clawsec 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +560 -0
- package/dist/bin/clawsec.d.ts +7 -0
- package/dist/bin/clawsec.d.ts.map +1 -0
- package/dist/bin/clawsec.js +12 -0
- package/dist/bin/clawsec.js.map +1 -0
- package/dist/src/actions/block.d.ts +22 -0
- package/dist/src/actions/block.d.ts.map +1 -0
- package/dist/src/actions/block.js +83 -0
- package/dist/src/actions/block.js.map +1 -0
- package/dist/src/actions/confirm.d.ts +35 -0
- package/dist/src/actions/confirm.d.ts.map +1 -0
- package/dist/src/actions/confirm.js +156 -0
- package/dist/src/actions/confirm.js.map +1 -0
- package/dist/src/actions/executor.d.ts +64 -0
- package/dist/src/actions/executor.d.ts.map +1 -0
- package/dist/src/actions/executor.js +114 -0
- package/dist/src/actions/executor.js.map +1 -0
- package/dist/src/actions/index.d.ts +13 -0
- package/dist/src/actions/index.d.ts.map +1 -0
- package/dist/src/actions/index.js +15 -0
- package/dist/src/actions/index.js.map +1 -0
- package/dist/src/actions/log.d.ts +19 -0
- package/dist/src/actions/log.d.ts.map +1 -0
- package/dist/src/actions/log.js +63 -0
- package/dist/src/actions/log.js.map +1 -0
- package/dist/src/actions/types.d.ts +85 -0
- package/dist/src/actions/types.d.ts.map +1 -0
- package/dist/src/actions/types.js +78 -0
- package/dist/src/actions/types.js.map +1 -0
- package/dist/src/actions/warn.d.ts +22 -0
- package/dist/src/actions/warn.d.ts.map +1 -0
- package/dist/src/actions/warn.js +84 -0
- package/dist/src/actions/warn.js.map +1 -0
- package/dist/src/approval/agent-confirm.d.ts +104 -0
- package/dist/src/approval/agent-confirm.d.ts.map +1 -0
- package/dist/src/approval/agent-confirm.js +173 -0
- package/dist/src/approval/agent-confirm.js.map +1 -0
- package/dist/src/approval/index.d.ts +14 -0
- package/dist/src/approval/index.d.ts.map +1 -0
- package/dist/src/approval/index.js +9 -0
- package/dist/src/approval/index.js.map +1 -0
- package/dist/src/approval/native.d.ts +56 -0
- package/dist/src/approval/native.d.ts.map +1 -0
- package/dist/src/approval/native.js +196 -0
- package/dist/src/approval/native.js.map +1 -0
- package/dist/src/approval/store.d.ts +88 -0
- package/dist/src/approval/store.d.ts.map +1 -0
- package/dist/src/approval/store.js +192 -0
- package/dist/src/approval/store.js.map +1 -0
- package/dist/src/approval/types.d.ts +119 -0
- package/dist/src/approval/types.d.ts.map +1 -0
- package/dist/src/approval/types.js +6 -0
- package/dist/src/approval/types.js.map +1 -0
- package/dist/src/approval/webhook.d.ts +170 -0
- package/dist/src/approval/webhook.d.ts.map +1 -0
- package/dist/src/approval/webhook.js +362 -0
- package/dist/src/approval/webhook.js.map +1 -0
- package/dist/src/cli/commands/audit.d.ts +43 -0
- package/dist/src/cli/commands/audit.d.ts.map +1 -0
- package/dist/src/cli/commands/audit.js +115 -0
- package/dist/src/cli/commands/audit.js.map +1 -0
- package/dist/src/cli/commands/feedback.d.ts +27 -0
- package/dist/src/cli/commands/feedback.d.ts.map +1 -0
- package/dist/src/cli/commands/feedback.js +228 -0
- package/dist/src/cli/commands/feedback.js.map +1 -0
- package/dist/src/cli/commands/index.d.ts +11 -0
- package/dist/src/cli/commands/index.d.ts.map +1 -0
- package/dist/src/cli/commands/index.js +13 -0
- package/dist/src/cli/commands/index.js.map +1 -0
- package/dist/src/cli/commands/status.d.ts +20 -0
- package/dist/src/cli/commands/status.d.ts.map +1 -0
- package/dist/src/cli/commands/status.js +122 -0
- package/dist/src/cli/commands/status.js.map +1 -0
- package/dist/src/cli/commands/test.d.ts +23 -0
- package/dist/src/cli/commands/test.d.ts.map +1 -0
- package/dist/src/cli/commands/test.js +134 -0
- package/dist/src/cli/commands/test.js.map +1 -0
- package/dist/src/cli/commands/types.d.ts +81 -0
- package/dist/src/cli/commands/types.d.ts.map +1 -0
- package/dist/src/cli/commands/types.js +6 -0
- package/dist/src/cli/commands/types.js.map +1 -0
- package/dist/src/cli/index.d.ts +17 -0
- package/dist/src/cli/index.d.ts.map +1 -0
- package/dist/src/cli/index.js +267 -0
- package/dist/src/cli/index.js.map +1 -0
- package/dist/src/config/defaults.d.ts +20 -0
- package/dist/src/config/defaults.d.ts.map +1 -0
- package/dist/src/config/defaults.js +123 -0
- package/dist/src/config/defaults.js.map +1 -0
- package/dist/src/config/index.d.ts +8 -0
- package/dist/src/config/index.d.ts.map +1 -0
- package/dist/src/config/index.js +41 -0
- package/dist/src/config/index.js.map +1 -0
- package/dist/src/config/loader.d.ts +99 -0
- package/dist/src/config/loader.d.ts.map +1 -0
- package/dist/src/config/loader.js +242 -0
- package/dist/src/config/loader.js.map +1 -0
- package/dist/src/config/schema.d.ts +627 -0
- package/dist/src/config/schema.d.ts.map +1 -0
- package/dist/src/config/schema.js +585 -0
- package/dist/src/config/schema.js.map +1 -0
- package/dist/src/detectors/destructive/cloud-detector.d.ts +51 -0
- package/dist/src/detectors/destructive/cloud-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/cloud-detector.js +556 -0
- package/dist/src/detectors/destructive/cloud-detector.js.map +1 -0
- package/dist/src/detectors/destructive/code-detector.d.ts +59 -0
- package/dist/src/detectors/destructive/code-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/code-detector.js +558 -0
- package/dist/src/detectors/destructive/code-detector.js.map +1 -0
- package/dist/src/detectors/destructive/index.d.ts +54 -0
- package/dist/src/detectors/destructive/index.d.ts.map +1 -0
- package/dist/src/detectors/destructive/index.js +168 -0
- package/dist/src/detectors/destructive/index.js.map +1 -0
- package/dist/src/detectors/destructive/shell-detector.d.ts +43 -0
- package/dist/src/detectors/destructive/shell-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/shell-detector.js +302 -0
- package/dist/src/detectors/destructive/shell-detector.js.map +1 -0
- package/dist/src/detectors/destructive/types.d.ts +143 -0
- package/dist/src/detectors/destructive/types.d.ts.map +1 -0
- package/dist/src/detectors/destructive/types.js +6 -0
- package/dist/src/detectors/destructive/types.js.map +1 -0
- package/dist/src/detectors/exfiltration/cloud-detector.d.ts +51 -0
- package/dist/src/detectors/exfiltration/cloud-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/cloud-detector.js +427 -0
- package/dist/src/detectors/exfiltration/cloud-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/http-detector.d.ts +47 -0
- package/dist/src/detectors/exfiltration/http-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/http-detector.js +429 -0
- package/dist/src/detectors/exfiltration/http-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/index.d.ts +44 -0
- package/dist/src/detectors/exfiltration/index.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/index.js +118 -0
- package/dist/src/detectors/exfiltration/index.js.map +1 -0
- package/dist/src/detectors/exfiltration/network-detector.d.ts +55 -0
