resksecure 0.1.0__py3-none-any.whl

resksecure/__init__.py

@@ -0,0 +1,57 @@
+"""
+reskSecure - Bitmask-based LLM security firewall.
+
+A policy-driven LogitsProcessor that restricts LLM output based on
+capability bitmasks. Uses resklogits (VectorizedAhoCorasick) for
+GPU-accelerated pattern matching.
+
+Usage::
+
+    from resksecure import (
+        BitmaskLogitsProcessor,
+        PolicySet,
+        load_policy,
+        verify_tool_action,
+    )
+
+    policy_set = load_policy("config/policy.yaml")
+    processor = BitmaskLogitsProcessor(
+        mask=7,
+        model_name="mistralai/Mistral-7B-v0.1",
+        tokenizer=tokenizer,
+        policy_set=policy_set,
+        device="cuda",
+    )
+    outputs = model.generate(**inputs, logits_processor=[processor])
+"""
+
+from .bitmask_processor import BitmaskLogitsProcessor
+from .cache import TrieCache, trie_cache
+from .policy_loader import (
+    PhraseRule,
+    Policy,
+    PolicySet,
+    ToolRule,
+    load_policy,
+)
+from .policy_watcher import PolicyWatcher
+from .tool_guard import get_allowed_tools, verify_tool_action
+from .trie_factory import build_ac_from_policy, get_or_build_ac
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "BitmaskLogitsProcessor",
+    "TrieCache",
+    "trie_cache",
+    "PhraseRule",
+    "Policy",
+    "PolicySet",
+    "ToolRule",
+    "load_policy",
+    "PolicyWatcher",
+    "get_allowed_tools",
+    "verify_tool_action",
+    "build_ac_from_policy",
+    "get_or_build_ac",
+]

