prae-cli 0.7.0 → 0.8.0

package/lib/{views-UODslKwu.js → views-CCwVXpo2.js}

@@ -1,50 +1,98 @@
 //#region ../kernel/src/frameworks.ts
-const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-	name: "OWASP Top 10 for LLM Applications — 2026",
-	short: "OWASP LLM 2026",
-	controls: {
-		LLM01: {
-			name: "Prompt Injection",
-			summary: "Instructions in a prompt or in retrieved content alter what the model does."
-		},
-		LLM02: {
-			name: "Sensitive Information Disclosure",
-			summary: "Credentials, personal data or proprietary content reach the model or its output."
-		},
-		LLM03: {
-			name: "Excessive Agency",
-			summary: "The model can take actions, or holds permissions, beyond what its task needs."
-		},
-		LLM04: {
-			name: "Supply Chain",
-			summary: "A compromised model, dataset, plugin or dependency enters the application."
-		},
-		LLM05: {
-			name: "Data and Model Poisoning",
-			summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-		},
-		LLM06: {
-			name: "Unbounded Consumption",
-			summary: "The application permits resource use without a limit, exhausting budget or service."
-		},
-		LLM07: {
-			name: "Misinformation",
-			summary: "The model produces false or misleading content that is acted on as if true."
-		},
-		LLM08: {
-			name: "Hidden Context Exposure",
-			summary: "System prompts, hidden instructions or internal context are revealed."
-		},
-		LLM09: {
-			name: "Vector and Embedding Weaknesses",
-			summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-		},
-		LLM10: {
-			name: "Improper Output Handling",
-			summary: "Model output is passed to downstream systems without validation."
+const FRAMEWORKS = {
+	"owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	},
+	"owasp-agentic-top-10-2026": {
+		name: "OWASP Top 10 for Agentic Applications — 2026",
+		short: "OWASP Agentic 2026",
+		controls: {
+			ASI01: {
+				name: "Agent Goal Hijack",
+				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+			},
+			ASI02: {
+				name: "Tool Misuse and Exploitation",
+				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+			},
+			ASI03: {
+				name: "Identity and Privilege Abuse",
+				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+			},
+			ASI04: {
+				name: "Agentic Supply Chain",
+				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+			},
+			ASI05: {
+				name: "Unexpected Code Execution",
+				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+			},
+			ASI06: {
+				name: "Memory and Context Poisoning",
+				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+			},
+			ASI07: {
+				name: "Insecure Inter-Agent Communication",
+				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+			},
+			ASI08: {
+				name: "Cascading Failures",
+				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+			},
+			ASI09: {
+				name: "Human-Agent Trust Exploitation",
+				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+			},
+			ASI10: {
+				name: "Rogue Agents",
+				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+			}
 		}
 	}
-} };
+};
 /**
 * Every framework control a rule cites, resolved to names.
 *
@@ -802,6 +850,7 @@ const OBLIGATIONS = [
 	}
 ];
 const OWASP = "owasp-llm-top-10-2026";
+const AGENTIC = "owasp-agentic-top-10-2026";
 /** Rules in the pack that cite one control of one framework. */
 function citing(pack, framework, control) {
 	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
@@ -819,32 +868,91 @@ const NOT_THIS_BOUNDARY = {
 	LLM07: "Whether an answer is true is not a property of a tool call.",
 	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
 	LLM09: "Retrieval stores are upstream of the call the gate judges.",
-	LLM10: "What downstream code does with model output is that code's boundary, not this one's."
+	LLM10: "What downstream code does with model output is that code's boundary, not this one's.",
+	ASI04: "Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.",
+	ASI06: "Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.",
+	ASI07: "A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.",
+	ASI09: "Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion."
+};
+/**
+* A risk this gate answers by *not* answering it: nothing here detects an
+* injected instruction or a hijacked goal, and saying otherwise would be the
+* claim a red team disproves first. What the gate does is bound what the
+* subverted agent can execute — the cited controls of another risk doing
+* their job. Said in those words, every time.
+*/
+const BOUNDED_BY = {
+	LLM01: {
+		framework: OWASP,
+		control: "LLM03"
+	},
+	ASI01: {
+		framework: AGENTIC,
+		control: "ASI02"
+	}
+};
+function bounded(data, risk, by) {
+	const bounding = citing(data.pack, by.framework, by.control);
+	const what = risk === "ASI01" ? "a hijacked goal" : "injected instructions";
+	const who = risk === "ASI01" ? "a hijacked agent" : "an injected instruction";
