shieldcortex 2.13.3 → 2.14.0

package/dist/cli/iron-dome.js

@@ -0,0 +1,219 @@
+/**
+ * Iron Dome CLI Commands
+ *
+ * Usage:
+ *   shieldcortex iron-dome activate [--profile school|enterprise|personal|paranoid]
+ *   shieldcortex iron-dome status
+ *   shieldcortex iron-dome deactivate
+ *   shieldcortex iron-dome scan --text "..."
+ *   shieldcortex iron-dome scan --file <path>
+ *   shieldcortex iron-dome audit [--tail] [--search <term>] [--date <date>]
+ */
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { initDatabase } from '../database/init.js';
+import { activateIronDome, deactivateIronDome, getIronDomeStatus, scanForInjection, } from '../defence/iron-dome/index.js';
+import { queryAuditLogs } from '../defence/audit/index.js';
+const bold = '\x1b[1m';
+const reset = '\x1b[0m';
+const green = '\x1b[32m';
+const red = '\x1b[31m';
+const yellow = '\x1b[33m';
+const cyan = '\x1b[36m';
+const dim = '\x1b[2m';
+/**
+ * Ensure database is initialised for CLI commands.
+ */
+function ensureDb() {
+    const dbPath = process.env.CLAUDE_MEMORY_DB || path.join(os.homedir(), '.shieldcortex', 'memories.db');
+    initDatabase(dbPath);
+}
+/**
+ * Handle the `iron-dome` subcommand.
+ */
+export async function handleIronDomeCommand(args) {
+    const subcommand = args[0];
+    if (!subcommand || subcommand === '--help' || subcommand === '-h') {
+        printUsage();
+        return;
+    }
+    ensureDb();
+    switch (subcommand) {
+        case 'activate':
+            handleActivate(args.slice(1));
+            break;
+        case 'status':
+            handleStatus();
+            break;
+        case 'deactivate':
+            handleDeactivate();
+            break;
+        case 'scan':
+            handleScan(args.slice(1));
+            break;
+        case 'audit':
+            handleAudit(args.slice(1));
+            break;
+        default:
+            console.error(`Unknown iron-dome command: ${subcommand}`);
+            printUsage();
+            process.exit(1);
+    }
+}
+function printUsage() {
+    console.log(`
+${bold}Iron Dome — Behaviour Protection Layer${reset}
+
+${bold}Usage:${reset}
+  shieldcortex iron-dome activate [--profile <profile>]
+  shieldcortex iron-dome status
+  shieldcortex iron-dome deactivate
+  shieldcortex iron-dome scan --text "..." | --file <path>
+  shieldcortex iron-dome audit [--tail] [--search <term>]
+
+${bold}Profiles:${reset}
+  school       GDPR strict, pupil data locked
+  enterprise   Financial protection, compliance
+  personal     Lighter touch for personal use
+  paranoid     Everything requires approval
+`);
+}
+function handleActivate(args) {
+    let profile;
+    const profileIdx = args.indexOf('--profile');
+    if (profileIdx !== -1 && args[profileIdx + 1]) {
+        const p = args[profileIdx + 1];
+        if (!['school', 'enterprise', 'personal', 'paranoid'].includes(p)) {
+            console.error(`${red}Unknown profile: ${p}${reset}`);
+            console.error(`Available: school, enterprise, personal, paranoid`);
+            process.exit(1);
+        }
+        profile = p;
+    }
+    const config = activateIronDome(profile);
+    console.log(`
+${bold}${green}Iron Dome Activated${reset}
+
+  Profile:          ${config.profile ?? 'default'}
+  Trusted channels: ${config.trustedChannels.join(', ')}
+  Kill phrase:      "${config.killPhrase}"
+  Require approval: ${config.requireApproval.length} action type(s)
+  Auto-approve:     ${config.autoApprove.length} action type(s)
+  PII never output: ${config.piiRules.neverOutput.length} categories
+  PII aggregates:   ${config.piiRules.aggregatesOnly.length} categories
+`);
+}
+function handleStatus() {
+    const status = getIronDomeStatus();
+    if (!status.enabled) {
+        console.log(`
+${bold}Iron Dome Status${reset}
+${'─'.repeat(40)}
+  Status: ${dim}INACTIVE${reset}
+
+  Run ${cyan}shieldcortex iron-dome activate${reset} to enable.
+`);
+        return;
+    }
+    const c = status.config;
+    console.log(`
+${bold}Iron Dome Status${reset}
+${'─'.repeat(40)}
+  Status:           ${green}ACTIVE${reset}