- package/dist/src/detectors/exfiltration/network-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/network-detector.js +504 -0
- package/dist/src/detectors/exfiltration/network-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/types.d.ts +139 -0
- package/dist/src/detectors/exfiltration/types.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/types.js +6 -0
- package/dist/src/detectors/exfiltration/types.js.map +1 -0
- package/dist/src/detectors/purchase/domain-detector.d.ts +44 -0
- package/dist/src/detectors/purchase/domain-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/domain-detector.js +296 -0
- package/dist/src/detectors/purchase/domain-detector.js.map +1 -0
- package/dist/src/detectors/purchase/form-detector.d.ts +27 -0
- package/dist/src/detectors/purchase/form-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/form-detector.js +344 -0
- package/dist/src/detectors/purchase/form-detector.js.map +1 -0
- package/dist/src/detectors/purchase/index.d.ts +65 -0
- package/dist/src/detectors/purchase/index.d.ts.map +1 -0
- package/dist/src/detectors/purchase/index.js +216 -0
- package/dist/src/detectors/purchase/index.js.map +1 -0
- package/dist/src/detectors/purchase/spend-tracker.d.ts +132 -0
- package/dist/src/detectors/purchase/spend-tracker.d.ts.map +1 -0
- package/dist/src/detectors/purchase/spend-tracker.js +313 -0
- package/dist/src/detectors/purchase/spend-tracker.js.map +1 -0
- package/dist/src/detectors/purchase/types.d.ts +139 -0
- package/dist/src/detectors/purchase/types.d.ts.map +1 -0
- package/dist/src/detectors/purchase/types.js +6 -0
- package/dist/src/detectors/purchase/types.js.map +1 -0
- package/dist/src/detectors/purchase/url-detector.d.ts +31 -0
- package/dist/src/detectors/purchase/url-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/url-detector.js +292 -0
- package/dist/src/detectors/purchase/url-detector.js.map +1 -0
- package/dist/src/detectors/secrets/api-key-detector.d.ts +30 -0
- package/dist/src/detectors/secrets/api-key-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/api-key-detector.js +297 -0
- package/dist/src/detectors/secrets/api-key-detector.js.map +1 -0
- package/dist/src/detectors/secrets/index.d.ts +43 -0
- package/dist/src/detectors/secrets/index.d.ts.map +1 -0
- package/dist/src/detectors/secrets/index.js +261 -0
- package/dist/src/detectors/secrets/index.js.map +1 -0
- package/dist/src/detectors/secrets/pii-detector.d.ts +54 -0
- package/dist/src/detectors/secrets/pii-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/pii-detector.js +286 -0
- package/dist/src/detectors/secrets/pii-detector.js.map +1 -0
- package/dist/src/detectors/secrets/token-detector.d.ts +51 -0
- package/dist/src/detectors/secrets/token-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/token-detector.js +233 -0
- package/dist/src/detectors/secrets/token-detector.js.map +1 -0
- package/dist/src/detectors/secrets/types.d.ts +157 -0
- package/dist/src/detectors/secrets/types.d.ts.map +1 -0
- package/dist/src/detectors/secrets/types.js +6 -0
- package/dist/src/detectors/secrets/types.js.map +1 -0
- package/dist/src/detectors/website/category-detector.d.ts +22 -0
- package/dist/src/detectors/website/category-detector.d.ts.map +1 -0
- package/dist/src/detectors/website/category-detector.js +162 -0
- package/dist/src/detectors/website/category-detector.js.map +1 -0
- package/dist/src/detectors/website/index.d.ts +53 -0
- package/dist/src/detectors/website/index.d.ts.map +1 -0
- package/dist/src/detectors/website/index.js +232 -0
- package/dist/src/detectors/website/index.js.map +1 -0
- package/dist/src/detectors/website/pattern-matcher.d.ts +33 -0
- package/dist/src/detectors/website/pattern-matcher.d.ts.map +1 -0
- package/dist/src/detectors/website/pattern-matcher.js +121 -0
- package/dist/src/detectors/website/pattern-matcher.js.map +1 -0
- package/dist/src/detectors/website/types.d.ts +105 -0
- package/dist/src/detectors/website/types.d.ts.map +1 -0
- package/dist/src/detectors/website/types.js +6 -0
- package/dist/src/detectors/website/types.js.map +1 -0
- package/dist/src/engine/analyzer.d.ts +87 -0
- package/dist/src/engine/analyzer.d.ts.map +1 -0
- package/dist/src/engine/analyzer.js +427 -0
- package/dist/src/engine/analyzer.js.map +1 -0
- package/dist/src/engine/cache.d.ts +80 -0
- package/dist/src/engine/cache.d.ts.map +1 -0
- package/dist/src/engine/cache.js +167 -0
- package/dist/src/engine/cache.js.map +1 -0
- package/dist/src/engine/index.d.ts +11 -0
- package/dist/src/engine/index.d.ts.map +1 -0
- package/dist/src/engine/index.js +11 -0
- package/dist/src/engine/index.js.map +1 -0
- package/dist/src/engine/llm-client.d.ts +210 -0
- package/dist/src/engine/llm-client.d.ts.map +1 -0
- package/dist/src/engine/llm-client.js +506 -0
- package/dist/src/engine/llm-client.js.map +1 -0
- package/dist/src/engine/types.d.ts +163 -0
- package/dist/src/engine/types.d.ts.map +1 -0
- package/dist/src/engine/types.js +21 -0
- package/dist/src/engine/types.js.map +1 -0
- package/dist/src/feedback/index.d.ts +9 -0
- package/dist/src/feedback/index.d.ts.map +1 -0
- package/dist/src/feedback/index.js +8 -0
- package/dist/src/feedback/index.js.map +1 -0
- package/dist/src/feedback/learner.d.ts +222 -0
- package/dist/src/feedback/learner.d.ts.map +1 -0
- package/dist/src/feedback/learner.js +401 -0
- package/dist/src/feedback/learner.js.map +1 -0
- package/dist/src/feedback/store.d.ts +113 -0
- package/dist/src/feedback/store.d.ts.map +1 -0
- package/dist/src/feedback/store.js +228 -0
- package/dist/src/feedback/store.js.map +1 -0
- package/dist/src/feedback/types.d.ts +126 -0
- package/dist/src/feedback/types.d.ts.map +1 -0
- package/dist/src/feedback/types.js +6 -0
- package/dist/src/feedback/types.js.map +1 -0
- package/dist/src/hooks/before-agent-start/handler.d.ts +37 -0
- package/dist/src/hooks/before-agent-start/handler.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/handler.js +109 -0
- package/dist/src/hooks/before-agent-start/handler.js.map +1 -0
- package/dist/src/hooks/before-agent-start/index.d.ts +8 -0
- package/dist/src/hooks/before-agent-start/index.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/index.js +7 -0
- package/dist/src/hooks/before-agent-start/index.js.map +1 -0
- package/dist/src/hooks/before-agent-start/prompts.d.ts +48 -0
- package/dist/src/hooks/before-agent-start/prompts.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/prompts.js +103 -0
- package/dist/src/hooks/before-agent-start/prompts.js.map +1 -0
- package/dist/src/hooks/before-tool-call/handler.d.ts +42 -0
- package/dist/src/hooks/before-tool-call/handler.d.ts.map +1 -0
- package/dist/src/hooks/before-tool-call/handler.js +226 -0
- package/dist/src/hooks/before-tool-call/handler.js.map +1 -0
- package/dist/src/hooks/before-tool-call/index.d.ts +7 -0
- package/dist/src/hooks/before-tool-call/index.d.ts.map +1 -0
- package/dist/src/hooks/before-tool-call/index.js +6 -0
