agentshield-sdk 7.2.0 → 7.3.0

package/src/main.js

@@ -27,7 +27,7 @@ function safeRequire(path, label) {
 // Core (these are critical — if they fail, we still export what we can)
 const { AgentShield } = safeRequire('./index', 'core');
 const { scanText, getPatterns, SEVERITY_ORDER } = safeRequire('./detector-core', 'detector-core');
-const { expressMiddleware, wrapAgent, shieldTools, extractTextFromBody } = safeRequire('./middleware', 'middleware');
+const { expressMiddleware, wrapAgent, shieldTools, extractTextFromBody, rateLimitMiddleware, shieldMiddleware } = safeRequire('./middleware', 'middleware');
 
 // Protection
 const { CircuitBreaker, shadowMode, RateLimiter, STATE } = safeRequire('./circuit-breaker', 'circuit-breaker');
@@ -51,7 +51,7 @@ const { SteganographyDetector, EncodingBruteforceDetector, StructuredDataScanner
 const { OutputWatermark, DifferentialPrivacy } = safeRequire('./watermark', 'watermark');
 
 // Utilities
-const { getGrade, getGradeLabel, makeBar, truncate, formatHeader, generateId } = safeRequire('./utils', 'utils');
+const { getGrade, getGradeLabel, makeBar, truncate, formatHeader, generateId, createGracefulShutdown, loadEnvFile } = safeRequire('./utils', 'utils');
 
 // Error codes & deprecation
 const { ERROR_CODES, createShieldError, deprecationWarning } = safeRequire('./errors', 'errors');
@@ -173,6 +173,48 @@ const { OpenClawShieldSkill, shieldOpenClawMessages, generateOpenClawSkill } = s
 // v7.2 — IPIA Detector
 const { IPIADetector, ContextConstructor, FeatureExtractor, TreeClassifier, ExternalEmbedder, createIPIAScanner, ipiaMiddleware, FEATURE_NAMES: IPIA_FEATURE_NAMES, INJECTION_LEXICON: IPIA_INJECTION_LEXICON } = safeRequire('./ipia-detector', 'ipia-detector');
 
+// v7.2.1 — Pre-Deployment Audit
+const { SecurityAudit, AuditReport, AUDIT_ATTACKS, generateMutations: auditMutations, runAuditCLI } = safeRequire('./audit', 'audit');
+
+// v7.2.1 — Flight Recorder
+const { FlightRecorder } = safeRequire('./flight-recorder', 'flight-recorder');
+
+// v7.2.1 — HTML Report Generator
+const { generateHTMLReport, generateReportFile } = safeRequire('./report-generator', 'report-generator');
+
+// v7.3 — Supply Chain Verification
+const { ToolChainValidator, ResponseScanner, DomainAllowlist, RESPONSE_INJECTION_PATTERNS, EXFILTRATION_URL_PATTERNS, CREDENTIAL_PATTERNS, CHAIN_SUSPICIOUS_PATTERNS } = safeRequire('./supply-chain', 'supply-chain');
+
+// v7.4 — Herd Immunity
+const { HerdImmunity, ImmuneMemory, createHerdNetwork } = safeRequire('./herd-immunity', 'herd-immunity');
+
+// v7.4 — Adversarial Evolution Simulator
+const { EvolutionSimulator, MutationEngine, hardenFromEvolution } = safeRequire('./evolution-simulator', 'evolution-simulator');
+
+// v7.4 — Attack Replay Platform
+const { AttackReplayEngine, compareDefenses } = safeRequire('./attack-replay', 'attack-replay');
+
+// v7.4 — Enterprise SOC Dashboard
+const { SOCDashboard, SlackAlertChannel, PagerDutyAlertChannel, TeamsAlertChannel } = safeRequire('./soc-dashboard', 'soc-dashboard');
+
+// v7.4 — Attack Genome (loaded when available)
+const { AttackGenome, GenomeDatabase, detectByGenome, INTENT_PATTERNS: GENOME_INTENT_PATTERNS, TECHNIQUE_PATTERNS: GENOME_TECHNIQUE_PATTERNS, EVASION_PATTERNS: GENOME_EVASION_PATTERNS, TARGET_PATTERNS: GENOME_TARGET_PATTERNS } = safeRequire('./attack-genome', 'attack-genome');
+
+// v7.4 — Intent Firewall (loaded when available)
+const { IntentFirewall, ContextAnalyzer: IntentContextAnalyzer, IntentRules, intentDemo, INTENT_CATEGORIES, INTENT_SIGNALS, CONTEXT_MODIFIERS } = safeRequire('./intent-firewall', 'intent-firewall');
+
+// v7.4 — Real Attack Dataset Testing
+const { DatasetRunner, HACKAPROMPT_SAMPLES, TENSORTRUST_SAMPLES, RESEARCH_SAMPLES, BENIGN_SAMPLES } = safeRequire('./real-attack-datasets', 'real-attack-datasets');
+
+// v7.4 — Federated Threat Intelligence
+const { ThreatIntelFederation, createFederationMesh } = safeRequire('./threat-intel-federation', 'threat-intel-federation');
+
+// v7.4 — Behavioral DNA (loaded when available)
+const { BehavioralDNA, AgentProfiler, extractFeatures: extractBehavioralFeatures, DEFAULT_NUMERIC_FEATURES, DEFAULT_CATEGORICAL_FEATURES } = safeRequire('./behavioral-dna', 'behavioral-dna');
+
+// v7.4 — Compliance Certification Authority (loaded when available)
+const { ComplianceCertificateAuthority, ComplianceReport: ComplianceCertReport, ComplianceScheduler, AUTHORITY_FRAMEWORKS, CAPABILITY_MAP: CA_CAPABILITY_MAP, CERTIFICATE_LEVELS: CA_CERTIFICATE_LEVELS } = safeRequire('./compliance-authority', 'compliance-authority');
+
 // --- v1.2 Modules ---
 
