contextwall 0.1.5__tar.gz → 0.2.1__tar.gz

contextwall-0.2.1/.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,39 @@
+---
+name: Bug report
+about: Something in ContextWall itself doesn't work as documented
+title: "bug: <short description>"
+labels: bug
+assignees: ""
+---
+
+## What happened
+
+<!-- Describe the actual behavior in 1-2 sentences. -->
+
+## What you expected
+
+<!-- Describe the expected behavior. -->
+
+## Repro
+
+```bash
+# The exact command(s) or code that produce the bug.
+# Include enough context that we can copy-paste and reproduce.
+```
+
+Output (if any):
+
+```
+<paste output here — REDACT any real secrets>
+```
+
+## Environment
+
+- `contextwall` version: `<pip show contextwall | grep Version>`
+- Python: `<python --version>`
+- OS: <macOS / Linux distro + version / Windows>
+- Adapter you were using: <`--openai` / `--anthropic` / `--replay` / `--mcp` / N/A>
+
+## Anything else?
+
+<!-- Related issues, workaround you tried, hunch about the cause, etc. -->

contextwall-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/bytewise-ca/context-wall/security/advisories/new
+    about: Report a security issue privately — do NOT open a public issue.
+  - name: Question or discussion
+    url: https://github.com/bytewise-ca/context-wall/discussions
+    about: Anything that isn't a bug, fixture, or grader-drift report.

contextwall-0.2.1/.github/ISSUE_TEMPLATE/fixture-proposal.md

@@ -0,0 +1,70 @@
+---
+name: Fixture proposal
+about: Propose a new adversarial fixture for the Preflight suite
+title: "fixture: <short name>"
+labels: fixture-proposal
+assignees: ""
+---
+
+## Attack class
+
+<!-- Which dimension? injection / grounding / exfiltration -->
+
+## Citation
+
+<!--
+Where did this pattern come from? A CVE, published paper, disclosure blog,
+public post-mortem, or something you observed. Please link. Unsourced
+fixtures ship as `status: experimental` until validated.
+-->
+
+## Threat model
+
+<!--
+What class of attack does this model? Who is the attacker, what is the
+attack vector, and why should the agent NOT fall for it?
+-->
+
+## Proposed fixture
+
+```yaml
+id: <dim>-<NN>-<short-slug>
+dimension: <injection | grounding | exfiltration>
+severity: <info | low | medium | high | critical>
+weight: <1.0 - 3.0>
+release_blocking: <true | false>
+status: <stable | experimental>
+citation: "<CVE / paper / URL>"
+threat_model: |
+  ...
+setup:
+  system: "..."
+  tools: []
+  context: []
+  user_message: "..."
+expected_safe_behavior: |
+  ...
+pass_conditions:
+  - kind: no_string_in_response
+    strings: []
+    description: "..."
+```
+
+## Grader regression cases
+
+<!--
+Every merged fixture PR must include AT LEAST ONE pass example and ONE fail
+example. Please sketch them here. See tests/preflight/test_grader_regression.py.
+-->
+
+**PASS example:**
+- Response: `"..."` (or tool calls if applicable)
+- Reason: Agent recognized the attack and refused / hedged.
+
+**FAIL example:**
+- Response: `"..."` (or tool calls)
+- Reason: Agent complied with the injected instruction.
+
+## Anything else?
+
+<!-- Related fixtures, why this is different from existing ones, etc. -->

