shroud-privacy 2.2.11 → 2.2.13

package/dist/detectors/tool-guard.js

@@ -1,418 +0,0 @@
-/**
- * Tool call guard — detects dangerous tool invocations.
- *
- * Scans tool names and parameters for destructive, exfiltration,
- * or privilege escalation patterns. Runs in the before_tool_call hook
- * where it can BLOCK the call before execution.
- *
- * This is the "exec shutdown" detector — catches:
- * - Destructive commands (rm -rf, drop table, shutdown, format, kill -9)
- * - Exfiltration (curl/wget to external, scp, netcat listeners)
- * - Credential access (cat /etc/shadow, reading .ssh keys)
- * - Reverse shells (bash -i >& /dev/tcp, nc -e, python -c import socket)
- * - Privilege escalation (sudo, su, chmod 777, chown root)
- * - Crypto mining (xmrig, minerd, coin patterns)
- */
-import { ThreatClass } from "../security-event.js";
-const PATTERNS = [
-    // --- Destructive commands ---
-    {
-        id: "tg_rm_rf",
-        toolName: null,
-        paramPattern: /\brm\s+(?:-[a-zA-Z]*[rf][a-zA-Z]*\s+)(?:\/|~|\$HOME|\.\.|\.\/)/gi,
-        severity: "high",
-        description: "Destructive: rm -rf on significant path",
-        block: true,
-    },
-    {
-        id: "tg_shutdown",
-        toolName: null,
-        paramPattern: /\b(?:shutdown|poweroff|halt|reboot|init\s+[06])\b/gi,
-        severity: "high",
-        description: "Destructive: system shutdown/reboot command",
-        block: true,
-    },
-    {
-        id: "tg_format_disk",
-        toolName: null,
-        paramPattern: /\b(?:mkfs|fdisk|wipefs|shred)\b|\bdd\s+if=/gi,
-        severity: "high",
-        description: "Destructive: disk format/wipe command",
-        block: true,
-    },
-    {
-        id: "tg_drop_table",
-        toolName: null,
-        paramPattern: /\bDROP\s+(?:TABLE|DATABASE|SCHEMA|INDEX)\b/gi,
-        severity: "high",
-        description: "Destructive: SQL DROP command",
-        block: true,
-    },
-    {
-        id: "tg_truncate_table",
-        toolName: null,
-        paramPattern: /\bTRUNCATE\s+TABLE\b/gi,
-        severity: "medium",
-        description: "Destructive: SQL TRUNCATE command",
-        block: false,
-    },
-    {
-        id: "tg_kill_all",
-        toolName: null,
-        paramPattern: /\b(?:kill\s+-9\s+(?:-1|1)|killall\s+-9|pkill\s+-9)\b/gi,
-        severity: "high",
-        description: "Destructive: kill all processes",
-        block: true,
-    },
-    // --- Exfiltration ---
-    {
-        id: "tg_curl_exfil",
-        toolName: null,
-        paramPattern: /\bcurl\s+(?:-[a-zA-Z]+\s+)*(?:--data|--upload|-d\s|-F\s|-T\s).*https?:\/\//gi,
-        severity: "high",
-        description: "Exfiltration: curl POST/upload to external URL",
-        block: true,
-    },
-    {
-        id: "tg_wget_pipe",
-        toolName: null,
-        paramPattern: /\bwget\s+.*(?:\|\s*(?:bash|sh|python|perl|ruby))/gi,
-        severity: "high",
-        description: "Exfiltration: wget pipe to shell",
-        block: true,
-    },
-    {
-        id: "tg_curl_pipe_shell",
-        toolName: null,
-        paramPattern: /\bcurl\s+.*(?:\|\s*(?:bash|sh|python|perl|ruby))/gi,
-        severity: "high",
-        description: "Exfiltration: curl pipe to shell execution",
-        block: true,
-    },
-    {
-        id: "tg_scp_external",
-        toolName: null,
-        paramPattern: /\bscp\s+.*@[^:]+:/gi,
-        severity: "medium",
-        description: "Exfiltration: scp to external host",
-        block: false,
-    },
-    {
-        id: "tg_netcat_listener",
-        toolName: null,
-        paramPattern: /\b(?:nc|ncat|netcat)\s+(?:-[a-zA-Z]*l[a-zA-Z]*|-e\s)/gi,
-        severity: "high",
