clawsec 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (361) hide show
  1. package/README.md +560 -0
  2. package/dist/bin/clawsec.d.ts +7 -0
  3. package/dist/bin/clawsec.d.ts.map +1 -0
  4. package/dist/bin/clawsec.js +12 -0
  5. package/dist/bin/clawsec.js.map +1 -0
  6. package/dist/src/actions/block.d.ts +22 -0
  7. package/dist/src/actions/block.d.ts.map +1 -0
  8. package/dist/src/actions/block.js +83 -0
  9. package/dist/src/actions/block.js.map +1 -0
  10. package/dist/src/actions/confirm.d.ts +35 -0
  11. package/dist/src/actions/confirm.d.ts.map +1 -0
  12. package/dist/src/actions/confirm.js +156 -0
  13. package/dist/src/actions/confirm.js.map +1 -0
  14. package/dist/src/actions/executor.d.ts +64 -0
  15. package/dist/src/actions/executor.d.ts.map +1 -0
  16. package/dist/src/actions/executor.js +114 -0
  17. package/dist/src/actions/executor.js.map +1 -0
  18. package/dist/src/actions/index.d.ts +13 -0
  19. package/dist/src/actions/index.d.ts.map +1 -0
  20. package/dist/src/actions/index.js +15 -0
  21. package/dist/src/actions/index.js.map +1 -0
  22. package/dist/src/actions/log.d.ts +19 -0
  23. package/dist/src/actions/log.d.ts.map +1 -0
  24. package/dist/src/actions/log.js +63 -0
  25. package/dist/src/actions/log.js.map +1 -0
  26. package/dist/src/actions/types.d.ts +85 -0
  27. package/dist/src/actions/types.d.ts.map +1 -0
  28. package/dist/src/actions/types.js +78 -0
  29. package/dist/src/actions/types.js.map +1 -0
  30. package/dist/src/actions/warn.d.ts +22 -0
  31. package/dist/src/actions/warn.d.ts.map +1 -0
  32. package/dist/src/actions/warn.js +84 -0
  33. package/dist/src/actions/warn.js.map +1 -0
  34. package/dist/src/approval/agent-confirm.d.ts +104 -0
  35. package/dist/src/approval/agent-confirm.d.ts.map +1 -0
  36. package/dist/src/approval/agent-confirm.js +173 -0
  37. package/dist/src/approval/agent-confirm.js.map +1 -0
  38. package/dist/src/approval/index.d.ts +14 -0
  39. package/dist/src/approval/index.d.ts.map +1 -0
  40. package/dist/src/approval/index.js +9 -0
  41. package/dist/src/approval/index.js.map +1 -0
  42. package/dist/src/approval/native.d.ts +56 -0
  43. package/dist/src/approval/native.d.ts.map +1 -0
  44. package/dist/src/approval/native.js +196 -0
  45. package/dist/src/approval/native.js.map +1 -0
  46. package/dist/src/approval/store.d.ts +88 -0
  47. package/dist/src/approval/store.d.ts.map +1 -0
  48. package/dist/src/approval/store.js +192 -0
  49. package/dist/src/approval/store.js.map +1 -0
  50. package/dist/src/approval/types.d.ts +119 -0
  51. package/dist/src/approval/types.d.ts.map +1 -0
  52. package/dist/src/approval/types.js +6 -0
  53. package/dist/src/approval/types.js.map +1 -0
  54. package/dist/src/approval/webhook.d.ts +170 -0
  55. package/dist/src/approval/webhook.d.ts.map +1 -0
  56. package/dist/src/approval/webhook.js +362 -0
  57. package/dist/src/approval/webhook.js.map +1 -0
  58. package/dist/src/cli/commands/audit.d.ts +43 -0
  59. package/dist/src/cli/commands/audit.d.ts.map +1 -0
  60. package/dist/src/cli/commands/audit.js +115 -0
  61. package/dist/src/cli/commands/audit.js.map +1 -0
  62. package/dist/src/cli/commands/feedback.d.ts +27 -0
  63. package/dist/src/cli/commands/feedback.d.ts.map +1 -0
  64. package/dist/src/cli/commands/feedback.js +228 -0
  65. package/dist/src/cli/commands/feedback.js.map +1 -0
  66. package/dist/src/cli/commands/index.d.ts +11 -0
  67. package/dist/src/cli/commands/index.d.ts.map +1 -0
  68. package/dist/src/cli/commands/index.js +13 -0
  69. package/dist/src/cli/commands/index.js.map +1 -0
  70. package/dist/src/cli/commands/status.d.ts +20 -0
  71. package/dist/src/cli/commands/status.d.ts.map +1 -0
  72. package/dist/src/cli/commands/status.js +122 -0
  73. package/dist/src/cli/commands/status.js.map +1 -0
  74. package/dist/src/cli/commands/test.d.ts +23 -0
  75. package/dist/src/cli/commands/test.d.ts.map +1 -0
  76. package/dist/src/cli/commands/test.js +134 -0
  77. package/dist/src/cli/commands/test.js.map +1 -0
  78. package/dist/src/cli/commands/types.d.ts +81 -0
  79. package/dist/src/cli/commands/types.d.ts.map +1 -0
  80. package/dist/src/cli/commands/types.js +6 -0
  81. package/dist/src/cli/commands/types.js.map +1 -0
  82. package/dist/src/cli/index.d.ts +17 -0
  83. package/dist/src/cli/index.d.ts.map +1 -0
  84. package/dist/src/cli/index.js +267 -0
  85. package/dist/src/cli/index.js.map +1 -0
  86. package/dist/src/config/defaults.d.ts +20 -0
  87. package/dist/src/config/defaults.d.ts.map +1 -0
  88. package/dist/src/config/defaults.js +123 -0
  89. package/dist/src/config/defaults.js.map +1 -0
  90. package/dist/src/config/index.d.ts +8 -0
  91. package/dist/src/config/index.d.ts.map +1 -0
  92. package/dist/src/config/index.js +41 -0
  93. package/dist/src/config/index.js.map +1 -0
  94. package/dist/src/config/loader.d.ts +99 -0
  95. package/dist/src/config/loader.d.ts.map +1 -0
  96. package/dist/src/config/loader.js +242 -0
  97. package/dist/src/config/loader.js.map +1 -0
  98. package/dist/src/config/schema.d.ts +627 -0
  99. package/dist/src/config/schema.d.ts.map +1 -0
  100. package/dist/src/config/schema.js +585 -0
  101. package/dist/src/config/schema.js.map +1 -0
  102. package/dist/src/detectors/destructive/cloud-detector.d.ts +51 -0
  103. package/dist/src/detectors/destructive/cloud-detector.d.ts.map +1 -0
  104. package/dist/src/detectors/destructive/cloud-detector.js +556 -0
  105. package/dist/src/detectors/destructive/cloud-detector.js.map +1 -0
  106. package/dist/src/detectors/destructive/code-detector.d.ts +59 -0
  107. package/dist/src/detectors/destructive/code-detector.d.ts.map +1 -0
  108. package/dist/src/detectors/destructive/code-detector.js +558 -0
  109. package/dist/src/detectors/destructive/code-detector.js.map +1 -0
  110. package/dist/src/detectors/destructive/index.d.ts +54 -0
  111. package/dist/src/detectors/destructive/index.d.ts.map +1 -0
