clawsec 0.0.1

package/dist/src/detectors/website/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Website Detector
+ * Main detector that controls which websites an AI agent can navigate to
+ *
+ * Supports two modes:
+ * - Allowlist mode: Only pre-approved domains are accessible
+ * - Blocklist mode: Everything except blocked domains is accessible
+ *
+ * Additionally performs category-based detection for malware, phishing, etc.
+ */
+import type { DetectionContext, WebsiteDetectionResult, WebsiteDetector as IWebsiteDetector, WebsiteDetectorConfig } from './types.js';
+import type { WebsiteRule, FilterMode } from '../../config/index.js';
+export * from './types.js';
+export { extractDomain, extractUrlFromContext, matchesAnyPattern, matchesGlobPattern, globToRegex, } from './pattern-matcher.js';
+export { detectCategory, isDangerousCategory, isWarningCategory, getCategorySeverityDescription, } from './category-detector.js';
+/**
+ * Main website detector implementation
+ */
+export declare class WebsiteDetectorImpl implements IWebsiteDetector {
+    private config;
+    constructor(config: WebsiteDetectorConfig);
+    detect(context: DetectionContext): Promise<WebsiteDetectionResult>;
+    /**
+     * Allowlist mode: Block if NOT in allowlist
+     */
+    private checkAllowlistMode;
+    /**
+     * Blocklist mode: Block if IN blocklist
+     */
+    private checkBlocklistMode;
+    /**
+     * Get the configured action for detected websites
+     */
+    getAction(): "block" | "confirm" | "agent-confirm" | "warn" | "log";
+    /**
+     * Check if the detector is enabled
+     */
+    isEnabled(): boolean;
+    /**
+     * Get the filter mode
+     */
+    getMode(): FilterMode;
+}
+/**
+ * Create a website detector from WebsiteRule configuration
+ */
+export declare function createWebsiteDetector(rule: WebsiteRule): WebsiteDetectorImpl;
+/**
+ * Create a website detector with default configuration
+ */
+export declare function createDefaultWebsiteDetector(): WebsiteDetectorImpl;
+export default WebsiteDetectorImpl;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/detectors/website/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/detectors/website/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,IAAI,gBAAgB,EACnC,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAWpB,OAAO,KAAK,EAAE,WAAW,EAAY,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG/E,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAkBhC;;GAEG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IAC1D,OAAO,CAAC,MAAM,CAAwB;gBAE1B,MAAM,EAAE,qBAAqB;IAInC,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6CxE;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiE1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAiD1B;;OAEG;IACH,SAAS;IAIT;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,OAAO,IAAI,UAAU;CAGtB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAW5E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAGD,eAAe,mBAAmB,CAAC"}

package/dist/src/detectors/website/index.js

@@ -0,0 +1,232 @@
+/**
+ * Website Detector
+ * Main detector that controls which websites an AI agent can navigate to
+ *
+ * Supports two modes:
+ * - Allowlist mode: Only pre-approved domains are accessible
+ * - Blocklist mode: Everything except blocked domains is accessible
+ *
+ * Additionally performs category-based detection for malware, phishing, etc.