+  Profile:          ${c.profile ?? 'custom'}
+  Trusted channels: ${c.trustedChannels.join(', ')}
+  Kill phrase:      "${c.killPhrase}"
+  Require approval: ${c.requireApproval.join(', ')}
+  Auto-approve:     ${c.autoApprove.join(', ')}
+  PII never output: ${c.piiRules.neverOutput.length > 0 ? c.piiRules.neverOutput.join(', ') : '(none)'}
+  PII aggregates:   ${c.piiRules.aggregatesOnly.length > 0 ? c.piiRules.aggregatesOnly.join(', ') : '(none)'}
+  Sub-agent blocks: ${c.subAgentRestrictions.blockedOperations.length > 0 ? c.subAgentRestrictions.blockedOperations.join(', ') : '(none)'}
+  Sanitise context: ${c.subAgentRestrictions.sanitiseContext ? 'yes' : 'no'}
+`);
+}
+function handleDeactivate() {
+    deactivateIronDome();
+    console.log(`${bold}Iron Dome deactivated.${reset}`);
+}
+function handleScan(args) {
+    let text;
+    const textIdx = args.indexOf('--text');
+    const fileIdx = args.indexOf('--file');
+    if (textIdx !== -1 && args[textIdx + 1]) {
+        text = args[textIdx + 1];
+    }
+    else if (fileIdx !== -1 && args[fileIdx + 1]) {
+        const filePath = args[fileIdx + 1];
+        try {
+            text = fs.readFileSync(filePath, 'utf-8');
+        }
+        catch (err) {
+            console.error(`${red}Error reading file: ${err.message}${reset}`);
+            process.exit(2);
+        }
+    }
+    if (!text) {
+        console.error('Usage: shieldcortex iron-dome scan --text "..." | --file <path>');
+        process.exit(1);
+    }
+    const result = scanForInjection(text);
+    if (result.clean) {
+        console.log(`${green}CLEAN${reset} — No injection patterns detected (${result.textLength} chars scanned)`);
+        process.exit(0);
+    }
+    console.log(`\n${'!'.repeat(3)}  ${red}${bold}INJECTION DETECTED${reset}  ${'!'.repeat(3)}`);
+    console.log(`Risk level: ${result.riskLevel}`);
+    console.log(`Detections: ${result.detections.length}`);
+    console.log(`Scanned:    ${result.textLength} chars`);
+    console.log();
+    // Group by category
+    const byCat = {};
+    for (const d of result.detections) {
+        (byCat[d.category] ??= []).push(d);
+    }
+    for (const [cat, dets] of Object.entries(byCat).sort(([a], [b]) => a.localeCompare(b))) {
+        console.log(`  ${bold}[${cat}]${reset}`);
+        for (const d of dets) {
+            const sColor = d.severity === 'critical' ? red : d.severity === 'high' ? red : d.severity === 'medium' ? yellow : cyan;
+            console.log(`    ${sColor}[${d.severity.toUpperCase()}]${reset} ${d.pattern}: ${d.description}`);
+            const preview = d.match.slice(0, 120);
+            const suffix = d.match.length > 120 ? '...' : '';
+            console.log(`           ${dim}matched: "${preview}${suffix}"${reset}`);
+        }
+        console.log();
+    }
+    process.exit(1);
+}
+function handleAudit(args) {
+    const searchIdx = args.indexOf('--search');
+    const search = searchIdx !== -1 ? args[searchIdx + 1] : undefined;
+    const tail = args.includes('--tail');
+    const logs = queryAuditLogs({
+        firewallResult: undefined,
+        limit: tail ? 20 : 50,
+    });
+    // Filter to iron-dome entries
+    const ironDomeLogs = logs.filter((log) => log.reason?.startsWith('[iron-dome:'));
+    if (search) {
+        const filtered = ironDomeLogs.filter((log) => log.reason?.toLowerCase().includes(search.toLowerCase()));
+        printAuditLogs(filtered);
+    }
+    else {
+        printAuditLogs(ironDomeLogs);
+    }
+}
+function printAuditLogs(logs) {
+    if (logs.length === 0) {
+        console.log(`${dim}No Iron Dome audit entries found.${reset}`);
+        return;
+    }
+    console.log(`\n${bold}Iron Dome Audit Log${reset} (${logs.length} entries)`);
+    console.log('─'.repeat(60));
+    for (const log of logs) {
+        const resultColor = log.firewall_result === 'ALLOW' ? green : red;
+        console.log(`  ${dim}${log.timestamp}${reset} ${resultColor}${log.firewall_result}${reset} ${log.reason ?? ''}`);
+    }
+    console.log();
+}
+//# sourceMappingURL=iron-dome.js.map