  112. package/dist/src/detectors/destructive/index.js +168 -0
  113. package/dist/src/detectors/destructive/index.js.map +1 -0
  114. package/dist/src/detectors/destructive/shell-detector.d.ts +43 -0
  115. package/dist/src/detectors/destructive/shell-detector.d.ts.map +1 -0
  116. package/dist/src/detectors/destructive/shell-detector.js +302 -0
  117. package/dist/src/detectors/destructive/shell-detector.js.map +1 -0
  118. package/dist/src/detectors/destructive/types.d.ts +143 -0
  119. package/dist/src/detectors/destructive/types.d.ts.map +1 -0
  120. package/dist/src/detectors/destructive/types.js +6 -0
  121. package/dist/src/detectors/destructive/types.js.map +1 -0
  122. package/dist/src/detectors/exfiltration/cloud-detector.d.ts +51 -0
  123. package/dist/src/detectors/exfiltration/cloud-detector.d.ts.map +1 -0
  124. package/dist/src/detectors/exfiltration/cloud-detector.js +427 -0
  125. package/dist/src/detectors/exfiltration/cloud-detector.js.map +1 -0
  126. package/dist/src/detectors/exfiltration/http-detector.d.ts +47 -0
  127. package/dist/src/detectors/exfiltration/http-detector.d.ts.map +1 -0
  128. package/dist/src/detectors/exfiltration/http-detector.js +429 -0
  129. package/dist/src/detectors/exfiltration/http-detector.js.map +1 -0
  130. package/dist/src/detectors/exfiltration/index.d.ts +44 -0
  131. package/dist/src/detectors/exfiltration/index.d.ts.map +1 -0
  132. package/dist/src/detectors/exfiltration/index.js +118 -0
  133. package/dist/src/detectors/exfiltration/index.js.map +1 -0
  134. package/dist/src/detectors/exfiltration/network-detector.d.ts +55 -0
  135. package/dist/src/detectors/exfiltration/network-detector.d.ts.map +1 -0
  136. package/dist/src/detectors/exfiltration/network-detector.js +504 -0
  137. package/dist/src/detectors/exfiltration/network-detector.js.map +1 -0
  138. package/dist/src/detectors/exfiltration/types.d.ts +139 -0
  139. package/dist/src/detectors/exfiltration/types.d.ts.map +1 -0
  140. package/dist/src/detectors/exfiltration/types.js +6 -0
  141. package/dist/src/detectors/exfiltration/types.js.map +1 -0
  142. package/dist/src/detectors/purchase/domain-detector.d.ts +44 -0
  143. package/dist/src/detectors/purchase/domain-detector.d.ts.map +1 -0
  144. package/dist/src/detectors/purchase/domain-detector.js +296 -0
  145. package/dist/src/detectors/purchase/domain-detector.js.map +1 -0
  146. package/dist/src/detectors/purchase/form-detector.d.ts +27 -0
  147. package/dist/src/detectors/purchase/form-detector.d.ts.map +1 -0
  148. package/dist/src/detectors/purchase/form-detector.js +344 -0
  149. package/dist/src/detectors/purchase/form-detector.js.map +1 -0
  150. package/dist/src/detectors/purchase/index.d.ts +65 -0
  151. package/dist/src/detectors/purchase/index.d.ts.map +1 -0
  152. package/dist/src/detectors/purchase/index.js +216 -0
  153. package/dist/src/detectors/purchase/index.js.map +1 -0
  154. package/dist/src/detectors/purchase/spend-tracker.d.ts +132 -0
  155. package/dist/src/detectors/purchase/spend-tracker.d.ts.map +1 -0
  156. package/dist/src/detectors/purchase/spend-tracker.js +313 -0
  157. package/dist/src/detectors/purchase/spend-tracker.js.map +1 -0
  158. package/dist/src/detectors/purchase/types.d.ts +139 -0
  159. package/dist/src/detectors/purchase/types.d.ts.map +1 -0
  160. package/dist/src/detectors/purchase/types.js +6 -0
  161. package/dist/src/detectors/purchase/types.js.map +1 -0
  162. package/dist/src/detectors/purchase/url-detector.d.ts +31 -0
  163. package/dist/src/detectors/purchase/url-detector.d.ts.map +1 -0
  164. package/dist/src/detectors/purchase/url-detector.js +292 -0
  165. package/dist/src/detectors/purchase/url-detector.js.map +1 -0
  166. package/dist/src/detectors/secrets/api-key-detector.d.ts +30 -0
  167. package/dist/src/detectors/secrets/api-key-detector.d.ts.map +1 -0
  168. package/dist/src/detectors/secrets/api-key-detector.js +297 -0
  169. package/dist/src/detectors/secrets/api-key-detector.js.map +1 -0
  170. package/dist/src/detectors/secrets/index.d.ts +43 -0
  171. package/dist/src/detectors/secrets/index.d.ts.map +1 -0
  172. package/dist/src/detectors/secrets/index.js +261 -0
  173. package/dist/src/detectors/secrets/index.js.map +1 -0
  174. package/dist/src/detectors/secrets/pii-detector.d.ts +54 -0
  175. package/dist/src/detectors/secrets/pii-detector.d.ts.map +1 -0
  176. package/dist/src/detectors/secrets/pii-detector.js +286 -0
  177. package/dist/src/detectors/secrets/pii-detector.js.map +1 -0
  178. package/dist/src/detectors/secrets/token-detector.d.ts +51 -0
  179. package/dist/src/detectors/secrets/token-detector.d.ts.map +1 -0
  180. package/dist/src/detectors/secrets/token-detector.js +233 -0
  181. package/dist/src/detectors/secrets/token-detector.js.map +1 -0
  182. package/dist/src/detectors/secrets/types.d.ts +157 -0
  183. package/dist/src/detectors/secrets/types.d.ts.map +1 -0
  184. package/dist/src/detectors/secrets/types.js +6 -0
  185. package/dist/src/detectors/secrets/types.js.map +1 -0
  186. package/dist/src/detectors/website/category-detector.d.ts +22 -0
  187. package/dist/src/detectors/website/category-detector.d.ts.map +1 -0
  188. package/dist/src/detectors/website/category-detector.js +162 -0
  189. package/dist/src/detectors/website/category-detector.js.map +1 -0
  190. package/dist/src/detectors/website/index.d.ts +53 -0
  191. package/dist/src/detectors/website/index.d.ts.map +1 -0
  192. package/dist/src/detectors/website/index.js +232 -0
  193. package/dist/src/detectors/website/index.js.map +1 -0
  194. package/dist/src/detectors/website/pattern-matcher.d.ts +33 -0
  195. package/dist/src/detectors/website/pattern-matcher.d.ts.map +1 -0
  196. package/dist/src/detectors/website/pattern-matcher.js +121 -0
  197. package/dist/src/detectors/website/pattern-matcher.js.map +1 -0
  198. package/dist/src/detectors/website/types.d.ts +105 -0
  199. package/dist/src/detectors/website/types.d.ts.map +1 -0