resksecure/bitmask_processor.py

@@ -0,0 +1,152 @@
+from __future__ import annotations
+from typing import Dict, Optional
+
+import torch
+from resklogits import VectorizedAhoCorasick
+from transformers import LogitsProcessor
+
+from .policy_loader import Policy, PolicySet
+from .trie_factory import get_or_build_ac
+
+
+class BitmaskLogitsProcessor(LogitsProcessor):
+    """LogitsProcessor that applies bitmask-based policy filtering.
+
+    Uses VectorizedAhoCorasick from resklogits to detect and block
+    or penalize banned phrases during token generation.
+
+    Two severity modes:
+    - ``hard``: banned phrase tokens get logit = -inf (impossible to generate)
+    - ``bias``:  banned phrase tokens get logit -= penalty (unlikely but not impossible)
+
+    Strict mode: forces EOS as soon as a banned pattern prefix is detected.
+
+    Usage::
+
+        processor = BitmaskLogitsProcessor(
+            mask=7,
+            model_name="mistralai/Mistral-7B-v0.1",
+            tokenizer=tokenizer,
+            policy_set=policy_set,
+            device="cuda",
+        )
+        outputs = model.generate(**inputs, logits_processor=[processor])
+    """
+
+    def __init__(
+        self,
+        mask: int,
+        model_name: str,
+        tokenizer,
+        policy_set: PolicySet,
+        device: str = "cuda",
+    ):
+        super().__init__()
+        self.mask = mask
+        self.model_name = model_name
+        self.tokenizer = tokenizer
+        self.device = device
+        self.strict: bool = False
+
+        hard_ac, bias_ac, hard_meta, bias_meta, policy = get_or_build_ac(
+            mask, model_name, tokenizer, policy_set, device,
+        )
+
+        self.hard_ac: Optional[VectorizedAhoCorasick] = hard_ac
+        self.hard_modes: Dict[int, str] = hard_meta
+        self.bias_ac: Optional[VectorizedAhoCorasick] = bias_ac
+        self.bias_penalties: Dict[int, float] = {
+            pid: penalty for pid, penalty in bias_meta.items()
+        }
+        self.policy: Optional[Policy] = policy
+        self.strict = policy.strict if policy else False
+
+        self._hard_state: int = 0
+        self._bias_state: int = 0
+
+    def __call__(
+        self,
+        input_ids: torch.LongTensor,
+        scores: torch.FloatTensor,
+    ) -> torch.FloatTensor:
+        if input_ids.shape[0] != 1:
+            raise NotImplementedError("Batch size > 1 not supported")
+
+        if input_ids.shape[1] > 0:
+            last_token = int(input_ids[0, -1].item())
+            if self.hard_ac is not None:
+                self._hard_state = self.hard_ac.step(self._hard_state, last_token)
+            if self.bias_ac is not None:
+                self._bias_state = self.bias_ac.step(self._bias_state, last_token)
+
+        # Hard mode: effectively ban dangerous tokens (-1e9 ≈ -inf in fp32)
+        if self.hard_ac is not None and self.hard_ac.danger_mask.any():
+            scores[0, self.hard_ac.danger_mask] = torch.where(
+                scores[0, self.hard_ac.danger_mask] > -1e9,
+                torch.tensor(-1e9, device=scores.device),
+                scores[0, self.hard_ac.danger_mask],
+            )
+
+        # Bias mode: apply configured penalty to dangerous tokens
+        if self.bias_ac is not None and self.bias_ac.danger_mask.any():
+            penalty = self._get_bias_penalty()
+            if penalty != 0.0:
+                scores[0, self.bias_ac.danger_mask] += penalty
+
+        # Hard mode complete match: force EOS immediately
+        if self.hard_ac is not None and self.hard_ac.has_match(self._hard_state):
+            scores[0, :] = -float("inf")
+            eos_id = self.tokenizer.eos_token_id
+            if eos_id is not None:
+                scores[0, eos_id] = 0.0
+            return scores
+
+        # Strict mode: force EOS when on a path that leads to a hard match
+        if self.strict and self.hard_ac is not None:
+            if self._is_on_path_to_hard_match():
+                scores[0, :] = -float("inf")
+                eos_id = self.tokenizer.eos_token_id
+                if eos_id is not None:
+                    scores[0, eos_id] = 0.0
+
+        return scores
+
+    def _get_bias_penalty(self) -> float:
+        """Get the bias penalty for currently matched patterns."""
+        if self.bias_ac is None:
+            return 0.0
+        if not self.bias_ac.has_match(self._bias_state):
+            return 0.0
+        matched = self.bias_ac.get_matched_patterns(self._bias_state)
+        penalty = 0.0
+        for pid in matched:
+            p = self.bias_penalties.get(pid, 0.0)
+            if p < penalty:
+                penalty = p
+        return penalty
+
+    def _is_on_path_to_hard_match(self) -> bool:
+        """Check if current AC state could reach a match in one step."""
+        if self.hard_ac is None:
+            return False
+        state = self._hard_state
+        if state == 0:
+            return False
+        for token, _child_state in self.hard_ac.trie.get(state, {}).items():
+            next_state = self.hard_ac.step(state, token)
+            if self.hard_ac.has_match(next_state):
+                return True
+        current = state
+        visited = set()
+        while current in self.hard_ac.failure and current not in visited:
+            visited.add(current)
+            current = self.hard_ac.failure[current]
+            for token, _child_state in self.hard_ac.trie.get(current, {}).items():
+                next_state = self.hard_ac.step(current, token)
+                if self.hard_ac.has_match(next_state):
+                    return True
+        return False
+
+    def reset(self) -> None:
+        self._hard_state = 0
+        self._bias_state = 0

resksecure/cache.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+import time
+from threading import Lock
+from typing import Any, Dict, Optional, Tuple
+
+
+class TrieCache:
+    def __init__(self, ttl: int = 300):
+        self._data: Dict[Tuple[int, str], Tuple[Any, float]] = {}
+        self._ttl = ttl
+        self._lock = Lock()
+
+    def get(self, key: Tuple[int, str]) -> Any:
+        with self._lock:
+            if key not in self._data:
+                return None
+            entry, timestamp = self._data[key]
+            if time.monotonic() - timestamp > self._ttl:
+                del self._data[key]
+                return None
+            return entry
+
+    def set(self, key: Tuple[int, str], value: Any) -> None:
+        with self._lock:
+            self._data[key] = (value, time.monotonic())
+
+    def invalidate(
+        self,
+        mask: Optional[int] = None,
+        model_name: Optional[str] = None,
+    ) -> None:
+        with self._lock:
+            if mask is None and model_name is None:
+                self._data.clear()
+                return
+            keys_to_delete = [
+                k for k in self._data
+                if (mask is None or k[0] == mask)
+                and (model_name is None or k[1] == model_name)
+            ]
+            for k in keys_to_delete:
+                del self._data[k]
+
+    def invalidate_all(self) -> None:
+        with self._lock:
+            self._data.clear()
+
+    def __len__(self) -> int:
+        with self._lock:
+            return len(self._data)
+
+
+trie_cache = TrieCache()

