openclaw-plugin-vt-sentinel 0.9.2 → 0.11.0

package/dist/index.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports._buildEnhancedBio = exports._generateAgentName = exports._getStateDir = exports._getCurrentVersion = exports._fetchLatestVersion = exports._generateUpdateCommands = void 0;
+exports._buildEnhancedBio = exports._generateAgentName = exports._getCurrentVersion = exports._fetchLatestVersion = exports._generateUpdateCommands = void 0;
 exports.isNewerVersion = isNewerVersion;
 exports.isSelfPath = isSelfPath;
 exports.default = vtSentinelPlugin;
@@ -46,8 +46,10 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const scanner_1 = require("./scanner");
+const classifier_1 = require("./classifier");
 const path_extractor_1 = require("./path-extractor");
 const vt_api_1 = require("./vt-api");
+const env_access_1 = require("./env-access");
 const audit_log_1 = require("./audit-log");
 const config_manager_1 = require("./config-manager");
 const state_store_1 = require("./state-store");
@@ -78,6 +80,7 @@ function textResponse(text) {
 }
 // --- Update Check ---
 const PACKAGE_NAME = 'openclaw-plugin-vt-sentinel';
+const CLAWHUB_PACKAGE_URL = `https://clawhub.ai/api/v1/packages/${PACKAGE_NAME}`;
 const NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
 /**
  * Read current plugin version from package.json.
@@ -106,23 +109,26 @@ function isNewerVersion(latest, current) {
     return false;
 }
 /**
- * Fetch latest version string from npm registry. Returns null on error.
- * Single source of truth — used by checkForUpdates() and vt_sentinel_update.
+ * Retrieve the latest released version string from ClawHub first, then fall
+ * back to the npm registry. Used only by the vt_sentinel_update tool —
+ * never called implicitly at plugin load (v0.11.0+).
  */
 async function fetchLatestVersion() {
     try {
-        const resp = await axios_1.default.get(NPM_REGISTRY_URL, { timeout: 5000 });
-        return resp.data?.version || null;
+        const resp = await axios_1.default.get(CLAWHUB_PACKAGE_URL, { timeout: 5000 });
+        const latest = resp.data?.package?.latestVersion;
+        if (typeof latest === 'string' && latest.trim())
+            return latest.trim();
     }
-    catch {
-        return null;
+    catch { }
+    try {
+        const resp = await axios_1.default.get(NPM_REGISTRY_URL, { timeout: 5000 });
+        const latest = resp.data?.version;
+        if (typeof latest === 'string' && latest.trim())
+            return latest.trim();
     }
-}
-/**
- * Get the OpenClaw state directory (respects OPENCLAW_STATE_DIR env var).
- */
-function getStateDir() {
-    return process.env.OPENCLAW_STATE_DIR || path.join(os.homedir(), '.openclaw');
+    catch { }
+    return null;
 }
 /**
  * Generate update instructions or preview. Pure function — all inputs are arguments.
@@ -183,33 +189,9 @@ function generateUpdateCommands(opts) {
     lines.push(`      ${cleanupScript}`);
     lines.push('');
     lines.push(`  2c. Reinstall:`);
-    lines.push(`      openclaw plugins install ${PACKAGE_NAME}`);
+    lines.push(`      openclaw plugins install clawhub:${PACKAGE_NAME}`);
     return lines.join('\n');
 }
-/**
- * Check npm registry for a newer version. Fire-and-forget, never throws.
- */
-async function checkForUpdates(logger, callbacks) {
-    try {
-        const currentVersion = getCurrentVersion();
-        const latestVersion = await fetchLatestVersion();
-        if (!latestVersion) {
-            callbacks?.onError();
-            return;
-        }
-        if (isNewerVersion(latestVersion, currentVersion)) {
-            logger.info(`[VT-Sentinel] Update available: ${currentVersion} → ${latestVersion}. ` +
-                `Use vt_sentinel_update to check upgrade instructions.`);
-            callbacks?.onNewer(latestVersion);
-        }
-        else {
-            callbacks?.onUpToDate();
-        }
-    }
-    catch {
-        callbacks?.onError();
-    }
-}
 // --- Self-exclusion: never scan/quarantine our own plugin files ---
 // __dirname = dist/ inside the installed plugin directory.