+ */
+import { extractDomain, extractUrlFromContext, matchesAnyPattern, } from './pattern-matcher.js';
+import { detectCategory, isDangerousCategory, getCategorySeverityDescription, } from './category-detector.js';
+// Re-export types
+export * from './types.js';
+// Re-export pattern matcher functions
+export { extractDomain, extractUrlFromContext, matchesAnyPattern, matchesGlobPattern, globToRegex, } from './pattern-matcher.js';
+// Re-export category detector functions
+export { detectCategory, isDangerousCategory, isWarningCategory, getCategorySeverityDescription, } from './category-detector.js';
+/**
+ * No detection result (used when disabled or allowed)
+ */
+function noDetection(severity, mode) {
+    return {
+        detected: false,
+        category: 'website',
+        severity,
+        confidence: 0,
+        reason: 'Website access is allowed',
+        metadata: {
+            mode,
+        },
+    };
+}
+/**
+ * Main website detector implementation
+ */
+export class WebsiteDetectorImpl {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async detect(context) {
+        // Check if detector is enabled
+        if (!this.config.enabled) {
+            return noDetection(this.config.severity, this.config.mode);
+        }
+        // Extract URL from context
+        const url = extractUrlFromContext(context);
+        if (!url) {
+            return noDetection(this.config.severity, this.config.mode);
+        }
+        // Extract domain from URL
+        const domain = extractDomain(url);
+        if (!domain) {
+            return noDetection(this.config.severity, this.config.mode);
+        }
+        // First, check for dangerous categories (malware, phishing) regardless of mode
+        const categoryResult = detectCategory(domain);
+        if (categoryResult.detected && categoryResult.category && isDangerousCategory(categoryResult.category)) {
+            return {
+                detected: true,
+                category: 'website',
+                severity: 'critical', // Always critical for dangerous categories
+                confidence: categoryResult.confidence,
+                reason: `Blocked: ${getCategorySeverityDescription(categoryResult.category)} detected`,
+                metadata: {
+                    url,
+                    domain,
+                    matchedPattern: categoryResult.matchedPattern,
+                    mode: this.config.mode,
+                    websiteCategory: categoryResult.category,
+                },
+            };
+        }
+        // Apply mode-based filtering
+        if (this.config.mode === 'allowlist') {
+            return this.checkAllowlistMode(url, domain, categoryResult);
+        }
+        else {
+            return this.checkBlocklistMode(url, domain, categoryResult);
+        }
+    }
+    /**
+     * Allowlist mode: Block if NOT in allowlist
+     */
+    checkAllowlistMode(url, domain, categoryResult) {
+        const allowlist = this.config.allowlist;
+        // If allowlist is empty, block everything
+        if (allowlist.length === 0) {
+            return {
+                detected: true,
+                category: 'website',
+                severity: this.config.severity,
+                confidence: 0.99,
+                reason: 'Blocked: No websites are allowed (empty allowlist)',
+                metadata: {
+                    url,
+                    domain,
+                    mode: 'allowlist',
+                    websiteCategory: categoryResult.category,
+                },
+            };
+        }
+        // Check if domain is in allowlist
+        const allowlistMatch = matchesAnyPattern(domain, allowlist);
+        if (allowlistMatch.matched) {
+            // Domain is allowed
+            return {
+                detected: false,
+                category: 'website',
+                severity: this.config.severity,
+                confidence: 0,
+                reason: `Website is allowed: ${domain} matched allowlist pattern "${allowlistMatch.pattern}"`,
+                metadata: {
+                    url,
+                    domain,
+                    matchedPattern: allowlistMatch.pattern,
+                    mode: 'allowlist',
+                },
+            };
+        }
+        // Domain is NOT in allowlist - block it
+        let reason = `Blocked: ${domain} is not in the allowlist`;
+        if (categoryResult.detected && categoryResult.category) {
+            reason += ` (detected as ${getCategorySeverityDescription(categoryResult.category)})`;
+        }
+        return {
+            detected: true,
+            category: 'website',
+            severity: this.config.severity,
+            confidence: 0.95,
+            reason,
+            metadata: {
+                url,
+                domain,
+                mode: 'allowlist',
+                websiteCategory: categoryResult.category,
+            },
+        };
+    }
+    /**
+     * Blocklist mode: Block if IN blocklist
+     */
+    checkBlocklistMode(url, domain, categoryResult) {
+        const blocklist = this.config.blocklist;