resksecure/config/example_policy.yaml

@@ -0,0 +1,98 @@
+version: "0.1.0"
+
+policies:
+  - mask: 7
+    name: "contributor"
+    strict: false
+    default: true
+    rules:
+      - phrase: "DROP TABLE"
+        mode: hard
+      - phrase: "DELETE FROM"
+        mode: hard
+      - phrase: "ALTER TABLE"
+        mode: hard
+      - phrase: "TRUNCATE"
+        mode: hard
+      - phrase: "EXEC"
+        mode: hard
+      - phrase: "xp_cmdshell"
+        mode: hard
+      - phrase: "INTO OUTFILE"
+        mode: hard
+      - phrase: "GRANT ALL"
+        mode: hard
+      - phrase: "salaries"
+        mode: bias
+        penalty: -5.0
+      - phrase: "passwords"
+        mode: bias
+        penalty: -5.0
+      - phrase: "credit_cards"
+        mode: bias
+        penalty: -8.0
+      - phrase: "ssn"
+        mode: bias
+        penalty: -8.0
+    tools:
+      read_email:
+        required_bit: 0
+        trigger_phrases:
+          - "read_email("
+          - "get_emails("
+      send_email:
+        required_bit: 1
+        trigger_phrases:
+          - "send_email("
+          - "send_mail("
+      read_sql:
+        required_bit: 2
+        trigger_phrases:
+          - "read_sql("
+          - "query_database("
+
+  - mask: 15
+    name: "admin"
+    strict: false
+    rules:
+      - phrase: "xp_cmdshell"
+        mode: hard
+    tools:
+      read_email:
+        required_bit: 0
+      send_email:
+        required_bit: 1
+      read_sql:
+        required_bit: 2
+      write_sql:
+        required_bit: 3
+        trigger_phrases:
+          - "write_sql("
+          - "execute_sql("
+
+  - mask: 23
+    name: "auditor"
+    strict: true
+    rules:
+      - phrase: "DROP TABLE"
+        mode: hard
+      - phrase: "DELETE"
+        mode: hard
+      - phrase: "ALTER"
+        mode: hard
+      - phrase: "salaries"
+        mode: bias
+        penalty: -10.0
+      - phrase: "ssn"
+        mode: bias
+        penalty: -10.0
+    tools:
+      read_email:
+        required_bit: 0
+      read_sql:
+        required_bit: 2
+      create_jira:
+        required_bit: 4
+        trigger_phrases:
+          - "create_jira("
+          - "create_ticket("

resksecure/policy_loader.py

@@ -0,0 +1,95 @@
+from __future__ import annotations
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Dict, List, Optional
+import yaml
+
+
+@dataclass
+class PhraseRule:
+    phrase: str
+    mode: str = "hard"
+    penalty: float = 0.0
+
+
+@dataclass
+class ToolRule:
+    name: str
+    required_bit: int
+    trigger_phrases: List[str] = field(default_factory=list)
+
+
+@dataclass
+class Policy:
+    mask: int
+    name: str = ""
+    rules: List[PhraseRule] = field(default_factory=list)
+    tools: Dict[str, ToolRule] = field(default_factory=dict)
+    strict: bool = False
+
+
+@dataclass
+class PolicySet:
+    policies: Dict[int, Policy] = field(default_factory=dict)
+    default_policy: Optional[Policy] = None
+    version: str = ""
+    _path: Optional[Path] = None
+    _mtime: float = 0.0
+
+    def get_policy_for_mask(self, mask: int) -> Optional[Policy]:
+        if mask in self.policies:
+            return self.policies[mask]
+        return self.default_policy
+
+
+def load_policy(path: str | Path) -> PolicySet:
+    path = Path(path)
+    with open(path) as f:
+        data = yaml.safe_load(f)
+
+    if data is None:
+        return PolicySet()
+
+    version = data.get("version", "")
+    policies: Dict[int, Policy] = {}
+    default_policy: Optional[Policy] = None
+
+    for entry in data.get("policies", []):
+        mask = entry["mask"]
+        name = entry.get("name", f"policy_{mask}")
+        strict = entry.get("strict", False)
+
+        rules = []
+        for r in entry.get("rules", []):
+            rules.append(PhraseRule(
+                phrase=r["phrase"],
+                mode=r.get("mode", "hard"),
+                penalty=r.get("penalty", 0.0),
+            ))
+
+        tools = {}
+        for tool_name, config in entry.get("tools", {}).items():
+            tools[tool_name] = ToolRule(
+                name=tool_name,
+                required_bit=config["required_bit"],
+                trigger_phrases=config.get("trigger_phrases", []),
+            )
+
+        policy = Policy(
+            mask=mask,
+            name=name,
+            rules=rules,
+            tools=tools,
+            strict=strict,
+        )
+        policies[mask] = policy
+        if entry.get("default", False):
+            default_policy = policy
+
+    return PolicySet(
+        policies=policies,
+        default_policy=default_policy,
+        version=version,
+        _path=path,
+        _mtime=path.stat().st_mtime,
+    )