+	return {
+		state: "partial",
+		note: bounding.length === 0 ? `Not mitigated: this gate does not detect ${what}, and no ${by.control} control in this pack bounds what ${who} can execute.` : `Not mitigated: this gate does not detect ${what}. Bounded: ${bounding.length} ${by.control} control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what ${who} can execute.`
+	};
+}
+/**
+* Risks whose evidence is in the record rather than in a citing rule.
+*
+* ASI06: a poisoned context cannot be prevented here, but every change to what
+* the agent was told is sealed, so it is evidenced. ASI10: a drifting agent's
+* actions are judged like any other's; what the record shows is whether the
+* gate refused any of them.
+*/
+const FROM_THE_RECORD = {
+	ASI06: (data) => {
+		const seals = data.entries.filter((e) => e.rule === "PRAE-ASM" || e.rule === "PRAE-CTX");
+		return seals.length === 0 ? void 0 : {
+			state: "partial",
+			note: `Evidenced, not prevented: ${seals.length} seal${seals.length === 1 ? "" : "s"} of what the agent was told (PRAE-ASM / PRAE-CTX) in this record; a poisoned context changes the hash and is answerable afterwards.`
+		};
+	},
+	ASI10: (data) => {
+		const refused = data.entries.filter((e) => e.verdict === "deny").length;
+		const armed = [
+			"ASI02",
+			"ASI03",
+			"ASI08"
+		].flatMap((c) => citing(data.pack, AGENTIC, c));
+		if (armed.length === 0) return void 0;
+		return {
+			state: refused > 0 ? "covered" : "partial",
+			note: refused > 0 ? `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call, and ${refused} refusal${refused === 1 ? "" : "s"} in this record show them holding.` : `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call; none has refused one in this record yet. Detecting drift itself is derived from the record, not a rule.`
+		};
+	}
 };
-function owaspRow(control) {
-	const framework = FRAMEWORKS[OWASP];
+function frameworkRow(frameworkId, control) {
+	const framework = FRAMEWORKS[frameworkId];
 	const risk = framework?.controls[control];
 	const name = risk?.name ?? control;
 	return {
-		id: `${framework?.short ?? OWASP} · ${control}`,
+		id: `${framework?.short ?? frameworkId} · ${control}`,
 		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
 		evidence: (data) => {
 			if (data.pack === void 0) return {
 				state: "absent",
 				note: "No pack supplied to this view."
 			};
-			if (control === "LLM01") {
-				const bounding = citing(data.pack, OWASP, "LLM03");
+			const by = BOUNDED_BY[control];
+			if (by !== void 0) return bounded(data, control, by);
+			const rules = citing(data.pack, frameworkId, control);
+			if (rules.length === 0) {
+				const derived = FROM_THE_RECORD[control]?.(data);
+				if (derived !== void 0) return derived;
 				return {
-					state: "partial",
-					note: bounding.length === 0 ? "Not mitigated: this gate does not detect injected instructions, and no LLM03 control in this pack bounds what one can execute." : `Not mitigated: this gate does not detect injected instructions. Bounded: ${bounding.length} LLM03 control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what an injected instruction can execute.`
+					state: "absent",
+					note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
 				};
 			}
-			const rules = citing(data.pack, OWASP, control);
-			if (rules.length === 0) return {
-				state: "absent",
-				note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
-			};
 			const ids = new Set(rules.map((rule) => rule.id));
 			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
 			const listed = rules.map((rule) => rule.id).join(", ");
@@ -858,14 +966,18 @@ function owaspRow(control) {
 		}
 	};
 }
-const OWASP_ROWS = Object.keys(FRAMEWORKS[OWASP]?.controls ?? {}).map(owaspRow);
+const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ?? {}).map((control) => frameworkRow(frameworkId, control));
 /**
-* The obligations first, then the OWASP risks. Two kinds of row in one table
-* on purpose: an auditor reads down one list and finds the audit obligations
-* the ledger evidences and the application risks the pack's rules address,
-* each stated in its framework's own words.
+* The obligations first, then the risks framework by framework. Two kinds of
+* row in one table on purpose: an auditor reads down one list and finds the
+* audit obligations the ledger evidences and the application risks the pack's
+* rules address, each stated in its framework's own words.
 */
-const CONTROLS = [...OBLIGATIONS, ...OWASP_ROWS];
+const CONTROLS = [
+	...OBLIGATIONS,
+	...rowsOf(OWASP),
+	...rowsOf(AGENTIC)
+];
 
 //#endregion
 //#region src/console/views.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,9 +40,9 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
-    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
+    "@prae/controls": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",