+        // Check if domain is in blocklist
+        const blocklistMatch = matchesAnyPattern(domain, blocklist);
+        if (blocklistMatch.matched) {
+            return {
+                detected: true,
+                category: 'website',
+                severity: this.config.severity,
+                confidence: blocklistMatch.confidence,
+                reason: `Blocked: ${domain} matched blocklist pattern "${blocklistMatch.pattern}"`,
+                metadata: {
+                    url,
+                    domain,
+                    matchedPattern: blocklistMatch.pattern,
+                    mode: 'blocklist',
+                    websiteCategory: categoryResult.category,
+                },
+            };
+        }
+        // Check for warning categories (gambling, adult) - detected but with warning
+        if (categoryResult.detected && categoryResult.category) {
+            return {
+                detected: true,
+                category: 'website',
+                severity: 'medium', // Lower severity for warning categories
+                confidence: categoryResult.confidence,
+                reason: `Warning: ${getCategorySeverityDescription(categoryResult.category)} detected`,
+                metadata: {
+                    url,
+                    domain,
+                    matchedPattern: categoryResult.matchedPattern,
+                    mode: 'blocklist',
+                    websiteCategory: categoryResult.category,
+                },
+            };
+        }
+        // Domain is allowed (not in blocklist and no category detected)
+        return noDetection(this.config.severity, this.config.mode);
+    }
+    /**
+     * Get the configured action for detected websites
+     */
+    getAction() {
+        return this.config.action;
+    }
+    /**
+     * Check if the detector is enabled
+     */
+    isEnabled() {
+        return this.config.enabled;
+    }
+    /**
+     * Get the filter mode
+     */
+    getMode() {
+        return this.config.mode;
+    }
+}
+/**
+ * Create a website detector from WebsiteRule configuration
+ */
+export function createWebsiteDetector(rule) {
+    const config = {
+        enabled: rule.enabled,
+        mode: rule.mode,
+        severity: rule.severity,
+        action: rule.action,
+        blocklist: rule.blocklist,
+        allowlist: rule.allowlist,
+    };
+    return new WebsiteDetectorImpl(config);
+}
+/**
+ * Create a website detector with default configuration
+ */
+export function createDefaultWebsiteDetector() {
+    return new WebsiteDetectorImpl({
+        enabled: true,
+        mode: 'blocklist',
+        severity: 'high',
+        action: 'block',
+        blocklist: [],
+        allowlist: [],
+    });
+}
+// Default export
+export default WebsiteDetectorImpl;
+//# sourceMappingURL=index.js.map

package/dist/src/detectors/website/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/detectors/website/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAGhC,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAE3B,sCAAsC;AACtC,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,wCAAwC;AACxC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,SAAS,WAAW,CAAC,QAAkB,EAAE,IAAgB;IACvD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,SAAS;QACnB,QAAQ;QACR,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE;YACR,IAAI;SACL;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAwB;IAEtC,YAAY,MAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAyB;QACpC,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,2BAA2B;QAC3B,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,0BAA0B;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,+EAA+E;QAC/E,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,IAAI,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvG,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,UAAU,EAAE,2CAA2C;gBACjE,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,MAAM,EAAE,YAAY,8BAA8B,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW;gBACtF,QAAQ,EAAE;oBACR,GAAG;oBACH,MAAM;oBACN,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACtB,eAAe,EAAE,cAAc,CAAC,QAAQ;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,GAAW,EACX,MAAc,EACd,cAAiD;QAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAExC,0CAA0C;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,oDAAoD;gBAC5D,QAAQ,EAAE;oBACR,GAAG;oBACH,MAAM;oBACN,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,cAAc,CAAC,QAAQ;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE5D,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,oBAAoB;YACpB,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,uBAAuB,MAAM,+BAA+B,cAAc,CAAC,OAAO,GAAG;gBAC7F,QAAQ,EAAE;oBACR,GAAG;oBACH,MAAM;oBACN,cAAc,EAAE,cAAc,CAAC,OAAO;oBACtC,IAAI,EAAE,WAAW;iBAClB;aACF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,IAAI,MAAM,GAAG,YAAY,MAAM,0BAA0B,CAAC;QAC1D,IAAI,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,8BAA8B,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QACxF,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU,EAAE,IAAI