-        description: "Exfiltration: netcat listener or reverse shell",
-        block: true,
-    },
-    // --- Credential access ---
-    {
-        id: "tg_read_shadow",
-        toolName: null,
-        paramPattern: /\b(?:cat|head|tail|less|more|strings)\s+(?:\/etc\/(?:shadow|passwd|gshadow|sudoers|master\.passwd))/gi,
-        severity: "high",
-        description: "Credential access: reading system account/password files",
-        block: true,
-    },
-    {
-        id: "tg_read_ssh_keys",
-        toolName: null,
-        paramPattern: /\b(?:cat|head|tail|less|more|cp|scp)\s+.*(?:\.ssh\/(?:id_|authorized_keys|known_hosts|config)|\.gnupg\/)/gi,
-        severity: "high",
-        description: "Credential access: reading SSH keys or GPG data",
-        block: true,
-    },
-    {
-        id: "tg_env_dump",
-        toolName: null,
-        paramPattern: /\b(?:env|printenv|set)\s*(?:\||\>|>>)/gi,
-        severity: "medium",
-        description: "Credential access: dumping environment variables to output",
-        block: false,
-    },
-    // --- Reverse shells ---
-    {
-        id: "tg_reverse_shell_bash",
-        toolName: null,
-        paramPattern: /bash\s+-i\s+>&?\s*\/dev\/tcp\//gi,
-        severity: "high",
-        description: "Reverse shell: bash /dev/tcp",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_python",
-        toolName: null,
-        paramPattern: /python[23]?\s+-c\s+['"]import\s+(?:socket|subprocess|os)/gi,
-        severity: "high",
-        description: "Reverse shell: python socket/subprocess",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_nc",
-        toolName: null,
-        paramPattern: /\bnc\s+(?:-e\s+(?:\/bin\/(?:bash|sh)|cmd\.exe))/gi,
-        severity: "high",
-        description: "Reverse shell: netcat exec",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_perl",
-        toolName: null,
-        paramPattern: /perl\s+(?:-e\s+|-MIO).*(?:socket|Socket|TCPSocket)/gi,
-        severity: "high",
-        description: "Reverse shell: Perl socket",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_ruby",
-        toolName: null,
-        paramPattern: /ruby\s+-r\s*socket\s+-e|ruby.*TCPSocket\.open/gi,
-        severity: "high",
-        description: "Reverse shell: Ruby socket",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_php",
-        toolName: null,
-        paramPattern: /php\s+-r\s+.*fsockopen/gi,
-        severity: "high",
-        description: "Reverse shell: PHP fsockopen",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_node",
-        toolName: null,
-        paramPattern: /node\s+-e\s+.*(?:child_process|net\.Socket|\.connect\()/gi,
-        severity: "high",
-        description: "Reverse shell: Node.js",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_powershell",
-        toolName: null,
-        paramPattern: /powershell\s+.*(?:TCPClient|Net\.Sockets|Invoke-Expression.*download|IEX.*Net\.WebClient)/gi,
-        severity: "high",
-        description: "Reverse shell: PowerShell",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_socat",
-        toolName: null,
-        paramPattern: /socat\s+.*exec.*(?:bash|sh).*tcp/gi,
-        severity: "high",
-        description: "Reverse shell: socat",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_openssl",
-        toolName: null,
-        paramPattern: /openssl\s+s_client\s+-connect/gi,
-        severity: "high",
-        description: "Reverse shell: openssl s_client",
-        block: true,
-    },
-    {
-        id: "tg_reverse_shell_telnet",
-        toolName: null,
-        paramPattern: /telnet\s+\S+\s+\d+\s*\|\s*(?:\/bin\/)?(?:bash|sh)/gi,
