shroud-privacy 2.2.7 → 2.2.8

package/README.md

@@ -256,6 +256,16 @@ Shroud distinguishes between internal and external URLs:
 | `https://secret.local/admin` | NXDOMAIN | Obfuscate |
 | `https://github.com/org/repo` | (PUBLIC_DOMAINS list) | Pass through |
 
+### LLM agent guidance
+
+Because Shroud replaces URLs before they reach the LLM, the LLM may see unfamiliar or fake-looking domains in the conversation context. Tool calls (fetch, read, etc.) are deobfuscated automatically before execution, so they work correctly even when the LLM sees a fake URL.
+
+**If you are building an agent that uses Shroud, add the following to your agent's system prompt or instruction files:**
+
+> Shroud privacy is active. URLs and domains in the conversation may appear different from what the user sent — internal URLs are replaced with fake domains to protect infrastructure. If a URL looks unfamiliar or doesn't resolve, it has likely been obfuscated. The tool call pipeline deobfuscates automatically. Do NOT tell the user a URL is invalid just because you see an unfamiliar domain. If a fetch or read tool succeeded with the URL, trust the result.
+
+This prevents the LLM from questioning obfuscated URLs or telling the user their link is broken.
+
 ---
 
 ## Redaction levels

package/dist/detectors/regex.js

@@ -113,6 +113,38 @@ export function isDocExample(value, category) {
         case Category.BGP_ASN:
             // Private ASNs are real infra identifiers — don't skip them
             return false;
+        case Category.FILE_PATH: {
+            // Skip paths that are clearly URL path components from public domains.
+            // e.g., /www.npmjs.com/package/shroud-privacy, /github.com/org/repo
+            // This is a safety net — the span fix in detect() should prevent these,
+            // but production environments may have edge cases we can't reproduce.
+            if (value.startsWith("/")) {
+                const pathLower = value.toLowerCase();
+                for (const d of PUBLIC_DOMAINS) {
+                    if (pathLower.startsWith(`/${d}/`) || pathLower.startsWith(`/${d}`)
+                        || pathLower.startsWith(`/www.${d}/`) || pathLower.startsWith(`/www.${d}`)) {
+                        return true;
+                    }
+                }
+                for (const d of DOC_DOMAINS) {
+                    if (pathLower.startsWith(`/${d}/`) || pathLower.startsWith(`/${d}`)
+                        || pathLower.startsWith(`/www.${d}/`) || pathLower.startsWith(`/www.${d}`)) {
+                        return true;
+                    }
+                }
+                // DNS cache check — if the first path segment is a public domain
+                const dnsCache = globalThis.__shroudDnsCache;
+                if (dnsCache) {
+                    const firstSeg = value.slice(1).split("/")[0];
+                    if (firstSeg && firstSeg.includes(".")) {
+                        const isPublic = dnsCache.isPublic("https://" + firstSeg + "/");
+                        if (isPublic === true)
+                            return true;
+                    }
+                }
+            }
+            return false;
+        }
         case Category.HOSTNAME:
             if (DOC_HOSTNAMES.has(value) || DOC_HOSTNAMES.has(value.toUpperCase()))
                 return true;

package/dist/hooks.js

@@ -194,7 +194,32 @@ export function registerHooks(api, obfuscator) {
         }
         // DNS cache for public URL detection — shared across plugin instances
         if (!g.__shroudDnsCache) {
-            g.__shroudDnsCache = new DnsCache();
+            const cache = new DnsCache();
+            g.__shroudDnsCache = cache;
+            // Pre-warm with well-known public domains so first-turn URLs pass through
+            // without waiting for async DNS resolution. These domains are guaranteed
+            // public — no lookup needed.
+            const publicDomains = [
+                "youtube.com", "youtu.be", "m.youtube.com",
+                "google.com", "google.co.uk", "google.de", "google.fr",
+                "github.com", "gitlab.com", "bitbucket.org",
+                "stackoverflow.com", "stackexchange.com",
+                "wikipedia.org", "wikimedia.org",
+                "twitter.com", "x.com",
+                "reddit.com",
+                "linkedin.com",
+                "medium.com",
+                "npmjs.com", "www.npmjs.com", "pypi.org", "crates.io",
+                "docker.com", "hub.docker.com",
+                "microsoft.com", "apple.com",
+                "mozilla.org",
+                "w3.org",
+                "archive.org",
+            ];
+            for (const d of publicDomains) {
+                cache.seed(d, "0.0.0.1", true); // address doesn't matter, isPublic=true
+                cache.seed("www." + d, "0.0.0.1", true);
+            }
         }
     }
     // All hook closures must use the shared obfuscator, not the local parameter.
@@ -215,12 +240,24 @@ export function registerHooks(api, obfuscator) {
         // Extract all URLs from the prompt and messages, resolve their FQDNs
         // to determine public vs private. This runs BEFORE obfuscation so
         // the sync pipeline's isDocExample() can check the cache.
+        //
+        // Slack wraps URLs as <https://url|display> or <https://url>.
+        // We must strip this markup BEFORE extracting URLs, otherwise the
+        // regex won't match and the DNS cache won't warm for Slack messages.
         const dnsCache = globalThis.__shroudDnsCache;
         if (dnsCache) {
             const urlRe = /https?:\/\/[^\s<>"')\]]+[^\s<>"')\].,;:!?]/g;
             const allUrls = [];
+            // Strip Slack link markup so URL regex can match cleanly
+            function stripSlackForDns(text) {
+                text = text.replace(/<mailto:[^|>]+\|([^>]*)>/g, "$1");
+                text = text.replace(/<(https?:\/\/[^|>]+)\|[^>]*>/g, "$1");
+                text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
+                return text;
+            }
             if (typeof event?.prompt === "string") {
-                for (const m of event.prompt.matchAll(urlRe))
+                const cleaned = stripSlackForDns(event.prompt);
+                for (const m of cleaned.matchAll(urlRe))
                     allUrls.push(m[0]);
             }
             if (Array.isArray(event?.messages)) {
@@ -235,7 +272,8 @@ export function registerHooks(api, obfuscator) {
                         }
                     }
                     for (const text of texts) {
-                        for (const m of text.matchAll(urlRe))
+                        const cleaned = stripSlackForDns(text);
+                        for (const m of cleaned.matchAll(urlRe))
                             allUrls.push(m[0]);
                     }
                 }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "description": "Privacy and infrastructure protection for AI agents — detects sensitive data (PII, network topology, credentials, OT/SCADA) and replaces with deterministic fakes before anything reaches the LLM.",
   "type": "module",
   "main": "dist/index.js",