atabey 0.0.15 → 0.0.16

package/dist/framework-mcp/src/utils/permissions.js

@@ -1,6 +1,50 @@
+/**
+ * ─── RBAC PERMISSION MATRIX ───────────────────────────────────────────────
+ *
+ * Enforces agent-scoped file system permissions at the MCP tool layer.
+ * This is the file-level RBAC enforcement point for:
+ *   - Claude Code  (calls write_file / read_file via MCP sub-agents)
+ *   - Gemini CLI   (calls write_file / read_file via MCP server)
+ *   - Cursor       (calls write_file / read_file via MCP rules)
+ *   - Codex CLI    (calls write_file / read_file via agent allowed-tools)
+ *   - Antigravity  (calls write_file / read_file via customAgentSpec tools)
+ *
+ * Permission matrix is stored in `.atabey/permission-matrix.json`:
+ * {
+ *   "@frontend": { "write": ["apps/web/**"], "read": ["apps/web/**", "docs/**"] },
+ *   "@backend":  { "write": ["apps/backend/**"], "read": ["apps/backend/**", "apps/web/types/**"] }
+ * }
+ *
+ * Agent Tier enforcement:
+ *   supreme (@manager, @security) — no write/read restrictions (omnipotent)
+ *   core    (@backend, @frontend, ...) — matrix-enforced
+ *   recon   (@explorer, @git, @analyst, @native) — read-only by default,
+ *             write requires explicit matrix entry
+ */
 import fs from "fs";
 import path from "path";
 import { resolveFrameworkDir } from "./security.js";
+// ─── Tier hierarchy ─────────────────────────────────────────────────────────
+/** Well-known tier for agents defined in the built-in registry */
+const AGENT_TIER_MAP = {
+    "@manager": "supreme",
+    "@security": "supreme",
+    "@backend": "core",
+    "@frontend": "core",
+    "@mobile": "core",
+    "@quality": "core",
+    "@database": "core",
+    "@devops": "core",
+    "@architect": "core",
+    "@explorer": "recon",
+    "@git": "recon",
+    "@analyst": "recon",
+    "@native": "recon",
+};
+export function getAgentTier(agentName) {
+    return AGENT_TIER_MAP[agentName] ?? "core"; // unknown agents default to core
+}
+// ─── Glob → RegExp ──────────────────────────────────────────────────────────
 function globToRegex(glob) {
     const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
     const step1 = escaped.replace(/\*\*/g, "__DBL_STR__");
@@ -8,65 +52,157 @@ function globToRegex(glob) {
     const regexStr = "^" + step2.replace(/__DBL_STR__/g, ".*") + "$";
     return new RegExp(regexStr);
 }
+// ─── Active Agent Resolution ─────────────────────────────────────────────────
 /**
- * Validates if the active agent has write permission for the target file.
- * Automatically identifies the active agent by checking the status.json store
- * for the agent in the "EXECUTING" state.
+ * Resolves the active agent for the current operation.
+ *
+ * Priority order:
+ * 1. ATABEY_ACTIVE_AGENT env var (set by AgentLoop per-invocation — most reliable)
+ * 2. `.atabey/memory/status.json` first EXECUTING agent (legacy fallback)
+ *
+ * Note: The traceId-scoped approach is preferred when AgentLoop sets
+ * ATABEY_ACTIVE_AGENT before spawning the MCP tool call.
  */
-export function verifyWritePermission(projectRoot, targetFilePath) {
-    const frameworkDir = resolveFrameworkDir(projectRoot);
-    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
-        ? frameworkDir
-        : path.resolve(projectRoot, frameworkDir);
-    const matrixPath = path.join(absoluteFrameworkPath, "permission-matrix.json");
-    // If no permission matrix exists, skip enforcement (default allow)
-    if (!fs.existsSync(matrixPath)) {
-        return;
+export function resolveActiveAgent(frameworkDir) {
+    // 1. Env var (highest reliability — set by orchestration layer)
+    const envAgent = process.env.ATABEY_ACTIVE_AGENT?.trim();
+    if (envAgent) {
+        return envAgent.startsWith("@") ? envAgent : `@${envAgent}`;
     }
-    let matrix;
+    // 2. status.json fallback
+    const statusPath = path.join(frameworkDir, "memory", "status.json");
+    if (!fs.existsSync(statusPath))
+        return null;
     try {
-        matrix = JSON.parse(fs.readFileSync(matrixPath, "utf8"));
+        const status = JSON.parse(fs.readFileSync(statusPath, "utf8"));
+        for (const [agentName, info] of Object.entries(status)) {
+            if (info.state === "EXECUTING") {
+                return agentName.startsWith("@") ? agentName : `@${agentName}`;
+            }
+        }
+    }
+    catch (e) {
+        process.stderr.write(`[Permissions] Warning: Failed to read status.json: ${String(e)}\n`);
+    }
+    return null;
+}
+// ─── Matrix Loader ───────────────────────────────────────────────────────────
+function loadMatrix(frameworkDir) {
+    const matrixPath = path.join(frameworkDir, "permission-matrix.json");
+    if (!fs.existsSync(matrixPath))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(matrixPath, "utf8"));
     }
     catch (e) {
         throw new Error(`Failed to parse permission-matrix.json: ${String(e)}`, { cause: e });
     }
-    // Determine the active agent from status.json
-    const statusPath = path.join(absoluteFrameworkPath, "memory", "status.json");
-    let activeAgent = null;
-    if (fs.existsSync(statusPath)) {
-        try {
-            const status = JSON.parse(fs.readFileSync(statusPath, "utf8"));
-            // Find an agent that is currently in the EXECUTING state
-            for (const [agentName, info] of Object.entries(status)) {
-                const data = info;
-                if (data.state === "EXECUTING") {
-                    activeAgent = agentName.startsWith("@") ? agentName : `@${agentName}`;
-                    break;
-                }
-            }
+}
+/**
+ * Internal enforcement logic for both read and write operations.
+ *
+ * Enforcement logic per tier:
