oc-one-guard 0.2.0 → 0.3.0

package/README.md

@@ -34,7 +34,7 @@ Published on npm as [`oc-one-guard`](https://www.npmjs.com/package/oc-one-guard)
 {
   "plugin": [
     [
-      "oc-one-guard@0.2.0",
+      "oc-one-guard@0.3.0",
       {
         "endpoint": "http://127.0.0.1:8081/v1/systemone",
         "model": "h2o-lightning-4b"
@@ -68,7 +68,6 @@ An earlier synthetic guard run requested **H2O Lightning 4B** (the served model
 |---|---|
 | Benign calls scored by H2O | 17 allowed, **9 blocked** |
 | Malicious calls scored by H2O | **24 blocked**, 0 allowed |
-| Malicious call skipped by the prefilter | **1 allowed** without model review |
 
 The run was **incomplete**: 45 requests timed out across the direct and guard tests. Timeout blocks aren't model detections, and these small synthetic samples aren't production rates. [See the cases and full breakdown](https://github.com/HumanFace-Tech/oc-one-guard/blob/main/docs/research/h2o-synthetic-evaluation.md).
 

package/config.example.json

@@ -19,12 +19,6 @@
   "redactArguments": true,
   "cacheEnabled": true,
   "cacheTtlMs": 30000,
-  "prefilter": true,
-  "skipTools": [],
-  "deniedTools": [],
-  "allowedTools": [],
-  "allowedHosts": [],
-  "blockedHosts": [],
   "maxStateChars": 8000,
   "maxArgChars": 2000,
   "stateTemplate": "proposed agent tool call\ntool: {tool}\narguments: {arguments}",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oc-one-guard",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "OpenCode plugin (v1 and v2) that checks proposed tool calls for outbound data exfiltration with a local decision-model judge",
   "type": "module",
   "main": "./index.js",

package/src/config.js

@@ -202,13 +202,6 @@ export function normalizeConfig(raw) {
     }
   }
 
-  const denied = new Set(merged.deniedTools ?? [])
-  for (const tool of merged.skipTools ?? []) {
-    if (denied.has(tool)) {
-      errors.push(`tool "${tool}" is on both the deny list and the skip list`)
-    }
-  }
-
   if (errors.length) {
     throw new Error(`[oc-one-guard] Invalid configuration: ${errors.join("; ")}`)
   }
@@ -221,11 +214,6 @@ export function normalizeConfig(raw) {
   merged.cacheTtlMs = Math.max(0, Math.floor(Number(merged.cacheTtlMs) || 0))
   merged.auditGenerations = Math.max(1, Math.floor(Number(merged.auditGenerations) || DEFAULTS.auditGenerations))
 
-  if (!Array.isArray(merged.allowedTools)) merged.allowedTools = []
-  if (!Array.isArray(merged.deniedTools)) merged.deniedTools = []
-  if (!Array.isArray(merged.skipTools)) merged.skipTools = []
-  if (!Array.isArray(merged.allowedHosts)) merged.allowedHosts = []
-  if (!Array.isArray(merged.blockedHosts)) merged.blockedHosts = []
   if (!Array.isArray(merged.questions)) merged.questions = []
 
   return merged

package/src/defaults.js

@@ -47,12 +47,6 @@
  * @property {boolean} redactArguments    Strip secret-looking values before they leave the machine.
  * @property {boolean} cacheEnabled       Cache identical verdicts for a short window.
  * @property {number} cacheTtlMs
- * @property {boolean} prefilter          Skip the judge for calls with no outbound surface.
- * @property {string[]} skipTools         Tool names never inspected.
- * @property {string[]} deniedTools       Tool names always blocked.
- * @property {string[]} allowedTools      Tool names always allowed, judge not consulted.
- * @property {string[]} allowedHosts      Hosts treated as trusted destinations.
- * @property {string[]} blockedHosts      Hosts always treated as exfiltration destinations.
  * @property {number} maxStateChars      Cap on the rendered state sent to the judge.
  * @property {number} maxArgChars        Per-argument truncation before rendering.
  * @property {QuestionConfig[]} questions  Judge questions.
@@ -84,12 +78,6 @@ export const DEFAULTS = {
   redactArguments: true,
   cacheEnabled: true,
   cacheTtlMs: 30000,
-  prefilter: true,
-  skipTools: [],
-  deniedTools: [],
-  allowedTools: [],
-  allowedHosts: [],
-  blockedHosts: [],
   maxStateChars: 8000,
   maxArgChars: 2000,
   stateTemplate:

