node range, and SymJack-safe); a symlink that would otherwise be a
+ * scan target is recorded as skipped so it cannot pass silently.
+ *
+ * Findings use the canonical atr.* shape (matched values redacted by default per
+ * the engine INTERFACE-CONTRACT), consistent with openshell-filter, so Seam A
+ * (runtime) and Seam B (supply chain) feed the same OCSF detection_finding
+ * audit stream. Reuses ATREngine in skill context; adds no dependency.
+ *
+ * @module agent-threat-rules/nemoclaw-preflight
+ */
+export type Decision = 'pass' | 'block' | 'incomplete';
+/** Reason a target could not be fully scanned (fail-closed signals). */
+export type SkipReason = 'too_large' | 'unreadable' | 'symlink' | 'max_files_exceeded';
+export interface PreflightOptions {
+    /** Block when a matched rule's severity is at or above this (default "high"). */
+    readonly minSeverity: string;
+    /** Directory of ATR rule YAML files. Omit to use the rules bundled with the package. */
+    readonly rulesDir?: string;
+    /** When true, include the raw matched value instead of redacting it. */
+    readonly forensic: boolean;
+    /** Skip files larger than this (default 1 MB) — skipped files block the gate. */
+    readonly maxFileBytes?: number;
+    /** Stop collecting after this many target files (default 2000) — truncation blocks the gate. */
+    readonly maxFiles?: number;
+}
+/** A finding, in the canonical atr.* shape plus the source file that triggered it. */
+export interface PreflightFinding {
+    readonly 'atr.rule_id': string;
+    readonly 'atr.severity': string;
+    readonly 'atr.category': string;
+    readonly 'atr.confidence': number;
+    readonly 'atr.matched_value_redacted': string;
+    readonly 'atr.source_path': string;
+}
+export interface SkippedFile {
+    readonly path: string;
+    readonly reason: SkipReason;
+}
+export interface PreflightResult {
+    readonly decision: Decision;
+    /** Number of files actually read and evaluated (not merely discovered). */
+    readonly scanned: number;
+    /** Targets that could not be fully scanned. Non-empty ⇒ verdict cannot be a clean pass. */
+    readonly skipped: readonly SkippedFile[];
+    readonly findings: readonly PreflightFinding[];
+}
+/** The supply-chain pre-flight scanner. Construct once, reuse across bundles. */
+export declare class NemoClawPreflight {
+    private readonly options;
+    private readonly engine;
+    private readonly blockRank;
+    private readonly maxFileBytes;
+    private readonly maxFiles;
+    private loadPromise;
+    constructor(options: PreflightOptions);
+    private ensureLoaded;
+    /**
+     * Scan one file's content in skill context. Returns the findings and a skip
+     * reason (null if the file was actually read and evaluated). Oversized and
+     * unreadable files are reported as skipped (fail-closed), never silently
+     * treated as clean.
+     */
+    private scanFile;
+    private toFinding;
+    /**
+     * Scan an agent bundle (directory or single file). Block on any finding at or
+     * above the threshold; otherwise report incomplete if any target could not be
+     * fully scanned (fail-closed); otherwise pass.
+     */
+    scanBundle(root: string): Promise<PreflightResult>;
+}
+/** Build options from the ATR_* environment contract. */
+export declare function optionsFromEnv(): PreflightOptions;
+//# sourceMappingURL=nemoclaw-preflight.d.ts.map

package/dist/adapters/nemoclaw-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nemoclaw-preflight.d.ts","sourceRoot":"","sources":["../../src/adapters/nemoclaw-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAOH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,CAAC;AAEvD,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAiCvF,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAChD;AAiFD,iFAAiF;AACjF,qBAAa,iBAAiB;IAOhB,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,WAAW,CAAgC;gBAEtB,OAAO,EAAE,gBAAgB;IAOtD,OAAO,CAAC,YAAY;IAKpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,SAAS;IAYjB;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAyBzD;AAID,yDAAyD;AACzD,wBAAgB,cAAc,IAAI,gBAAgB,CASjD"}

package/dist/adapters/nemoclaw-preflight.js

@@ -0,0 +1,290 @@
+/**
+ * NemoClaw / OpenShell supply-chain pre-flight scanner (ATR Seam B).