+ * - supreme: always allowed (no matrix needed)
+ * - core: enforced by matrix; if no rule defined → default-allow
+ * - recon: write → always denied unless explicit matrix allow
+ *           read  → allowed by default (recon agents must be able to explore)
+ */
+function enforcePermission(projectRoot, targetFilePath, accessType) {
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
+        ? frameworkDir
+        : path.resolve(projectRoot, frameworkDir);
+    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
+    // No active agent identified → default-allow (non-agent call, e.g. CLI tools)
+    if (!activeAgent)
+        return;
+    const tier = getAgentTier(activeAgent);
+    // Supreme agents are omnipotent — no matrix enforcement
+    if (tier === "supreme")
+        return;
+    // Recon agents: block writes unless explicitly allowed in matrix
+    if (tier === "recon" && accessType === "write") {
+        const matrix = loadMatrix(absoluteFrameworkPath);
+        if (!matrix) {
+            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) cannot write files. ` +
+                "Recon agents (@explorer, @git, @analyst, @native) are read-only by default. " +
+                "Add an explicit write rule to permission-matrix.json to grant write access.");
         }
-        catch (e) {
-            // Log warning but don't crash, default to allowing if status can't be parsed
-            process.stderr.write(`[Permissions] Warning: Failed to read status.json: ${String(e)}\n`);
+        const agentRules = matrix[activeAgent];
+        if (!agentRules?.write?.length) {
+            throw new Error(`Permission Denied: Agent ${activeAgent} (tier: recon) has no write rules in permission-matrix.json. ` +
+                "Recon agents are read-only by default.");
         }
+        // Fall through to glob check below
     }
-    // If no active executing agent is found, default to allowing
-    if (!activeAgent) {
+    const matrix = loadMatrix(absoluteFrameworkPath);
+    // No matrix file → default-allow (matrix is opt-in)
+    if (!matrix)
         return;
-    }
     const agentRules = matrix[activeAgent];
-    // If no rules defined for the agent, default to allowing
-    if (!agentRules || !agentRules.write) {
+    // No rules for this agent → default-allow
+    if (!agentRules)
+        return;
+    const rules = accessType === "write" ? agentRules.write : (agentRules.read ?? null);
+    // No rule for this access type → default-allow
+    if (!rules)
         return;
-    }
-    // Resolve target path relative to project root for glob matching
     const relativeTargetPath = path.relative(projectRoot, path.resolve(projectRoot, targetFilePath));
-    const allowed = agentRules.write.some(glob => {
-        const regex = globToRegex(glob);
-        return regex.test(relativeTargetPath);
-    });
+    const allowed = rules.some(glob => globToRegex(glob).test(relativeTargetPath));
     if (!allowed) {
-        throw new Error(`Permission Denied: Agent ${activeAgent} is not authorized to write to "${relativeTargetPath}". Matrix rules restrict writes to: [${agentRules.write.join(", ")}].`);
+        throw new Error(`Permission Denied: Agent ${activeAgent} (tier: ${tier}) is not authorized to ` +
+            `${accessType} "${relativeTargetPath}". ` +
+            `Matrix rules restrict ${accessType} to: [${rules.join(", ")}].`);
+    }
+}
+// ─── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Verifies that the active agent has WRITE permission for the target file.
+ * Called by: write_file, replace_text, batch_surgical_edit, patch_file
+ *
+ * Throws a descriptive error if permission is denied.
+ */
+export function verifyWritePermission(projectRoot, targetFilePath) {
+    enforcePermission(projectRoot, targetFilePath, "write");
+}
+/**
+ * Verifies that the active agent has READ permission for the target file.
+ * Called by: read_file, view_file (alias)
+ *
+ * Throws a descriptive error if permission is denied.
+ * Note: read enforcement is SOFTER than write — recon agents can read freely
+ * unless an explicit read matrix restriction is defined.
+ */
+export function verifyReadPermission(projectRoot, targetFilePath) {
+    enforcePermission(projectRoot, targetFilePath, "read");
+}
+/**
+ * Verifies that the sender agent is allowed to send messages to the target agent
+ * based on the AgentTier hierarchy.
+ *
+ * Messaging rules (AI IDE governance layer):
+ * - Any tier → supreme:  allowed (escalation always permitted)
+ * - core → core:         allowed
+ * - recon → core:        allowed (recon can delegate up)
+ * - recon → supreme:     allowed
+ * - core → recon:        BLOCKED (core agents should not delegate down to recon)
+ * - supreme → any:       allowed
+ *
+ * Rationale: Recon agents (@explorer, @git) are information-gatherers.
+ * If a core agent delegates to a recon agent, it bypasses the quality gate
+ * and risk engine — a potential governance gap.
+ */
+export function verifyMessagingPermission(fromAgent, toAgent) {
+    const fromTier = getAgentTier(fromAgent);
+    const toTier = getAgentTier(toAgent);
+    // supreme senders: unrestricted
+    if (fromTier === "supreme")
+        return;
+    // core → recon: block (prevents quality-gate bypass via recon delegation)
+    if (fromTier === "core" && toTier === "recon") {
+        throw new Error(`[RBAC] Messaging violation: Agent ${fromAgent} (tier: core) cannot delegate to ` +
+            `${toAgent} (tier: recon). Core agents must delegate up to @manager or peer core agents. ` +
+            "Recon agents are read-only information gatherers and cannot execute delegated tasks.");
     }
 }
 //# sourceMappingURL=permissions.js.map