 // Semantic Detection
@@ -288,6 +330,8 @@ const _exports = {
   wrapAgent,
   shieldTools,
   extractTextFromBody,
+  rateLimitMiddleware,
+  shieldMiddleware,
 
   // Protection
   CircuitBreaker,
@@ -343,6 +387,8 @@ const _exports = {
   truncate,
   formatHeader,
   generateId,
+  createGracefulShutdown,
+  loadEnvFile,
 
   // Integrations
   ShieldCallbackHandler,
@@ -753,6 +799,93 @@ const _exports = {
   ipiaMiddleware,
   IPIA_FEATURE_NAMES,
   IPIA_INJECTION_LEXICON,
+
+  // v7.2.1 — Pre-Deployment Audit
+  SecurityAudit,
+  AuditReport,
+  AUDIT_ATTACKS,
+  auditMutations,
+  runAuditCLI,
+
+  // v7.2.1 — Flight Recorder
+  FlightRecorder,
+
+  // v7.2.1 — HTML Report Generator
+  generateHTMLReport,
+  generateReportFile,
+
+  // v7.3 — Supply Chain Verification
+  ToolChainValidator,
+  ResponseScanner,
+  DomainAllowlist,
+  RESPONSE_INJECTION_PATTERNS,
+  EXFILTRATION_URL_PATTERNS,
+  CREDENTIAL_PATTERNS,
+  CHAIN_SUSPICIOUS_PATTERNS,
+
+  // v7.4 — Herd Immunity
+  HerdImmunity,
+  ImmuneMemory,
+  createHerdNetwork,
+
+  // v7.4 — Adversarial Evolution Simulator
+  EvolutionSimulator,
+  MutationEngine,
+  hardenFromEvolution,
+
+  // v7.4 — Attack Replay Platform
+  AttackReplayEngine,
+  compareDefenses,
+
+  // v7.4 — Enterprise SOC Dashboard
+  SOCDashboard,
+  SlackAlertChannel,
+  PagerDutyAlertChannel,
+  TeamsAlertChannel,
+
+  // v7.4 — Attack Genome
+  AttackGenome,
+  GenomeDatabase,
+  detectByGenome,
+  GENOME_INTENT_PATTERNS,
+  GENOME_TECHNIQUE_PATTERNS,
+  GENOME_EVASION_PATTERNS,
+  GENOME_TARGET_PATTERNS,
+
+  // v7.4 — Intent Firewall
+  IntentFirewall,
+  IntentContextAnalyzer,
+  IntentRules,
+  intentDemo,
+  INTENT_CATEGORIES,
+  INTENT_SIGNALS,
+  CONTEXT_MODIFIERS,
+
+  // v7.4 — Real Attack Datasets
+  DatasetRunner,
+  HACKAPROMPT_SAMPLES,
+  TENSORTRUST_SAMPLES,
+  RESEARCH_SAMPLES,
+  BENIGN_SAMPLES,
+
+  // v7.4 — Federated Threat Intelligence
+  ThreatIntelFederation,
+  createFederationMesh,
+
+  // v7.4 — Behavioral DNA
+  BehavioralDNA,
+  AgentProfiler,
+  extractBehavioralFeatures,
+  DEFAULT_NUMERIC_FEATURES,
+  DEFAULT_CATEGORICAL_FEATURES,
+
+  // v7.5 — Compliance Certification Authority
+  ComplianceCertificateAuthority,
+  ComplianceCertReport,
+  ComplianceScheduler,
+  AUTHORITY_FRAMEWORKS,
+  CA_CAPABILITY_MAP,
+  CA_CERTIFICATE_LEVELS,
 };
 
 // Filter out undefined exports (from modules that failed to load)

package/src/mcp-security-runtime.js

@@ -23,6 +23,7 @@
  */
 
 const crypto = require('crypto');
+const { createShieldError } = require('./errors');
 const { MCPBridge, MCPSessionGuard, MCPResourceScanner, MCPToolPolicy } = require('./mcp-bridge');
 const { AuthorizationContext, ConfusedDeputyGuard } = require('./confused-deputy');
 const { BehaviorProfile } = require('./behavior-profiling');
@@ -199,14 +200,14 @@ class MCPSecurityRuntime {
    */
   createSession(params) {
     if (!params.userId || !params.agentId) {
-      throw new Error(`${LOG_PREFIX} createSession requires userId and agentId`);
+      throw createShieldError('AS-AUT-004', { reason: 'createSession requires userId and agentId' });
     }
 