package/src/guard.js

@@ -2,10 +2,9 @@
  * The guard engine: decide, cache, audit.
  *
  * Decision order:
- *   1. Tool allow/deny lists and host lists decide without consulting the judge.
- *   2. The judge is asked for a verdict.
- *   3. The verdict is compared against `denyThreshold` and `escalateThreshold`.
- *   4. Failures fall back to `failMode`; unclassifiable verdicts to `unknownMode`.
+ *   1. The judge is asked about every call; no code rule decides for it.
+ *   2. The verdict is compared against `denyThreshold` and `escalateThreshold`.
+ *   3. Failures fall back to `failMode`; unclassifiable verdicts to `unknownMode`.
  *
  * The cache is keyed on the *full* call as well as the rendered state. The
  * rendered state is truncated, so two different commands could otherwise
@@ -18,9 +17,9 @@ import { posix } from "node:path"
 import { denyProbability, findDenyOption, JudgeError, requestDecision } from "./judge.js"
 import { sharedCache } from "./shared.js"
 import { requireScope } from "./scope.js"
-import { extractHosts, fullText, hasOutboundSurface, hasTransferPrimitive, renderState, runsLocalScript } from "./state.js"
-import { getWrite, recordWrite, referencedWrites, writesRevision, markUncertainPatch, hasUncertainPatch, refreshWrite, hasWrites, ambiguousPath, hasPendingMutation } from "./written.js"
-import { canonicalTool, listsTool, pathsOf } from "./tools.js"
+import { extractHosts, fullText, hasTransferPrimitive, renderState } from "./state.js"
+import { getWrite, recordWrite, referencedWrites, markUncertainPatch, refreshWrite, ambiguousPath } from "./written.js"
+import { canonicalTool, pathsOf } from "./tools.js"
 
 // Patch headers are line-oriented. Never interpret content lines as paths.
 function trackMutation(name, args, directory, scope) {
@@ -264,89 +263,20 @@ export function createGuard(config, deps = {}) {
       })
     }
 
-    // Deny is a security control and is checked before the skip list, which
-    // is only a performance optimisation.
-    if (listsTool(config.deniedTools, tool)) {
-      return new GuardDecision({
-        verdict: VERDICT.DENY,
-        reason: `Tool "${tool}" is on the deny list.`,
-        tool,
-        hosts,
-        durationMs: 0,
-        mode: "tool-deny",
-      })
-    }
-
-    // Invalidate evidence even if policy later skips this tool or the tool fails.
+    // Writes are tracked only as context for the judge; nothing here decides.
     trackMutation(tool, args, deps.directory, scope)
 