;YAChB,MAAM;YACN,QAAQ,EAAE;gBACR,GAAG;gBACH,MAAM;gBACN,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,cAAc,CAAC,QAAQ;aACzC;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,GAAW,EACX,MAAc,EACd,cAAiD;QAEjD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAExC,kCAAkC;QAClC,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE5D,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,MAAM,EAAE,YAAY,MAAM,+BAA+B,cAAc,CAAC,OAAO,GAAG;gBAClF,QAAQ,EAAE;oBACR,GAAG;oBACH,MAAM;oBACN,cAAc,EAAE,cAAc,CAAC,OAAO;oBACtC,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,cAAc,CAAC,QAAQ;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YACvD,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,QAAQ,EAAE,wCAAwC;gBAC5D,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,MAAM,EAAE,YAAY,8BAA8B,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW;gBACtF,QAAQ,EAAE;oBACR,GAAG;oBACH,MAAM;oBACN,cAAc,EAAE,cAAc,CAAC,cAAc;oBAC7C,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,cAAc,CAAC,QAAQ;iBACzC;aACF,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,MAAM,GAA0B;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IAEF,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,mBAAmB,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;KACd,CAAC,CAAC;AACL,CAAC;AAED,iBAAiB;AACjB,eAAe,mBAAmB,CAAC"}

package/dist/src/detectors/website/pattern-matcher.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Pattern Matcher
+ * Glob pattern matching for domains with support for * and ** wildcards
+ */
+import type { PatternMatchResult } from './types.js';
+/**
+ * Extract domain from URL
+ */
+export declare function extractDomain(url: string): string | null;
+/**
+ * Convert glob pattern to regex
+ * Supports:
+ * - * matches any sequence of characters except dots (single segment)
+ * - ** matches any sequence of characters including dots (multiple segments)
+ * - ? matches any single character
+ */
+export declare function globToRegex(pattern: string): RegExp;
+/**
+ * Check if domain matches a glob pattern
+ */
+export declare function matchesGlobPattern(domain: string, pattern: string): boolean;
+/**
+ * Check if domain matches any pattern in a list
+ */
+export declare function matchesAnyPattern(domain: string, patterns: string[]): PatternMatchResult;
+/**
+ * Extract URL from detection context
+ */
+export declare function extractUrlFromContext(context: {
+    url?: string;
+    toolInput: Record<string, unknown>;
+}): string | null;
+//# sourceMappingURL=pattern-matcher.d.ts.map

package/dist/src/detectors/website/pattern-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.d.ts","sourceRoot":"","sources":["../../../../src/detectors/website/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqBnD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG3E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAmCxF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,GAAG,MAAM,GAAG,IAAI,CAsChB"}

package/dist/src/detectors/website/pattern-matcher.js

@@ -0,0 +1,121 @@
+/**
+ * Pattern Matcher
+ * Glob pattern matching for domains with support for * and ** wildcards
+ */
+/**
+ * Extract domain from URL
+ */
+export function extractDomain(url) {
+    try {
+        // Handle URLs without protocol
+        let normalizedUrl = url;
+        if (!url.includes('://')) {
+            normalizedUrl = 'https://' + url;
+        }
+        const parsed = new URL(normalizedUrl);
+        return parsed.hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Convert glob pattern to regex
+ * Supports:
+ * - * matches any sequence of characters except dots (single segment)
+ * - ** matches any sequence of characters including dots (multiple segments)
+ * - ? matches any single character
+ */
+export function globToRegex(pattern) {
+    // Escape special regex characters except *, ?, and **
+    let regex = pattern.toLowerCase();
+    // First, handle ** (matches anything including dots)
+    // Use a placeholder to preserve ** before processing single *
+    regex = regex.replace(/\*\*/g, '<<<DOUBLE_STAR>>>');
+    // Escape special regex characters
+    regex = regex.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    // Convert single * to match anything except dots (single segment)
+    regex = regex.replace(/\*/g, '[^.]*');
+    // Convert ** placeholder back to match anything including dots
+    regex = regex.replace(/<<<DOUBLE_STAR>>>/g, '.*');
+    // Convert ? to match any single character
+    regex = regex.replace(/\?/g, '.');
+    return new RegExp(`^${regex}$`, 'i');
+}
+/**
+ * Check if domain matches a glob pattern
+ */
+export function matchesGlobPattern(domain, pattern) {
+    const regex = globToRegex(pattern);
+    return regex.test(domain.toLowerCase());
+}
+/**
+ * Check if domain matches any pattern in a list
+ */
+export function matchesAnyPattern(domain, patterns) {
+    const domainLower = domain.toLowerCase();
+    for (const pattern of patterns) {
+        const patternLower = pattern.toLowerCase();
+        // Check for exact match first (highest confidence)
+        if (domainLower === patternLower) {