package/dist/cli/iron-dome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iron-dome.js","sourceRoot":"","sources":["../../src/cli/iron-dome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,SAAS,CAAC;AACxB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,GAAG,GAAG,SAAS,CAAC;AAEtB;;GAEG;AACH,SAAS,QAAQ;IACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACvG,YAAY,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAc;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAClE,UAAU,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,QAAQ,EAAE,CAAC;IAEX,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,QAAQ;YACX,YAAY,EAAE,CAAC;YACf,MAAM;QACR,KAAK,YAAY;YACf,gBAAgB,EAAE,CAAC;YACnB,MAAM;QACR,KAAK,MAAM;YACT,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM;QACR,KAAK,OAAO;YACV,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;YAC1D,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,CAAC,GAAG,CAAC;EACZ,IAAI,yCAAyC,KAAK;;EAElD,IAAI,SAAS,KAAK;;;;;;;EAOlB,IAAI,YAAY,KAAK;;;;;CAKtB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,OAAoC,CAAC;IAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAoB,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,oBAAoB,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,CAAC,GAAG,CAAC;EACZ,IAAI,GAAG,KAAK,sBAAsB,KAAK;;sBAEnB,MAAM,CAAC,OAAO,IAAI,SAAS;sBAC3B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;uBAChC,MAAM,CAAC,UAAU;sBAClB,MAAM,CAAC,eAAe,CAAC,MAAM;sBAC7B,MAAM,CAAC,WAAW,CAAC,MAAM;sBACzB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM;sBAClC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM;CAC1D,CAAC,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC;EACd,IAAI,mBAAmB,KAAK;EAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACJ,GAAG,WAAW,KAAK;;QAEvB,IAAI,kCAAkC,KAAK;CAClD,CAAC,CAAC;QACC,OAAO;IACT,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC;EACZ,IAAI,mBAAmB,KAAK;EAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;sBACM,KAAK,SAAS,KAAK;sBACnB,CAAC,CAAC,OAAO,IAAI,QAAQ;sBACrB,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;uBAC3B,CAAC,CAAC,UAAU;sBACb,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;sBAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;sBACxB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ;sBAChF,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ;sBACtF,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ;sBACpH,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;CAC1E,CAAC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,kBAAkB,EAAE,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,yBAAyB,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,IAAI,IAAwB,CAAC;IAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,uBAAuB,GAAG,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,KAAK,sCAAsC,MAAM,CAAC,UAAU,iBAAiB,CAAC,CAAC;QAC3G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,IAAI,qBAAqB,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,QAAQ,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,oBAAoB;IACpB,MAAM,KAAK,GAA6C,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACvH,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,aAAa,OAAO,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,cAAc,EAAE,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACtB,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC9B,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,CACpD,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CACvE,CAAC;QACF,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,YAAY,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAW;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,oCAAoC,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,sBAAsB,KAAK,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,CAAC,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,KAAK,IAAI,WAAW,GAAG,GAAG,CAAC,eAAe,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/defence/index.d.ts