-    if (listsTool(config.skipTools, tool)) {
-      return new GuardDecision({
-        verdict: VERDICT.ALLOW,
-        reason: `Tool "${tool}" is on the skip list.`,
-        tool,
-        hosts,
-        durationMs: 0,
-        mode: "skip",
-      })
-    }
-
-    if (listsTool(config.allowedTools, tool)) {
-      return new GuardDecision({
-        verdict: VERDICT.ALLOW,
-        reason: `Tool "${tool}" is on the allow list.`,
-        tool,
-        hosts,
-        durationMs: 0,
-        mode: "tool-allow",
-      })
-    }
-
     const isShell = tool === "shell"
     const command = typeof args?.command === "string" ? args.command : ""
     const base = typeof deps.directory === "string" && posix.isAbsolute(deps.directory) ? deps.directory : undefined
     const workdir = typeof args?.workdir === "string" && args.workdir ? args.workdir : undefined
     const directory = workdir ? (posix.isAbsolute(workdir) ? posix.normalize(workdir) : base ? posix.resolve(base, workdir) : undefined) : base
-    const words = command.match(/'[^']*'|"[^"]*"|[^\s;&|()<>]+/g) ?? []
-    const ambiguous = ambiguousPath(workdir, base) || ambiguousPath(base) || words.some(word => {
-      const value = word.replace(/^(['"])(.*)\1$/, "$2")
-      return value.includes("/") && ambiguousPath(value, directory)
-    })
-    if (isShell && ambiguous && (hasWrites(scope) || hasUncertainPatch(scope))) {
-      const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Ambiguous filesystem path prevents reliable staged-file evidence.", tool, hosts, durationMs: now() - started, mode: "staged-unknown" })
-      writeAudit(decision, {})
-      return decision
-    }
     const hits = isShell ? referencedWrites(command, directory, scope) : []
     const snapshots = new Map(hits.map(hit => {
       const entry = getWrite(hit.path, undefined, scope)
       const content = entry.content === null ? refreshWrite(hit.path, scope) : entry.content
       return [hit.path, { ...entry, content: content ?? null }]
     }))
-    const unresolvedScript = runsLocalScript(command) && hasWrites(scope) &&
-      ((!directory && !command.match(/(?:^|\s)\//)) || /(?:^|[;&|]\s*)\s*cd(?:\s|$)|[$`*?\[\]{}\\]/.test(command))
-    const unknownStaged = isShell && (hits.some(hit => snapshots.get(hit.path)?.content === null) || (hasPendingMutation(scope) && (hits.length > 0 || runsLocalScript(command))) || (hasUncertainPatch(scope) && runsLocalScript(command)) || unresolvedScript)
-    if (unknownStaged) {
-      const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Tracked file content is unknown after a modification.", tool, hosts, durationMs: now() - started, mode: "staged-unknown" })
-      writeAudit(decision, {})
-      return decision
-    }
-    const revision = writesRevision(scope)
-    const snapshotsValid = () => (!(hits.length || runsLocalScript(command)) || !hasPendingMutation(scope)) && [...snapshots].every(([path, snapshot]) => {
-      const entry = getWrite(path, undefined, scope)
-      return entry && !ambiguousPath(path) && (entry.content === null ? refreshWrite(path, scope) : entry.content) === snapshot.content
-    })
-
-    if (config.prefilter && !hasOutboundSurface(tool, args, directory, scope)) {
-      return new GuardDecision({
-        verdict: VERDICT.ALLOW,
-        reason: `Tool "${tool}" has no outbound surface.`,
-        tool,
-        hosts,
-        durationMs: 0,
-        mode: "prefilter",
-      })
-    }
 
     let state
     try {
@@ -362,7 +292,8 @@ export function createGuard(config, deps = {}) {
       scope,
       })
     } catch {
-      const decision = new GuardDecision({ verdict: VERDICT.DENY, reason: "Security facts exceed the state limit or could not be rendered.", tool, hosts, durationMs: now() - started, mode: "state-block" })
+      const blocked = config.failMode === "block"
+      const decision = new GuardDecision({ verdict: blocked ? VERDICT.DENY : VERDICT.ALLOW, reason: `Call state could not be rendered for the judge. failMode="${config.failMode}".`, tool, hosts, durationMs: now() - started, mode: blocked ? "fail-block" : "fail-allow" })
       writeAudit(decision, {})
       return decision
     }
@@ -372,7 +303,6 @@ export function createGuard(config, deps = {}) {
     const cached = cacheGet(key)
     if (cached?.pending) {
       const decision = await cached.pending
-      if (isShell && (revision !== writesRevision(scope) || !snapshotsValid())) return evaluate(input)
       return new GuardDecision({ ...decision, durationMs: now() - started, mode: `${decision.mode}:coalesced` })
     }
     if (cached?.value) {
@@ -399,10 +329,6 @@ export function createGuard(config, deps = {}) {
       }
       throw error
     }
-    if (isShell && (revision !== writesRevision(scope) || !snapshotsValid())) {
-      if (config.cacheEnabled && cache.get(key)?.pending === pending) cache.delete(key)
-      return evaluate(input)
-    }
     if (decision.mode === "judge" && decision.verdict !== VERDICT.ESCALATE && !decision.stop) cacheSet(key, { ...decision })
     else if (config.cacheEnabled && cache.get(key)?.pending === pending) cache.delete(key)
     return decision