resksecure/policy_watcher.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+import time
+from pathlib import Path
+from threading import Lock, Thread
+from typing import Callable, Optional
+
+from .cache import trie_cache
+from .policy_loader import PolicySet, load_policy
+
+
+class PolicyWatcher:
+    """Watches a policy file for changes and triggers cache invalidation."""
+
+    def __init__(
+        self,
+        policy_path: str | Path,
+        interval: float = 5.0,
+        on_reload: Optional[Callable[[PolicySet], None]] = None,
+        auto_start: bool = True,
+    ):
+        self._path = Path(policy_path)
+        self._interval = interval
+        self._on_reload = on_reload
+        self._last_mtime = self._path.stat().st_mtime if self._path.exists() else 0.0
+        self._running = False
+        self._thread: Optional[Thread] = None
+        self._lock = Lock()
+        self._current_policy: Optional[PolicySet] = None
+
+        if auto_start:
+            self.start()
+
+    def start(self) -> None:
+        if self._running:
+            return
+        self._running = True
+        self._thread = Thread(target=self._watch, daemon=True)
+        self._thread.start()
+
+    def stop(self) -> None:
+        self._running = False
+        if self._thread is not None:
+            self._thread.join(timeout=2.0)
+
+    @property
+    def current_policy(self) -> Optional[PolicySet]:
+        with self._lock:
+            return self._current_policy
+
+    def _watch(self) -> None:
+        while self._running:
+            try:
+                if self._path.exists():
+                    mtime = self._path.stat().st_mtime
+                    if mtime > self._last_mtime:
+                        self._last_mtime = mtime
+                        policy = load_policy(self._path)
+                        with self._lock:
+                            self._current_policy = policy
+                        trie_cache.invalidate_all()
+                        if self._on_reload:
+                            self._on_reload(policy)
+            except Exception:
+                pass
+            time.sleep(self._interval)
+
+    def __enter__(self) -> "PolicyWatcher":
+        self.start()
+        return self
+
+    def __exit__(self, *args) -> None:
+        self.stop()

resksecure/tool_guard.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+from .policy_loader import PolicySet
+
+
+def verify_tool_action(
+    tool_name: str,
+    user_mask: int,
+    policy_set: PolicySet,
+) -> bool:
+    """Check whether a tool action is allowed for the given user mask.
+
+    Looks up the tool's required bit from the policy matching *user_mask*,
+    then checks if that bit is set in the mask.
+
+    Returns:
+        True if the tool is allowed, False otherwise.
+    """
+    policy = policy_set.get_policy_for_mask(user_mask)
+    if policy is None:
+        return False
+    tool_rule = policy.tools.get(tool_name)
+    if tool_rule is None:
+        return False
+    required_bit = tool_rule.required_bit
+    return (user_mask & (1 << required_bit)) != 0
+
+
+def get_allowed_tools(
+    user_mask: int,
+    policy_set: PolicySet,
+) -> list[str]:
+    """Return the list of tool names the user mask permits."""
+    policy = policy_set.get_policy_for_mask(user_mask)
+    if policy is None:
+        return []
+    return [
+        name
+        for name, rule in policy.tools.items()
+        if (user_mask & (1 << rule.required_bit)) != 0
+    ]