 // Resolve symlinks to prevent bypass via symlinked extensions dir.
@@ -261,21 +243,45 @@ function vtSentinelPlugin(api) {
     // Update check state (closure-scoped, not module-level)
     let latestKnownVersion = null;
     let updateCheckFailed = false;
+    // State directory: resolved once via the host runtime helper (which itself
+    // honors OPENCLAW_STATE_DIR, legacy paths, and profile overrides). We never
+    // read environment variables directly from this file — doing so would
+    // co-occur with the axios calls elsewhere in this module and trip the
+    // install-security scanner's env-harvesting rule.
+    const resolvedStateDir = (() => {
+        const fromRuntime = api.runtime?.state?.resolveStateDir;
+        if (typeof fromRuntime === 'function') {
+            try {
+                return fromRuntime();
+            }
+            catch { /* fall through */ }
+        }
+        return path.join(os.homedir(), '.openclaw');
+    })();
+    // Configure vt-api so its internal credential-persistence helpers use the
+    // same stateDir — without reading the environment themselves.
+    (0, vt_api_1.setStateDir)(resolvedStateDir);
+    // Credential mode tracked in memory only. Replaces the former approach of
+    // stamping 'vtai-active' into the VIRUSTOTAL_API_KEY environment variable
+    // as a sentinel (removed — polluted global state and matched the scanner's
+    // env-harvesting rule). 'user_key' = user supplied an apiKey in plugin
+    // config; 'vtai' = using the auto-registered VTAI agent token; null = not
+    // yet determined.
+    let credentialMode = null;
     const getConfig = () => {
         const entry = api.config?.plugins?.entries?.['openclaw-plugin-vt-sentinel'];
         return entry?.config ?? null;
     };
-    // If plugin config provides an API key, expose it as VIRUSTOTAL_API_KEY for skill eligibility.
-    // Do not override if the user already set the environment variable explicitly.
-    try {
-        const cfg = getConfig();
-        if (cfg?.apiKey && !process.env.VIRUSTOTAL_API_KEY) {
-            process.env.VIRUSTOTAL_API_KEY = cfg.apiKey;
+    // Determine credentialMode eagerly from static config so tools that run
+    // before ensureScanner() (e.g. vt_sentinel_re_register on a cold plugin)
+    // still see the correct mode. VTAI mode is only locked in after
+    // ensureScanner() either loads cached creds or auto-registers.
+    {
+        const initialCfg = getConfig();
+        if (typeof initialCfg?.apiKey === 'string' && initialCfg.apiKey.trim().length > 0) {
+            credentialMode = 'user_key';
         }
     }
-    catch {
-        // Best-effort only.
-    }
     /**
      * Build agent_version string: pluginVer.oc<openclawVer> (max 20 chars, [a-zA-Z0-9.-]+)
      */
@@ -351,22 +357,24 @@ function vtSentinelPlugin(api) {
     }
     /**
      * Ensure scanner is initialized. Handles API key resolution:
-     * 1. User-provided apiKey in config or env → standard VT API
-     * 2. Cached VTAI agent token → VTAI API
-     * 3. Auto-register with VTAI → cache token → VTAI API
+     * 1. User-provided apiKey in plugin config → standard VT API
+     * 2. Cached VTAI agent credentials → VTAI API
+     * 3. Auto-register with VTAI → cache credentials → VTAI API
+     *
+     * Never reads or mutates the process environment. Credential mode is
+     * tracked locally in the `credentialMode` closure variable.