+ *
+ * Scans an agent bundle — SKILL.md skills and MCP server configs — BEFORE it is
+ * provisioned into a NemoClaw/OpenShell sandbox, and returns a gate verdict:
+ *   exit 0 = pass        (all targets scanned, nothing at/above threshold)
+ *   exit 1 = block       (a rule at/above the threshold matched)
+ *   exit 2 = incomplete  (could not fully scan — oversized/unreadable/symlink/
+ *                         too many files) OR internal error
+ *
+ * It is FAIL-CLOSED: because this is the only pre-deployment barrier, an
+ * incomplete scan is never reported as a pass. A skipped file (too large to
+ * scan, unreadable, a symlink, or beyond the file cap) yields an "incomplete"
+ * verdict the caller must treat as a gate failure, not a clean result.
+ *
+ * This is the pre-deployment counterpart to the runtime content filter
+ * (openshell-filter): the filter inspects L7 traffic at run time; this inspects
+ * the skill / MCP supply chain at provision time — a gap neither OpenShell's
+ * capability policy nor a runtime guard covers.
+ *
+ * Why MCP configs specifically: OpenShell/NemoClaw run OpenClaw/Hermes agents
+ * that load skills and register MCP servers (.mcp.json, .cursor/mcp.json,
+ * .claude/settings.json, ...). Malicious server definitions (stdio RCE, unauth
+ * registration, SymJack symlink-config redirection) are a content-level attack
+ * surface ATR has rules for. The `atr scan` CLI treats .json as MCP *events*;
+ * this scans MCP *config* files as content, which is the missing path.
+ *
+ * Symlinks are never followed (cycle-safe, version-consistent across the
+ * supported Node range, and SymJack-safe); a symlink that would otherwise be a
+ * scan target is recorded as skipped so it cannot pass silently.
+ *
+ * Findings use the canonical atr.* shape (matched values redacted by default per
+ * the engine INTERFACE-CONTRACT), consistent with openshell-filter, so Seam A
+ * (runtime) and Seam B (supply chain) feed the same OCSF detection_finding
+ * audit stream. Reuses ATREngine in skill context; adds no dependency.
+ *
+ * @module agent-threat-rules/nemoclaw-preflight
+ */
+import { existsSync, lstatSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { basename, join, relative } from 'node:path';
+import { ATREngine } from '../engine.js';
+/** Severity ordering for the block threshold (ATR_MIN_SEVERITY). */
+const SEVERITY_RANK = Object.freeze({
+    informational: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+});
+const DEFAULT_MIN_SEVERITY = 'high';
+const DEFAULT_MAX_FILE_BYTES = 1024 * 1024; // 1 MB per file
+const DEFAULT_MAX_FILES = 2000;
+const REDACTED = '[REDACTED]';
+const SKIP_DIRS = new Set([
+    '.git', 'node_modules', '.venv', 'venv', 'dist', 'build', '__pycache__', '.next',
+]);
+/** MCP config file basenames (exact) and path suffixes (agent-specific locations). */
+const MCP_CONFIG_BASENAMES = new Set(['.mcp.json', 'mcp.json']);
+const MCP_CONFIG_SUFFIXES = [
+    '.cursor/mcp.json',
+    '.vscode/mcp.json',
+    '.claude/settings.json',
+    '.gemini/settings.json',
+    '.codex/config.toml',
+];
+function severityRank(severity) {
+    return SEVERITY_RANK[severity.toLowerCase()] ?? 0;
+}
+function isSkillFile(base) {
+    return base.toLowerCase() === 'skill.md';
+}
+function isMcpConfig(relPath, base) {
+    if (MCP_CONFIG_BASENAMES.has(base))
+        return true;
+    const norm = relPath.split('\\').join('/');
+    return MCP_CONFIG_SUFFIXES.some((suffix) => norm.endsWith(suffix));
+}
+/**
+ * Recursively collect skill + MCP-config files under root (bounded, skipping
+ * vendor dirs and never following symlinks). A symlink that would otherwise be a
+ * target is reported as skipped; hitting maxFiles sets truncated.
