shroud-privacy 2.2.7 → 2.2.9

package/README.md

@@ -256,6 +256,16 @@ Shroud distinguishes between internal and external URLs:
 | `https://secret.local/admin` | NXDOMAIN | Obfuscate |
 | `https://github.com/org/repo` | (PUBLIC_DOMAINS list) | Pass through |
 
+### LLM agent guidance
+
+Because Shroud replaces URLs before they reach the LLM, the LLM may see unfamiliar or fake-looking domains in the conversation context. Tool calls (fetch, read, etc.) are deobfuscated automatically before execution, so they work correctly even when the LLM sees a fake URL.
+
+**If you are building an agent that uses Shroud, add the following to your agent's system prompt or instruction files:**
+
+> Shroud privacy is active. URLs and domains in the conversation may appear different from what the user sent — internal URLs are replaced with fake domains to protect infrastructure. If a URL looks unfamiliar or doesn't resolve, it has likely been obfuscated. The tool call pipeline deobfuscates automatically. Do NOT tell the user a URL is invalid just because you see an unfamiliar domain. If a fetch or read tool succeeded with the URL, trust the result.
+
+This prevents the LLM from questioning obfuscated URLs or telling the user their link is broken.
+
 ---
 
 ## Redaction levels

package/dist/detectors/regex.js

@@ -42,6 +42,24 @@ const PUBLIC_DOMAINS = new Set([
     "w3.org",
     "archive.org",
 ]);
+/**
+ * Operational path prefixes — local system/workspace paths that agents need
+ * to function. These are NOT sensitive infrastructure to hide from the LLM.
+ */
+const OPERATIONAL_PATH_PREFIXES = [
+    "/home/", // user home directories (workspace, scripts, media)
+    "/tmp/", // temp files
+    "/proc/", // procfs
+    "/sys/", // sysfs
+    "/dev/", // devices
+    "/run/", // runtime data
+    "/snap/", // snap packages
+    "/root/", // root home
+    "/nix/", // nix store
+    // NOTE: /etc/, /usr/, /var/, /bin/, /sbin/, /lib/, /opt/ are NOT included —
+    // they may contain infrastructure config paths (nginx, systemd units, etc.)
+    // that should be obfuscated in network/OT contexts.
+];
 const DOC_HOSTNAMES = new Set([
     "localhost", "HOSTNAME", "EXAMPLE", "CHANGEME",
     "YOUR_HOST", "YOURHOST", "hostname", "example",
@@ -113,6 +131,44 @@ export function isDocExample(value, category) {
         case Category.BGP_ASN:
             // Private ASNs are real infra identifiers — don't skip them
             return false;
+        case Category.FILE_PATH: {
+            if (value.startsWith("/")) {
+                const pathLower = value.toLowerCase();
+                // Skip operational/system paths — these are local workspace paths the
+                // agent needs to function, not sensitive infrastructure to hide from the LLM.
+                // Sensitive paths are things like /opt/network-configs/router.cfg on internal
+                // servers — those won't match these prefixes.
+                for (const pfx of OPERATIONAL_PATH_PREFIXES) {
+                    if (pathLower.startsWith(pfx))
+                        return true;
+                }
+                // Skip paths that are clearly URL path components from public domains.
+                // e.g., /www.npmjs.com/package/shroud-privacy, /github.com/org/repo
+                for (const d of PUBLIC_DOMAINS) {
+                    if (pathLower.startsWith(`/${d}/`) || pathLower.startsWith(`/${d}`)
+                        || pathLower.startsWith(`/www.${d}/`) || pathLower.startsWith(`/www.${d}`)) {
+                        return true;
+                    }
+                }
+                for (const d of DOC_DOMAINS) {
+                    if (pathLower.startsWith(`/${d}/`) || pathLower.startsWith(`/${d}`)
+                        || pathLower.startsWith(`/www.${d}/`) || pathLower.startsWith(`/www.${d}`)) {
+                        return true;
+                    }
+                }
+                // DNS cache check — if the first path segment is a public domain
+                const dnsCache = globalThis.__shroudDnsCache;
+                if (dnsCache) {
+                    const firstSeg = value.slice(1).split("/")[0];
+                    if (firstSeg && firstSeg.includes(".")) {
+                        const isPublic = dnsCache.isPublic("https://" + firstSeg + "/");
+                        if (isPublic === true)
+                            return true;
+                    }
+                }
+            }
+            return false;
+        }
         case Category.HOSTNAME:
             if (DOC_HOSTNAMES.has(value) || DOC_HOSTNAMES.has(value.toUpperCase()))
                 return true;
@@ -584,7 +640,11 @@ export const BUILTIN_PATTERNS = [
     },
     {
         name: "gps_coordinate",
-        pattern: /(?<!\w)-?\d{1,3}\.\d{4,8}[,\s]+-?\d{1,3}\.\d{4,8}(?!\w)/g,
+        // Require realistic lat/lon ranges: lat [-90,90], lon [-180,180].
+        // Must be comma-separated (not just whitespace — that matches too many
+        // false positives in financial data, ML weights, research metrics).
+        // Require 4-8 decimal places (GPS precision).
+        pattern: /(?<!\w)-?(?:[0-8]?\d(?:\.\d{4,8})|90(?:\.0{4,8}))\s*,\s*-?(?:1[0-7]\d(?:\.\d{4,8})|0?\d{1,2}(?:\.\d{4,8})|180(?:\.0{4,8}))(?!\w)/g,
         category: Category.GPS_COORDINATE,
         confidence: 0.85,
     },