+            return {
+                matched: true,
+                domain: domainLower,
+                pattern: pattern,
+                matchType: 'exact',
+                confidence: 0.99,
+            };
+        }
+        // Check glob pattern match
+        if (pattern.includes('*') || pattern.includes('?')) {
+            if (matchesGlobPattern(domainLower, patternLower)) {
+                return {
+                    matched: true,
+                    domain: domainLower,
+                    pattern: pattern,
+                    matchType: 'glob',
+                    confidence: 0.95,
+                };
+            }
+        }
+    }
+    return {
+        matched: false,
+        confidence: 0,
+    };
+}
+/**
+ * Extract URL from detection context
+ */
+export function extractUrlFromContext(context) {
+    // Direct URL in context
+    if (context.url) {
+        return context.url;
+    }
+    // Check common tool input patterns
+    const input = context.toolInput;
+    // Browser navigation tools
+    if (typeof input.url === 'string') {
+        return input.url;
+    }
+    // Some tools use href
+    if (typeof input.href === 'string') {
+        return input.href;
+    }
+    // Check for URLs in link/target fields
+    if (typeof input.link === 'string') {
+        return input.link;
+    }
+    if (typeof input.target === 'string' && input.target.includes('://')) {
+        return input.target;
+    }
+    // Check for URLs in src/source fields (for fetch/request tools)
+    if (typeof input.src === 'string') {
+        return input.src;
+    }
+    if (typeof input.source === 'string' && input.source.includes('://')) {
+        return input.source;
+    }
+    return null;
+}
+//# sourceMappingURL=pattern-matcher.js.map

package/dist/src/detectors/website/pattern-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-matcher.js","sourceRoot":"","sources":["../../../../src/detectors/website/pattern-matcher.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,+BAA+B;QAC/B,IAAI,aAAa,GAAG,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,aAAa,GAAG,UAAU,GAAG,GAAG,CAAC;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,sDAAsD;IACtD,IAAI,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAElC,qDAAqD;IACrD,8DAA8D;IAC9D,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAEpD,kCAAkC;IAClC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAEnD,kEAAkE;IAClE,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEtC,+DAA+D;IAC/D,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAElD,0CAA0C;IAC1C,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAElC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAe;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAkB;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,mDAAmD;QACnD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,OAAO;oBAChB,SAAS,EAAE,MAAM;oBACjB,UAAU,EAAE,IAAI;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,CAAC;KACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,wBAAwB;IACxB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IAED,mCAAmC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;IAEhC,2BAA2B;IAC3B,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,gEAAgE;IAChE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/detectors/website/types.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Website Detector Types
+ * Type definitions for the website access control system
+ */
+import type { Severity, Action, FilterMode } from '../../config/index.js';
+/**
+ * Detection context passed to detectors
+ */
+export interface DetectionContext {
+    /** Name of the tool being invoked */
+    toolName: string;
+    /** Input parameters to the tool */
+    toolInput: Record<string, unknown>;
+    /** URL being accessed (for browser/navigation tools) */
+    url?: string;
+}
+/**
+ * Website categories for additional detection
+ */
+export type WebsiteCategory = 'malware' | 'phishing' | 'gambling' | 'adult' | 'unknown';
+/**
+ * Result of a website detection operation
+ */
+export interface WebsiteDetectionResult {
+    /** Whether the website should be blocked/warned */
+    detected: boolean;
+    /** Category of the detection */
+    category: 'website';
+    /** Severity level of the detection */
+    severity: Severity;
+    /** Confidence score from 0 to 1 */
+    confidence: number;
+    /** Human-readable reason for the detection */
+    reason: string;
+    /** Additional metadata about the detection */
+    metadata?: {
+        /** URL that triggered the detection */
+        url?: string;
+        /** Domain that triggered the detection */
+        domain?: string;
+        /** Pattern that matched */
+        matchedPattern?: string;
+        /** Filter mode that was used */
+        mode: FilterMode;
+        /** Detected website category (malware, phishing, etc.) */
+        websiteCategory?: WebsiteCategory;
+    };
+}
+/**
+ * Configuration for the website detector
+ */
+export interface WebsiteDetectorConfig {
+    /** Whether the detector is enabled */
+    enabled: boolean;
+    /** Mode for website filtering */
