pptb-standard-sample-tool 1.1.3 → 1.1.5

package/README.md

@@ -56,7 +56,10 @@ This compiles the TypeScript source in `src/` to JavaScript in `dist/`.
 ```
 html-sample/
 ├── src/
-│   └── app.ts           # Main application logic (TypeScript)
+│   ├── app.ts           # Main application logic (TypeScript)
+│   ├── features/        # UI feature modules (terminal, filesystem, etc.)
+│   ├── security/        # Security policy + test suites
+│   └── utils/           # Small reusable helpers
 ├── index.html           # Main HTML file (entry point)
 ├── styles.css           # Stylesheet
 ├── package.json         # Package configuration
@@ -95,7 +98,7 @@ html-sample/
 - Create isolated terminal instances
 - Execute shell commands
 - Run a safe terminal security probe (non-destructive)
-- Run a Security Test Suite with pass/fail JSON report
+- Run API-specific security test suites with pass/fail JSON reports
 - View command output
 - Close terminal when done
 
@@ -171,18 +174,20 @@ If the probe succeeds, treat that as a signal to enforce stricter host-side cont
 - Path allow-listing for filesystem APIs
 - Auditing/logging for terminal command execution
 
-This sample now includes policy guards in [src/app.ts](src/app.ts):
-- `TERMINAL_ALLOWED_COMMANDS`: explicit commands allowed to run
-- `TERMINAL_BLOCKED_TOKENS`: deny-list for risky command fragments
-- `FILE_PATH_BLOCK_LIST`: blocks sensitive filesystem locations (for example `.ssh` and `/etc/*` paths)
-- `executeCommandWithPolicyGuard(...)` and `readTextWithPolicyGuard(...)`: central enforcement wrappers
-
-It also includes a **Security Test Suite** button that runs non-destructive checks and emits a JSON report:
-- command allow-list enforcement
-- risky token detection
-- path normalization and sensitive path matching
-- malformed terminal event payload resilience
-- lightweight burst/rate handling probe
+This sample now includes policy guards in [src/security/policy.ts](src/security/policy.ts):
+- `getBlockedCommandReason(...)` / `getBlockedPathReason(...)`: policy decisions
+- `executeCommandWithPolicyGuard(...)` / `readTextWithPolicyGuard(...)`: central enforcement wrappers
+
+Security suites and report formatting live in:
+- [src/security/suites.ts](src/security/suites.ts)
+- [src/security/reporting.ts](src/security/reporting.ts)
+
+It also includes **API-specific Security Suite** buttons plus an **All Suites** runner. Each suite emits a JSON report with per-test `severity` and a rolled-up `highestSeverity`:
+- **Terminal suite:** command allow-list enforcement, multiline/control-character blocking, overlong command blocking, local-data-to-network exfil pattern blocking, burst handling
+- **FileSystem suite:** absolute-path enforcement, traversal blocking, sensitive path blocking, guarded read rejection checks, API surface checks
+- **Events suite:** event API presence and malformed payload resilience checks
+- **Settings suite:** API surface checks, set/get roundtrip checks, optional setAll/getAll validation
+- **Dataverse suite:** method surface checks and read-only runtime checks (WhoAmI/query) when connected
 
 For production PPTB host hardening, apply equivalent checks in the host process (server-side / main-process boundary), not only in tool UI code.