shadowshield 0.6.2__tar.gz → 0.6.3__tar.gz

{shadowshield-0.6.2 → shadowshield-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: shadowshield
-Version: 0.6.2
+Version: 0.6.3
 Summary: Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw.
 Project-URL: Homepage, https://shadowshield.xyz
 Project-URL: Documentation, https://github.com/0xsl1m/shadowshield#readme
@@ -28,7 +28,6 @@ Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic>=2.5
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: structlog>=24.1
-Requires-Dist: tiktoken>=0.6
 Provides-Extra: all
 Requires-Dist: datasets>=2.18; extra == 'all'
 Requires-Dist: fastapi>=0.110; extra == 'all'
@@ -207,8 +206,8 @@ pip install "shadowshield[dashboard]"      # + FastAPI HTTP server & dashboard
 pip install "shadowshield[all]"            # everything
 ```
 
-Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, `httpx`,
-`tiktoken`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
+Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, and
+`httpx`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
 behind extras — the default install pulls **no** heavy ML stack.
 
 ---
@@ -330,7 +329,7 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
@@ -351,14 +350,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.2.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.3.
 docker compose up -d
 ```
 

{shadowshield-0.6.2 → shadowshield-0.6.3}/README.md

@@ -134,8 +134,8 @@ pip install "shadowshield[dashboard]"      # + FastAPI HTTP server & dashboard
 pip install "shadowshield[all]"            # everything
 ```
 
-Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, `httpx`,
-`tiktoken`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
+Core deps are intentionally small: `pydantic`, `structlog`, `pyyaml`, and
+`httpx`. The ML classifier, Presidio PII, dataset loaders, and dashboard live
 behind extras — the default install pulls **no** heavy ML stack.
 
 ---
@@ -257,7 +257,7 @@ export SHADOWSHIELD_ADMIN_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 docker compose pull
 docker compose up -d
 ```
@@ -278,14 +278,14 @@ Upgrading a control-plane volume from 0.6.0 requires an offline re-key because
 ```bash
 # Load the existing scan/admin keys first so the new Compose file can resolve.
 export SHADOWSHIELD_IMAGE_DIGEST="$(curl -fsSL \
-  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.2/container-digest.txt)"
+  https://github.com/0xsl1m/shadowshield/releases/download/v0.6.3/container-digest.txt)"
 export SHADOWSHIELD_POLICY_KEY="<existing-0.6.0-policy-key>"
 export SHADOWSHIELD_POLICY_STATE_KEY="$(openssl rand -hex 32)"
 # Stop every writer and snapshot the volume before running the migration.
 docker compose stop shadowshield
 docker compose run --rm --no-deps shadowshield \
   shadowshield migrate-policy-state --path /var/lib/shadowshield/policy-state.json
-# Preserve the reported .pre-0.6.1.bak file, then start 0.6.2.
+# Preserve the reported .pre-0.6.1.bak file, then start 0.6.3.
 docker compose up -d
 ```
 