package/dist/framework-mcp/src/utils/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../../framework-mcp/src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AASpD,SAAS,WAAW,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;IACjE,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,cAAsB;IAC7E,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;IAE9E,mEAAmE;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO;IACX,CAAC;IAED,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC7E,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,yDAAyD;YACzD,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAyB,CAAC;gBACvC,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC7B,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;oBACtE,MAAM;gBACV,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,6EAA6E;YAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,OAAO;IACX,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,yDAAyD;IACzD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO;IACX,CAAC;IAED,iEAAiE;IACjE,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,mCAAmC,kBAAkB,wCAAwC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzL,CAAC;AACL,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../../framework-mcp/src/utils/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAcpD,+EAA+E;AAE/E,kEAAkE;AAClE,MAAM,cAAc,GAA8B;IAC9C,UAAU,EAAG,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,UAAU,EAAG,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,SAAS,EAAI,MAAM;IACnB,UAAU,EAAG,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,SAAS,EAAI,MAAM;IACnB,YAAY,EAAC,MAAM;IACnB,WAAW,EAAE,OAAO;IACpB,MAAM,EAAO,OAAO;IACpB,UAAU,EAAG,OAAO;IACpB,SAAS,EAAI,OAAO;CACvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC1C,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,iCAAiC;AACjF,CAAC;AAED,+EAA+E;AAE/E,SAAS,WAAW,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC;IACjE,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACnD,gEAAgE;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAsC,CAAC;QACpG,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;YACnE,CAAC;QACL,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU,CAAC,YAAoB;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACL,CAAC;AAMD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACtB,WAAmB,EACnB,cAAsB,EACtB,UAAsB;IAEtB,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAE9C,MAAM,WAAW,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,IAAI,CAAC,WAAW;QAAE,OAAO;IAEzB,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAEvC,wDAAwD;IACxD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAE/B,iEAAiE;IACjE,IAAI,IAAI,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACX,4BAA4B,WAAW,qCAAqC;gBAC5E,8EAA8E;gBAC9E,6EAA6E,CAChF,CAAC;QACN,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACX,4BAA4B,WAAW,+DAA+D;gBACtG,wCAAwC,CAC3C,CAAC;QACN,CAAC;QACD,mCAAmC;IACvC,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAEjD,oDAAoD;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvC,0CAA0C;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,KAAK,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAEpF,+CAA+C;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CACpC,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAC5C,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE/E,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACX,4BAA4B,WAAW,WAAW,IAAI,yBAAyB;YAC/E,GAAG,UAAU,KAAK,kBAAkB,KAAK;YACzC,yBAAyB,UAAU,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACnE,CAAC;IACN,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,cAAsB;IAC7E,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,cAAsB;IAC5E,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,OAAe;IACxE,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAK,YAAY,CAAC,OAAO,CAAC,CAAC;IAEvC,gCAAgC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IAEnC,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACX,qCAAqC,SAAS,mCAAmC;YACjF,GAAG,OAAO,gFAAgF;YAC1F,sFAAsF,CACzF,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/framework-mcp/src/utils/prompt-injection.d.ts