@@ -13,6 +13,8 @@ export type { CredentialScanResult, CredentialFinding, CredentialDetectionConfig
 export { logAudit, queryAuditLogs, getAuditStats } from './audit/index.js';
 export { scanSkill, scanSkillContent, discoverSkillFiles, detectFormat, detectFormatFromContent, parseSkillFile, readSkillFile } from './skill-scanner/index.js';
 export type { SkillScanResult, SkillScanOptions, SkillThreatFinding, ParsedSkill, SkillFormat } from './skill-scanner/index.js';
+export { activateIronDome, deactivateIronDome, getIronDomeStatus, isChannelTrusted, isActionAllowed, scanForInjection, checkPII, handleKillPhrase, IRON_DOME_PROFILES, DEFAULT_IRON_DOME_CONFIG, } from './iron-dome/index.js';
+export type { IronDomeConfig, IronDomeProfile, InjectionScanResult, InjectionDetection, InjectionSeverity, InjectionCategory, GatewayResult, ActionGateResult, ActionDecision, PiiCheckResult, PiiViolation, KillSwitchResult, } from './iron-dome/index.js';
 export { getCloudConfig, setCloudConfig, clearCloudConfigCache, getTrustedSkills, addTrustedSkill, removeTrustedSkill, getDeviceId, getDeviceName, getDefenceMode, setDefenceMode, isConfigTampered, getVerifyConfig, setVerifyConfig } from '../cloud/config.js';
 export type { CloudConfig, DefenceMode, VerifyConfig } from '../cloud/config.js';
 export { syncToCloud } from '../cloud/sync.js';

package/dist/defence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/defence/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,+BAA+B,EAC/B,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,UAAU,GACX,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGxF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC9G,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGzJ,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjK,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGhI,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClQ,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/defence/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,+BAA+B,EAC/B,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,UAAU,GACX,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGxF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC9G,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGzJ,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACjK,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGhI,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAClQ,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/defence/index.js

@@ -19,6 +19,8 @@ export { scanForCredentials, redactCredentials, DEFAULT_CREDENTIAL_CONFIG } from
 export { logAudit, queryAuditLogs, getAuditStats } from './audit/index.js';
 // Skill Scanner
 export { scanSkill, scanSkillContent, discoverSkillFiles, detectFormat, detectFormatFromContent, parseSkillFile, readSkillFile } from './skill-scanner/index.js';
+// Iron Dome — Behaviour Protection Layer
+export { activateIronDome, deactivateIronDome, getIronDomeStatus, isChannelTrusted, isActionAllowed, scanForInjection, checkPII, handleKillPhrase, IRON_DOME_PROFILES, DEFAULT_IRON_DOME_CONFIG, } from './iron-dome/index.js';
 // Cloud
 export { getCloudConfig, setCloudConfig, clearCloudConfigCache, getTrustedSkills, addTrustedSkill, removeTrustedSkill, getDeviceId, getDeviceName, getDefenceMode, setDefenceMode, isConfigTampered, getVerifyConfig, setVerifyConfig } from '../cloud/config.js';
 export { syncToCloud } from '../cloud/sync.js';

package/dist/defence/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/defence/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAEjF,iBAAiB;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAmBpD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE9F,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,sCAAsC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAG9G,QAAQ;AACR,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,gBAAgB;AAChB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjK,QAAQ;AACR,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAElQ,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/defence/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAEjF,iBAAiB;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAmBpD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE9F,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,sCAAsC;AACtC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAG9G,QAAQ;AACR,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3E,gBAAgB;AAChB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGjK,yCAAyC;AACzC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAgB9B,QAAQ;AACR,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAElQ,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/defence/iron-dome/__tests__/action-gate.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Iron Dome — Action Gate Tests
+ */
+export {};
+//# sourceMappingURL=action-gate.test.d.ts.map

package/dist/defence/iron-dome/__tests__/action-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-gate.test.d.ts","sourceRoot":"","sources":["../../../../src/defence/iron-dome/__tests__/action-gate.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/defence/iron-dome/__tests__/action-gate.test.js