resksecure/trie_factory.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+from typing import Dict, List, Optional, Tuple
+
+from resklogits import VectorizedAhoCorasick
+
+from .cache import trie_cache
+from .policy_loader import Policy, PolicySet, PhraseRule
+
+
+def _expand_phrases(phrases: List[str]) -> List[str]:
+    """Generate variants of each phrase (space-prefixed, capitalized)."""
+    expanded: List[str] = []
+    for s in phrases:
+        s = s.strip()
+        expanded.append(s)
+        if not s.startswith(" "):
+            expanded.append(" " + s)
+        capitalized = s.capitalize()
+        if capitalized != s:
+            expanded.append(capitalized)
+    return expanded
+
+
+def build_ac_from_policy(
+    policy: Policy,
+    tokenizer,
+    device: str = "cuda",
+) -> Tuple[Optional[VectorizedAhoCorasick], Dict[int, str], Dict[int, float]]:
+    """Build a VectorizedAhoCorasick from a Policy.
+
+    Generates phrase variants (with space prefix, capitalized) to cover
+    different tokenization contexts.
+
+    Returns:
+        (automaton, pattern_modes, pattern_penalties)
+        - automaton: VectorizedAhoCorasick or None if no rules
+        - pattern_modes: pattern_index -> 'hard' | 'bias'
+        - pattern_penalties: pattern_index -> penalty value
+    """
+    if not policy.rules:
+        return None, {}, {}
+
+    all_phrases: List[str] = []
+    pattern_meta: List[Tuple[str, float]] = []
+
+    for rule in policy.rules:
+        for variant in _expand_phrases([rule.phrase]):
+            all_phrases.append(variant)
+            pattern_meta.append((rule.mode, rule.penalty))
+
+    if not all_phrases:
+        return None, {}, {}
+
+    ac = VectorizedAhoCorasick(
+        tokenizer=tokenizer,
+        banned_phrases=all_phrases,
+        device=device,
+    )
+
+    pattern_modes = {i: meta[0] for i, meta in enumerate(pattern_meta)}
+    pattern_penalties = {i: meta[1] for i, meta in enumerate(pattern_meta)}
+
+    return ac, pattern_modes, pattern_penalties
+
+
+def get_or_build_ac(
+    mask: int,
+    model_name: str,
+    tokenizer,
+    policy_set: PolicySet,
+    device: str = "cuda",
+):
+    """Get cached automaton or build it from the policy.
+
+    Also derives tool trigger phrases that should be blocked for this mask.
+    If the user's mask does not have the required bit for a tool, that
+    tool's trigger phrases are added as hard-mode blocked phrases.
+
+    Returns:
+        (hard_ac, bias_ac, hard_meta, bias_meta, policy)
+        - hard_ac: VectorizedAhoCorasick or None for hard-mode phrases
+        - bias_ac: VectorizedAhoCorasick or None for bias-mode phrases
+        - hard_meta: dict pattern_index -> mode
+        - bias_meta: dict pattern_index -> penalty
+        - policy: the resolved Policy or None
+    """
+    key = (mask, model_name)
+    cached = trie_cache.get(key)
+    if cached is not None:
+        return cached
+
+    policy = policy_set.get_policy_for_mask(mask)
+    if policy is None:
+        return (None, None, {}, {}, policy)
+
+    # Collect explicit rules from the policy
+    hard_phrases = [r.phrase for r in policy.rules if r.mode == "hard"]
+    bias_phrases = [r.phrase for r in policy.rules if r.mode == "bias"]
+
+    # Derive tool trigger phrases for tools the user does NOT have access to.
+    # These are added as hard-mode phrases so the model can never generate
+    # a disallowed tool call at the token level.
+    if policy.tools:
+        for tool_name, tool_rule in policy.tools.items():
+            has_bit = (mask & (1 << tool_rule.required_bit)) != 0
+            if not has_bit and tool_rule.trigger_phrases:
+                hard_phrases.extend(tool_rule.trigger_phrases)
+
+    hard_ac, bias_ac = None, None
+    hard_meta, bias_meta = {}, {}
+
+    if hard_phrases:
+        hard_rules = [PhraseRule(phrase=p, mode="hard") for p in hard_phrases]
+        hard_ac, hard_meta, _ = build_ac_from_policy(
+            Policy(mask=policy.mask, rules=hard_rules),
+            tokenizer,
+            device,
+        )
+
+    if bias_phrases:
+        bias_rules = [PhraseRule(phrase=p, mode="bias", penalty=-5.0) for p in bias_phrases]
+        bias_ac, bias_meta, _ = build_ac_from_policy(
+            Policy(mask=policy.mask, rules=bias_rules),
+            tokenizer,
+            device,
+        )
+
+    result = (hard_ac, bias_ac, hard_meta, bias_meta, policy)
+    trie_cache.set(key, result)
+    return result