- package/dist/src/hooks/before-tool-call/index.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/filter.d.ts +72 -0
- package/dist/src/hooks/tool-result-persist/filter.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/filter.js +305 -0
- package/dist/src/hooks/tool-result-persist/filter.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/handler.d.ts +49 -0
- package/dist/src/hooks/tool-result-persist/handler.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/handler.js +217 -0
- package/dist/src/hooks/tool-result-persist/handler.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/index.d.ts +11 -0
- package/dist/src/hooks/tool-result-persist/index.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/index.js +11 -0
- package/dist/src/hooks/tool-result-persist/index.js.map +1 -0
- package/dist/src/index.d.ts +256 -0
- package/dist/src/index.d.ts.map +1 -0
- package/dist/src/index.js +222 -0
- package/dist/src/index.js.map +1 -0
- package/dist/src/notifications/discord.d.ts +10 -0
- package/dist/src/notifications/discord.d.ts.map +1 -0
- package/dist/src/notifications/discord.js +218 -0
- package/dist/src/notifications/discord.js.map +1 -0
- package/dist/src/notifications/index.d.ts +37 -0
- package/dist/src/notifications/index.d.ts.map +1 -0
- package/dist/src/notifications/index.js +68 -0
- package/dist/src/notifications/index.js.map +1 -0
- package/dist/src/notifications/slack.d.ts +10 -0
- package/dist/src/notifications/slack.d.ts.map +1 -0
- package/dist/src/notifications/slack.js +218 -0
- package/dist/src/notifications/slack.js.map +1 -0
- package/dist/src/notifications/telegram.d.ts +10 -0
- package/dist/src/notifications/telegram.d.ts.map +1 -0
- package/dist/src/notifications/telegram.js +242 -0
- package/dist/src/notifications/telegram.js.map +1 -0
- package/dist/src/notifications/types.d.ts +119 -0
- package/dist/src/notifications/types.d.ts.map +1 -0
- package/dist/src/notifications/types.js +6 -0
- package/dist/src/notifications/types.js.map +1 -0
- package/dist/src/proxy/index.d.ts +8 -0
- package/dist/src/proxy/index.d.ts.map +1 -0
- package/dist/src/proxy/index.js +9 -0
- package/dist/src/proxy/index.js.map +1 -0
- package/dist/src/proxy/middleware.d.ts +55 -0
- package/dist/src/proxy/middleware.d.ts.map +1 -0
- package/dist/src/proxy/middleware.js +215 -0
- package/dist/src/proxy/middleware.js.map +1 -0
- package/dist/src/proxy/server.d.ts +57 -0
- package/dist/src/proxy/server.d.ts.map +1 -0
- package/dist/src/proxy/server.js +298 -0
- package/dist/src/proxy/server.js.map +1 -0
- package/dist/src/proxy/types.d.ts +136 -0
- package/dist/src/proxy/types.d.ts.map +1 -0
- package/dist/src/proxy/types.js +6 -0
- package/dist/src/proxy/types.js.map +1 -0
- package/dist/src/sanitization/index.d.ts +10 -0
- package/dist/src/sanitization/index.d.ts.map +1 -0
- package/dist/src/sanitization/index.js +9 -0
- package/dist/src/sanitization/index.js.map +1 -0
- package/dist/src/sanitization/patterns.d.ts +51 -0
- package/dist/src/sanitization/patterns.d.ts.map +1 -0
- package/dist/src/sanitization/patterns.js +266 -0
- package/dist/src/sanitization/patterns.js.map +1 -0
- package/dist/src/sanitization/scanner.d.ts +29 -0
- package/dist/src/sanitization/scanner.d.ts.map +1 -0
- package/dist/src/sanitization/scanner.js +328 -0
- package/dist/src/sanitization/scanner.js.map +1 -0
- package/dist/src/sanitization/types.d.ts +57 -0
- package/dist/src/sanitization/types.d.ts.map +1 -0
- package/dist/src/sanitization/types.js +5 -0
- package/dist/src/sanitization/types.js.map +1 -0
- package/openclaw.plugin.json +114 -0
- package/package.json +63 -0
- package/rules/builtin/README.md +139 -0
- package/rules/builtin/ai-services.yaml +70 -0
- package/rules/builtin/api-keys.yaml +64 -0
- package/rules/builtin/authentication.yaml +56 -0
- package/rules/builtin/aws-security.yaml +57 -0
- package/rules/builtin/azure-security.yaml +58 -0
- package/rules/builtin/cicd-security.yaml +64 -0
- package/rules/builtin/cloud-storage.yaml +64 -0
- package/rules/builtin/container-registry.yaml +55 -0
- package/rules/builtin/crypto-wallets.yaml +71 -0
- package/rules/builtin/database-nosql.yaml +58 -0
- package/rules/builtin/database-sql.yaml +62 -0
- package/rules/builtin/development-env.yaml +67 -0
- package/rules/builtin/docker.yaml +57 -0
- package/rules/builtin/filesystem.yaml +71 -0
- package/rules/builtin/financial-pci.yaml +61 -0
- package/rules/builtin/gcp-security.yaml +57 -0
- package/rules/builtin/git-operations.yaml +68 -0
- package/rules/builtin/healthcare-hipaa.yaml +64 -0
- package/rules/builtin/kubernetes.yaml +60 -0
- package/rules/builtin/messaging-services.yaml +53 -0
- package/rules/builtin/minimal.yaml +47 -0
- package/rules/builtin/mobile-development.yaml +61 -0
- package/rules/builtin/monitoring.yaml +63 -0
- package/rules/builtin/network-security.yaml +57 -0
- package/rules/builtin/package-managers.yaml +74 -0
- package/rules/builtin/payment-processing.yaml +66 -0
- package/rules/builtin/pii-protection.yaml +48 -0
- package/rules/builtin/production-strict.yaml +55 -0
- package/rules/builtin/secrets-management.yaml +63 -0
- package/rules/builtin/serverless.yaml +74 -0
- package/rules/builtin/ssh-security.yaml +66 -0
- package/rules/builtin/terraform.yaml +51 -0
- package/rules/builtin/web-security.yaml +62 -0
|
@@ -0,0 +1,585 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Clawsec Configuration Schema
|
|
3
|
+
* Zod schemas and TypeScript types for the security plugin configuration
|
|
4
|
+
*/
|
|
5
|
+
import { z } from 'zod';
|
|
6
|
+
// =============================================================================
|
|
7
|
+
// ENUMS
|
|
8
|
+
// =============================================================================
|
|
9
|
+
/**
|
|
10
|
+
* Severity levels for security detections
|
|
11
|
+
*/
|
|
12
|
+
export const SeveritySchema = z.enum(['critical', 'high', 'medium', 'low']);
|
|
13
|
+
/**
|
|
14
|
+
* Actions that can be taken when a threat is detected
|
|
15
|
+
*/
|
|
16
|
+
export const ActionSchema = z.enum(['block', 'confirm', 'agent-confirm', 'warn', 'log']);
|
|
17
|
+
/**
|
|
18
|
+
* Log levels for the plugin
|
|
19
|
+
*/
|
|
20
|
+
export const LogLevelSchema = z.enum(['debug', 'info', 'warn', 'error']);
|
|
21
|
+
/**
|
|
22
|
+
* Mode for domain/website filtering
|
|
23
|
+
*/
|
|
24
|
+
export const FilterModeSchema = z.enum(['blocklist', 'allowlist']);
|
|
25
|
+
// =============================================================================
|
|
26
|
+
// GLOBAL CONFIGURATION
|
|
27
|
+
// =============================================================================
|
|
28
|
+
/**
|
|
29
|
+
* Global plugin settings
|
|
30
|
+
*/
|
|
31
|
+
export const GlobalConfigSchema = z.object({
|
|
32
|
+
/** Whether the plugin is enabled */
|
|
33
|
+
enabled: z.boolean().default(true),
|
|
34
|
+
/** Log level for the plugin */
|
|
35
|
+
logLevel: LogLevelSchema.default('info'),
|
|
36
|
+
}).default(() => ({