  200. package/dist/src/detectors/website/types.js +6 -0
  201. package/dist/src/detectors/website/types.js.map +1 -0
  202. package/dist/src/engine/analyzer.d.ts +87 -0
  203. package/dist/src/engine/analyzer.d.ts.map +1 -0
  204. package/dist/src/engine/analyzer.js +427 -0
  205. package/dist/src/engine/analyzer.js.map +1 -0
  206. package/dist/src/engine/cache.d.ts +80 -0
  207. package/dist/src/engine/cache.d.ts.map +1 -0
  208. package/dist/src/engine/cache.js +167 -0
  209. package/dist/src/engine/cache.js.map +1 -0
  210. package/dist/src/engine/index.d.ts +11 -0
  211. package/dist/src/engine/index.d.ts.map +1 -0
  212. package/dist/src/engine/index.js +11 -0
  213. package/dist/src/engine/index.js.map +1 -0
  214. package/dist/src/engine/llm-client.d.ts +210 -0
  215. package/dist/src/engine/llm-client.d.ts.map +1 -0
  216. package/dist/src/engine/llm-client.js +506 -0
  217. package/dist/src/engine/llm-client.js.map +1 -0
  218. package/dist/src/engine/types.d.ts +163 -0
  219. package/dist/src/engine/types.d.ts.map +1 -0
  220. package/dist/src/engine/types.js +21 -0
  221. package/dist/src/engine/types.js.map +1 -0
  222. package/dist/src/feedback/index.d.ts +9 -0
  223. package/dist/src/feedback/index.d.ts.map +1 -0
  224. package/dist/src/feedback/index.js +8 -0
  225. package/dist/src/feedback/index.js.map +1 -0
  226. package/dist/src/feedback/learner.d.ts +222 -0
  227. package/dist/src/feedback/learner.d.ts.map +1 -0
  228. package/dist/src/feedback/learner.js +401 -0
  229. package/dist/src/feedback/learner.js.map +1 -0
  230. package/dist/src/feedback/store.d.ts +113 -0
  231. package/dist/src/feedback/store.d.ts.map +1 -0
  232. package/dist/src/feedback/store.js +228 -0
  233. package/dist/src/feedback/store.js.map +1 -0
  234. package/dist/src/feedback/types.d.ts +126 -0
  235. package/dist/src/feedback/types.d.ts.map +1 -0
  236. package/dist/src/feedback/types.js +6 -0
  237. package/dist/src/feedback/types.js.map +1 -0
  238. package/dist/src/hooks/before-agent-start/handler.d.ts +37 -0
  239. package/dist/src/hooks/before-agent-start/handler.d.ts.map +1 -0
  240. package/dist/src/hooks/before-agent-start/handler.js +109 -0
  241. package/dist/src/hooks/before-agent-start/handler.js.map +1 -0
  242. package/dist/src/hooks/before-agent-start/index.d.ts +8 -0
  243. package/dist/src/hooks/before-agent-start/index.d.ts.map +1 -0
  244. package/dist/src/hooks/before-agent-start/index.js +7 -0
  245. package/dist/src/hooks/before-agent-start/index.js.map +1 -0
  246. package/dist/src/hooks/before-agent-start/prompts.d.ts +48 -0
  247. package/dist/src/hooks/before-agent-start/prompts.d.ts.map +1 -0
  248. package/dist/src/hooks/before-agent-start/prompts.js +103 -0
  249. package/dist/src/hooks/before-agent-start/prompts.js.map +1 -0
  250. package/dist/src/hooks/before-tool-call/handler.d.ts +42 -0
  251. package/dist/src/hooks/before-tool-call/handler.d.ts.map +1 -0
  252. package/dist/src/hooks/before-tool-call/handler.js +226 -0
  253. package/dist/src/hooks/before-tool-call/handler.js.map +1 -0
  254. package/dist/src/hooks/before-tool-call/index.d.ts +7 -0
  255. package/dist/src/hooks/before-tool-call/index.d.ts.map +1 -0
  256. package/dist/src/hooks/before-tool-call/index.js +6 -0
  257. package/dist/src/hooks/before-tool-call/index.js.map +1 -0
  258. package/dist/src/hooks/tool-result-persist/filter.d.ts +72 -0
  259. package/dist/src/hooks/tool-result-persist/filter.d.ts.map +1 -0
  260. package/dist/src/hooks/tool-result-persist/filter.js +305 -0
  261. package/dist/src/hooks/tool-result-persist/filter.js.map +1 -0
  262. package/dist/src/hooks/tool-result-persist/handler.d.ts +49 -0
  263. package/dist/src/hooks/tool-result-persist/handler.d.ts.map +1 -0
  264. package/dist/src/hooks/tool-result-persist/handler.js +217 -0
  265. package/dist/src/hooks/tool-result-persist/handler.js.map +1 -0
  266. package/dist/src/hooks/tool-result-persist/index.d.ts +11 -0
  267. package/dist/src/hooks/tool-result-persist/index.d.ts.map +1 -0
  268. package/dist/src/hooks/tool-result-persist/index.js +11 -0
  269. package/dist/src/hooks/tool-result-persist/index.js.map +1 -0
  270. package/dist/src/index.d.ts +256 -0
  271. package/dist/src/index.d.ts.map +1 -0
  272. package/dist/src/index.js +222 -0
  273. package/dist/src/index.js.map +1 -0
  274. package/dist/src/notifications/discord.d.ts +10 -0
  275. package/dist/src/notifications/discord.d.ts.map +1 -0
  276. package/dist/src/notifications/discord.js +218 -0
  277. package/dist/src/notifications/discord.js.map +1 -0
  278. package/dist/src/notifications/index.d.ts +37 -0
  279. package/dist/src/notifications/index.d.ts.map +1 -0
  280. package/dist/src/notifications/index.js +68 -0
  281. package/dist/src/notifications/index.js.map +1 -0
  282. package/dist/src/notifications/slack.d.ts +10 -0
  283. package/dist/src/notifications/slack.d.ts.map +1 -0
  284. package/dist/src/notifications/slack.js +218 -0
  285. package/dist/src/notifications/slack.js.map +1 -0
  286. package/dist/src/notifications/telegram.d.ts +10 -0
  287. package/dist/src/notifications/telegram.d.ts.map +1 -0
  288. package/dist/src/notifications/telegram.js +242 -0
  289. package/dist/src/notifications/telegram.js.map +1 -0
  290. package/dist/src/notifications/types.d.ts +119 -0
  291. package/dist/src/notifications/types.d.ts.map +1 -0
  292. package/dist/src/notifications/types.js +6 -0
  293. package/dist/src/notifications/types.js.map +1 -0
  294. package/dist/src/proxy/index.d.ts +8 -0
  295. package/dist/src/proxy/index.d.ts.map +1 -0
  296. package/dist/src/proxy/index.js +9 -0
  297. package/dist/src/proxy/index.js.map +1 -0
  298. package/dist/src/proxy/middleware.d.ts +55 -0
  299. package/dist/src/proxy/middleware.d.ts.map +1 -0
  300. package/dist/src/proxy/middleware.js +215 -0
  301. package/dist/src/proxy/middleware.js.map +1 -0
  302. package/dist/src/proxy/server.d.ts +57 -0