+ */
+function collectTargets(root, maxFiles) {
+    // lstat (not stat) so a symlinked root is NOT silently followed — the
+    // per-entry guard during traversal only covers symlinks found inside dirs,
+    // not the root argument itself. Honors the module's "never follow symlinks".
+    const rootStat = lstatSync(root);
+    if (rootStat.isSymbolicLink()) {
+        return { targets: [], skipped: [{ path: root, reason: 'symlink' }], truncated: false };
+    }
+    if (rootStat.isFile()) {
+        const base = basename(root);
+        const kind = isMcpConfig(root, base) ? 'mcp-config' : 'skill';
+        return { targets: [{ path: root, kind }], skipped: [], truncated: false };
+    }
+    const targets = [];
+    const skipped = [];
+    const stack = [root];
+    let truncated = false;
+    while (stack.length > 0) {
+        if (targets.length >= maxFiles) {
+            truncated = true;
+            break;
+        }
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            skipped.push({ path: dir, reason: 'unreadable' });
+            continue;
+        }
+        for (const entry of entries) {
+            if (targets.length >= maxFiles) {
+                truncated = true;
+                break;
+            }
+            const full = join(dir, entry.name);
+            const rel = relative(root, full);
+            const wouldBeTarget = isSkillFile(entry.name) || isMcpConfig(rel, entry.name);
+            // Never follow symlinks: avoids traversal cycles, is consistent across the
+            // supported Node range (Dirent.isDirectory() follows links on some), and
+            // refuses SymJack-style redirection. Surface link-targets as skipped.
+            if (entry.isSymbolicLink()) {
+                if (wouldBeTarget)
+                    skipped.push({ path: full, reason: 'symlink' });
+                continue;
+            }
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name))
+                    stack.push(full);
+                continue;
+            }
+            if (isSkillFile(entry.name))
+                targets.push({ path: full, kind: 'skill' });
+            else if (isMcpConfig(rel, entry.name))
+                targets.push({ path: full, kind: 'mcp-config' });
+        }
+    }
+    return { targets, skipped, truncated };
+}
+/** The supply-chain pre-flight scanner. Construct once, reuse across bundles. */
+export class NemoClawPreflight {
+    options;
+    engine;
+    blockRank;
+    maxFileBytes;
+    maxFiles;
+    loadPromise = null;
+    constructor(options) {
+        this.options = options;
+        this.engine = new ATREngine(options.rulesDir ? { rulesDir: options.rulesDir } : {});
+        this.blockRank = severityRank(options.minSeverity);
+        this.maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
+        this.maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
+    }
+    ensureLoaded() {
+        if (this.loadPromise === null)
+            this.loadPromise = this.engine.loadRules();
+        return this.loadPromise;
+    }
+    /**
+     * Scan one file's content in skill context. Returns the findings and a skip
+     * reason (null if the file was actually read and evaluated). Oversized and
+     * unreadable files are reported as skipped (fail-closed), never silently
+     * treated as clean.
+     */
+    scanFile(target) {
+        let content;
+        try {
+            if (statSync(target.path).size > this.maxFileBytes) {
+                return { findings: [], skip: 'too_large' };
+            }
+            content = readFileSync(target.path, 'utf8');
+        }
+        catch {
+            return { findings: [], skip: 'unreadable' };
+        }
+        if (!content.trim())
+            return { findings: [], skip: null };
+        // scanContext 'skill' makes every rule evaluate against the whole content,
+        // with the engine's compound gating controlling false positives — correct
+        // for both SKILL.md and MCP config text (exec commands, server
+        // registrations, symlink targets are inspected as content).