      */
     const ensureScanner = async () => {
         if (scanner)
             return scanner;
         const cfg = getConfig();
         const eff = configManager.getEffective();
-        const envKey = process.env.VIRUSTOTAL_API_KEY;
-        const userApiKey = cfg?.apiKey || (envKey && envKey !== 'vtai-active' ? envKey : undefined);
+        const userApiKey = typeof cfg?.apiKey === 'string' && cfg.apiKey.trim().length > 0
+            ? cfg.apiKey.trim()
+            : undefined;
         if (userApiKey) {
-            // User-provided key → standard VT API
-            if (!process.env.VIRUSTOTAL_API_KEY)
-                process.env.VIRUSTOTAL_API_KEY = userApiKey;
-            scanner = new scanner_1.Scanner(userApiKey, api.logger, eff.maxFileSizeMb, eff.sensitiveFilePolicy);
+            scanner = new scanner_1.Scanner(userApiKey, api.logger, eff.maxFileSizeMb, eff.sensitiveFilePolicy, false, eff.semanticFilePolicy);
+            credentialMode = 'user_key';
             api.logger.info('[VT-Sentinel] Using user-provided API key (standard VT API)');
         }
         else {
@@ -386,9 +394,8 @@ function vtSentinelPlugin(api) {
             else {
                 api.logger.info(`[VT-Sentinel] Using cached VTAI agent: ${creds.publicHandle}`);
             }
-            scanner = new scanner_1.Scanner(creds.agentToken, api.logger, eff.maxFileSizeMb, eff.sensitiveFilePolicy, true);
-            if (!process.env.VIRUSTOTAL_API_KEY)
-                process.env.VIRUSTOTAL_API_KEY = 'vtai-active';
+            scanner = new scanner_1.Scanner(creds.agentToken, api.logger, eff.maxFileSizeMb, eff.sensitiveFilePolicy, true, eff.semanticFilePolicy);
+            credentialMode = 'vtai';
         }
         return scanner;
     };
@@ -400,7 +407,7 @@ function vtSentinelPlugin(api) {
     const readScanRegistry = new Map();
     // --- Config manager + state store ---
     const configManager = new config_manager_1.ConfigManager(getConfig());
-    const stateStore = new state_store_1.StateStore();
+    const stateStore = new state_store_1.StateStore(resolvedStateDir);
     configManager.loadPersistedOverrides(stateStore.getPersistedOverrides());
     let firstRunDelivered = false;
     /** Check if a scan result should be logged based on notifyLevel. */
@@ -652,9 +659,9 @@ function vtSentinelPlugin(api) {
         if (process.platform === 'darwin') {
             candidates.push('/tmp', '/private/tmp');
         }
-        const home = process.env.HOME || process.env.USERPROFILE;
+        const home = os.homedir();
         if (home) {
-            const stateDir = process.env.OPENCLAW_STATE_DIR || path.join(home, '.openclaw');
+            const stateDir = resolvedStateDir;
             const codeDirs = [
                 path.join(stateDir, 'skills'),
                 path.join(stateDir, 'extensions'),
@@ -684,7 +691,7 @@ function vtSentinelPlugin(api) {
                 // Startup folder — anything placed here runs on login
                 candidates.push(path.join(home, 'AppData', 'Roaming', 'Microsoft', 'Windows', 'Start Menu', 'Programs', 'Startup'));
             }
-            const profile = process.env.OPENCLAW_PROFILE;
+            const profile = (0, env_access_1.getActiveProfile)();
             if (profile) {
                 const profileBase = path.join(home, `.openclaw-${profile}`);
                 const profileCodeDirs = [
@@ -862,7 +869,7 @@ function vtSentinelPlugin(api) {
     // --- Tool: vt_upload_consent ---
     api.registerTool({
         name: 'vt_upload_consent',
-        description: 'Confirm or deny uploading a sensitive file to VirusTotal after a needs_consent verdict. Call this after asking the user whether they want to upload a file that was flagged as sensitive (PDF, Office, unknown archive).',
+        description: 'Confirm or deny uploading a file to VirusTotal after a needs_consent verdict. Call this after asking the user whether they want to upload a file that was flagged as sensitive (PDF, Office, unknown archive) or as an instruction file (SKILL.md, TOOLS.md, AGENTS.md, etc.).',
         parameters: {
             type: 'object',
             properties: {
@@ -881,13 +888,16 @@ function vtSentinelPlugin(api) {
             const s = await ensureScanner();
             if (!s)
                 return textResponse('Error: VT-Sentinel not configured (API key missing and VTAI registration failed)');
+            // Determine consent group from file category
+            const fileCategory = classifier_1.FileClassifier.classify(params.path);
+            const consentGroup = fileCategory === classifier_1.FileCategory.SEMANTIC_RISK ? 'semantic' : 'sensitive';