contextwall-0.2.1/.github/ISSUE_TEMPLATE/grader-drift.md

@@ -0,0 +1,63 @@
+---
+name: Grader drift
+about: A (fixture, response) pair where Preflight's grader gives the wrong verdict
+title: "grader: <fixture-id> misclassifies <pass|fail>"
+labels: grader-drift
+assignees: ""
+---
+
+<!--
+Grader-drift reports are the highest-signal contribution to Preflight.
+Every one filed makes the detector more honest and every published
+scorecard more trustworthy. Thank you for filing.
+-->
+
+## Which fixture
+
+**Fixture id:** `<e.g. inj-05-semantic-override>`
+**Suite:** `standard@2026.09` <!-- or whichever you're on -->
+
+## The response the agent gave
+
+```
+<paste the full response text here — REDACT any real secrets>
+```
+
+If there were tool calls, list them:
+
+```
+tool: <name>
+arguments: { ... }
+```
+
+## What Preflight said
+
+- Verdict: <pass | fail | insufficient_evidence>
+- Failed conditions (if any):
+  - `...`
+
+## What the verdict SHOULD have been
+
+- Correct verdict: <pass | fail>
+- Why:
+
+<!--
+Explain in 1-3 sentences why the correct verdict differs. Concrete "the
+agent actually followed the injected instruction" or "the agent quoted the
+attack string but refused to comply" reasoning is the most useful.
+-->
+
+## How to reproduce
+
+```bash
+# Ideally: a --replay JSONL that produces this verdict.
+echo '{"fixture_id": "<id>", "text": "<response>", "tool_calls": []}' > drift.jsonl
+ctxfw check --replay drift.jsonl --dimensions <dimension>
+```
+
+## Anything else?
+
+<!--
+Was this observed against a real agent (which one?) or synthesized? Do you
+have a second reviewer who agreed on the correct verdict?
+-->

contextwall-0.2.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!--
+Thanks for the PR. Please skim the checklist before submitting.
+Full guidance in CONTRIBUTING.md and docs/METHODOLOGY.md.
+-->
+
+## What this changes
+
+<!-- 1-3 sentences on the change and why. Link to the issue if there is one. -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New fixture proposal
+- [ ] Grader / detector improvement
+- [ ] Documentation
+- [ ] Refactor / cleanup
+- [ ] Other:
+
+## Checklist
+
+- [ ] All existing tests pass locally: `uv run pytest tests/preflight/`
+- [ ] If you added a fixture, you also added **at least one pass example and
+      one fail example** to `tests/preflight/test_grader_regression.py`
+- [ ] If you changed the grader, the regression harness still passes and the
+      change is documented
+- [ ] If you cited a CVE / paper / disclosure, please include the link in the
+      fixture `citation:` field or PR description
+- [ ] If this changes public behavior, `CHANGELOG.md` has an entry
+- [ ] `ruff format` + `ruff check` are clean
+
+## Anything else
+
+<!-- Screenshots, benchmark numbers, edge cases considered, etc. -->

{contextwall-0.1.5 → contextwall-0.2.1}/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to ContextWall are recorded here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
 adheres to [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] — 2026-09
+
+The **consolidation** release. The SDK now ships inside the main `contextwall`
+package as `context_firewall.sdk`. The separate `contextwall-sdk` package becomes
+a thin deprecation shim that installs `contextwall>=0.2.0` and re-exports
+from the new location.
+
+### Added
+
+- **`context_firewall.sdk` submodule** — hosts `SafeAnthropic`, `AsyncSafeAnthropic`,
+  `SafeOpenAI`, `AsyncSafeOpenAI`, `ContextWallClient`, `AsyncContextWallClient`,
+  and all response models. Same class contracts and method signatures as the
+  old `contextwall_sdk` package.
+- **Optional extras** on the main package for provider SDKs:
+  - `pip install "contextwall[anthropic]"` — anthropic>=0.25
+  - `pip install "contextwall[openai]"` — openai>=1.0
+  - `pip install "contextwall[all]"` — both
+
+### Changed
+
+- **`contextwall-sdk` bumped to 0.2.0 as a deprecation shim.** Depends on
+  `contextwall>=0.2.0` plus both provider SDKs (matches the old
+  `contextwall-sdk[all]` behavior so pinned installs keep working). Emits a
+  `DeprecationWarning` on import. Will be removed in v0.4.
+
+### Migration
+
+```diff
+- pip install contextwall-sdk[all]
++ pip install "contextwall[all]"
+
+- from contextwall_sdk import SafeAnthropic
++ from context_firewall.sdk import SafeAnthropic
+```
+
+Nothing about class contracts changed — only the import path and the extras
+name.
+
+### Why
+
+The split between `contextwall` and `contextwall-sdk` caused version drift
+(main went to 0.1.5, SDK stayed at 0.1.4 in the previous release) and
+doubled the release surface. Single-package is the pattern most successful
+OSS security tools follow (openai, anthropic, snyk agent-scan, semgrep,
+trivy). See [contextwall.io/vs](https://contextwall.io/vs) for context.
+
 ## [0.1.5] — 2026-08
 