|
|
37
|
+
enabled: true,
|
|
38
|
+
logLevel: 'info',
|
|
39
|
+
}));
|
|
40
|
+
// =============================================================================
|
|
41
|
+
// LLM CONFIGURATION
|
|
42
|
+
// =============================================================================
|
|
43
|
+
/**
|
|
44
|
+
* LLM integration settings
|
|
45
|
+
*/
|
|
46
|
+
export const LLMConfigSchema = z.object({
|
|
47
|
+
/** Whether LLM-based detection is enabled */
|
|
48
|
+
enabled: z.boolean().default(true),
|
|
49
|
+
/** Model to use (null means use OpenClaw's configured model) */
|
|
50
|
+
model: z.string().nullable().default(null),
|
|
51
|
+
}).default(() => ({
|
|
52
|
+
enabled: true,
|
|
53
|
+
model: null,
|
|
54
|
+
}));
|
|
55
|
+
// =============================================================================
|
|
56
|
+
// PURCHASE RULE CONFIGURATION
|
|
57
|
+
// =============================================================================
|
|
58
|
+
/**
|
|
59
|
+
* Spending limits for purchase protection
|
|
60
|
+
*/
|
|
61
|
+
export const SpendLimitsSchema = z.object({
|
|
62
|
+
/** Maximum amount per transaction */
|
|
63
|
+
perTransaction: z.number().nonnegative().default(100),
|
|
64
|
+
/** Maximum daily spending amount */
|
|
65
|
+
daily: z.number().nonnegative().default(500),
|
|
66
|
+
}).default(() => ({
|
|
67
|
+
perTransaction: 100,
|
|
68
|
+
daily: 500,
|
|
69
|
+
}));
|
|
70
|
+
/**
|
|
71
|
+
* Domain filtering configuration for purchases
|
|
72
|
+
*/
|
|
73
|
+
export const PurchaseDomainsSchema = z.object({
|
|
74
|
+
/** Mode for domain filtering */
|
|
75
|
+
mode: FilterModeSchema.default('blocklist'),
|
|
76
|
+
/** Domains to block (supports glob patterns) */
|
|
77
|
+
blocklist: z.array(z.string()).default([]),
|
|
78
|
+
}).default(() => ({
|
|
79
|
+
mode: 'blocklist',
|
|
80
|
+
blocklist: [],
|
|
81
|
+
}));
|
|
82
|
+
/**
|
|
83
|
+
* Purchase protection rule configuration
|
|
84
|
+
*/
|
|
85
|
+
export const PurchaseRuleSchema = z.object({
|
|
86
|
+
/** Whether purchase protection is enabled */
|
|
87
|
+
enabled: z.boolean().default(true),
|
|
88
|
+
/** Severity level for purchase detections */
|
|
89
|
+
severity: SeveritySchema.default('critical'),
|
|
90
|
+
/** Action to take when purchase is detected */
|
|
91
|
+
action: ActionSchema.default('block'),
|
|
92
|
+
/** Spending limits */
|
|
93
|
+
spendLimits: SpendLimitsSchema.optional().default(() => ({
|
|
94
|
+
perTransaction: 100,
|
|
95
|
+
daily: 500,
|
|
96
|
+
})),
|
|
97
|
+
/** Domain configuration */
|
|
98
|
+
domains: PurchaseDomainsSchema.optional().default(() => ({
|
|
99
|
+
mode: 'blocklist',
|
|
100
|
+
blocklist: [],
|
|
101
|
+
})),
|
|
102
|
+
}).default(() => ({
|
|
103
|
+
enabled: true,
|
|
104
|
+
severity: 'critical',
|
|
105
|
+
action: 'block',
|
|
106
|
+
spendLimits: { perTransaction: 100, daily: 500 },
|
|
107
|
+
domains: { mode: 'blocklist', blocklist: [] },
|
|
108
|
+
}));
|
|
109
|
+
// =============================================================================
|
|
110
|
+
// WEBSITE RULE CONFIGURATION
|
|
111
|
+
// =============================================================================
|
|
112
|
+
/**
|
|
113
|
+
* Website control rule configuration
|
|
114
|
+
*/
|
|
115
|
+
export const WebsiteRuleSchema = z.object({
|
|
116
|
+
/** Whether website control is enabled */
|
|
117
|
+
enabled: z.boolean().default(true),
|
|
118
|
+
/** Mode for website filtering */
|
|
119
|
+
mode: FilterModeSchema.default('blocklist'),
|
|
120
|
+
/** Severity level for website detections */
|
|
121
|
+
severity: SeveritySchema.default('high'),
|
|
122
|
+
/** Action to take when blocked website is accessed */
|
|
123
|
+
action: ActionSchema.default('block'),
|
|
124
|
+
/** Websites to block (supports glob patterns like *.malware.com) */
|
|
125
|
+
blocklist: z.array(z.string()).default([]),
|
|
126
|
+
/** Websites to allow (supports glob patterns) */
|
|
127
|
+
allowlist: z.array(z.string()).default([]),
|
|
128
|
+
}).default(() => ({
|
|
129
|
+
enabled: true,
|
|
130
|
+
mode: 'blocklist',
|
|
131
|
+
severity: 'high',
|
|
132
|
+
action: 'block',
|
|
133
|
+
blocklist: [],
|
|
134
|
+
allowlist: [],
|
|
135
|
+
}));
|
|
136
|
+
// =============================================================================
|
|
137
|
+
// DESTRUCTIVE COMMANDS RULE CONFIGURATION
|
|
138
|
+
// =============================================================================
|
|
139
|
+
/**
|
|
140
|
+
* Shell command protection configuration
|
|
141
|
+
*/
|
|
142
|
+
export const ShellProtectionSchema = z.object({
|
|
143
|
+
/** Whether shell command protection is enabled */
|
|
144
|
+
enabled: z.boolean().default(true),
|
|
145
|
+
}).default(() => ({ enabled: true }));
|
|
146
|
+
/**
|
|
147
|
+
* Cloud operation protection configuration
|
|
148
|
+
*/
|
|
149
|
+
export const CloudProtectionSchema = z.object({
|
|
150
|
+
/** Whether cloud operation protection is enabled */
|
|
151
|
+
enabled: z.boolean().default(true),
|
|
152
|
+
}).default(() => ({ enabled: true }));
|
|
153
|
+
/**
|
|
154
|
+
* Code pattern protection configuration
|
|
155
|
+
*/
|
|
156
|
+
export const CodeProtectionSchema = z.object({
|
|
157
|
+
/** Whether code pattern protection is enabled */
|
|
158
|
+
enabled: z.boolean().default(true),
|
|
159
|
+
}).default(() => ({ enabled: true }));
|
|
160
|
+
/**
|
|
161
|
+
* Destructive commands rule configuration
|
|
162
|
+
*/
|
|
163
|
+
export const DestructiveRuleSchema = z.object({
|
|
164
|
+
/** Whether destructive command protection is enabled */
|
|
165
|
+
enabled: z.boolean().default(true),
|
|
166
|
+
/** Severity level for destructive command detections */
|
|
167
|
+
severity: SeveritySchema.default('critical'),
|
|
168
|
+
/** Action to take when destructive command is detected */
|
|
169
|
+
action: ActionSchema.default('confirm'),
|
|
170
|
+
/** Shell command protection settings */
|
|
171
|
+
shell: ShellProtectionSchema.optional().default(() => ({ enabled: true })),
|
|
172
|
+
/** Cloud operation protection settings */
|
|
173
|
+
cloud: CloudProtectionSchema.optional().default(() => ({ enabled: true })),
|
|
174
|
+
/** Code pattern protection settings */
|
|
175
|
+
code: CodeProtectionSchema.optional().default(() => ({ enabled: true })),
|
|
176
|
+
}).default(() => ({
|
|
177
|
+
enabled: true,
|
|
178
|
+
severity: 'critical',
|
|
179
|
+
action: 'confirm',
|
|
180
|
+
shell: { enabled: true },
|
|
181
|
+
cloud: { enabled: true },
|
|
182
|
+
code: { enabled: true },
|
|
183
|
+
}));
|
|
184
|
+
// =============================================================================
|
|
185
|
+
// OUTPUT SANITIZATION CONFIGURATION
|
|
186
|
+
// =============================================================================
|
|
187
|
+
/**
|
|
188
|
+
* Injection scanner category configuration
|
|
189
|
+
*/
|
|
190
|
+