+        const event = {
+            type: 'tool_call',
+            timestamp: new Date().toISOString(),
+            content,
+            scanContext: 'skill',
+        };
+        const findings = this.engine
+            .evaluate(event)
+            .filter((m) => severityRank(m.rule.severity) >= this.blockRank)
+            .map((m) => this.toFinding(m, target.path));
+        return { findings, skip: null };
+    }
+    toFinding(match, sourcePath) {
+        const matchedPattern = match.matchedPatterns?.[0];
+        return {
+            'atr.rule_id': match.rule.id,
+            'atr.severity': match.rule.severity,
+            'atr.category': match.rule.tags?.category ?? 'unknown',
+            'atr.confidence': match.confidence,
+            'atr.matched_value_redacted': this.options.forensic && matchedPattern ? matchedPattern : REDACTED,
+            'atr.source_path': sourcePath,
+        };
+    }
+    /**
+     * Scan an agent bundle (directory or single file). Block on any finding at or
+     * above the threshold; otherwise report incomplete if any target could not be
+     * fully scanned (fail-closed); otherwise pass.
+     */
+    async scanBundle(root) {
+        await this.ensureLoaded();
+        if (!existsSync(root)) {
+            throw new Error(`path not found: ${root}`);
+        }
+        const collected = collectTargets(root, this.maxFiles);
+        const skipped = [...collected.skipped];
+        const findings = [];
+        let evaluated = 0;
+        for (const target of collected.targets) {
+            const { findings: f, skip } = this.scanFile(target);
+            if (skip)
+                skipped.push({ path: target.path, reason: skip });
+            else
+                evaluated++;
+            findings.push(...f);
+        }
+        if (collected.truncated) {
+            skipped.push({ path: root, reason: 'max_files_exceeded' });
+        }
+        const decision = findings.length > 0 ? 'block' : skipped.length > 0 ? 'incomplete' : 'pass';
+        return { decision, scanned: evaluated, skipped, findings };
+    }
+}
+// ── CLI wiring (provisioning gate the supervisor / CI runs) ──────────────────
+/** Build options from the ATR_* environment contract. */
+export function optionsFromEnv() {
+    const minRaw = (process.env['ATR_MIN_SEVERITY'] ?? DEFAULT_MIN_SEVERITY).toLowerCase();
+    const minSeverity = SEVERITY_RANK[minRaw] !== undefined ? minRaw : DEFAULT_MIN_SEVERITY;
+    const forensicRaw = process.env['ATR_FORENSIC_MODE'];
+    return {
+        minSeverity,
+        rulesDir: process.env['ATR_RULES_DIR'] ?? process.env['ATR_CORPUS_PATH'] ?? undefined,
+        forensic: forensicRaw === '1' || forensicRaw === 'true',
+    };
+}
+function exitCodeFor(decision) {
+    return decision === 'block' ? 1 : decision === 'incomplete' ? 2 : 0;
+}
+async function main(argv) {
+    const target = argv.find((a) => !a.startsWith('-'));
+    if (!target) {
+        process.stderr.write('usage: nemoclaw-preflight <agent-bundle-dir> [--json]\n');
+        return 2;
+    }
+    const result = await new NemoClawPreflight(optionsFromEnv()).scanBundle(target);
+    if (argv.includes('--json')) {
+        process.stdout.write(JSON.stringify(result) + '\n');
+        return exitCodeFor(result.decision);
+    }
+    if (result.decision === 'block') {
+        process.stderr.write(`BLOCK: ${result.findings.length} finding(s) across ${result.scanned} file(s)\n`);
+        for (const f of result.findings) {
+            process.stderr.write(`  ${f['atr.severity']}  ${f['atr.rule_id']}  ${f['atr.category']}  ${f['atr.source_path']}\n`);
+        }
+    }
+    else if (result.decision === 'incomplete') {
+        process.stderr.write(`INCOMPLETE: scanned ${result.scanned} file(s); ${result.skipped.length} could not be scanned (treated as gate failure)\n`);
+        for (const s of result.skipped) {
+            process.stderr.write(`  ${s.reason}  ${s.path}\n`);
+        }
+    }
+    else {
+        process.stderr.write(`PASS: ${result.scanned} file(s) scanned, no findings at or above threshold\n`);
+    }
+    return exitCodeFor(result.decision);
+}
+const isDirectInvocation = Boolean(process.argv[1]) && import.meta.url === `file://${process.argv[1]}`;
+if (isDirectInvocation) {
+    main(process.argv.slice(2))
+        .then((code) => process.exit(code))
+        .catch((err) => {
+        process.stderr.write(`nemoclaw-preflight: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(2);