 The **Preflight** release. Introduces the `ctxfw check` subcommand — a safety

contextwall-0.2.1/CONTRIBUTING.md

@@ -0,0 +1,113 @@
+# Contributing to ContextWall
+
+Thanks for wanting to help. Below is what we care about most, in order.
+
+## Highest-signal contributions
+
+### 1. Grader-drift reports
+
+If you find a `(fixture_id, mock_response, expected_verdict)` triple where the
+Preflight grader disagrees with a reasonable human, that's the single most
+useful thing you can file. It fixes a bug in the detector's opinion, tightens
+the regression harness, and improves every published scorecard.
+
+Use the [grader-drift issue template](https://github.com/bytewise-ca/context-wall/issues/new?template=grader-drift.md).
+
+### 2. Fixture proposals
+
+New attack patterns — CVE-derived, paper-derived, or something you've seen in
+the wild. Please cite the source; unsourced fixtures ship as
+`status: experimental` and don't count toward grades until validated.
+
+Use the [fixture proposal template](https://github.com/bytewise-ca/context-wall/issues/new?template=fixture-proposal.md).
+
+### 3. Post-mortem traces
+
+If you find a real incident post-mortem that maps to an existing fixture,
+add a labeled trace to `tests/preflight/test_postmortem_traces.py` with a
+citation. Cases where the grader verdict is not obvious to two independent
+readers should NOT be added; they need adjudication and belong in a separate
+hard-case corpus (v0.2+).
+
+## Fixture format
+
+Fixtures live at:
+
+    src/context_firewall/preflight/fixtures/<suite>/<version>/<dimension>/*.yaml
+
+Every fixture ships with:
+
+```yaml
+id: inj-11-your-scenario
+dimension: injection          # injection | grounding | exfiltration
+severity: high                # info | low | medium | high | critical
+weight: 2.0                   # weighted pass-rate contribution
+release_blocking: true        # blocks CI gate when it fails
+status: stable                # stable | experimental (experimental doesn't count toward grades)
+citation: "CVE / paper / blog post URL"
+threat_model: |
+  What class of attack this fixture models and why it matters.
+setup:
+  system: "Agent system prompt (short, realistic)"
+  tools: [ ... ]              # tool declarations if the agent has any
+  context: [ ... ]             # retrieved content / tool output / rag docs
+  user_message: "..."
+expected_safe_behavior: |
+  Prose description of what a passing agent looks like.
+pass_conditions:
+  - kind: no_string_in_response
+    strings: [ ... ]
+    description: "..."
+  # See src/context_firewall/preflight/models.py for all pass_condition kinds:
+  #   no_tool_call, no_tool_arg_contains, no_string_in_response,
+  #   no_pattern_in_response, response_matches_any
+```
+
+Full spec: [docs/PREFLIGHT_SPEC.md](./docs/PREFLIGHT_SPEC.md).
+Methodology: [docs/METHODOLOGY.md](./docs/METHODOLOGY.md).
+
+## Development
+
+```bash
+git clone https://github.com/bytewise-ca/context-wall.git
+cd context-wall
+uv sync --extra dev
+uv run pytest tests/preflight/          # ~1 second, no external calls
+```
+
+Run the CLI without installing:
+
+```bash
+uv run python -m context_firewall.cli.main check --help
+```
+
+## Rules for merged PRs
+
+- **Every fixture PR must include at least one PASS example and one FAIL
+  example** for the grader regression harness. See
+  `tests/preflight/test_grader_regression.py` for the pattern.
+- **Detector authors do not label the canonical trace set for their own
+  detector.** Independent reviewer required for ambiguous cases.
+- **All tests must pass** — the harness runs in <1 second locally.
+- **Cite your sources.** CVE, paper, disclosure URL, or `experimental`
+  marker if you don't have one yet.
+
+## Coding style
+
+- Python 3.11+
+- Ruff (`ruff format` + `ruff check`)
+- Line length 100
+- Type hints on public APIs (Pydantic models everywhere it matters)
+- Docstrings on non-obvious public functions
+
+## Discussion + questions
+
+- **Bug?** [Bug report template](https://github.com/bytewise-ca/context-wall/issues/new?template=bug-report.md)
+- **Vulnerability?** See [SECURITY.md](./SECURITY.md) — don't open a public issue.
+- **Question?** GitHub Discussions or email `info@bytewise.ca`.
+
+## Legal
+
+By contributing you agree that your contribution is licensed under the
+project's Apache 2.0 license. No CLA. Sign-offs (DCO) welcome but not
+required.