  303. package/dist/src/proxy/server.d.ts.map +1 -0
  304. package/dist/src/proxy/server.js +298 -0
  305. package/dist/src/proxy/server.js.map +1 -0
  306. package/dist/src/proxy/types.d.ts +136 -0
  307. package/dist/src/proxy/types.d.ts.map +1 -0
  308. package/dist/src/proxy/types.js +6 -0
  309. package/dist/src/proxy/types.js.map +1 -0
  310. package/dist/src/sanitization/index.d.ts +10 -0
  311. package/dist/src/sanitization/index.d.ts.map +1 -0
  312. package/dist/src/sanitization/index.js +9 -0
  313. package/dist/src/sanitization/index.js.map +1 -0
  314. package/dist/src/sanitization/patterns.d.ts +51 -0
  315. package/dist/src/sanitization/patterns.d.ts.map +1 -0
  316. package/dist/src/sanitization/patterns.js +266 -0
  317. package/dist/src/sanitization/patterns.js.map +1 -0
  318. package/dist/src/sanitization/scanner.d.ts +29 -0
  319. package/dist/src/sanitization/scanner.d.ts.map +1 -0
  320. package/dist/src/sanitization/scanner.js +328 -0
  321. package/dist/src/sanitization/scanner.js.map +1 -0
  322. package/dist/src/sanitization/types.d.ts +57 -0
  323. package/dist/src/sanitization/types.d.ts.map +1 -0
  324. package/dist/src/sanitization/types.js +5 -0
  325. package/dist/src/sanitization/types.js.map +1 -0
  326. package/openclaw.plugin.json +114 -0
  327. package/package.json +63 -0
  328. package/rules/builtin/README.md +139 -0
  329. package/rules/builtin/ai-services.yaml +70 -0
  330. package/rules/builtin/api-keys.yaml +64 -0
  331. package/rules/builtin/authentication.yaml +56 -0
  332. package/rules/builtin/aws-security.yaml +57 -0
  333. package/rules/builtin/azure-security.yaml +58 -0
  334. package/rules/builtin/cicd-security.yaml +64 -0
  335. package/rules/builtin/cloud-storage.yaml +64 -0
  336. package/rules/builtin/container-registry.yaml +55 -0
  337. package/rules/builtin/crypto-wallets.yaml +71 -0
  338. package/rules/builtin/database-nosql.yaml +58 -0
  339. package/rules/builtin/database-sql.yaml +62 -0
  340. package/rules/builtin/development-env.yaml +67 -0
  341. package/rules/builtin/docker.yaml +57 -0
  342. package/rules/builtin/filesystem.yaml +71 -0
  343. package/rules/builtin/financial-pci.yaml +61 -0
  344. package/rules/builtin/gcp-security.yaml +57 -0
  345. package/rules/builtin/git-operations.yaml +68 -0
  346. package/rules/builtin/healthcare-hipaa.yaml +64 -0
  347. package/rules/builtin/kubernetes.yaml +60 -0
  348. package/rules/builtin/messaging-services.yaml +53 -0
  349. package/rules/builtin/minimal.yaml +47 -0
  350. package/rules/builtin/mobile-development.yaml +61 -0
  351. package/rules/builtin/monitoring.yaml +63 -0
  352. package/rules/builtin/network-security.yaml +57 -0
  353. package/rules/builtin/package-managers.yaml +74 -0
  354. package/rules/builtin/payment-processing.yaml +66 -0
  355. package/rules/builtin/pii-protection.yaml +48 -0
  356. package/rules/builtin/production-strict.yaml +55 -0
  357. package/rules/builtin/secrets-management.yaml +63 -0
  358. package/rules/builtin/serverless.yaml +74 -0
  359. package/rules/builtin/ssh-security.yaml +66 -0
  360. package/rules/builtin/terraform.yaml +51 -0
  361. package/rules/builtin/web-security.yaml +62 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/engine/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,SAAS,GACT,aAAa,GACb,SAAS,GACT,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,kCAAkC;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,wDAAwD;IACxD,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;IACrB,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC;IACT,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC7C,0BAA0B;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7D,+CAA+C;IAC/C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,wBAAwB;IACxB,KAAK,IAAI,IAAI,CAAC;IACd,8BAA8B;IAC9B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,gCAAgC;IAChC,IAAI,IAAI,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,MAAM,EAAE,aAAa,CAAC;IACtB,qCAAqC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,aAAa,EAAE,gBAAgB,CAAC;IAChC,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,eAAe,EAAE,kBAAkB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,4DAA4D;IAC5D,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,8DAA8D;IAC9D,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,0DAA0D;IAC1D,WAAW,IAAI,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,gCAAgC;IAChC,UAAU,IAAI,IAAI,CAAC;IACnB,2BAA2B;IAC3B,aAAa,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACrD;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAKrD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CAEhE"}
@@ -0,0 +1,21 @@
1
+ /**
2
+ * Hybrid Detection Engine Types
3
+ * Type definitions for the main detection engine that orchestrates all detectors
4
+ */
5
+ /**
6
+ * Severity weights for sorting (higher = more severe)
7
+ */
8
+ export const SEVERITY_WEIGHTS = {
9
+ critical: 4,
10
+ high: 3,
11
+ medium: 2,
12
+ low: 1,
13
+ };
14
+ /**
15
+ * Compare two severities
16
+ * @returns negative if a < b, 0 if equal, positive if a > b
17
+ */
18
+ export function compareSeverity(a, b) {
19
+ return SEVERITY_WEIGHTS[a] - SEVERITY_WEIGHTS[b];
20
+ }
21
+ //# sourceMappingURL=types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/engine/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwKH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,CAAW,EAAE,CAAW;IACtD,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC"}
@@ -0,0 +1,9 @@
1
+ /**
2
+ * Feedback Module
3
+ * User feedback for detection accuracy (false positives/negatives)
4
+ */
5
+ export type { FeedbackStatus, FeedbackType, FeedbackDetectionContext, FeedbackEntry, FalsePositiveOptions, FalseNegativeOptions, FeedbackInput, FeedbackStore, FeedbackOptions, FeedbackResult, } from './types.js';
6
+ export { FileFeedbackStore, getFeedbackStore, resetGlobalFeedbackStore, createFeedbackStore, } from './store.js';
7
+ export type { PatternWeight, LearnerStats, WeightStore, Learner, } from './learner.js';