+    });
+}
+//# sourceMappingURL=nemoclaw-preflight.js.map

package/dist/adapters/nemoclaw-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nemoclaw-preflight.js","sourceRoot":"","sources":["../../src/adapters/nemoclaw-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,oEAAoE;AACpE,MAAM,aAAa,GAAqC,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,CAAC;IAChB,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;AAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO;CACjF,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AACrF,MAAM,mBAAmB,GAAsB;IAC7C,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAkDD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAe,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE9E,2EAA2E;YAC3E,yEAAyE;YACzE,sEAAsE;YACtE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,IAAI,aAAa;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;iBACpE,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,iBAAiB;IAOC;IANZ,MAAM,CAAY;IAClB,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,QAAQ,CAAS;IAC1B,WAAW,GAA2B,IAAI,CAAC;IAEnD,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACxD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,MAAc;QAC7B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAEzD,2EAA2E;QAC3E,0EAA0E;QAC1E,+DAA+D;QAC/D,4DAA4D;QAC5D,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO;YACP,WAAW,EAAE,OAAO;SACrB,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;aACzB,QAAQ,CAAC,KAAK,CAAC;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAEO,SAAS,CAAC,KAAe,EAAE,UAAkB;QACnD,MAAM,cAAc,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO;YACL,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC5B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YACnC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,SAAS;YACtD,gBAAgB,EAAE,KAAK,CAAC,UAAU;YAClC,4BAA4B,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ;YACjG,iBAAiB,EAAE,UAAU;SAC9B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,OAAO,GAAkB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;;gBACvD,SAAS,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GACZ,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7D,CAAC;CACF;AAED,gFAAgF;AAEhF,yDAAyD;AACzD,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;IACvF,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACxF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACrD,OAAO;QACL,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;QACrF,QAAQ,EAAE,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,MAAM;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB;IACrC,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAuB;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEhF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,MAAM,sBAAsB,MAAM,CAAC,OAAO,YAAY,CAAC,CAAC;QACvG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,mDAAmD,CAAC,CAAC;QACjJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,OAAO,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACvG,IAAI,kBAAkB,EAAE,CAAC;IACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/adapters/openshell-filter.d.ts

@@ -0,0 +1,95 @@
+/**
+ * OpenShell content-inspection filter — ATR reference binding for NVIDIA OpenShell.
+ *
+ * Implements the external content-filter contract proposed in
+ * NVIDIA/OpenShell#1272 ("L7 content inspection hooks — scriptable
+ * request/response filtering"): the OpenShell *supervisor* (outside the agent
+ * sandbox) runs this as a script against L7 request/response bodies. The body
+ * arrives on stdin; the script signals the verdict via exit code:
+ *
+ *   exit 0  -> allow  (no rule at/above the deny threshold matched)
+ *   exit 1  -> deny   (the verdict JSON, with reasons, is written to stdout)
+ *   exit 2  -> internal error (supervisor applies its on_timeout/on_error policy)
+ *
+ * Two run modes:
+ *   one-shot (default): read the whole body from stdin, evaluate, exit.
+ *       Matches the #1272 contract literally. Cold-starts the engine per call.
+ *   serve (--serve):    read NDJSON requests line-by-line from stdin and write
+ *       one NDJSON verdict per line. Loads the rule set ONCE, so per-request
+ *       latency is just regex evaluation (sub-ms). Production path for a
+ *       persistent guard service (cf. NVIDIA/OpenShell#1733 RFC 0005). A bad
+ *       line (or an engine error) yields a per-line error verdict and the
+ *       stream continues — one malformed body cannot take the inspector offline.