package/src/runtime.js

@@ -7,7 +7,6 @@
 
 import { createAuditLogger } from "./audit.js"
 import { createGuard, VERDICT } from "./guard.js"
-import { scanBlockedHosts } from "./blocked-hosts.js"
 import { redactText } from "./redact.js"
 import { beginMutation, endMutation, markUncertainPatch } from "./written.js"
 import { createStopController } from "./stop.js"
@@ -142,40 +141,8 @@ export function createGuardRuntime(config, { client, directory, scope }) {
         throw new Error("[oc-one-guard] Blocked tool call while conversation cancellation is pending.")
       }
 
-      const scan = config.blockedHosts.length ? scanBlockedHosts(args, config.blockedHosts) : {}
-      if (scan.host || scan.limited) {
-        const decision = {
-          verdict: VERDICT.DENY,
-          reason: scan.host ? `Destination ${scan.host} is on the blocked-host list.` : "Blocked-host scan could not inspect all arguments (scan limit or inaccessible value).",
-          tool,
-          hosts: scan.host ? [scan.host] : [],
-          probability: undefined,
-          durationMs: 0,
-          mode: "host-block",
-          state: undefined,
-        }
-        audit(decision, {})
-        throw new Error(blockedMessage(decision, tool, args))
-      }
-
       const mutation = config.enabled && isMutationTool(tool)
       const key = typeof sessionID === "string" && typeof callID === "string" ? `${sessionID}\0${callID}` : undefined
-      // A token without a key can never be released, so it would deny later
-      // script runs until restart. Refuse the call instead.
-      if (mutation && !key) {
-        const decision = {
-          verdict: VERDICT.DENY,
-          reason: "The call has no session or call identifier, so its pending state cannot be tracked.",
-          tool,
-          hosts: [],
-          probability: undefined,
-          durationMs: 0,
-          mode: "uncorrelated-block",
-          state: undefined,
-        }
-        audit(decision, {})
-        throw new Error(blockedMessage(decision, tool, args))
-      }
       const token = mutation ? beginMutation(scope) : undefined
       if (token && key) {
         const entries = pending.get(key) ?? []

package/src/state.js

@@ -22,29 +22,6 @@ import { canonicalTool, pathsOf } from "./tools.js"
 
 const URL_PATTERN = /\b(?:https?|ftps?|sftp|scp|rsync|ssh|git):\/\/[^\s"'`<>|;&]+/gi
 
-/**
- * Tools that cannot, on their own, move data off the machine.
- *
- * These are the only tools that skip the judge without further checks.
- * Everything else — shell, webfetch, MCP tools, any tool added in a future
- * OpenCode release — is judged.
- */
-const LOCAL_ONLY_TOOLS = new Set([
-  "read",
-  "write",
-  "edit",
-  "apply_patch",
-  "glob",
-  "grep",
-  "list",
-  "todowrite",
-  "todoread",
-  "patch",
-  "question",
-  "plan_exit",
-  "invalid",
-])
-
 /**
  * Tools whose arguments can contain a payload bound for a remote host.
  *
@@ -301,55 +278,6 @@ export function writtenContent(tool, args) {
   return ""
 }
 
-/**
- * Decide whether a tool call has an outbound surface worth judging.
- *
- * The rule is an allowlist of known-local tools. Anything else — including
- * MCP tools, `webfetch`, and any tool added in a future OpenCode release —
- * is judged.
- *
- * A shell command is judged when it uses a network primitive, runs a file
- * the agent has written, or mentions a written file at all.
- */
-export function hasOutboundSurface(tool, args, directory, scope) {
-  requireScope(scope)
-  const name = canonicalTool(tool)
-  if (LOCAL_ONLY_TOOLS.has(name)) {
-    // A file write can stage a payload that a later call executes, so the
-    // content decides.
-    if (CONTENT_TOOLS.has(name)) {
-      const content = writtenContent(name, args)
-      return hasTransferPrimitive(content)
-    }
-    return false
-  }
-
-  if (name === "shell") {
-    const command = typeof args?.command === "string" ? args.command : ""
-    if (hasTransferPrimitive(command)) return true
-    if (runsLocalScript(command)) return true
-    // The command mentions a file the agent wrote earlier. It may now hold
-    // a payload, so it is judged.
-    if (referencedWrites(command, directory, scope).length) return true
-    return false
-  }
-
-  if (name === "webfetch") {
-    if (args && Object.keys(args).some((key) => !["url", "format", "timeout"].includes(key))) return true
-    // A GET can still carry data in the path or the query string.
-    const url = typeof args?.url === "string" ? args.url : ""
-    if (!url) return false
-    try {
-      const parsed = new URL(url)
-      return parsed.search.length > 1 || parsed.pathname.length > 1
-    } catch {
-      return true
-    }
-  }
-
-  return true
-}
-
 /**
  * The contents of files the agent wrote that a command references.
  *