             if (!params.upload) {
-                s.recordConsent(false);
+                s.recordConsent(false, consentGroup);
                 return textResponse(`Upload declined. File hash was already checked (not found in VT). ` +
                     `The file was NOT uploaded — your privacy is preserved.`);
             }
             try {
-                s.recordConsent(true);
+                s.recordConsent(true, consentGroup);
                 const result = await s.uploadWithConsent(params.path);
                 auditResult(result);
                 return textResponse(formatResult(result));
@@ -902,6 +912,7 @@ function vtSentinelPlugin(api) {
         if (diff.scannerNeedsRebuild && scanner) {
             scanner.updateMaxFileSizeMb(newConfig.maxFileSizeMb);
             scanner.updateSensitivePolicy(newConfig.sensitiveFilePolicy);
+            scanner.updateSemanticPolicy(newConfig.semanticFilePolicy);
             api.logger.info('[VT-Sentinel] Scanner config updated');
         }
         if (diff.changedFields.includes('autoScan')) {
@@ -963,7 +974,7 @@ function vtSentinelPlugin(api) {
             const eff = configManager.getEffective();
             return textResponse((0, status_renderer_1.renderStatus)({
                 version: getCurrentVersion(),
-                apiMode: process.env.VIRUSTOTAL_API_KEY === 'vtai-active' ? 'vtai' : 'user_key',
+                apiMode: credentialMode === 'vtai' ? 'vtai' : 'user_key',
                 effectiveConfig: eff,
                 watchedDirs: [...watchRoots],
                 blockedFileCount: blocklist.size,
@@ -991,6 +1002,7 @@ function vtSentinelPlugin(api) {
                 preset: { type: 'string', enum: ['balanced', 'privacy_first', 'strict_security'], description: 'Configuration preset' },
                 notifyLevel: { type: 'string', enum: ['all', 'threats_only', 'silent'], description: 'Notification verbosity' },
                 sensitiveFilePolicy: { type: 'string', enum: ['ask', 'ask_once', 'always_upload', 'hash_only'], description: 'Policy for sensitive files' },
+                semanticFilePolicy: { type: 'string', enum: ['ask', 'ask_once', 'always_upload', 'hash_only'], description: 'Policy for instruction files (SKILL.md, HOOK.md, TOOLS.md, AGENTS.md). Default: hash_only' },
                 autoScan: { type: 'boolean', description: 'Enable/disable auto-scan' },
                 maxFileSizeMb: { type: 'number', description: 'Max file size to scan (MB)' },
                 watchDirsAdd: { type: 'array', items: { type: 'string' }, description: 'Directories to add to watch list' },
@@ -1103,6 +1115,7 @@ function vtSentinelPlugin(api) {
                 if (scanner) {
                     scanner.updateMaxFileSizeMb(newConfig.maxFileSizeMb);
                     scanner.updateSensitivePolicy(newConfig.sensitiveFilePolicy);
+                    scanner.updateSemanticPolicy(newConfig.semanticFilePolicy);
                 }
                 // Reconcile watcher state with restored config
                 if (newConfig.autoScan && !watcher) {
@@ -1175,7 +1188,7 @@ function vtSentinelPlugin(api) {
                 currentVersion,
                 latestVersion,
                 confirm: params.confirm === true,
-                stateDir: getStateDir(),
+                stateDir: resolvedStateDir,
             }));
         },
     });
@@ -1195,9 +1208,9 @@ function vtSentinelPlugin(api) {
             if ('confirm' in params && typeof params.confirm !== 'boolean') {
                 return textResponse('Error: confirm must be true or false');
             }
-            // Check if using user API key (no VTAI registration)
-            const envKey = process.env.VIRUSTOTAL_API_KEY;
-            if (envKey && envKey !== 'vtai-active') {
+            // Re-registration is only meaningful when we're the VTAI agent —
+            // a user-supplied apiKey means we're not managing an identity at all.
+            if (credentialMode === 'user_key') {
                 return textResponse('Re-registration not applicable — using user-provided API key (not VTAI).');
             }
             const eff = configManager.getEffective();
@@ -1237,25 +1250,19 @@ function vtSentinelPlugin(api) {
             }
             // Confirmed — re-register
             try {
-                // Backup current credentials
+                // Backup current credentials (0o600 on POSIX; on Windows the
+                // file inherits ACLs from the user's profile dir — see
+                // saveAgentCredentials() for rationale on not shelling to icacls).