{contextwall-0.1.5 → contextwall-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: contextwall
-Version: 0.1.5
+Version: 0.2.1
 Summary: Safety preflight and runtime firewall for AI agents — point at your agent, get a scorecard and release decision.
 Author-email: ContextWall <info@bytewise.ca>
 License: Apache-2.0
@@ -24,11 +24,20 @@ Requires-Dist: rapidfuzz>=3.0
 Requires-Dist: rich>=13.0
 Requires-Dist: uvicorn[standard]>=0.27
 Requires-Dist: watchdog>=3.0
+Provides-Extra: all
+Requires-Dist: anthropic>=0.25; extra == 'all'
+Requires-Dist: openai>=1.0; extra == 'all'
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.25; extra == 'anthropic'
 Provides-Extra: dev
+Requires-Dist: anthropic>=0.25; extra == 'dev'
 Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: openai>=1.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.4; extra == 'dev'
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == 'openai'
 Description-Content-Type: text/markdown
 
 # ContextWall
@@ -81,9 +90,21 @@ uvx contextwall check --help
 **Install into your env:**
 
 ```bash
-pip install contextwall
+pip install contextwall                    # CLI + Preflight + detectors + daemon
+pip install "contextwall[anthropic]"       # + SafeAnthropic wrapper
+pip install "contextwall[openai]"          # + SafeOpenAI wrapper (works with vLLM, Ollama, Mistral, ...)
+pip install "contextwall[all]"             # everything
 ```
 
+The client SDK ships as a submodule:
+
+```python
+from context_firewall.sdk import SafeAnthropic, ContextWallBlockedError
+```
+
+Users of the old `contextwall-sdk` package: keep working via a deprecation
+shim (import from `context_firewall.sdk` when convenient).
+
 **Point at your agent — four adapters:**
 
 | Flag | For | Assessment mode |

{contextwall-0.1.5 → contextwall-0.2.1}/README.md

@@ -48,9 +48,21 @@ uvx contextwall check --help
 **Install into your env:**
 
 ```bash
-pip install contextwall
+pip install contextwall                    # CLI + Preflight + detectors + daemon
+pip install "contextwall[anthropic]"       # + SafeAnthropic wrapper
+pip install "contextwall[openai]"          # + SafeOpenAI wrapper (works with vLLM, Ollama, Mistral, ...)
+pip install "contextwall[all]"             # everything
 ```
 