resksecure-0.1.0.dist-info/METADATA

@@ -0,0 +1,238 @@
+Metadata-Version: 2.4
+Name: resksecure
+Version: 0.1.0
+Summary: Bitmask-based LLM security firewall with policy-driven logits filtering using GPU-accelerated Aho-Corasick pattern matching
+Project-URL: Homepage, https://github.com/Resk-Security/reskSecure
+Project-URL: Repository, https://github.com/Resk-Security/reskSecure
+Project-URL: Documentation, https://github.com/Resk-Security/reskSecure
+Author: RESK Security
+License: RESK Software License
+License-File: LICENSE
+Keywords: aho-corasick,bitmask,dlp,filtering,firewall,gpu,llm,logits,permissions,policy,safety,security,transformers
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.13
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: resklogits>=0.1.0
+Requires-Dist: torch>=2.0.0
+Requires-Dist: transformers>=4.35.0
+Provides-Extra: dev
+Requires-Dist: black>=23.0.0; extra == 'dev'
+Requires-Dist: mypy>=1.0.0; extra == 'dev'
+Requires-Dist: pytest>=7.0.0; extra == 'dev'
+Requires-Dist: ruff>=0.1.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# reskSecure
+
+[![PyPI version](https://img.shields.io/pypi/v/resksecure)](https://pypi.org/project/resksecure/)
+[![PyPI downloads](https://img.shields.io/pypi/dm/resksecure)](https://pypi.org/project/resksecure/)
+[![Python versions](https://img.shields.io/pypi/pyversions/resksecure)](https://pypi.org/project/resksecure/)
+[![License](https://img.shields.io/badge/license-RESK-blue)](LICENSE)
+
+**Bitmask-based LLM security firewall.** A Python package that restricts what a language model can generate based on user permissions encoded as a bitmask. It works by intercepting the model's token predictions and blocking or penalizing disallowed phrases before they appear in the output.
+
+Available on [PyPI](https://pypi.org/project/resksecure/).
+
+Unlike prompt-based filters (which can be jailbroken) or post-generation content moderation (which lets forbidden content leak before detection), reskSecure acts at the logits level -- directly inside the model's generation loop. Each token must pass through the security policy before being emitted.
+
+---
+
+## How it works
+
+```
+User request with bitmask (e.g. 7)
+    |
+    v
+BitmaskLogitsProcessor intercepts each token prediction
+    |
+    v
+For every candidate token, the Aho-Corasick automaton (from resklogits)
+checks if selecting it would start or complete a banned phrase
+    |
+    v
+Hard-mode phrases: the token's logit is set to -inf (impossible to generate)
+Bias-mode phrases: the token's logit is reduced by a configurable penalty
+    |
+    v
+On complete match: EOS token is forced, generation stops immediately
+    |
+    v
+Output response or tool call
+```
+
+Tool calls are also blocked at the token level. If the user's bitmask does not
+contain the required bit for a tool, that tool's trigger phrases (like
+`"send_email("` or `"create_ticket("`) are automatically added to the
+hard-mode blocked list. The model can never generate the first token of
+a disallowed tool call, regardless of prompt engineering or jailbreak
+attempts.
+
+A post-generation check (`verify_tool_action`) is also available as a
+defense-in-depth layer, but the primary protection is at the logits level.
+
+---
+
+## Why not just prompt engineering?
+
+- Prompt injections can bypass instruction-based filters
+- Post-generation regex or classifier scans catch violations after they appear, but the forbidden content has already been emitted
+- Logits-level filtering blocks tokens before they are sampled -- the model never "sees" the banned sequence as a completion candidate
+
+---
+
+## Features
+
+- **Two severity modes**: `hard` blocks tokens completely (-inf logit), `bias` reduces probability by a configurable penalty
+- **Strict mode**: forces end-of-sequence as soon as the generated prefix matches the start of a banned phrase, even before the full phrase is formed
+- **GPU-accelerated pattern matching**: uses VectorizedAhoCorasick from the resklogits package for fast token scanning
+- **Policy system**: YAML configuration associates capability bitmasks with phrase rules and tool permissions
+- **Hot-reload**: PolicyWatcher detects file changes and rebuilds the automaton without restarting the server
+- **Thread-safe cache**: automata are cached by (mask, model_name) with configurable TTL
+- **Tool guard**: post-generation bitmask check for tool call execution
+- **No JWT handling**: the package receives a raw integer bitmask; authentication and JWT decoding are handled by the calling application
+
+---
+
+## Requirements
+
+- Python >= 3.13
+- PyTorch >= 2.0.0
+- transformers >= 4.35.0
+- resklogits >= 0.1.0
+
+---
+
+## Installation
+
+```bash
+pip install resksecure
+```
+
+[![PyPI version](https://img.shields.io/pypi/v/resksecure)](https://pypi.org/project/resksecure/)
+[![PyPI downloads](https://img.shields.io/pypi/dm/resksecure)](https://pypi.org/project/resksecure/)
+
+From source:
+
+```bash
+git clone https://github.com/Resk-Security/reskSecure.git
+cd reskSecure
+pip install -e .
+```
+
+---
+
+## Quick start
+
+Define a policy file (`policy.yaml`):
+
+```yaml
+version: "1.0"
+policies:
+  - mask: 7
+    name: contributor
+    strict: false
+    default: true
+    rules:
+      - phrase: "DROP TABLE"
+        mode: hard
+      - phrase: "DELETE FROM"
+        mode: hard
+      - phrase: "salaries"
+        mode: bias
+        penalty: -5.0
+    tools:
+      read_email:
+        required_bit: 0
+      send_email:
+        required_bit: 1
+      read_sql:
+        required_bit: 2
+```
+
+Use it in your generation pipeline:
+
+```python
+from resksecure import BitmaskLogitsProcessor, load_policy, verify_tool_action
+
+policy_set = load_policy("policy.yaml")
+
+processor = BitmaskLogitsProcessor(
+    mask=7,
+    model_name="mistralai/Mistral-7B-v0.1",
+    tokenizer=tokenizer,
+    policy_set=policy_set,
+    device="cuda",
+)
+
+outputs = model.generate(**inputs, logits_processor=[processor])
+
+# Optional: verify tool calls against the bitmask
+if has_tool_call(response):
+    if not verify_tool_action("send_email", user_mask=7, policy_set=policy_set):
+        raise PermissionError("Action not authorized")
+```
+
+---
+
+## Policy reference
+
+Policy-level fields:
+
+| Field       | Type    | Description                                              |
+|-------------|---------|----------------------------------------------------------|
+| `mask`      | int     | Capability bitmask that identifies this policy           |
+| `name`      | string  | Human-readable policy name                               |
+| `strict`    | bool    | If true, stop generation at the first banned prefix      |
+| `default`   | bool    | If true, this policy is used when no exact mask matches  |
+| `rules`     | list    | List of phrase rules (see below)                         |
+| `tools`     | dict    | Map of tool names to tool rule objects (see below)       |
+
+Phrase rule fields:
+
+| Field     | Type   | Description                                                |
+|-----------|--------|------------------------------------------------------------|
+| `phrase`  | string | Text pattern to ban or penalize                            |
+| `mode`    | string | Either `hard` (block completely) or `bias` (reduce logits) |
+| `penalty` | float  | Logit penalty for bias mode (e.g. -5.0)                   |
+
+Tool rule fields:
+
+| Field              | Type     | Description                                                    |
+|--------------------|----------|----------------------------------------------------------------|
+| `required_bit`     | int      | Bit position that must be set in the user mask to use this tool |
+| `trigger_phrases`  | string[] | Phrases that start this tool call (blocked if bit not set)      |
+
+---
+
+## Package structure
+
+```
+reskSecure/
+  src/resksecure/
+    __init__.py              Public exports, version
+    policy_loader.py         YAML parsing, Policy/PolicySet models
+    trie_factory.py          Builds VectorizedAhoCorasick from a Policy
+    bitmask_processor.py     BitmaskLogitsProcessor (LogitsProcessor subclass)
+    tool_guard.py            Post-generation tool action verification
+    cache.py                 Thread-safe TTL cache for automata
+    policy_watcher.py        Hot-reload daemon that watches YAML mtime
+    config/example_policy.yaml
+  tests/
+  examples/
+```
+
+---
+
+## License
+
+This software is licensed under the RESK Software License. Commercial use requires a separate paid license. See the [LICENSE](LICENSE) file for details.
+
+For commercial licensing inquiries, contact: contact@resk.fr