@@ -0,0 +1,20 @@
+/**
+ * ─── PROMPT INJECTION PROTECTION ENGINE ────────────────────────────
+ *
+ * Scans, detects, and neutralizes prompt injection payloads in tool outputs
+ * before they are returned to the AI assistant's context.
+ *
+ * This prevents malicious files, code comments, or external resources from
+ * hijacking the AI client (e.g., instructing it to delete files or ignore safety).
+ */
+export declare class PromptInjectionProtection {
+    /**
+     * Scan tool response text for injection patterns.
+     * Replaces any matches with a redirection block and logs it.
+     */
+    static sanitizeResponse(text: string): {
+        sanitized: string;
+        detected: boolean;
+        patterns: string[];
+    };
+}

package/dist/framework-mcp/src/utils/prompt-injection.js

@@ -0,0 +1,64 @@
+/**
+ * ─── PROMPT INJECTION PROTECTION ENGINE ────────────────────────────
+ *
+ * Scans, detects, and neutralizes prompt injection payloads in tool outputs
+ * before they are returned to the AI assistant's context.
+ *
+ * This prevents malicious files, code comments, or external resources from
+ * hijacking the AI client (e.g., instructing it to delete files or ignore safety).
+ */
+import { logger } from "../../../src/shared/logger.js";
+// Common prompt injection signatures
+const INJECTION_PATTERNS = [
+    /ignore\s+(?:all\s+)?instructions/gi,
+    /system\s+override/gi,
+    /you\s+must\s+now/gi,
+    /you\s+are\s+now/gi,
+    /bypass\s+governance/gi,
+    /bypass\s+safety/gi,
+    /bypass\s+atabey/gi,
+    /dan\s+mode/gi,
+    /developer\s+mode/gi,
+    /override\s+system\s+instructions/gi,
+    /ignore\s+safety\s+rules/gi,
+    /\[system\s+prompt\]/gi,
+    /<system_prompt>/gi,
+    /disable\s+restrictions/gi
+];
+export class PromptInjectionProtection {
+    /**
+     * Scan tool response text for injection patterns.
+     * Replaces any matches with a redirection block and logs it.
+     */
+    static sanitizeResponse(text) {
+        if (!text) {
+            return { sanitized: text, detected: false, patterns: [] };
+        }
+        let detected = false;
+        const patternsMatched = [];
+        let sanitized = text;
+        for (const pattern of INJECTION_PATTERNS) {
+            if (pattern.test(sanitized)) {
+                detected = true;
+                const matches = text.match(pattern);
+                if (matches) {
+                    matches.forEach(m => {
+                        if (!patternsMatched.includes(m)) {
+                            patternsMatched.push(m);
+                        }
+                    });
+                }
+                sanitized = sanitized.replace(pattern, "[REDACTED PROMPT INJECTION]");
+            }
+        }
+        if (detected) {
+            logger.warn(`[INJECTION PROTECTION] Blocked prompt injection pattern in tool response: ${patternsMatched.join(", ")}`);
+        }
+        return {
+            sanitized,
+            detected,
+            patterns: patternsMatched
+        };
+    }
+}
+//# sourceMappingURL=prompt-injection.js.map

package/dist/framework-mcp/src/utils/prompt-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection.js","sourceRoot":"","sources":["../../../../framework-mcp/src/utils/prompt-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,qCAAqC;AACrC,MAAM,kBAAkB,GAAG;IACvB,oCAAoC;IACpC,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,mBAAmB;IACnB,cAAc;IACd,oBAAoB;IACpB,oCAAoC;IACpC,2BAA2B;IAC3B,uBAAuB;IACvB,mBAAmB;IACnB,0BAA0B;CAC7B,CAAC;AAEF,MAAM,OAAO,yBAAyB;IAClC;;;OAGG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAAY;QAKvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,SAAS,GAAG,IAAI,CAAC;QAErB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpC,IAAI,OAAO,EAAE,CAAC;oBACV,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;wBAChB,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC/B,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;wBAC5B,CAAC;oBACL,CAAC,CAAC,CAAC;gBACP,CAAC;gBACD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;YAC1E,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,6EAA6E,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,OAAO;YACH,SAAS;YACT,QAAQ;YACR,QAAQ,EAAE,eAAe;SAC5B,CAAC;IACN,CAAC;CACJ"}