export const InjectionCategoriesSchema = z.object({
|
|
191
|
+
/** Detect instruction override attempts */
|
|
192
|
+
instructionOverride: z.boolean().default(true),
|
|
193
|
+
/** Detect system prompt leak attempts */
|
|
194
|
+
systemLeak: z.boolean().default(true),
|
|
195
|
+
/** Detect jailbreak patterns */
|
|
196
|
+
jailbreak: z.boolean().default(true),
|
|
197
|
+
/** Detect encoded payloads */
|
|
198
|
+
encodedPayload: z.boolean().default(true),
|
|
199
|
+
}).default(() => ({
|
|
200
|
+
instructionOverride: true,
|
|
201
|
+
systemLeak: true,
|
|
202
|
+
jailbreak: true,
|
|
203
|
+
encodedPayload: true,
|
|
204
|
+
}));
|
|
205
|
+
/**
|
|
206
|
+
* Output sanitization rule configuration
|
|
207
|
+
*/
|
|
208
|
+
export const SanitizationRuleSchema = z.object({
|
|
209
|
+
/** Whether output sanitization is enabled */
|
|
210
|
+
enabled: z.boolean().default(true),
|
|
211
|
+
/** Severity level for injection detections */
|
|
212
|
+
severity: SeveritySchema.default('high'),
|
|
213
|
+
/** Action to take when injection is detected */
|
|
214
|
+
action: ActionSchema.default('block'),
|
|
215
|
+
/** Minimum confidence threshold (0.0-1.0) */
|
|
216
|
+
minConfidence: z.number().min(0).max(1).default(0.5),
|
|
217
|
+
/** Whether to redact detected injections (vs blocking entirely) */
|
|
218
|
+
redactMatches: z.boolean().default(false),
|
|
219
|
+
/** Categories to scan for */
|
|
220
|
+
categories: InjectionCategoriesSchema.optional().default(() => ({
|
|
221
|
+
instructionOverride: true,
|
|
222
|
+
systemLeak: true,
|
|
223
|
+
jailbreak: true,
|
|
224
|
+
encodedPayload: true,
|
|
225
|
+
})),
|
|
226
|
+
}).default(() => ({
|
|
227
|
+
enabled: true,
|
|
228
|
+
severity: 'high',
|
|
229
|
+
action: 'block',
|
|
230
|
+
minConfidence: 0.5,
|
|
231
|
+
redactMatches: false,
|
|
232
|
+
categories: {
|
|
233
|
+
instructionOverride: true,
|
|
234
|
+
systemLeak: true,
|
|
235
|
+
jailbreak: true,
|
|
236
|
+
encodedPayload: true,
|
|
237
|
+
},
|
|
238
|
+
}));
|
|
239
|
+
// =============================================================================
|
|
240
|
+
// SECRETS/PII RULE CONFIGURATION
|
|
241
|
+
// =============================================================================
|
|
242
|
+
/**
|
|
243
|
+
* Secrets and PII detection rule configuration
|
|
244
|
+
*/
|
|
245
|
+
export const SecretsRuleSchema = z.object({
|
|
246
|
+
/** Whether secrets/PII detection is enabled */
|
|
247
|
+
enabled: z.boolean().default(true),
|
|
248
|
+
/** Severity level for secrets detections */
|
|
249
|
+
severity: SeveritySchema.default('critical'),
|
|
250
|
+
/** Action to take when secrets are detected */
|
|
251
|
+
action: ActionSchema.default('block'),
|
|
252
|
+
}).default(() => ({
|
|
253
|
+
enabled: true,
|
|
254
|
+
severity: 'critical',
|
|
255
|
+
action: 'block',
|
|
256
|
+
}));
|
|
257
|
+
// =============================================================================
|
|
258
|
+
// DATA EXFILTRATION RULE CONFIGURATION
|
|
259
|
+
// =============================================================================
|
|
260
|
+
/**
|
|
261
|
+
* Data exfiltration detection rule configuration
|
|
262
|
+
*/
|
|
263
|
+
export const ExfiltrationRuleSchema = z.object({
|
|
264
|
+
/** Whether data exfiltration detection is enabled */
|
|
265
|
+
enabled: z.boolean().default(true),
|
|
266
|
+
/** Severity level for exfiltration detections */
|
|
267
|
+
severity: SeveritySchema.default('high'),
|
|
268
|
+
/** Action to take when exfiltration is detected */
|
|
269
|
+
action: ActionSchema.default('block'),
|
|
270
|
+
}).default(() => ({
|
|
271
|
+
enabled: true,
|
|
272
|
+
severity: 'high',
|
|
273
|
+
action: 'block',
|
|
274
|
+
}));
|
|
275
|
+
// =============================================================================
|
|
276
|
+
// RULES CONFIGURATION
|
|
277
|
+
// =============================================================================
|
|
278
|
+
/**
|
|
279
|
+
* All security rules configuration
|
|
280
|
+
*/
|
|
281
|
+
export const RulesConfigSchema = z.object({
|
|
282
|
+
/** Purchase protection rules */
|
|
283
|
+
purchase: PurchaseRuleSchema.optional().default(() => ({
|
|
284
|
+
enabled: true,
|
|
285
|
+
severity: 'critical',
|
|
286
|
+
action: 'block',
|
|
287
|
+
spendLimits: { perTransaction: 100, daily: 500 },
|
|
288
|
+
domains: { mode: 'blocklist', blocklist: [] },
|
|
289
|
+
})),
|
|
290
|
+
/** Website control rules */
|
|
291
|
+
website: WebsiteRuleSchema.optional().default(() => ({
|
|
292
|
+
enabled: true,
|
|
293
|
+
mode: 'blocklist',
|
|
294
|
+
severity: 'high',
|
|
295
|
+
action: 'block',
|
|
296
|
+
blocklist: [],
|
|
297
|
+
allowlist: [],
|
|
298
|
+
})),
|
|
299
|
+
/** Destructive command rules */
|
|
300
|
+
destructive: DestructiveRuleSchema.optional().default(() => ({
|
|
301
|
+
enabled: true,
|
|
302
|
+
severity: 'critical',
|
|
303
|
+
action: 'confirm',
|
|
304
|
+
shell: { enabled: true },
|
|
305
|
+
cloud: { enabled: true },
|
|
306
|
+
code: { enabled: true },
|
|
307
|
+
})),
|
|
308
|
+
/** Secrets/PII detection rules */
|
|
309
|
+
secrets: SecretsRuleSchema.optional().default(() => ({
|
|
310
|
+
enabled: true,
|
|
311
|
+
severity: 'critical',
|
|
312
|
+
action: 'block',
|
|
313
|
+
})),
|
|
314
|
+
/** Data exfiltration detection rules */
|
|
315
|
+
exfiltration: ExfiltrationRuleSchema.optional().default(() => ({
|
|
316
|
+
enabled: true,
|
|
317
|
+
severity: 'high',
|
|
318
|
+
action: 'block',
|
|
319
|
+
})),
|
|
320
|
+
/** Output sanitization rules */
|
|
321
|
+
sanitization: SanitizationRuleSchema.optional().default(() => ({
|
|
322
|
+
enabled: true,
|
|
323
|
+
severity: 'high',
|
|
324
|
+
action: 'block',
|
|
325
|
+
minConfidence: 0.5,
|
|
326
|
+
redactMatches: false,
|
|
327
|
+
categories: {
|
|
328
|
+
instructionOverride: true,
|
|
329
|
+
systemLeak: true,
|
|
330
|
+
jailbreak: true,
|
|
331
|
+
encodedPayload: true,
|
|
332
|
+
},
|
|
333
|
+
})),
|
|
334
|
+
}).default(() => ({
|
|
335
|
+
purchase: {
|
|
336
|
+
enabled: true,
|
|
337
|
+
severity: 'critical',
|
|
338
|
+
action: 'block',
|
|
339
|
+
spendLimits: { perTransaction: 100, daily: 500 },
|
|
340
|
+
domains: { mode: 'blocklist', blocklist: [] },
|
|
341
|
+
},
|
|
342
|
+
website: {
|
|
343
|
+
enabled: true,
|
|
344
|
+
mode: 'blocklist',
|
|
345
|
+
severity: 'high',
|
|
346
|
+
action: 'block',
|
|
347
|
+
blocklist: [],
|
|
348
|
+
allowlist: [],
|
|
349
|
+
},
|
|
350
|
+
destructive: {
|
|
351
|
+
enabled: true,
|
|
352
|
+
severity: 'critical',
|
|
353
|
+
action: 'confirm',
|
|
354
|
+
shell: { enabled: true },
|
|
355
|
+
cloud: { enabled: true },
|
|
356
|
+
code: { enabled: true },
|
|
357
|
+
},
|
|
358
|
+
secrets: {
|
|
359
|
+
enabled: true,
|
|
360
|
+
severity: 'critical',
|
|
361
|
+
action: 'block',
|
|
362
|
+
},
|
|
363
|
+
exfiltration: {
|
|
364
|
+
enabled: true,
|
|
365
|
+
severity: 'high',
|
|
366