8
+ export { FileWeightStore, PatternLearner, getLearner, getWeightStore, resetGlobalLearner, createLearner, createWeightStore, } from './learner.js';
9
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/feedback/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,YAAY,EACV,cAAc,EACd,YAAY,EACZ,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,OAAO,GACR,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,cAAc,CAAC"}
@@ -0,0 +1,8 @@
1
+ /**
2
+ * Feedback Module
3
+ * User feedback for detection accuracy (false positives/negatives)
4
+ */
5
+ // Store exports
6
+ export { FileFeedbackStore, getFeedbackStore, resetGlobalFeedbackStore, createFeedbackStore, } from './store.js';
7
+ export { FileWeightStore, PatternLearner, getLearner, getWeightStore, resetGlobalLearner, createLearner, createWeightStore, } from './learner.js';
8
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/feedback/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,gBAAgB;AAChB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAUpB,OAAO,EACL,eAAe,EACf,cAAc,EACd,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,cAAc,CAAC"}
@@ -0,0 +1,222 @@
1
+ /**
2
+ * Pattern Weight Learner
3
+ * Adjusts pattern weights based on user feedback to improve detection accuracy
4
+ */
5
+ import type { ThreatCategory } from '../engine/index.js';
6
+ import type { FeedbackEntry } from './types.js';
7
+ /**
8
+ * Weight information for a pattern
9
+ */
10
+ export interface PatternWeight {
11
+ /** The regex pattern or identifier */
12
+ pattern: string;
13
+ /** Threat category this pattern belongs to */
14
+ category: ThreatCategory;
15
+ /** Original weight (0-1) */
16
+ baseWeight: number;
17
+ /** After feedback adjustment */
18
+ adjustedWeight: number;
19
+ /** Count of false positive reports */
20
+ falsePositives: number;
21
+ /** Count of false negative reports */
22
+ falseNegatives: number;
23
+ /** Unix timestamp of last update */
24
+ lastUpdated: number;
25
+ }
26
+ /**
27
+ * Statistics about learning activity
28
+ */
29
+ export interface LearnerStats {
30
+ /** Total number of weight adjustments made */
31
+ totalAdjustments: number;
32
+ /** Number of false positives processed */
33
+ falsePositivesProcessed: number;
34
+ /** Number of false negatives processed */
35
+ falseNegativesProcessed: number;
36
+ /** Number of patterns that have been adjusted */
37
+ patternsAdjusted: number;
38
+ }
39
+ /**
40
+ * Interface for weight storage operations
41
+ */
42
+ export interface WeightStore {
43
+ /** All pattern weights */
44
+ weights: Map<string, PatternWeight>;
45
+ /** Load weights from persistent storage */
46
+ load(): Promise<void>;
47
+ /** Save weights to persistent storage */
48
+ save(): Promise<void>;
49
+ /** Get the adjusted weight for a pattern */
50
+ getWeight(pattern: string): number;
51
+ /** Adjust weight for a false positive report */
52
+ adjustForFalsePositive(pattern: string, category: ThreatCategory): void;
53
+ /** Adjust weight for a false negative report */
54
+ adjustForFalseNegative(pattern: string, category: ThreatCategory): void;
55
+ /** Reset weights for a pattern or all patterns */
56
+ reset(pattern?: string): void;
57
+ }
58
+ /**
59
+ * Interface for the pattern weight learner
60
+ */
61
+ export interface Learner {
62
+ /** Process feedback and adjust weights */
63
+ processFeedback(entry: FeedbackEntry): Promise<void>;
64
+ /** Get adjusted confidence for a detection */
65
+ getAdjustedConfidence(baseConfidence: number, pattern: string, category: ThreatCategory): number;
66
+ /** Get learning statistics */
67
+ getStats(): LearnerStats;
68
+ }
69
+ /**
70
+ * File-based weight storage implementation
71
+ */
72
+ export declare class FileWeightStore implements WeightStore {
73
+ weights: Map<string, PatternWeight>;
74
+ private filePath;
75
+ private loaded;
76
+ /**
77
+ * Create a new file-based weight store
78
+ *
79
+ * @param projectRoot - Root directory of the project (default: current working directory)
80
+ * @param filename - Name of the storage file (default: weights.json)
81
+ */
82
+ constructor(projectRoot?: string, filename?: string);
83
+ /**
84
+ * Load weights from the storage file
85
+ */
86
+ load(): Promise<void>;
87
+ /**
88
+ * Save weights to the storage file
89
+ */
90
+ save(): Promise<void>;
91
+ /**
92
+ * Get the adjusted weight for a pattern
93
+ * Returns 1.0 if pattern has no adjustment
94
+ *
95
+ * @param pattern - The pattern identifier
96
+ * @returns The adjusted weight (0.1-1.0) or 1.0 if not found
97
+ */
98
+ getWeight(pattern: string): number;
99
+ /**
100
+ * Calculate the adjusted weight based on false positive/negative counts
101
+ */
102
+ private calculateAdjustedWeight;
103
+ /**
104
+ * Adjust weight for a false positive report
105
+ *
106
+ * @param pattern - The pattern identifier
107
+ * @param category - The threat category
108
+ */
109
+ adjustForFalsePositive(pattern: string, category: ThreatCategory): void;
110
+ /**
111
+ * Adjust weight for a false negative report
112
+ *
113
+ * @param pattern - The pattern identifier
114
+ * @param category - The threat category
115
+ */
116
+ adjustForFalseNegative(pattern: string, category: ThreatCategory): void;
117
+ /**
118
+ * Reset weights for a specific pattern or all patterns
119
+ *
120
+ * @param pattern - Optional pattern to reset (resets all if omitted)
121
+ */
122
+ reset(pattern?: string): void;
123
+ /**
124
+ * Check if the store has been loaded from disk
125
+ */
126
+ isLoaded(): boolean;
127
+ /**
128
+ * Get the number of patterns in the store
129
+ */
130
+ size(): number;
131
+ /**
132
+ * Clear all weights from the store
133
+ */
134
+ clear(): void;
135
+ /**
136
+ * Get the storage file path
137
+ */
138
+ getFilePath(): string;
139
+ }
140
+ /**
141
+ * Pattern weight learner implementation
142
+ */
143
+ export declare class PatternLearner implements Learner {
144