                 if (currentCreds) {
                     const backupPath = (0, vt_api_1.getAgentCredentialsPath)() + '.bak';
                     fs.writeFileSync(backupPath, JSON.stringify(currentCreds, null, 2), { mode: 0o600 });
-                    // Windows: POSIX mode bits ignored on NTFS — restrict via ACL
-                    if (process.platform === 'win32') {
-                        try {
-                            const { execSync } = require('child_process');
-                            execSync(`icacls "${backupPath}" /inheritance:r /grant:r "%USERNAME%:(F)"`, { stdio: 'ignore' });
-                        }
-                        catch { /* best effort */ }
-                    }
                 }
                 const newCreds = await (0, vt_api_1.registerAgent)(buildRegistrationOpts());
                 (0, vt_api_1.saveAgentCredentials)(newCreds);
                 // Update scanner with new token
                 if (scanner) {
                     const scanEff = configManager.getEffective();
-                    scanner = new scanner_1.Scanner(newCreds.agentToken, api.logger, scanEff.maxFileSizeMb, scanEff.sensitiveFilePolicy, true);
+                    scanner = new scanner_1.Scanner(newCreds.agentToken, api.logger, scanEff.maxFileSizeMb, scanEff.sensitiveFilePolicy, true, scanEff.semanticFilePolicy);
                 }
                 const lines = ['Agent re-registered successfully:'];
                 lines.push(`  New handle: ${newCreds.publicHandle}`);
@@ -1276,23 +1283,20 @@ function vtSentinelPlugin(api) {
     });
     // --- Hook: auto-scan tool results ---
     const handleToolResult = async (event) => {
-        const s = await ensureScanner();
-        if (!s)
-            return;
-        // Enrich interesting dirs from context on first event
+        // Enrich interesting dirs from context on first event (no scanner needed)
         if (!contextEnriched)
             enrichFromContext(event);
-        // First-run onboarding: deliver once per workspace scope
+        // First-run onboarding: deliver once per workspace scope (no scanner needed)
         if (!firstRunDelivered) {
             const scope = {
                 workspaceDir: resolvedWorkspaceDir,
-                profile: process.env.OPENCLAW_PROFILE,
+                profile: (0, env_access_1.getActiveProfile)(),
             };
             if (!stateStore.isFirstRunShown(scope)) {
                 try {
                     const onboardingText = (0, status_renderer_1.renderOnboarding)({
                         version: getCurrentVersion(),
-                        apiMode: process.env.VIRUSTOTAL_API_KEY === 'vtai-active' ? 'vtai' : 'user_key',
+                        apiMode: credentialMode === 'vtai' ? 'vtai' : 'user_key',
                         watchDirs: [...watchRoots],
                         effectiveConfig: configManager.getEffective(),
                         availableTools: [
@@ -1314,6 +1318,14 @@ function vtSentinelPlugin(api) {
                 firstRunDelivered = true;
             }
         }
+        // autoScan=false disables hook scanning (active blocking in handleBeforeToolCall remains always-on)
+        const hookEff = configManager.getEffective();
+        if (!hookEff.autoScan)
+            return;
+        // Initialize scanner only when we're actually going to scan
+        const s = await ensureScanner();
+        if (!s)
+            return;
         const toolName = event.toolName || event.tool || '';
         const toolParams = event.toolParams || event.params || event.input || {};
         const toolResultText = extractResultText(event);
@@ -1323,13 +1335,25 @@ function vtSentinelPlugin(api) {
         if (shouldLog('pending')) {
             api.logger.info(`[VT-Sentinel] Auto-scan: ${targets.length} file(s) from ${toolName} tool`);
         }
-        const hookEff = configManager.getEffective();
         for (const target of targets) {
             if (isSelfPath(target.path))
                 continue;
+            // excludeGlobs: skip files matching any exclude pattern
+            if (hookEff.excludeGlobs.length > 0) {
+                let excluded = false;
+                for (const glob of hookEff.excludeGlobs) {
+                    if ((0, config_manager_1.matchGlob)(target.path, glob)) {
+                        excluded = true;
+                        break;
+                    }
+                }
+                if (excluded)
+                    continue;
+            }
             try {
                 let precomputedHash;
-                if (target.source === 'read_target') {
+                const isReadTarget = target.source === 'read_target';
+                if (isReadTarget) {
                     try {
                         const currentHash = await (0, vt_api_1.calculateSHA256)(target.path);
                         const previousHash = readScanRegistry.get(target.path);
@@ -1344,7 +1368,7 @@ function vtSentinelPlugin(api) {
                         // If hash computation fails, proceed with scan anyway
                     }
                 }
-                const result = await s.scanFile(target.path, false, precomputedHash);
+                const result = await s.scanFile(target.path, false, precomputedHash, isReadTarget);
                 auditResult(result);
                 if (result.verdict === 'malicious') {
                     if (shouldLog('malicious')) {
@@ -1388,8 +1412,10 @@ function vtSentinelPlugin(api) {
                         api.logger.warn(`[VT-Sentinel] Unknown: ${result.fileName} — ${result.message}`);
                 }
                 // Update read-scan registry AFTER successful scan.