|
+
action: 'block',
|
|
367
|
+
},
|
|
368
|
+
sanitization: {
|
|
369
|
+
enabled: true,
|
|
370
|
+
severity: 'high',
|
|
371
|
+
action: 'block',
|
|
372
|
+
minConfidence: 0.5,
|
|
373
|
+
redactMatches: false,
|
|
374
|
+
categories: {
|
|
375
|
+
instructionOverride: true,
|
|
376
|
+
systemLeak: true,
|
|
377
|
+
jailbreak: true,
|
|
378
|
+
encodedPayload: true,
|
|
379
|
+
},
|
|
380
|
+
},
|
|
381
|
+
}));
|
|
382
|
+
// =============================================================================
|
|
383
|
+
// APPROVAL CONFIGURATION
|
|
384
|
+
// =============================================================================
|
|
385
|
+
/**
|
|
386
|
+
* Native approval flow configuration
|
|
387
|
+
*/
|
|
388
|
+
export const NativeApprovalSchema = z.object({
|
|
389
|
+
/** Whether native approval is enabled */
|
|
390
|
+
enabled: z.boolean().default(true),
|
|
391
|
+
/** Timeout in seconds for approval requests */
|
|
392
|
+
timeout: z.number().positive().default(300),
|
|
393
|
+
}).default(() => ({
|
|
394
|
+
enabled: true,
|
|
395
|
+
timeout: 300,
|
|
396
|
+
}));
|
|
397
|
+
/**
|
|
398
|
+
* Agent confirm approval flow configuration
|
|
399
|
+
*/
|
|
400
|
+
export const AgentConfirmSchema = z.object({
|
|
401
|
+
/** Whether agent confirm is enabled */
|
|
402
|
+
enabled: z.boolean().default(true),
|
|
403
|
+
/** Parameter name to use for confirmation */
|
|
404
|
+
parameterName: z.string().default('_clawsec_confirm'),
|
|
405
|
+
}).default(() => ({
|
|
406
|
+
enabled: true,
|
|
407
|
+
parameterName: '_clawsec_confirm',
|
|
408
|
+
}));
|
|
409
|
+
/**
|
|
410
|
+
* Webhook approval flow configuration
|
|
411
|
+
*/
|
|
412
|
+
export const WebhookApprovalSchema = z.object({
|
|
413
|
+
/** Whether webhook approval is enabled */
|
|
414
|
+
enabled: z.boolean().default(false),
|
|
415
|
+
/** Webhook URL for approval requests */
|
|
416
|
+
url: z.url().optional(),
|
|
417
|
+
/** Timeout in seconds for webhook requests */
|
|
418
|
+
timeout: z.number().positive().default(30),
|
|
419
|
+
/** Custom headers to send with webhook requests */
|
|
420
|
+
headers: z.record(z.string(), z.string()).default({}),
|
|
421
|
+
}).default(() => ({
|
|
422
|
+
enabled: false,
|
|
423
|
+
url: undefined,
|
|
424
|
+
timeout: 30,
|
|
425
|
+
headers: {},
|
|
426
|
+
}));
|
|
427
|
+
/**
|
|
428
|
+
* Approval flow configuration
|
|
429
|
+
*/
|
|
430
|
+
export const ApprovalConfigSchema = z.object({
|
|
431
|
+
/** Native approval settings */
|
|
432
|
+
native: NativeApprovalSchema.optional().default(() => ({
|
|
433
|
+
enabled: true,
|
|
434
|
+
timeout: 300,
|
|
435
|
+
})),
|
|
436
|
+
/** Agent confirm settings */
|
|
437
|
+
agentConfirm: AgentConfirmSchema.optional().default(() => ({
|
|
438
|
+
enabled: true,
|
|
439
|
+
parameterName: '_clawsec_confirm',
|
|
440
|
+
})),
|
|
441
|
+
/** Webhook approval settings */
|
|
442
|
+
webhook: WebhookApprovalSchema.optional().default(() => ({
|
|
443
|
+
enabled: false,
|
|
444
|
+
url: undefined,
|
|
445
|
+
timeout: 30,
|
|
446
|
+
headers: {},
|
|
447
|
+
})),
|
|
448
|
+
}).default(() => ({
|
|
449
|
+
native: { enabled: true, timeout: 300 },
|
|
450
|
+
agentConfirm: { enabled: true, parameterName: '_clawsec_confirm' },
|
|
451
|
+
webhook: { enabled: false, url: undefined, timeout: 30, headers: {} },
|
|
452
|
+
}));
|
|
453
|
+
// =============================================================================
|
|
454
|
+
// ROOT CONFIGURATION
|
|
455
|
+
// =============================================================================
|
|
456
|
+
/**
|
|
457
|
+
* Root configuration schema for clawsec.yaml
|
|
458
|
+
*/
|
|
459
|
+
export const ClawsecConfigSchema = z.object({
|
|
460
|
+
/** Configuration version */
|
|
461
|
+
version: z.string().default('1.0'),
|
|
462
|
+
/** Global plugin settings */
|
|
463
|
+
global: GlobalConfigSchema.optional().default(() => ({
|
|
464
|
+
enabled: true,
|
|
465
|
+
logLevel: 'info',
|
|
466
|
+
})),
|
|
467
|
+
/** LLM integration settings */
|
|
468
|
+
llm: LLMConfigSchema.optional().default(() => ({
|
|
469
|
+
enabled: true,
|
|
470
|
+
model: null,
|
|
471
|
+
})),
|
|
472
|
+
/** Security rules */
|
|
473
|
+
rules: RulesConfigSchema.optional().default(() => ({
|
|
474
|
+
purchase: {
|
|
475
|
+
enabled: true,
|
|
476
|
+
severity: 'critical',
|
|
477
|
+
action: 'block',
|
|
478
|
+
spendLimits: { perTransaction: 100, daily: 500 },
|
|
479
|
+
domains: { mode: 'blocklist', blocklist: [] },
|
|
480
|
+
},
|
|
481
|
+
website: {
|
|
482
|
+
enabled: true,
|
|
483
|
+
mode: 'blocklist',
|
|
484
|
+
severity: 'high',
|
|
485
|
+
action: 'block',
|
|
486
|
+
blocklist: [],
|
|
487
|
+
allowlist: [],
|
|
488
|
+
},
|
|
489
|
+
destructive: {
|
|
490
|
+
enabled: true,
|
|
491
|
+
severity: 'critical',
|
|
492
|
+
action: 'confirm',
|
|
493
|
+
shell: { enabled: true },
|
|
494
|
+
cloud: { enabled: true },
|
|
495
|
+
code: { enabled: true },
|
|
496
|
+
},
|
|
497
|
+
secrets: {
|
|
498
|
+
enabled: true,
|
|
499
|
+
severity: 'critical',
|
|
500
|
+
action: 'block',
|
|
501
|
+
},
|
|
502
|
+
exfiltration: {
|
|
503
|
+
enabled: true,
|
|
504
|
+
severity: 'high',
|
|
505
|
+
action: 'block',
|
|
506
|
+
},
|
|
507
|
+
sanitization: {
|
|
508
|
+
enabled: true,
|
|
509
|
+
severity: 'high',
|
|
510
|
+
action: 'block',
|
|
511
|
+
minConfidence: 0.5,
|
|
512
|
+
redactMatches: false,
|
|
513
|
+
categories: {
|
|
514
|
+
instructionOverride: true,
|
|
515
|
+
systemLeak: true,
|
|
516
|
+
jailbreak: true,
|
|
517
|
+
encodedPayload: true,
|
|
518
|
+
},
|
|
519
|
+
},
|
|
520
|
+
})),
|
|
521
|
+
/** Approval flow settings */
|
|
522
|
+
approval: ApprovalConfigSchema.optional().default(() => ({
|
|
523
|
+
native: { enabled: true, timeout: 300 },
|
|
524
|
+
agentConfirm: { enabled: true, parameterName: '_clawsec_confirm' },
|
|
525
|
+
webhook: { enabled: false, url: undefined, timeout: 30, headers: {} },
|
|
526
|
+
})),
|
|
527
|
+
}).default(() => ({
|
|
528
|
+
version: '1.0',
|
|
529
|
+
global: { enabled: true, logLevel: 'info' },
|
|
530
|
+
llm: { enabled: true, model: null },
|
|
531
|
+
rules: {
|
|
532
|
+
purchase: {
|
|
533
|
+
enabled: true,
|
|
534
|
+
severity: 'critical',
|
|
535
|
+
action: 'block',
|
|
536
|
+
spendLimits: { perTransaction: 100, daily: 500 },
|
|
537
|
+
domains: { mode: 'blocklist', blocklist: [] },
|
|
538
|
+
},
|
|
539
|
+
website: {
|
|
540
|
+
enabled: true,
|
|
541
|
+
mode: 'blocklist',
|
|
542
|
+
severity: 'high',
|
|
543
|
+
action: 'block',
|
|
544
|
+
blocklist: [],
|
|
545
|
+
allowlist: [],
|
|
546
|
+
},
|
|
547
|
+
destructive: {
|
|
548
|
+
enabled: true,
|
|
549
|
+
severity: 'critical',
|
|
550
|
+
action: 'confirm',
|
|
551
|
+
shell: { enabled: true },
|
|
552
|
+
cloud: { enabled: true },
|
|
553
|
+
code: { enabled: true },
|
|
554
|
+
},
|
|
555
|
+
secrets: {
|
|
556
|
+
enabled: true,
|
|
557
|
+
severity: 'critical',
|