+ private weightStore;
145
+ private stats;
146
+ private adjustedPatterns;
147
+ /**
148
+ * Create a new pattern learner
149
+ *
150
+ * @param weightStore - The weight store to use
151
+ */
152
+ constructor(weightStore: WeightStore);
153
+ /**
154
+ * Process feedback and adjust weights
155
+ * Only processes feedback entries with 'applied' status
156
+ *
157
+ * @param entry - The feedback entry to process
158
+ */
159
+ processFeedback(entry: FeedbackEntry): Promise<void>;
160
+ /**
161
+ * Process multiple feedback entries in batch
162
+ *
163
+ * @param entries - Array of feedback entries to process
164
+ */
165
+ processFeedbackBatch(entries: FeedbackEntry[]): Promise<void>;
166
+ /**
167
+ * Get adjusted confidence for a detection
168
+ *
169
+ * @param baseConfidence - The original confidence score (0-1)
170
+ * @param pattern - The pattern identifier
171
+ * @param category - The threat category
172
+ * @returns The adjusted confidence score
173
+ */
174
+ getAdjustedConfidence(baseConfidence: number, pattern: string, category: ThreatCategory): number;
175
+ /**
176
+ * Get learning statistics
177
+ */
178
+ getStats(): LearnerStats;
179
+ /**
180
+ * Extract pattern identifier from a feedback entry
181
+ * Uses detection reason or description as the pattern identifier
182
+ */
183
+ private extractPattern;
184
+ /**
185
+ * Reset learning statistics
186
+ */
187
+ resetStats(): void;
188
+ }
189
+ /**
190
+ * Get the global learner instance
191
+ *
192
+ * @param projectRoot - Optional project root for weight storage
193
+ * @returns The global learner instance
194
+ */
195
+ export declare function getLearner(projectRoot?: string): PatternLearner;
196
+ /**
197
+ * Get the global weight store instance
198
+ *
199
+ * @param projectRoot - Optional project root for weight storage
200
+ * @returns The global weight store instance
201
+ */
202
+ export declare function getWeightStore(projectRoot?: string): FileWeightStore;
203
+ /**
204
+ * Reset the global learner and weight store (primarily for testing)
205
+ */
206
+ export declare function resetGlobalLearner(): void;
207
+ /**
208
+ * Create a new learner with a specific weight store
209
+ *
210
+ * @param weightStore - The weight store to use
211
+ * @returns A new PatternLearner instance
212
+ */
213
+ export declare function createLearner(weightStore: WeightStore): PatternLearner;
214
+ /**
215
+ * Create a new weight store with a specific storage location
216
+ *
217
+ * @param projectRoot - Project root directory
218
+ * @param filename - Optional custom filename
219
+ * @returns A new FileWeightStore instance
220
+ */
221
+ export declare function createWeightStore(projectRoot: string, filename?: string): FileWeightStore;
222
+ //# sourceMappingURL=learner.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"learner.d.ts","sourceRoot":"","sources":["../../../src/feedback/learner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAoBhD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,QAAQ,EAAE,cAAc,CAAC;IACzB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,uBAAuB,EAAE,MAAM,CAAC;IAChC,0CAA0C;IAC1C,uBAAuB,EAAE,MAAM,CAAC;IAChC,iDAAiD;IACjD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,0BAA0B;IAC1B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpC,2CAA2C;IAC3C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,yCAAyC;IACzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,4CAA4C;IAC5C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,gDAAgD;IAChD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IACxE,gDAAgD;IAChD,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IACxE,kDAAkD;IAClD,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,0CAA0C;IAC1C,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,8CAA8C;IAC9C,qBAAqB,CACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,GACvB,MAAM,CAAC;IACV,8BAA8B;IAC9B,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAa;IAChD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;OAKG;gBACS,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;IAMnD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAW3B;;;;;;OAMG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAKlC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAc/B;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IA2BvE;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IA2BvE;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAoB7B;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,IAAI,IAAI,MAAM;IAId;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,WAAW,IAAI,MAAM;CAGtB;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,OAAO;IAC5C,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,KAAK,CAKX;IACF,OAAO,CAAC,gBAAgB,CAA0B;IAElD;;;;OAIG;gBACS,WAAW,EAAE,WAAW;IAIpC;;;;;OAKG;IACG,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC1D;;;;OAIG;IACG,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCnE;;;;;;;OAOG;IACH,qBAAqB,CACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,GACvB,MAAM;IAgBT;;OAEG;IACH,QAAQ,IAAI,YAAY;IAIxB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmBtB;;OAEG;IACH,UAAU,IAAI,IAAI;CASnB;AAQD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,eAAe,CAKpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,WAAW,GAAG,cAAc,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAEzF"}
@@ -0,0 +1,401 @@
1
+ /**
2
+ * Pattern Weight Learner
3
+ * Adjusts pattern weights based on user feedback to improve detection accuracy
4
+ */
5
+ import { mkdir, readFile, writeFile } from 'node:fs/promises';
6
+ import { dirname, join } from 'node:path';
7
+ /** Default storage directory relative to project root */
8
+ const DEFAULT_STORAGE_DIR = '.clawsec';
9
+ /** Default weights filename */
10
+ const DEFAULT_WEIGHTS_FILE = 'weights.json';
11
+ /** Decay factor per false positive (reduces weight) */
12
+ const DECAY_FACTOR = 0.1;
13
+ /** Boost factor per false negative (increases weight) */
14
+ const BOOST_FACTOR = 0.05;
15