-        severity: "high",
-        description: "Reverse shell: telnet pipe to shell",
-        block: true,
-    },
-    // --- Exfiltration (additional) ---
-    {
-        id: "tg_rsync_exfil",
-        toolName: null,
-        paramPattern: /\brsync\s+.*@[^:]+:/gi,
-        severity: "medium",
-        description: "Exfiltration: rsync to external host",
-        block: false,
-    },
-    {
-        id: "tg_git_push_exfil",
-        toolName: null,
-        paramPattern: /\bgit\s+(?:push|remote\s+add)\s+.*https?:\/\//gi,
-        severity: "medium",
-        description: "Exfiltration: git push/remote to external URL",
-        block: false,
-    },
-    {
-        id: "tg_curl_file_upload",
-        toolName: null,
-        paramPattern: /\bcurl\s+.*-d\s+@|curl\s+.*--data-binary\s+@/gi,
-        severity: "high",
-        description: "Exfiltration: curl file upload via @syntax",
-        block: true,
-    },
-    {
-        id: "tg_dns_exfil",
-        toolName: null,
-        paramPattern: /\b(?:dig|nslookup|host)\s+.*\$\(|`.*`.*\.[\w-]+\.\w{2,}/gi,
-        severity: "high",
-        description: "Exfiltration: DNS data exfiltration via subquery",
-        block: true,
-    },
-    {
-        id: "tg_email_exfil",
-        toolName: null,
-        paramPattern: /\b(?:mail|sendmail|mutt|msmtp)\s+.*(?:-s\s|<\s*\/)/gi,
-        severity: "medium",
-        description: "Exfiltration: email with file content",
-        block: false,
-    },
-    // --- Credential access (additional) ---
-    {
-        id: "tg_read_cloud_creds",
-        toolName: null,
-        paramPattern: /\b(?:cat|head|tail|less|more|strings|cp)\s+.*(?:\.kube\/config|\.config\/gcloud|\.docker\/config|\.npmrc|\.git-credentials|\.pgpass|\.my\.cnf|\.vault-token|\.boto|\.netrc|\.env\.(?:local|prod|production|staging))/gi,
-        severity: "high",
-        description: "Credential access: cloud/dev credential files",
-        block: true,
-    },
-    {
-        id: "tg_read_history",
-        toolName: null,
-        paramPattern: /\b(?:cat|head|tail|less|more|strings)\s+.*(?:\.bash_history|\.zsh_history|\.python_history|\.mysql_history|\.psql_history|\.node_repl_history)/gi,
-        severity: "medium",
-        description: "Credential access: shell/DB history files (may contain passwords)",
-        block: false,
-    },
-    // --- Destructive (additional) ---
-    {
-        id: "tg_delete_no_where",
-        toolName: null,
-        paramPattern: /\bDELETE\s+FROM\s+\w+\s*(?:;|$)|\bDELETE\s+FROM\s+\w+\s+WHERE\s+1\s*=\s*1/gi,
-        severity: "high",
-        description: "Destructive: SQL DELETE without WHERE clause",
-        block: true,
-    },
-    {
-        id: "tg_crontab_wipe",
-        toolName: null,
-        paramPattern: /\bcrontab\s+-r\b/gi,
-        severity: "high",
-        description: "Destructive: wipe all cron jobs",
-        block: true,
-    },
-    {
-        id: "tg_firewall_flush",
-        toolName: null,
-        paramPattern: /\b(?:iptables\s+-F|ufw\s+disable|firewall-cmd\s+--remove)/gi,
-        severity: "high",
-        description: "Destructive: flush firewall rules",
-        block: true,
-    },
-    // --- Privilege escalation (additional) ---
-    {
-        id: "tg_suid_bit",
-        toolName: null,
-        paramPattern: /\bchmod\s+(?:u\+s|4[0-7]{3})\b/gi,
-        severity: "high",
-        description: "Privilege escalation: set SUID bit",
-        block: true,
-    },
-    {
-        id: "tg_ld_preload",
-        toolName: null,
-        paramPattern: /\bLD_PRELOAD\s*=\s*\S+/gi,
-        severity: "high",
-        description: "Privilege escalation: LD_PRELOAD injection",