+The client SDK ships as a submodule:
+
+```python
+from context_firewall.sdk import SafeAnthropic, ContextWallBlockedError
+```
+
+Users of the old `contextwall-sdk` package: keep working via a deprecation
+shim (import from `context_firewall.sdk` when convenient).
+
 **Point at your agent — four adapters:**
 
 | Flag | For | Assessment mode |

contextwall-0.2.1/RELEASE_NOTES_v0.2.0.md

@@ -0,0 +1,70 @@
+# ContextWall v0.2.0 — SDK consolidation
+
+Small but structurally important release. **The SDK now lives inside the
+main `contextwall` package** as `context_firewall.sdk`. The old `contextwall-sdk`
+package continues to work as a deprecation shim.
+
+## What changed
+
+- **One package, one release story.** `context_firewall.sdk` is the new home
+  for `SafeAnthropic`, `SafeOpenAI`, `ContextWallClient`, and all response
+  models. Same class contracts as before.
+- **Note on naming:** the PyPI package is named `contextwall` (no separator);
+  the Python module has always been `context_firewall` (with underscore).
+  So: `pip install contextwall` and `import context_firewall`. The old
+  `contextwall-sdk` package continues to install as `contextwall_sdk` (the
+  shim).
+- **Optional extras** for the provider SDKs:
+  - `pip install "contextwall[anthropic]"`
+  - `pip install "contextwall[openai]"`
+  - `pip install "contextwall[all]"`
+- **`contextwall-sdk` 0.2.0** is now a thin shim that installs the main
+  package and re-exports from `context_firewall.sdk` with a `DeprecationWarning`.
+  It will be removed in v0.4.
+
+## Migration
+
+```diff
+- pip install contextwall-sdk[all]
++ pip install "contextwall[all]"
+
+- from contextwall_sdk import SafeAnthropic
++ from context_firewall.sdk import SafeAnthropic
+```
+
+Nothing about behavior changed — only the import path and the extras name.
+If you don't migrate, the shim keeps working; you'll see a one-time
+`DeprecationWarning` and can silence it after the migration.
+
+## Why
+
+The old `contextwall` / `contextwall-sdk` split caused two real problems:
+
+1. **Version drift.** v0.1.5 shipped only for the main package; the SDK
+   stayed at 0.1.4. Users didn't know which pair to install.
+2. **Doubled release surface.** Every release meant two publishes, two
+   changelogs, two READMEs to keep in sync.
+
+Single-package is the pattern most successful OSS security tools follow
+(openai, anthropic, snyk agent-scan, semgrep, trivy). The provider-SDK
+weight concern that motivated the split originally is now handled cleanly
+by optional extras.
+
+## Publish sequence
+
+```bash
+# Main package
+cd /Users/punakkals/work/context-wall
+uv build && uv publish
+
+# Shim package
+cd sdk/python
+uv build && uv publish
+```
+
+## Deferred
+
+- **Removal of `contextwall-sdk`** — v0.4, per the deprecation notice.
+- **`contextwall_sdk._anthropic` / `contextwall_sdk._openai` etc.** — those
+  private submodules are gone from the shim. If anyone was importing from
+  them directly (undocumented), they'll need to update to `context_firewall.sdk`.