+ /** Minimum weight - never fully disable a pattern */
16
+ const MIN_WEIGHT = 0.1;
17
+ /** Maximum weight */
18
+ const MAX_WEIGHT = 1.0;
19
+ /**
20
+ * File-based weight storage implementation
21
+ */
22
+ export class FileWeightStore {
23
+ weights = new Map();
24
+ filePath;
25
+ loaded = false;
26
+ /**
27
+ * Create a new file-based weight store
28
+ *
29
+ * @param projectRoot - Root directory of the project (default: current working directory)
30
+ * @param filename - Name of the storage file (default: weights.json)
31
+ */
32
+ constructor(projectRoot, filename) {
33
+ const root = projectRoot ?? process.cwd();
34
+ const file = filename ?? DEFAULT_WEIGHTS_FILE;
35
+ this.filePath = join(root, DEFAULT_STORAGE_DIR, file);
36
+ }
37
+ /**
38
+ * Load weights from the storage file
39
+ */
40
+ async load() {
41
+ try {
42
+ const json = await readFile(this.filePath, 'utf-8');
43
+ const data = JSON.parse(json);
44
+ this.weights.clear();
45
+ for (const weight of data) {
46
+ this.weights.set(weight.pattern, weight);
47
+ }
48
+ this.loaded = true;
49
+ }
50
+ catch (error) {
51
+ // File doesn't exist or is invalid - start with empty store
52
+ if (error.code !== 'ENOENT') {
53
+ console.warn(`Warning: Could not load weight store: ${error.message}`);
54
+ }
55
+ this.weights.clear();
56
+ this.loaded = true;
57
+ }
58
+ }
59
+ /**
60
+ * Save weights to the storage file
61
+ */
62
+ async save() {
63
+ // Ensure directory exists
64
+ await mkdir(dirname(this.filePath), { recursive: true });
65
+ // Convert weights to array for JSON serialization
66
+ const data = Array.from(this.weights.values());
67
+ const json = JSON.stringify(data, null, 2);
68
+ await writeFile(this.filePath, json, 'utf-8');
69
+ }
70
+ /**
71
+ * Get the adjusted weight for a pattern
72
+ * Returns 1.0 if pattern has no adjustment
73
+ *
74
+ * @param pattern - The pattern identifier
75
+ * @returns The adjusted weight (0.1-1.0) or 1.0 if not found
76
+ */
77
+ getWeight(pattern) {
78
+ const weight = this.weights.get(pattern);
79
+ return weight ? weight.adjustedWeight : 1.0;
80
+ }
81
+ /**
82
+ * Calculate the adjusted weight based on false positive/negative counts
83
+ */
84
+ calculateAdjustedWeight(baseWeight, fpCount, fnCount) {
85
+ // False positive: adjustedWeight = baseWeight * (1 - decayFactor * fpCount)
86
+ // False negative: adjustedWeight = min(1, baseWeight * (1 + boostFactor * fnCount))
87
+ // Apply false positive decay
88
+ let adjusted = baseWeight * (1 - DECAY_FACTOR * fpCount);
89
+ // Apply false negative boost
90
+ adjusted = adjusted * (1 + BOOST_FACTOR * fnCount);
91
+ // Clamp to bounds
92
+ return Math.max(MIN_WEIGHT, Math.min(MAX_WEIGHT, adjusted));
93
+ }
94
+ /**
95
+ * Adjust weight for a false positive report
96
+ *
97
+ * @param pattern - The pattern identifier
98
+ * @param category - The threat category
99
+ */
100
+ adjustForFalsePositive(pattern, category) {
101
+ let weight = this.weights.get(pattern);
102
+ if (!weight) {
103
+ // Create new weight entry with default base weight
104
+ weight = {
105
+ pattern,
106
+ category,
107
+ baseWeight: 1.0,
108
+ adjustedWeight: 1.0,
109
+ falsePositives: 0,
110
+ falseNegatives: 0,
111
+ lastUpdated: Date.now(),
112
+ };
113
+ }
114
+ weight.falsePositives++;
115
+ weight.adjustedWeight = this.calculateAdjustedWeight(weight.baseWeight, weight.falsePositives, weight.falseNegatives);
116
+ weight.lastUpdated = Date.now();
117
+ this.weights.set(pattern, weight);
118
+ }
119
+ /**
120
+ * Adjust weight for a false negative report
121
+ *
122
+ * @param pattern - The pattern identifier
123
+ * @param category - The threat category
124
+ */
125
+ adjustForFalseNegative(pattern, category) {
126
+ let weight = this.weights.get(pattern);
127
+ if (!weight) {
128
+ // Create new weight entry with default base weight
129
+ weight = {
130
+ pattern,
131
+ category,
132
+ baseWeight: 1.0,
133
+ adjustedWeight: 1.0,
134
+ falsePositives: 0,
135
+ falseNegatives: 0,
136
+ lastUpdated: Date.now(),
137
+ };
138
+ }
139
+ weight.falseNegatives++;
140
+ weight.adjustedWeight = this.calculateAdjustedWeight(weight.baseWeight, weight.falsePositives, weight.falseNegatives);
141
+ weight.lastUpdated = Date.now();
142
+ this.weights.set(pattern, weight);
143
+ }
144
+ /**
145
+ * Reset weights for a specific pattern or all patterns
146
+ *
147
+ * @param pattern - Optional pattern to reset (resets all if omitted)
148
+ */
149
+ reset(pattern) {
150
+ if (pattern) {
151
+ const weight = this.weights.get(pattern);
152
+ if (weight) {
153
+ weight.adjustedWeight = weight.baseWeight;
154
+ weight.falsePositives = 0;
155
+ weight.falseNegatives = 0;
156
+ weight.lastUpdated = Date.now();
157
+ }
158
+ }
159
+ else {
160
+ // Reset all weights
161
+ for (const weight of this.weights.values()) {
162
+ weight.adjustedWeight = weight.baseWeight;
163
+ weight.falsePositives = 0;
164
+ weight.falseNegatives = 0;
165
+ weight.lastUpdated = Date.now();
166
+ }
167
+ }
168
+ }
169
+ /**
170
+ * Check if the store has been loaded from disk
171
+ */
172
+ isLoaded() {
173
+ return this.loaded;
174
+ }
175
+ /**
176
+ * Get the number of patterns in the store
177
+ */
178
+ size() {
179
+ return this.weights.size;
180
+ }
181
+ /**
182
+ * Clear all weights from the store
183
+ */
184
+ clear() {
185
+ this.weights.clear();
186
+ }
187
+ /**
188
+ * Get the storage file path
189
+ */
190
+ getFilePath() {
191
+ return this.filePath;
192
+ }
193
+ }
194
+ /**
195
+ * Pattern weight learner implementation
196
+ */
197
+ export class PatternLearner {
198
+ weightStore;
199
+ stats = {
200
+ totalAdjustments: 0,
201
+ falsePositivesProcessed: 0,
202
+ falseNegativesProcessed: 0,
203
+ patternsAdjusted: 0,
204
+ };
205
+ adjustedPatterns = new Set();
206
+ /**
207
+ * Create a new pattern learner
208
+ *
209
+ * @param weightStore - The weight store to use
210
+ */
211
+ constructor(weightStore) {
212
+ this.weightStore = weightStore;
213
+ }