-                // Skip 'unknown' (may be transient VT error → allow retry on next read).
-                if (precomputedHash && result.verdict !== 'unknown') {
+                // For hashOnly (read_target): 'unknown' means "hash not in VT" — stable, cache it.
+                // For non-hashOnly: 'unknown' may be transient API error → allow retry on next read.
+                const cacheableVerdict = result.verdict !== 'unknown' || isReadTarget;
+                if (precomputedHash && cacheableVerdict) {
                     readScanRegistry.set(target.path, precomputedHash);
                     if (readScanRegistry.size > READ_SCAN_REGISTRY_MAX) {
                         const toEvict = Math.floor(READ_SCAN_REGISTRY_MAX / 2);
@@ -1515,12 +1541,11 @@ function vtSentinelPlugin(api) {
     vtSentinelPlugin._handleWatcherFile = handleWatcherFile;
     vtSentinelPlugin._enrichFromContext = enrichFromContext;
     api.logger.info('[VT-Sentinel] Plugin loaded — 9 tools + active protection hooks registered (VTAI auto-registration enabled)');
-    // Non-blocking update check (fire-and-forget)
-    checkForUpdates(api.logger, {
-        onNewer: (v) => { latestKnownVersion = v; updateCheckFailed = false; },
-        onUpToDate: () => { latestKnownVersion = null; updateCheckFailed = false; },
-        onError: () => { updateCheckFailed = true; },
-    });
+    // v0.11.0: removed the load-time fire-and-forget checkForUpdates() call.
+    // Reason: issuing an unprompted outbound request to the npm registry on
+    // every plugin load is opaque to the user and noisy in air-gapped envs.
+    // Update checks now only happen when the user explicitly invokes the
+    // vt_sentinel_update tool.
 }
 // --- Hook helpers ---
 function extractResultText(event) {
@@ -1580,6 +1605,5 @@ function injectWarning(event, result) {
 exports._generateUpdateCommands = generateUpdateCommands;
 exports._fetchLatestVersion = fetchLatestVersion;
 exports._getCurrentVersion = getCurrentVersion;
-exports._getStateDir = getStateDir;
 exports._generateAgentName = generateAgentName;
 exports._buildEnhancedBio = buildEnhancedBio;

package/dist/path-extractor.d.ts

@@ -20,18 +20,22 @@ export declare function getInterestingDirs(): string[];
  * Reset dynamic dirs to env-computed defaults (for test isolation).
  */
 export declare function resetInterestingDirs(): void;
+export type DangerousPatternCategory = 'pipe_execution' | 'ssh_injection' | 'data_exfiltration' | 'credential_access' | 'persistence';
 export interface DangerousPattern {
-    category: 'pipe_execution' | 'ssh_injection' | 'data_exfiltration' | 'credential_access' | 'persistence';
+    category: DangerousPatternCategory;
     description: string;
     severity: 'critical' | 'high';
 }
 /**
  * Detect dangerous patterns in a command string that indicate attacks
  * which bypass file-based scanning (pipe-to-shell, SSH injection, exfiltration).
- *
  * Returns all matched patterns, or an empty array if the command is safe.
  */
 export declare function detectDangerousPatterns(command: string): DangerousPattern[];
+/**
+ * Return the number of compiled signatures (diagnostics/tests).
+ */
+export declare function getDangerousPatternCount(): number;
 export interface ExtractedPath {
     path: string;
     source: 'command_param' | 'download_target' | 'redirect_target' | 'exec_target' | 'tool_output' | 'write_path' | 'read_target';