@@ -0,0 +1,71 @@
+/**
+ * Iron Dome — Action Gate Tests
+ */
+import { describe, it, expect, beforeEach } from '@jest/globals';
+import { DEFAULT_IRON_DOME_CONFIG } from '../config.js';
+describe('Action Gate', () => {
+    let activeConfig;
+    beforeEach(() => {
+        activeConfig = {
+            ...DEFAULT_IRON_DOME_CONFIG,
+            enabled: true,
+            requireApproval: ['send_email', 'delete_file', 'api_call', 'purchase'],
+            autoApprove: ['read_file', 'search', 'calculate'],
+            subAgentRestrictions: {
+                blockedOperations: ['export_data', 'bulk_email'],
+                sanitiseContext: true,
+            },
+        };
+    });
+    it('should auto-approve whitelisted actions', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('read_file', activeConfig);
+        expect(result.decision).toBe('approved');
+    });
+    it('should require approval for restricted actions', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('send_email', activeConfig);
+        expect(result.decision).toBe('requires_approval');
+    });
+    it('should approve unknown actions not in either list', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('custom_action', activeConfig);
+        expect(result.decision).toBe('approved');
+    });
+    it('should block sub-agent restricted operations', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const agentSource = { type: 'agent', identifier: 'sub-agent-1' };
+        const result = isActionAllowed('export_data', activeConfig, agentSource);
+        expect(result.decision).toBe('blocked');
+    });
+    it('should not block non-agent sources for sub-agent restrictions', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const userSource = { type: 'user', identifier: 'direct' };
+        const result = isActionAllowed('export_data', activeConfig, userSource);
+        // Not in requireApproval or autoApprove, so should be approved
+        expect(result.decision).toBe('approved');
+    });
+    it('should be case-insensitive for action names', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('Send_Email', activeConfig);
+        expect(result.decision).toBe('requires_approval');
+    });
+    it('should approve all actions when Iron Dome is disabled', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const disabledConfig = { ...activeConfig, enabled: false };
+        const result = isActionAllowed('send_email', disabledConfig);
+        expect(result.decision).toBe('approved');
+        expect(result.reason).toContain('not active');
+    });
+    it('should include action name in result', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('Delete_File', activeConfig);
+        expect(result.action).toBe('delete_file');
+    });
+    it('should match partial action names', async () => {
+        const { isActionAllowed } = await import('../action-gate.js');
+        const result = isActionAllowed('make_api_call', activeConfig);
+        expect(result.decision).toBe('requires_approval');
+    });
+});
+//# sourceMappingURL=action-gate.test.js.map

package/dist/defence/iron-dome/__tests__/action-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-gate.test.js","sourceRoot":"","sources":["../../../../src/defence/iron-dome/__tests__/action-gate.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,YAA4B,CAAC;IAEjC,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG;YACb,GAAG,wBAAwB;YAC3B,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC;YACtE,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;YACjD,oBAAoB,EAAE;gBACpB,iBAAiB,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;gBAChD,eAAe,EAAE,IAAI;aACtB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACxE,+DAA+D;QAC/D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/defence/iron-dome/__tests__/gateway.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Iron Dome — Gateway Tests
+ */
+export {};
+//# sourceMappingURL=gateway.test.d.ts.map

package/dist/defence/iron-dome/__tests__/gateway.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.test.d.ts","sourceRoot":"","sources":["../../../../src/defence/iron-dome/__tests__/gateway.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/defence/iron-dome/__tests__/gateway.test.js