     // Enforce per-user session limit
     const userSessions = this._userSessions.get(params.userId) || new Set();
     if (userSessions.size >= this._maxSessionsPerUser) {
       this._audit('session_denied', { userId: params.userId, reason: 'max_sessions_exceeded' });
-      throw new Error(`${LOG_PREFIX} Max sessions (${this._maxSessionsPerUser}) exceeded for user`);
+      throw createShieldError('AS-AUT-005', { userId: params.userId, maxSessions: this._maxSessionsPerUser });
     }
 
     const sessionId = crypto.randomUUID();
@@ -693,18 +694,18 @@ class MCPSecurityRuntime {
   delegateSession(sessionId, delegateAgentId, delegateScopes) {
     const parentSession = this._sessions.get(sessionId);
     if (!parentSession) {
-      throw new Error(`${LOG_PREFIX} Cannot delegate: invalid session`);
+      throw createShieldError('AS-AUT-006', { sessionId, reason: 'Cannot delegate: invalid session' });
     }
 
     // Enforce delegation depth limit
     if ((parentSession.authCtx.delegationDepth || 0) >= this._maxDelegationDepth) {
-      throw new Error(`${LOG_PREFIX} Cannot delegate: max delegation depth (${this._maxDelegationDepth}) exceeded`);
+      throw createShieldError('AS-AUT-007', { maxDepth: this._maxDelegationDepth, reason: 'Cannot delegate: max delegation depth exceeded' });
     }
 
     // Enforce per-user session limit for delegated sessions too
     const userSessions = this._userSessions.get(parentSession.authCtx.userId) || new Set();
     if (userSessions.size >= this._maxSessionsPerUser) {
-      throw new Error(`${LOG_PREFIX} Cannot delegate: max sessions (${this._maxSessionsPerUser}) exceeded for user`);
+      throw createShieldError('AS-AUT-005', { userId: parentSession.authCtx.userId, maxSessions: this._maxSessionsPerUser, reason: 'Cannot delegate: max sessions exceeded for user' });
     }
 
     const childCtx = parentSession.authCtx.delegate(delegateAgentId, delegateScopes);
@@ -812,16 +813,41 @@ class MCPSecurityRuntime {
 
   /**
    * Shuts down the runtime and cleans up resources.
+   * @param {object} [options]
+   * @param {number} [options.timeoutMs=10000] - Max time to wait for drain before forced cleanup.
+   * @returns {Promise<void>}
    */
-  shutdown() {
+  async shutdown(options = {}) {
+    const timeoutMs = options.timeoutMs || 10000;
+
     if (this._cleanupInterval) {
       clearInterval(this._cleanupInterval);
       this._cleanupInterval = null;
     }
-    const sessionIds = [...this._sessions.keys()];
-    for (const sessionId of sessionIds) {
-      this.terminateSession(sessionId);
-    }
+
+    // Drain: wait for in-flight operations with timeout
+    const drainPromise = new Promise((resolve) => {
+      const sessionIds = [...this._sessions.keys()];
+      for (const sessionId of sessionIds) {
+        try {
+          this.terminateSession(sessionId);
+        } catch (err) {
+          console.error(`${LOG_PREFIX} Error terminating session ${sessionId}: ${err.message}`);
+        }
+      }
+      resolve();
+    });
+
+    const timeoutPromise = new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        console.error(`${LOG_PREFIX} Shutdown drain timeout (${timeoutMs}ms), forcing cleanup`);
+        resolve();
+      }, timeoutMs);
+      if (timer.unref) timer.unref();
+    });
+
+    await Promise.race([drainPromise, timeoutPromise]);
+
     this._audit('runtime_shutdown', { totalProcessed: this.stats.toolCallsProcessed });
   }
 

package/src/mcp-server.js

@@ -707,6 +707,11 @@ class MCPServer {
 // =========================================================================
 
 if (require.main === module) {
+  const { createGracefulShutdown, loadEnvFile } = require('./utils');
+
+  // Load .env file if present
+  loadEnvFile();
+
   let config = {};
 
   // Parse --config flag
@@ -726,15 +731,14 @@ if (require.main === module) {
   const server = new MCPServer(config);
   server.start();
 
-  // Graceful shutdown
-  process.on('SIGINT', () => {
-    server.stop();
-    process.exit(0);
-  });
-  process.on('SIGTERM', () => {
-    server.stop();
-    process.exit(0);
+  // Graceful shutdown with timeout enforcement
+  const { shutdown } = createGracefulShutdown({
+    timeoutMs: parseInt(process.env.SHIELD_SHUTDOWN_TIMEOUT_MS, 10) || 10000,
+    cleanupFns: [() => server.stop()]
   });
+
+  process.on('SIGINT', () => shutdown('SIGINT').then(() => process.exit(0)));
+  process.on('SIGTERM', () => shutdown('SIGTERM').then(() => process.exit(0)));
 }
 
 module.exports = { MCPServer, MCPToolHandler };