+    mode: FilterMode;
+    /** Severity level to assign to detections */
+    severity: Severity;
+    /** Action to take when website is blocked */
+    action: Action;
+    /** Websites to block (supports glob patterns) */
+    blocklist: string[];
+    /** Websites to allow (supports glob patterns) */
+    allowlist: string[];
+}
+/**
+ * Interface for the main website detector
+ */
+export interface WebsiteDetector {
+    /**
+     * Detect website access violations
+     * @param context Detection context with tool information
+     * @returns Detection result
+     */
+    detect(context: DetectionContext): Promise<WebsiteDetectionResult>;
+}
+/**
+ * Pattern match result with confidence
+ */
+export interface PatternMatchResult {
+    /** Whether a match was found */
+    matched: boolean;
+    /** The domain that matched */
+    domain?: string;
+    /** The pattern that matched */
+    pattern?: string;
+    /** Match type */
+    matchType?: 'exact' | 'glob';
+    /** Confidence score */
+    confidence: number;
+}
+/**
+ * Category detection result
+ */
+export interface CategoryDetectionResult {
+    /** Whether a category was detected */
+    detected: boolean;
+    /** The detected category */
+    category?: WebsiteCategory;
+    /** The pattern that matched */
+    matchedPattern?: string;
+    /** Confidence score */
+    confidence: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/detectors/website/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/detectors/website/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,QAAQ,EAAE,OAAO,CAAC;IAClB,gCAAgC;IAChC,QAAQ,EAAE,SAAS,CAAC;IACpB,sCAAsC;IACtC,QAAQ,EAAE,QAAQ,CAAC;IACnB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,CAAC,EAAE;QACT,uCAAuC;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,0CAA0C;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2BAA2B;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gCAAgC;QAChC,IAAI,EAAE,UAAU,CAAC;QACjB,0DAA0D;QAC1D,eAAe,CAAC,EAAE,eAAe,CAAC;KACnC,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,sCAAsC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/src/detectors/website/types.js

@@ -0,0 +1,6 @@
+/**
+ * Website Detector Types
+ * Type definitions for the website access control system
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/detectors/website/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/detectors/website/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/src/engine/analyzer.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Hybrid Detection Engine Analyzer
+ * Main engine that orchestrates all 5 detectors and produces unified results
+ *
+ * Architecture:
+ * Tool Call -> Pattern Matching (≤5ms) -> BLOCK/ALLOW
+ *                                    |
+ *              ambiguous -------------+
+ *                   |
+ *                   v
+ *           LLM Analysis (~500ms) -> BLOCK/CONFIRM
+ */
+import type { Analyzer, AnalyzerConfig, AnalysisResult, Detection, ToolCallContext, ThreatCategory } from './types.js';
+import type { ClawsecConfig } from '../config/index.js';
+/**
+ * Main hybrid detection engine implementation
+ */
+export declare class HybridAnalyzer implements Analyzer {
+    private config;
+    private cache;
+    private cacheEnabled;
+    private cacheTtlMs;
+    private llmClient?;
+    private purchaseDetector;
+    private websiteDetector;
+    private destructiveDetector;
+    private secretsDetector;
+    private exfiltrationDetector;
+    constructor(analyzerConfig: AnalyzerConfig);
+    /**
+     * Analyze a tool call and return the result
+     */
+    analyze(context: ToolCallContext): Promise<AnalysisResult>;
+    /**
+     * Clear the detection cache
+     */
+    clearCache(): void;
+    /**
+     * Get cache statistics
+     */
+    getCacheStats(): {
+        size: number;
+        enabled: boolean;
+    };
+    /**
+     * Run purchase detector if enabled
+     */
+    private runPurchaseDetector;
+    /**
+     * Run website detector if enabled
+     */
+    private runWebsiteDetector;
+    /**
+     * Run destructive detector if enabled
+     */
+    private runDestructiveDetector;
+    /**
+     * Run secrets detector if enabled
+     */
+    private runSecretsDetector;
+    /**
+     * Run exfiltration detector if enabled
+     */
+    private runExfiltrationDetector;
+    /**
+     * Create a no-detection result for disabled detectors
+     */
+    private createNoDetection;
+    /**
+     * Perform LLM analysis on an ambiguous detection
+     */
+    private performLLMAnalysis;
+    /**
+     * Adjust the action based on LLM analysis result
+     */
+    private adjustActionFromLLM;
+}
+/**
+ * Create an analyzer from configuration
+ */
+export declare function createAnalyzer(config: ClawsecConfig, options?: Partial<AnalyzerConfig>): Analyzer;
+/**
+ * Create an analyzer with default configuration
+ */
+export declare function createDefaultAnalyzer(): Analyzer;
+export type { Analyzer, AnalyzerConfig, AnalysisResult, Detection, ToolCallContext, ThreatCategory };
+//# sourceMappingURL=analyzer.d.ts.map