@@ -0,0 +1,60 @@
+/**
+ * Iron Dome — Gateway Tests
+ */
+import { describe, it, expect, beforeEach } from '@jest/globals';
+import { DEFAULT_IRON_DOME_CONFIG } from '../config.js';
+describe('Gateway', () => {
+    let activeConfig;
+    beforeEach(() => {
+        activeConfig = {
+            ...DEFAULT_IRON_DOME_CONFIG,
+            enabled: true,
+            trustedChannels: ['terminal', 'cli', 'telegram'],
+        };
+    });
+    it('should allow trusted channels', async () => {
+        const { isChannelTrusted } = await import('../gateway.js');
+        expect(isChannelTrusted('terminal', activeConfig)).toBe(true);
+        expect(isChannelTrusted('cli', activeConfig)).toBe(true);
+        expect(isChannelTrusted('telegram', activeConfig)).toBe(true);
+    });
+    it('should block untrusted channels', async () => {
+        const { isChannelTrusted } = await import('../gateway.js');
+        expect(isChannelTrusted('email', activeConfig)).toBe(false);
+        expect(isChannelTrusted('web', activeConfig)).toBe(false);
+        expect(isChannelTrusted('unknown', activeConfig)).toBe(false);
+    });
+    it('should be case-insensitive for channel names', async () => {
+        const { isChannelTrusted } = await import('../gateway.js');
+        expect(isChannelTrusted('Terminal', activeConfig)).toBe(true);
+        expect(isChannelTrusted('CLI', activeConfig)).toBe(true);
+    });
+    it('should allow all channels when Iron Dome is disabled', async () => {
+        const { isChannelTrusted } = await import('../gateway.js');
+        const disabledConfig = { ...activeConfig, enabled: false };
+        expect(isChannelTrusted('email', disabledConfig)).toBe(true);
+        expect(isChannelTrusted('unknown', disabledConfig)).toBe(true);
+    });
+    it('should return gateway result with correct trust level', async () => {
+        const { validateGateway } = await import('../gateway.js');
+        const trusted = validateGateway('terminal', 'test instruction', activeConfig);
+        expect(trusted.allowed).toBe(true);
+        expect(trusted.trustLevel).toBe('trusted');
+        const untrusted = validateGateway('email', 'test instruction', activeConfig);
+        expect(untrusted.allowed).toBe(false);
+        expect(untrusted.trustLevel).toBe('untrusted');
+    });
+    it('should include channel name in result', async () => {
+        const { validateGateway } = await import('../gateway.js');
+        const result = validateGateway('Terminal', 'test', activeConfig);
+        expect(result.channel).toBe('terminal');
+    });
+    it('should pass through when disabled', async () => {
+        const { validateGateway } = await import('../gateway.js');
+        const disabledConfig = { ...activeConfig, enabled: false };
+        const result = validateGateway('email', 'anything', disabledConfig);
+        expect(result.allowed).toBe(true);
+        expect(result.reason).toContain('not active');
+    });
+});
+//# sourceMappingURL=gateway.test.js.map

package/dist/defence/iron-dome/__tests__/gateway.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.test.js","sourceRoot":"","sources":["../../../../src/defence/iron-dome/__tests__/gateway.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,IAAI,YAA4B,CAAC;IAEjC,UAAU,CAAC,GAAG,EAAE;QACd,YAAY,GAAG;YACb,GAAG,wBAAwB;YAC3B,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC9E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC7E,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/defence/iron-dome/__tests__/injection-scanner.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Iron Dome — Injection Scanner Tests
+ *
+ * Tests for all injection detection categories ported from scan.py.
+ */
+export {};
+//# sourceMappingURL=injection-scanner.test.d.ts.map

package/dist/defence/iron-dome/__tests__/injection-scanner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-scanner.test.d.ts","sourceRoot":"","sources":["../../../../src/defence/iron-dome/__tests__/injection-scanner.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}