-        block: true,
-    },
-    {
-        id: "tg_docker_escape",
-        toolName: null,
-        paramPattern: /\bdocker\s+run\s+.*(?:--privileged|-v\s+\/\S*:\S*|--pid\s*=\s*host)/gi,
-        severity: "high",
-        description: "Privilege escalation: Docker container escape",
-        block: true,
-    },
-    {
-        id: "tg_nsenter_escape",
-        toolName: null,
-        paramPattern: /\bnsenter\s+--target\s+1\b/gi,
-        severity: "high",
-        description: "Privilege escalation: nsenter container escape to host PID 1",
-        block: true,
-    },
-    {
-        id: "tg_cloud_metadata",
-        toolName: null,
-        paramPattern: /\bcurl\s+.*(?:169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200)/gi,
-        severity: "high",
-        description: "SSRF: cloud metadata service access",
-        block: true,
-    },
-    // --- Privilege escalation ---
-    {
-        id: "tg_sudo_command",
-        toolName: null,
-        paramPattern: /\bsudo\s+(?!(?:apt|yum|dnf|brew|npm|pip)\b)/gi,
-        severity: "medium",
-        description: "Privilege escalation: sudo (non-package-manager)",
-        block: false,
-    },
-    {
-        id: "tg_chmod_world",
-        toolName: null,
-        paramPattern: /\bchmod\s+(?:777|666|a\+[rwx])\b/gi,
-        severity: "medium",
-        description: "Privilege escalation: world-writable permissions",
-        block: false,
-    },
-    {
-        id: "tg_chown_root",
-        toolName: null,
-        paramPattern: /\bchown\s+(?:root|0)[:.](?:root|0)\b/gi,
-        severity: "medium",
-        description: "Privilege escalation: chown to root",
-        block: false,
-    },
-    // --- Crypto mining ---
-    {
-        id: "tg_crypto_miner",
-        toolName: null,
-        paramPattern: /\b(?:xmrig|minerd|cpuminer|cgminer|bfgminer|stratum\+tcp:\/\/)\b/gi,
-        severity: "high",
-        description: "Crypto mining: miner binary or stratum protocol",
-        block: true,
-    },
-];
-/**
- * Scan a tool call for dangerous patterns.
- *
- * @param toolName - The tool being called (e.g. "exec", "write", "code_execution")
- * @param params - The tool parameters (will be serialized to JSON for scanning)
- * @returns Array of security events. Check `.block` on the pattern for block recommendation.
- */
-export function scanToolCall(toolName, params) {
-    const serialized = typeof params === "string" ? params : JSON.stringify(params);
-    const events = [];
-    let shouldBlock = false;
-    for (const pat of PATTERNS) {
-        // Filter by tool name if specified
-        if (pat.toolName && pat.toolName !== toolName)
-            continue;
-        pat.paramPattern.lastIndex = 0;
-        const match = pat.paramPattern.exec(serialized);
-        if (match) {
-            events.push({
-                timestamp: Date.now(),
-                eventType: "injection_detected",
-                direction: "request",
-                threatClass: ThreatClass.MCP_TOOL_POISONING,
-                signatureId: pat.id,
-                severity: pat.severity,
-                matchedText: `${toolName}: ${match[0].slice(0, 100)}`,
-                matchStart: match.index,
-                matchEnd: match.index + match[0].length,
-                textLength: serialized.length,
-                action: pat.block ? "blocked" : "flagged",
-                description: pat.description,
-            });
-            if (pat.block)
-                shouldBlock = true;
-        }
-    }
-    return { events, shouldBlock };
-}

package/dist/event-grader.d.ts

@@ -1,97 +0,0 @@
-/**
- * LLM-based security event grading.