+ *
+ * Output is the canonical ATR detection event (atr.* fields per the engine
+ * INTERFACE-CONTRACT). Matched raw values are redacted by default
+ * (ATR_FORENSIC_MODE=1 to retain), satisfying the "audit evidence without
+ * storing raw sensitive values" requirement of the egress-middleware RFC (#1733).
+ *
+ * Environment (aligned with engines/{go,typescript}/INTERFACE-CONTRACT.md):
+ *   ATR_RULES_DIR | ATR_CORPUS_PATH  rule directory (default: bundled rules)
+ *   ATR_MIN_SEVERITY                 deny at or above this severity (default high)
+ *   ATR_FORENSIC_MODE                "1"/"true" to retain raw matched values
+ *   ATR_MAX_BODY_BYTES               stdin hard cap (default 524288)
+ *
+ * Adds NO new dependency: reuses the canonical ATREngine. It does not decide
+ * routing (that is OpenShell's Privacy Router, #1043) — it only inspects content
+ * and returns allow/deny, per the #1272 separation of concerns.
+ *
+ * @module agent-threat-rules/openshell-filter
+ */
+/** L7 traffic direction, mirroring OpenShell #1272 `content_filters[].direction`. */
+export type Direction = 'request' | 'response';
+/** Verdict decision returned to the supervisor. */
+export type Decision = 'allow' | 'deny';
+export interface FilterOptions {
+    /** Inbound response (agent will consume) vs outbound request (agent is sending). */
+    readonly direction: Direction;
+    /** Deny when a matched rule's severity is at or above this (default "high"). */
+    readonly minSeverity: string;
+    /** Directory of ATR rule YAML files. Omit to use the rules bundled with the package. */
+    readonly rulesDir?: string;
+    /** When true, include the raw matched value instead of redacting it. */
+    readonly forensic: boolean;
+}
+/**
+ * A single finding, shaped after the canonical ATR detection event
+ * (engines/go/INTERFACE-CONTRACT.md). Only the subset an inline content filter
+ * can populate is emitted; the supervisor enriches agent/session/service fields.
+ */
+export interface Finding {
+    readonly 'atr.rule_id': string;
+    readonly 'atr.severity': string;
+    readonly 'atr.category': string;
+    readonly 'atr.confidence': number;
+    readonly 'atr.matched_field': string;
+    readonly 'atr.matched_value_redacted': string;
+}
+export interface FilterVerdict {
+    readonly decision: Decision;
+    readonly findings: readonly Finding[];
+}
+/**
+ * The ATR content inspector. Construct once, reuse across many bodies (the
+ * `serve` path does exactly this so the rule set loads a single time).
+ */
+export declare class OpenShellFilter {
+    private readonly options;
+    private readonly engine;
+    private readonly denyRank;
+    private loadPromise;
+    constructor(options: FilterOptions);
+    /** Load rules exactly once, even under concurrent first calls. */
+    private ensureLoaded;
+    /**
+     * Inspect one body. Returns a deny verdict when any rule at or above the
+     * configured deny threshold matches; otherwise allow. Never throws on
+     * benign/empty input.
+     */
+    inspect(body: string): Promise<FilterVerdict>;
+}
+/** Parse the required --direction flag. Throws (fail-closed) on missing/invalid. */
+export declare function parseDirection(arg: string | undefined): Direction;
+/** Build FilterOptions from argv + the ATR_* environment contract. */
+export declare function optionsFromEnv(argv: readonly string[]): FilterOptions;
+//# sourceMappingURL=openshell-filter.d.ts.map

package/dist/adapters/openshell-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openshell-filter.d.ts","sourceRoot":"","sources":["../../src/adapters/openshell-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,qFAAqF;AACrF,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/C,mDAAmD;AACnD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAmBxC,MAAM,WAAW,aAAa;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAmCD;;;GAGG;AACH,qBAAa,eAAe;IAKd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,WAAW,CAAgC;gBAEtB,OAAO,EAAE,aAAa;IAKnD,kEAAkE;IAClE,OAAO,CAAC,YAAY;IAKpB;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAmBpD;AAID,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGjE;AAOD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAUrE"}