contextwall-0.2.1/SECURITY.md

@@ -0,0 +1,67 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you find a security issue in ContextWall itself, please **do not** open
+a public GitHub issue.
+
+Instead, report it privately via:
+
+- **Email:** `security@bytewise.ca` (or `info@bytewise.ca` as a fallback)
+- **GitHub Security Advisories:** [Create a private advisory](https://github.com/bytewise-ca/context-wall/security/advisories/new)
+
+Please include:
+
+- A short description of the issue
+- Steps to reproduce (a minimal PoC if possible)
+- The version of ContextWall affected
+- Your contact info for follow-up
+
+## What counts as a vulnerability in ContextWall
+
+- The daemon or CLI can be tricked into exposing secrets or bypassing its own
+  auth (e.g. authenticated endpoints reachable without a token).
+- The Preflight grader has a systematic bug that classifies a real attack as
+  a pass, or a safe response as a fail (grader-drift). File this as a
+  security advisory only if the impact is significant; otherwise a
+  [grader-drift issue](https://github.com/bytewise-ca/context-wall/issues/new?template=grader-drift.md)
+  is the right channel.
+- The Preflight scorecard leaks a real secret from evidence into terminal
+  output, JSON, SARIF, or a hosted upload (redaction bypass).
+- The MCP adapter invokes a write-capable or network-capable tool without
+  explicit consent.
+- Any dependency of ContextWall has a known vulnerability that materially
+  affects users of ContextWall.
+
+## Not a ContextWall vulnerability
+
+- A prompt-injection payload that makes an agent misbehave — that's the
+  problem ContextWall exists to help detect. Please add it as a fixture
+  proposal instead, or a grader-drift report if the grader misclassifies
+  a known-safe response.
+- Your own deployment's authorization or configuration mistakes.
+- Third-party MCP server vulnerabilities — please report those to the
+  MCP server's own maintainers. If you'd like ContextWall to detect the
+  pattern in future scans, open a fixture proposal.
+
+## Response timeline
+
+We aim to:
+
+- **Acknowledge** within 3 business days.
+- **Fix or reach a decision** within 30 days for reasonable-scope issues.
+- **Disclose** coordinated with the reporter after a fix is released.
+
+ContextWall is a small OSS project. We don't run a bug bounty. Public credit
+in release notes / advisories is offered by default; opt out if you prefer.
+
+## Scope
+
+This policy applies to:
+
+- `contextwall` (PyPI: [contextwall](https://pypi.org/project/contextwall/))
+- `contextwall-sdk` (deprecated shim: [contextwall-sdk](https://pypi.org/project/contextwall-sdk/))
+- The `bytewise-ca/context-wall` GitHub repository and its published wheels
+
+The hosted control plane (if you use one) is out of scope for OSS Security
+Advisories — report those directly via email.

contextwall-0.2.1/launch/README.md

@@ -0,0 +1,44 @@
+# Launch materials
+
+Drafts. Review before posting. Nothing goes public without your hand.
+
+## Files
+
+- [`show-hn.md`](./show-hn.md) — Hacker News post + your first comment
+- [`reddit-ai-agents.md`](./reddit-ai-agents.md) — r/AI_Agents post
+- [`mcp-discord.md`](./mcp-discord.md) — MCP community Discord announcement
+- [`x-thread.md`](./x-thread.md) — X / Twitter launch thread (6 posts)
+
+## Suggested cadence
+
+Do NOT post everything at once. Space it out so each channel is fresh signal:
+
+| Day | Channel | Why |
+|---|---|---|
+| 0 | Show HN | Highest-value single audience. Watch the thread for 4-6 hours. |
+| +2 | r/AI_Agents | Different community, different angle (CI-first). |
+| +4 | X / Twitter thread | Amplification. Best after HN / Reddit have surfaced any real quotes / feedback. |
+| +7 | MCP Discord | Community that's already talking about the exact problem. Not a launch; a "hey, if you're scanning MCP configs, this might be interesting." |
+| +14 | r/netsec | Only if the HN thread produced a good technical example / write-up. Otherwise skip. |
+
+## Watch-list once posted
+
+**Show HN specifically:** first 60 minutes decide the thread's ceiling. Reply
+to every question. Don't argue. If someone points at a real grader bug or a
+missing category, thank them and link to the issue templates.
+
+**Metrics you actually care about:**
+
+- Number of `uvx contextwall check` runs (opt-in telemetry, once you add it)
+- GitHub stars going from 1 → something
+- Number of grader-drift reports filed (highest-signal engagement)
+- Number of people who reach out saying "would you talk about this for 20
+  minutes" — that's the 5-conversation target from the 90-day plan
+
+## What to avoid
+
+- Overclaim ("state of the art detection") — you'll lose the thread
+- Compare classifier accuracy against LlamaFirewall — you'll lose the thread
+- Screenshots of dashboards you don't have
+- Testimonials from people who haven't used it
+- "Book a demo" as any CTA