214
+ /**
215
+ * Process feedback and adjust weights
216
+ * Only processes feedback entries with 'applied' status
217
+ *
218
+ * @param entry - The feedback entry to process
219
+ */
220
+ async processFeedback(entry) {
221
+ // Only process applied feedback
222
+ if (entry.status !== 'applied') {
223
+ return;
224
+ }
225
+ // Extract pattern from detection context
226
+ const pattern = this.extractPattern(entry);
227
+ if (!pattern) {
228
+ return;
229
+ }
230
+ const category = entry.detection?.category ?? entry.suggestedCategory;
231
+ if (!category) {
232
+ return;
233
+ }
234
+ if (entry.type === 'false-positive') {
235
+ this.weightStore.adjustForFalsePositive(pattern, category);
236
+ this.stats.falsePositivesProcessed++;
237
+ }
238
+ else if (entry.type === 'false-negative') {
239
+ this.weightStore.adjustForFalseNegative(pattern, category);
240
+ this.stats.falseNegativesProcessed++;
241
+ }
242
+ this.stats.totalAdjustments++;
243
+ this.adjustedPatterns.add(pattern);
244
+ this.stats.patternsAdjusted = this.adjustedPatterns.size;
245
+ // Save after processing
246
+ await this.weightStore.save();
247
+ }
248
+ /**
249
+ * Process multiple feedback entries in batch
250
+ *
251
+ * @param entries - Array of feedback entries to process
252
+ */
253
+ async processFeedbackBatch(entries) {
254
+ for (const entry of entries) {
255
+ // Process without saving each time
256
+ if (entry.status !== 'applied') {
257
+ continue;
258
+ }
259
+ const pattern = this.extractPattern(entry);
260
+ if (!pattern) {
261
+ continue;
262
+ }
263
+ const category = entry.detection?.category ?? entry.suggestedCategory;
264
+ if (!category) {
265
+ continue;
266
+ }
267
+ if (entry.type === 'false-positive') {
268
+ this.weightStore.adjustForFalsePositive(pattern, category);
269
+ this.stats.falsePositivesProcessed++;
270
+ }
271
+ else if (entry.type === 'false-negative') {
272
+ this.weightStore.adjustForFalseNegative(pattern, category);
273
+ this.stats.falseNegativesProcessed++;
274
+ }
275
+ this.stats.totalAdjustments++;
276
+ this.adjustedPatterns.add(pattern);
277
+ }
278
+ this.stats.patternsAdjusted = this.adjustedPatterns.size;
279
+ // Save once after batch processing
280
+ if (entries.length > 0) {
281
+ await this.weightStore.save();
282
+ }
283
+ }
284
+ /**
285
+ * Get adjusted confidence for a detection
286
+ *
287
+ * @param baseConfidence - The original confidence score (0-1)
288
+ * @param pattern - The pattern identifier
289
+ * @param category - The threat category
290
+ * @returns The adjusted confidence score
291
+ */
292
+ getAdjustedConfidence(baseConfidence, pattern, category) {
293
+ // Suppress unused parameter warning - category could be used for
294
+ // category-specific adjustments in the future
295
+ void category;
296
+ const weight = this.weightStore.getWeight(pattern);
297
+ // If no adjustment exists, return base confidence unchanged
298
+ if (weight === 1.0) {
299
+ return baseConfidence;
300
+ }
301
+ // Apply weight to confidence
302
+ return Math.max(0, Math.min(1, baseConfidence * weight));
303
+ }
304
+ /**
305
+ * Get learning statistics
306
+ */
307
+ getStats() {
308
+ return { ...this.stats };
309
+ }
310
+ /**
311
+ * Extract pattern identifier from a feedback entry
312
+ * Uses detection reason or description as the pattern identifier
313
+ */
314
+ extractPattern(entry) {
315
+ // For false positives, use the detection reason
316
+ if (entry.detection?.reason) {
317
+ return entry.detection.reason;
318
+ }
319
+ // For false negatives, use the description
320
+ if (entry.description) {
321
+ return entry.description;
322
+ }
323
+ // Fallback to detection ID
324
+ if (entry.detectionId) {
325
+ return `detection:${entry.detectionId}`;
326
+ }
327
+ return null;
328
+ }
329
+ /**
330
+ * Reset learning statistics
331
+ */
332
+ resetStats() {
333
+ this.stats = {
334
+ totalAdjustments: 0,
335
+ falsePositivesProcessed: 0,
336
+ falseNegativesProcessed: 0,
337
+ patternsAdjusted: 0,
338
+ };
339
+ this.adjustedPatterns.clear();
340
+ }
341
+ }
342
+ /**
343
+ * Global learner instance
344
+ */
345
+ let globalLearner = null;
346
+ let globalWeightStore = null;
347
+ /**
348
+ * Get the global learner instance
349
+ *
350
+ * @param projectRoot - Optional project root for weight storage
351
+ * @returns The global learner instance
352
+ */
353
+ export function getLearner(projectRoot) {
354
+ if (!globalLearner) {
355
+ globalWeightStore = new FileWeightStore(projectRoot);
356
+ globalLearner = new PatternLearner(globalWeightStore);
357
+ }
358
+ return globalLearner;
359
+ }
360
+ /**
361
+ * Get the global weight store instance
362
+ *
363
+ * @param projectRoot - Optional project root for weight storage
364
+ * @returns The global weight store instance
365
+ */
366
+ export function getWeightStore(projectRoot) {
367
+ if (!globalWeightStore) {
368
+ globalWeightStore = new FileWeightStore(projectRoot);
369
+ }
370
+ return globalWeightStore;
371
+ }
372
+ /**
373
+ * Reset the global learner and weight store (primarily for testing)
374
+ */
375
+ export function resetGlobalLearner() {
376
+ if (globalWeightStore) {
377
+ globalWeightStore.clear();
378
+ }
379
+ globalLearner = null;
380
+ globalWeightStore = null;
381
+ }
382
+ /**
383
+ * Create a new learner with a specific weight store
384
+ *
385
+ * @param weightStore - The weight store to use
386
+ * @returns A new PatternLearner instance
387
+ */
388
+ export function createLearner(weightStore) {
389
+ return new PatternLearner(weightStore);
390
+ }
391
+ /**
392
+ * Create a new weight store with a specific storage location
393
+ *
394
+ * @param projectRoot - Project root directory
395
+ * @param filename - Optional custom filename
396
+ * @returns A new FileWeightStore instance
397
+ */
398
+ export function createWeightStore(projectRoot, filename) {
399
+ return new FileWeightStore(projectRoot, filename);
400
+ }
401
+ //# sourceMappingURL=learner.js.map