resksecure-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+resksecure/__init__.py,sha256=vswAYW475bnZZufYrfLsKqmccYuPvb9dUIaPvDKzUTM,1363
+resksecure/bitmask_processor.py,sha256=Bawg7GeHegK-pOqrw1W5UgpcGgvgpvYBkMvc4zFtBGs,5547
+resksecure/cache.py,sha256=1c00QAEr2MhVJJw3X6AjPiETMIkWfM1OqFKC_1-ZFP8,1516
+resksecure/policy_loader.py,sha256=CrLnv-JsYZwEprPoguxNsWUtKuyxphCF71gNEKMT2Sk,2412
+resksecure/policy_watcher.py,sha256=aaEjB7Z4eCn7p70EG9wjnvZjpW6_gLfYFFlpG7zAuIA,2211
+resksecure/tool_guard.py,sha256=VtBYNscqz7RJMCBlQwfhZIWzO-8WXBY9maBs5gNJHKo,1110
+resksecure/trie_factory.py,sha256=LR63Y8J-me-7HvUJOuIjfZbg_16LXZWpnozNy3GhDTU,4307
+resksecure/config/example_policy.yaml,sha256=BNKee5k1_X3DFDxBvhDeWJFKKuZdzlbeOMq7itVTB5E,2040
+resksecure-0.1.0.dist-info/METADATA,sha256=_kXBbk5WA9HUV61WOQO6Cf3lj6tUPcYThuod86j2Qgk,8858
+resksecure-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+resksecure-0.1.0.dist-info/licenses/LICENSE,sha256=Pp2Rp2klJloZ-sEwrkv3MdSSZ7E_Ev0l94omDTWommU,4183
+resksecure-0.1.0.dist-info/RECORD,,