|
558
|
+
action: 'block',
|
|
559
|
+
},
|
|
560
|
+
exfiltration: {
|
|
561
|
+
enabled: true,
|
|
562
|
+
severity: 'high',
|
|
563
|
+
action: 'block',
|
|
564
|
+
},
|
|
565
|
+
sanitization: {
|
|
566
|
+
enabled: true,
|
|
567
|
+
severity: 'high',
|
|
568
|
+
action: 'block',
|
|
569
|
+
minConfidence: 0.5,
|
|
570
|
+
redactMatches: false,
|
|
571
|
+
categories: {
|
|
572
|
+
instructionOverride: true,
|
|
573
|
+
systemLeak: true,
|
|
574
|
+
jailbreak: true,
|
|
575
|
+
encodedPayload: true,
|
|
576
|
+
},
|
|
577
|
+
},
|
|
578
|
+
},
|
|
579
|
+
approval: {
|
|
580
|
+
native: { enabled: true, timeout: 300 },
|
|
581
|
+
agentConfirm: { enabled: true, parameterName: '_clawsec_confirm' },
|
|
582
|
+
webhook: { enabled: false, url: undefined, timeout: 30, headers: {} },
|
|
583
|
+
},
|
|
584
|
+
}));
|
|
585
|
+
//# sourceMappingURL=schema.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAG5E;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAGzF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAGzE;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAGnE,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,+BAA+B;IAC/B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;CACzC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,MAAe;CAC1B,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,qCAAqC;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACrD,oCAAoC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,cAAc,EAAE,GAAG;IACnB,KAAK,EAAE,GAAG;CACX,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,gCAAgC;IAChC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3C,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,IAAI,EAAE,WAAoB;IAC1B,SAAS,EAAE,EAAE;CACd,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,6CAA6C;IAC7C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;IACrC,sBAAsB;IACtB,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,cAAc,EAAE,GAAG;QACnB,KAAK,EAAE,GAAG;KACX,CAAC,CAAC;IACH,2BAA2B;IAC3B,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,WAAoB;QAC1B,SAAS,EAAE,EAAE;KACd,CAAC,CAAC;CACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,UAAmB;IAC7B,MAAM,EAAE,OAAgB;IACxB,WAAW,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;IAChD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,EAAE,EAAE;CACvD,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,iCAAiC;IACjC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3C,4CAA4C;IAC5C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,sDAAsD;IACtD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;IACrC,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,WAAoB;IAC1B,QAAQ,EAAE,MAAe;IACzB,MAAM,EAAE,OAAgB;IACxB,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,EAAE;CACd,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,0CAA0C;AAC1C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAGtC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oDAAoD;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAGtC;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,iDAAiD;IACjD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAGtC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,wDAAwD;IACxD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,0DAA0D;IAC1D,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,wCAAwC;IACxC,KAAK,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,0CAA0C;IAC1C,KAAK,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,uCAAuC;IACvC,IAAI,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;CACzE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,UAAmB;IAC7B,MAAM,EAAE,SAAkB;IAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IACxB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;CACxB,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,2CAA2C;IAC3C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,gCAAgC;IAChC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,8BAA8B;IAC9B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,mBAAmB,EAAE,IAAI;IACzB,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,gDAAgD;IAChD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;IACrC,6CAA6C;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACpD,mEAAmE;IACnE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,6BAA6B;IAC7B,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,mBAAmB,EAAE,IAAI;QACzB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;CACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,MAAe;IACzB,MAAM,EAAE,OAAgB;IACxB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE;QACV,mBAAmB,EAAE,IAAI;QACzB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,IAAI;KACrB;CACF,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;CACtC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,UAAmB;IAC7B,MAAM,EAAE,OAAgB;CACzB,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,iDAAiD;IACjD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,mDAAmD;IACnD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;CACtC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,MAAe;IACzB,MAAM,EAAE,OAAgB;CACzB,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,gCAAgC;IAChC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,OAAgB;QACxB,WAAW,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;QAChD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,EAAE,EAAE;KACvD,CAAC,CAAC;IACH,4BAA4B;IAC5B,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,WAAoB;QAC1B,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;KACd,CAAC,CAAC;IACH,gCAAgC;IAChC,WAAW,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,SAAkB;QAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACxB,CAAC,CAAC;IACH,kCAAkC;IAClC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,OAAgB;KACzB,CAAC,CAAC;IACH,wCAAwC;IACxC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;KACzB,CAAC,CAAC;IACH,gCAAgC;IAChC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;QACxB,aAAa,EAAE,GAAG;QAClB,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE;YACV,mBAAmB,EAAE,IAAI;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI;SACrB;KACF,CAAC,CAAC;CACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,OAAgB;QACxB,WAAW,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;QAChD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,EAAE,EAAE;KACvD;IACD,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,WAAoB;QAC1B,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;KACd;IACD,WAAW,EAAE;QACX,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,SAAkB;QAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACxB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,UAAmB;QAC7B,MAAM,EAAE,OAAgB;KACzB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;KACzB;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAe;QACzB,MAAM,EAAE,OAAgB;QACxB,aAAa,EAAE,GAAG;QAClB,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE;YACV,mBAAmB,EAAE,IAAI;YACzB,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI;SACrB;KACF;CACF,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,+CAA+C;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAC5C,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,GAAG;CACb,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,6CAA6C;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;CACtD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,kBAAkB;CAClC,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,wCAAwC;IACxC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvB,8CAA8C;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,mDAAmD;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,KAAK;IACd,GAAG,EAAE,SAAS;IACd,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC,CAAC;AAGJ;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,+BAA+B;IAC/B,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,GAAG;KACb,CAAC,CAAC;IACH,6BAA6B;IAC7B,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,kBAAkB;KAClC,CAAC,CAAC;IACH,gCAAgC;IAChC,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,KAAK;QACd,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;CACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;IACvC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE;IAClE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;CACtE,CAAC,CAAC,CAAC;AAGJ,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,4BAA4B;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,6BAA6B;IAC7B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAe;KAC1B,CAAC,CAAC;IACH,+BAA+B;IAC/B,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,qBAAqB;IACrB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,OAAgB;YACxB,WAAW,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAChD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,EAAE,EAAE;SACvD;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,WAAoB;YAC1B,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;YACxB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd;QACD,WAAW,EAAE;YACX,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,SAAkB;YAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACxB;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,OAAgB;SACzB;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;SACzB;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;YACxB,aAAa,EAAE,GAAG;YAClB,aAAa,EAAE,KAAK;YACpB,UAAU,EAAE;gBACV,mBAAmB,EAAE,IAAI;gBACzB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;aACrB;SACF;KACF,CAAC,CAAC;IACH,6BAA6B;IAC7B,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;QACvC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE;QAClE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;KACtE,CAAC,CAAC;CACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE;IACpD,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,KAAK,EAAE;QACL,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,OAAgB;YACxB,WAAW,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAChD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,EAAE,EAAE;SACvD;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,WAAoB;YAC1B,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;YACxB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd;QACD,WAAW,EAAE;YACX,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,SAAkB;YAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACxB;QACD,OAAO,EAAE;YACP,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,UAAmB;YAC7B,MAAM,EAAE,OAAgB;SACzB;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;SACzB;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAe;YACzB,MAAM,EAAE,OAAgB;YACxB,aAAa,EAAE,GAAG;YAClB,aAAa,EAAE,KAAK;YACpB,UAAU,EAAE;gBACV,mBAAmB,EAAE,IAAI;gBACzB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;aACrB;SACF;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;QACvC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE;QAClE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;KACtE;CACF,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Cloud Detector
|
|
3
|
+
* Detects dangerous cloud operations including AWS, GCP, Azure, Kubernetes, and Terraform
|
|
4
|
+
*/
|
|
5
|
+
import type { CloudMatchResult, DetectionContext, DestructiveDetectionResult, SubDetector } from './types.js';
|
|
6
|
+
import type { Severity } from '../../config/index.js';
|
|
7
|
+
/**
|
|
8
|
+
* Match AWS commands
|
|
9
|
+
*/
|
|
10
|
+
export declare function matchAwsCommand(command: string): CloudMatchResult;
|
|
11
|
+
/**
|
|
12
|
+
* Match GCP commands
|
|
13
|
+
*/
|
|
14
|
+
export declare function matchGcpCommand(command: string): CloudMatchResult;
|
|
15
|
+
/**
|
|
16
|
+
* Match Azure commands
|
|
17
|
+
*/
|
|
18
|
+
export declare function matchAzureCommand(command: string): CloudMatchResult;
|
|
19
|
+
/**
|
|
20
|
+
* Match Kubernetes commands
|
|
21
|
+
*/
|
|
22
|
+
export declare function matchKubernetesCommand(command: string): CloudMatchResult;
|
|
23
|
+
/**
|
|
24
|
+
* Match Terraform/IaC commands
|
|
25
|
+
*/
|
|
26
|
+
export declare function matchTerraformCommand(command: string): CloudMatchResult;
|
|
27
|
+
/**
|
|
28
|
+
* Match Git destructive commands
|
|
29
|
+
*/
|
|
30
|
+
export declare function matchGitCommand(command: string): CloudMatchResult;
|
|
31
|
+
/**
|
|
32
|
+
* Comprehensive cloud command matching
|
|
33
|
+
*/
|
|
34
|
+
export declare function matchCloudCommand(command: string): CloudMatchResult;
|
|
35
|
+
/**
|
|
36
|
+
* Cloud detector class
|
|
37
|
+
*/
|
|
38
|
+
export declare class CloudDetector implements SubDetector {
|
|
39
|
+
private severity;
|
|
40
|
+
constructor(severity?: Severity);
|
|
41
|
+
/**
|
|
42
|
+
* Extract command from tool context
|
|
43
|
+
*/
|
|
44
|
+
private extractCommand;
|
|
45
|
+
detect(context: DetectionContext): DestructiveDetectionResult | null;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Create a cloud detector with the given severity
|
|
49
|
+
*/
|
|
50
|
+
export declare function createCloudDetector(severity?: Severity): CloudDetector;
|
|
51
|
+
//# sourceMappingURL=cloud-detector.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-detector.d.ts","sourceRoot":"","sources":["../../../../src/detectors/destructive/cloud-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,0BAA0B,EAC1B,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AA0UtD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAejE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAejE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAenE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAexE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAevE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAejE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAqBnE;AAED;;GAEG;AACH,qBAAa,aAAc,YAAW,WAAW;IAC/C,OAAO,CAAC,QAAQ,CAAW;gBAEf,QAAQ,GAAE,QAAqB;IAI3C;;OAEG;IACH,OAAO,CAAC,cAAc;IAiDtB,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,0BAA0B,GAAG,IAAI;CAwCrE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,QAAqB,GAAG,aAAa,CAElF"}
|