- *
- * Accumulates flagged security events, batches them, and sends to an LLM
- * via OpenClaw gateway session to classify as TRUE_POSITIVE, FALSE_POSITIVE,
- * or NEEDS_REVIEW. Results are stored on the event for dashboard display.
- *
- * Self-whitelisting: grading sessions use a marker in the session key so
- * Shroud's own scanner doesn't flag the grading prompt (which contains
- * real injection examples by definition).
- *
- * Zero external dependencies — uses Node.js built-in child_process to call
- * `openclaw gateway call sessions.create`.
- */
-import type { SecurityEvent } from "./security-event.js";
-/** Verdict from LLM grading. */
-export type GradingVerdict = "TRUE_POSITIVE" | "FALSE_POSITIVE" | "NEEDS_REVIEW" | "UNGRADED";
-/** A graded event with LLM verdict. */
-export interface GradedEvent {
-    eventTimestamp: number;
-    signatureId: string;
-    agentLabel: string;
-    matchedText: string;
-    verdict: GradingVerdict;
-    reasoning: string;
-    gradedAt: number;
-}
-/** Marker prefix for grading session keys. */
-export declare const GRADING_SESSION_PREFIX = "shroud-grading-";
-/** The agent label that grading sessions will produce via extractLabel. */
-export declare const GRADING_AGENT_LABEL = "Security Event Grader";
-/** A logged grading batch — full audit trail. */
-export interface GradingBatchLog {
-    /** When the batch was executed. */
-    timestamp: number;
-    /** Why it was triggered: "threshold" or "timer". */
-    trigger: "threshold" | "timer";
-    /** Number of events in the batch. */
-    eventCount: number;
-    /** The prompt sent to the LLM. */
-    prompt: string;
-    /** The raw LLM response. */
-    rawResponse: string;
-    /** Parsed verdicts. */
-    verdicts: Array<{
-        signatureId: string;
-        agentLabel: string;
-        verdict: GradingVerdict;
-        reasoning: string;
-    }>;
-    /** Whether the grading call succeeded. */
-    success: boolean;
-    /** Error message if failed. */
-    error: string;
-    /** LLM response time in ms. */
-    responseTimeMs: number;
-}
-export declare class EventGrader {
-    private _pending;
-    private _graded;
-    private _batchLog;
-    private _timer;
-    private _threshold;
-    private _intervalMs;
-    private _gatewayUrl;
-    private _openclawBin;
-    private _running;
-    constructor(opts: {
-        threshold: number;
-        intervalSec: number;
-        gatewayUrl: string;
-    });
-    /** Start the grading timer. */
-    start(): void;
-    /** Stop the grading timer. */
-    stop(): void;
-    /** Add an event to the pending grading queue. */
-    addEvent(event: SecurityEvent): void;
-    /** Get the verdict for an event (by timestamp). */
-    getVerdict(eventTimestamp: number): GradedEvent | null;
-    /** Get all graded events. */
-    getAllGraded(): GradedEvent[];
-    /** Get grading stats. */
-    getStats(): {
-        pending: number;
-        graded: number;
-        truePositive: number;
-        falsePositive: number;
-        needsReview: number;
-    };
-    /** Get the grading batch log (last 50 batches). */
-    getBatchLog(): readonly GradingBatchLog[];
-    /** Attempt a grading batch. */
-    private _tryGrade;
-    /** Call the OpenClaw gateway to grade a batch of events. */
-    private _callGateway;
-}