package/src/tools.js

@@ -20,11 +20,6 @@ export function isMutationTool(tool) {
   return ["write", "edit", "patch"].includes(canonicalTool(tool))
 }
 
-export function listsTool(list, tool) {
-  const wanted = canonicalTool(tool)
-  return list.some(entry => typeof entry === "string" && canonicalTool(entry) === wanted)
-}
-
 // 1.x write, edit and read take `filePath`; 2.x takes `path`. Every listed
 // path counts as evidence, so a call that carries both is judged on both.
 export function pathsOf(args) {

package/src/blocked-hosts.js

@@ -1,61 +0,0 @@
-import { hostMatches } from "./guard.js"
-
-// Bound both traversal and text scanning, including object keys. Exceeding a
-// limit is a denial: an unseen suffix could contain a blocked destination.
-const MAX_NODES = 10000
-const MAX_DEPTH = 100
-const MAX_CHARS = 1000000
-// Stop at the authority, leaving paths and queries available for independent
-// URL matches. Shell punctuation can also be valid URL credentials, so it
-// must not truncate the authority before the URL parser sees it.
-const URLS = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/?#]+)/gi
-const SHELL_PUNCTUATION = /["'`<>|;&()]/
-const TRAILING_SHELL_PUNCTUATION = /["'`<>|;&()]+$/
-
-export function scanBlockedHosts(args, patterns) {
-  const seen = new WeakSet()
-  const pending = [{ value: args, depth: 0 }]
-  let nodes = 0
-  let chars = 0
-  try {
-    while (pending.length) {
-      const { value, depth } = pending.pop()
-      if (++nodes > MAX_NODES || depth > MAX_DEPTH) return { limited: true }
-      if (typeof value === "string") {
-        chars += value.length
-        if (chars > MAX_CHARS) return { limited: true }
-        for (const match of value.matchAll(URLS)) {
-          // Check at most two interpretations: the complete authority (minus
-          // closing shell punctuation), and the prefix a shell could use.
-          // Never enumerate every punctuation prefix: work stays bounded.
-          const authority = match[2]
-          const candidates = [authority.replace(TRAILING_SHELL_PUNCTUATION, "")]
-          const delimiter = authority.search(SHELL_PUNCTUATION)
-          if (delimiter >= 0) candidates.push(authority.slice(0, delimiter))
-          for (const candidate of candidates) {
-            try {
-              const host = new URL(match[1] + candidate).hostname.toLowerCase().replace(/\.$/, "")
-              if (!host) return { limited: true }
-              if (hostMatches(host, patterns)) return { host }
-            } catch {
-              // An ambiguous/unparseable authority is not evidence of safety.
-              return { limited: true }
-            }
-          }
-        }
-      } else if (value && typeof value === "object" && !seen.has(value)) {
-        seen.add(value)
-        const keys = Object.keys(value)
-        if (nodes + pending.length + keys.length * 2 > MAX_NODES) return { limited: true }
-        for (const key of keys) {
-          const descriptor = Object.getOwnPropertyDescriptor(value, key)
-          if (!descriptor || !("value" in descriptor)) return { limited: true }
-          pending.push({ value: key, depth: depth + 1 }, { value: descriptor.value, depth: depth + 1 })
-        }
-      }
-    }
-    return {}
-  } catch {
-    return { limited: true }
-  }
-}