resksecure-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

resksecure-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,105 @@
+RESK SOFTWARE LICENSE
+Version 1.0, June 2026
+
+Copyright (c) 2026 RESK Security
+
+TERMS AND CONDITIONS
+
+1. Definitions
+
+"Software" means the source code, documentation, and any accompanying
+materials in this repository.
+
+"Licensor" means RESK Security.
+
+"Licensee" means any individual or entity that accesses or uses the Software.
+
+"Commercial Use" means any use of the Software where the primary purpose
+is commercial advantage or monetary compensation, including but not limited
+to: integrating the Software into a commercial product, offering the Software
+as part of a SaaS service, using the Software for internal business operations
+that generate revenue, or distributing the Software in exchange for any form
+of payment.
+
+"Royalty" means the recurring fee payable to Licensor for any Commercial Use
+of the Software, as defined in a separate commercial agreement.
+
+2. Grant of License
+
+Subject to the terms and conditions of this License, Licensor grants Licensee
+a non-exclusive, non-transferable, non-sublicensable, limited license to:
+
+(a) View and study the Software source code.
+(b) Use the Software for non-commercial, personal, educational, or
+    evaluation purposes only.
+(c) Modify the Software for personal, non-commercial use only.
+
+3. Prohibited Uses
+
+Without the prior written consent of Licensor, Licensee may NOT:
+
+(a) Use the Software for any Commercial Use.
+(b) Distribute, sublicense, sell, lease, rent, or transfer the Software
+    or any derivative thereof to any third party.
+(c) Incorporate the Software or any portion thereof into any product or
+    service offered to third parties.
+(d) Remove or alter any copyright, trademark, or proprietary notice
+    contained in the Software.
+(e) Use the Software in any manner that competes with Licensor's business.
+(f) Create derivative works based on the Software for distribution or
+    Commercial Use.
+(g) Use the Software in any environment that processes sensitive personal
+    data without prior written authorization from Licensor.
+
+4. Commercial License and Royalties
+
+Any Commercial Use of the Software requires a separate commercial license
+agreement signed by both parties. Such agreement shall specify:
+
+(a) The scope of permitted Commercial Use.
+(b) Royalty fees, which shall be calculated as a percentage of revenue or
+    a fixed fee per deployment, as agreed upon in writing.
+(c) Duration and renewal terms.
+
+Contact: resk-security@proton.me for commercial licensing inquiries.
+
+5. Intellectual Property
+
+All right, title, and interest in and to the Software, including all
+intellectual property rights therein, remain the exclusive property of
+Licensor. This License does not transfer any ownership rights to Licensee.
+
+6. No Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+7. Limitation of Liability
+
+In no event shall Licensor be liable for any indirect, incidental, special,
+consequential, or punitive damages, including but not limited to loss of
+profits, data, or use, arising out of or in connection with the Software,
+whether based on warranty, contract, tort, or any other legal theory, even
+if Licensor has been advised of the possibility of such damages.
+
+8. Termination
+
+This License terminates automatically if Licensee fails to comply with any
+of its terms. Upon termination, Licensee must immediately cease all use of
+the Software and destroy all copies. Licensor reserves the right to pursue
+legal remedies for any unauthorized use.
+
+9. Governing Law
+
+This License shall be governed by and construed in accordance with the laws
+of France, without regard to its conflict of laws principles.
+
+10. Entire Agreement
+
+This License constitutes the entire agreement between the parties concerning
+the subject matter hereof and supersedes all prior agreements and
+understandings.