package/dist/hooks.js

@@ -194,7 +194,32 @@ export function registerHooks(api, obfuscator) {
         }
         // DNS cache for public URL detection — shared across plugin instances
         if (!g.__shroudDnsCache) {
-            g.__shroudDnsCache = new DnsCache();
+            const cache = new DnsCache();
+            g.__shroudDnsCache = cache;
+            // Pre-warm with well-known public domains so first-turn URLs pass through
+            // without waiting for async DNS resolution. These domains are guaranteed
+            // public — no lookup needed.
+            const publicDomains = [
+                "youtube.com", "youtu.be", "m.youtube.com",
+                "google.com", "google.co.uk", "google.de", "google.fr",
+                "github.com", "gitlab.com", "bitbucket.org",
+                "stackoverflow.com", "stackexchange.com",
+                "wikipedia.org", "wikimedia.org",
+                "twitter.com", "x.com",
+                "reddit.com",
+                "linkedin.com",
+                "medium.com",
+                "npmjs.com", "www.npmjs.com", "pypi.org", "crates.io",
+                "docker.com", "hub.docker.com",
+                "microsoft.com", "apple.com",
+                "mozilla.org",
+                "w3.org",
+                "archive.org",
+            ];
+            for (const d of publicDomains) {
+                cache.seed(d, "0.0.0.1", true); // address doesn't matter, isPublic=true
+                cache.seed("www." + d, "0.0.0.1", true);
+            }
         }
     }
     // All hook closures must use the shared obfuscator, not the local parameter.
@@ -215,12 +240,24 @@ export function registerHooks(api, obfuscator) {
         // Extract all URLs from the prompt and messages, resolve their FQDNs
         // to determine public vs private. This runs BEFORE obfuscation so
         // the sync pipeline's isDocExample() can check the cache.
+        //
+        // Slack wraps URLs as <https://url|display> or <https://url>.
+        // We must strip this markup BEFORE extracting URLs, otherwise the
+        // regex won't match and the DNS cache won't warm for Slack messages.
         const dnsCache = globalThis.__shroudDnsCache;
         if (dnsCache) {
             const urlRe = /https?:\/\/[^\s<>"')\]]+[^\s<>"')\].,;:!?]/g;
             const allUrls = [];
+            // Strip Slack link markup so URL regex can match cleanly
+            function stripSlackForDns(text) {
+                text = text.replace(/<mailto:[^|>]+\|([^>]*)>/g, "$1");
+                text = text.replace(/<(https?:\/\/[^|>]+)\|[^>]*>/g, "$1");
+                text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
+                return text;
+            }
             if (typeof event?.prompt === "string") {
-                for (const m of event.prompt.matchAll(urlRe))
+                const cleaned = stripSlackForDns(event.prompt);
+                for (const m of cleaned.matchAll(urlRe))
                     allUrls.push(m[0]);
             }
             if (Array.isArray(event?.messages)) {
@@ -235,7 +272,8 @@ export function registerHooks(api, obfuscator) {
                         }
                     }
                     for (const text of texts) {
-                        for (const m of text.matchAll(urlRe))
+                        const cleaned = stripSlackForDns(text);
+                        for (const m of cleaned.matchAll(urlRe))
                             allUrls.push(m[0]);
                     }
                 }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.2.7",
+  "version": "2.2.9",
   "description": "Privacy and infrastructure protection for AI agents — detects sensitive data (PII, network topology, credentials, OT/SCADA) and replaces with deterministic fakes before anything reaches the LLM.",
   "type": "module",
   "main": "dist/index.js",