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/BENCHMARKS.md

@@ -26,14 +26,40 @@ pip install "shadowshield[transformers]"
 shadowshield benchmark --hf deepset/prompt-injections --split test --transformer
 ```
 
+The CLI warms every configured detector before starting the latency clock. Its
+JSON and text reports include a runtime-integrity section covering warmup,
+readiness, and bounded per-detector failure counts. A benchmark with a warmup
+failure, a detector that remains unready, or any detector error exits non-zero
+and is marked **unreliable**; its confusion counts remain available for
+diagnosis but must not be published as quality evidence. CLI benchmark shields
+disable normal audit emission so logging I/O does not distort latency or corrupt
+the command's machine-readable JSON stdout.
+
+Programmatic callers can request the same behavior with
+`evaluate_shield(shield, examples, warmup=True)`. The default remains
+`warmup=False` for API compatibility. In both modes, readiness is checked after
+the scans and per-scan detector error counters are aggregated.
+
+Per-category output retains the original `total`, `flagged`, and flag-rate
+fields, and additionally reports class-conditional TP/FP/TN/FN, recall, FPR,
+and balanced accuracy. Recall is `null`/`n/a` for categories with no attack
+rows; FPR is `null`/`n/a` for categories with no benign rows; balanced accuracy
+is defined only when both classes are present.
+
+Aggregate and per-category recall/FPR also include two-sided 95% Wilson score
+intervals. Wilson intervals remain informative at small sample sizes and at
+observed rates of 0% or 100%; an interval is `null`/`n/a` when that category has
+no rows for the corresponding class. Existing scalar metric fields are
+unchanged, and the interval fields are additive.
+
 ## 1. Bundled benchmark (in-distribution — a regression baseline)
 
 75 curated examples (40 attack / 35 benign, incl. 16 NotInject-style hard
 negatives). `balanced` mode:
 
-| recall | FPR | precision | F1 | p50 |
+| recall (95% CI) | FPR (95% CI) | precision | F1 | p50 |
 |---:|---:|---:|---:|---:|
-| 100% | 0% | 100% | 100% | 0.16 ms |
+| 100% [91.2%, 100%] | 0% [0%, 9.9%] | 100% | 100% | 0.16 ms |
 
 **This is a regression baseline and a smoke test — NOT a claim of real-world
 accuracy.** 100% on our own set just means we don't regress on the attack
@@ -45,9 +71,9 @@ The 36-row adversarial catalogue includes obfuscation, multilingual and indirect
 attacks, plus benign trigger-heavy counterexamples. It improved from
 15/2/16/3 to 18/0/18/0 (TP/FP/TN/FN):
 
-| recall | FPR | precision | F1 |
+| recall (95% CI) | FPR (95% CI) | precision | F1 |
 |---:|---:|---:|---:|
-| 100% | 0% | 100% | 100% |
+| 100% [82.4%, 100%] | 0% [0%, 17.6%] | 100% | 100% |
 
 This is still a curated regression set. The signatures were developed with these
 cases visible, so its perfect score is not a generalization claim.
@@ -67,12 +93,12 @@ v1 SHA-256 `b3281ba1a42d266bb930bbb41943016d47b38dbc822ff7cff5131f3448a0248f`;
 v2 SHA-256 `aa8b8c81c00a55bb65180e15ff743b6241d24845b3886e8e60b52b9b23db47fa`;
 v3 SHA-256 `2285031e8143572311a522a4b6ec1a39c96a34ac2b42785f17818e8a145342bf`.
 
-| snapshot | rows | TP/FP/TN/FN | recall | FPR | balanced accuracy |
+| snapshot | rows | TP/FP/TN/FN | recall (95% CI) | FPR (95% CI) | balanced accuracy |
 |---|---:|---:|---:|---:|---:|
-| v1 | 30 | 4/2/13/11 | 26.7% | 13.3% | 56.7% |
-| v2 | 20 | 0/1/9/10 | 0% | 10% | 45% |
-| v3 | 40 | 6/6/14/14 | 30% | 30% | 50% |
-| **aggregate** | **90** | **10/9/36/35** | **22.2%** | **20%** | **51.1%** |
+| v1 | 30 | 4/2/13/11 | 26.7% [10.9%, 52.0%] | 13.3% [3.7%, 37.9%] | 56.7% |
+| v2 | 20 | 0/1/9/10 | 0% [0%, 27.8%] | 10% [1.8%, 40.4%] | 45% |
+| v3 | 40 | 6/6/14/14 | 30% [14.5%, 51.9%] | 30% [14.5%, 51.9%] | 50% |
+| **aggregate** | **90** | **10/9/36/35** | **22.2% [12.5%, 36.3%]** | **20% [10.9%, 33.8%]** | **51.1%** |
 
 The v3 snapshot was opened only after a detector candidate and acceptance bar
 were frozen. That candidate raised aggregate recall to 55.6% but failed the

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/PRODUCTION_READINESS.md

@@ -1,20 +1,21 @@
 # Production readiness roadmap
 
-**Baseline:** ShadowShield 0.6.2 · **Audit date:** 2026-07-25
+**Baseline:** ShadowShield 0.6.3 · **Audit date:** 2026-07-25
 
 This roadmap is the release gate for the Python library and the optional HTTP
-control plane. A checked item is implemented and locally verified; unchecked
-items require an explicit operator or maintainer decision before public launch.
+control plane. A checked item is implemented and locally verified. The
+operator-owned unchecked items do not block the library or static site, but they
+must be resolved before exposing the optional HTTP control plane publicly.
 
 ## Current readiness
 
 | Area | State | Evidence / remaining action |
 |---|---|---|
-| Correctness | Ready | 290+ unit/integration cases; strict mypy; Ruff lint/format; CodeQL extended scanning |
-| Packaging | Ready | Isolated sdist/wheel build, Twine metadata check, installed-wheel CI smoke test |
-| Runtime security | Ready with configuration | Early API-key/Bearer auth, body limits, restricted CORS, immutable protection floor, non-root read-only container |
-| Supply chain | Ready | Repository-enforced Action SHA pins, PyPI OIDC, exact-green-main release gates, pre-push image vulnerability gate, anonymous GHCR digest pull, registry-verified SLSA and CycloneDX attestations |
-| Observability | Ready for single process | Content-free telemetry, Prometheus endpoint, bounded in-memory event feed |
+| Correctness | Ready | 320 unit/integration cases; strict mypy; Ruff lint/format; CodeQL extended scanning |
+| Packaging | Ready | Hash-locked build environment, byte-for-byte repeat build gate, Twine validation, installed-wheel smoke test |
+| Runtime security | Ready with configuration | Early API-key/Bearer auth, bounded/deadlined body intake, detector-failure policy, restricted CORS, immutable protection floor, non-root read-only container |
+| Supply chain | Ready | Digest/SHA-pinned build inputs, PyPI OIDC, exact-green-main release gates, immutable image/evidence handling, pre-push vulnerability gate, anonymous GHCR digest pull, registry-verified SLSA and CycloneDX attestations |
+| Observability | Ready for single process | Content-free telemetry, detector-error counters, Prometheus endpoint, bounded in-memory event feed |
 | Detection quality | Beta | Curated adversarial: 100%/0% FPR; blind v1–v3 aggregate: 22.2%/20%; v3: 30%/30%; deepset core: 23.3%/0% |
 | Scale / HA | Not yet | Counters, events, configuration, and rate limits are process-local |
 | Streaming | Not yet | Outputs must be buffered before scanning |
@@ -23,7 +24,7 @@ items require an explicit operator or maintainer decision before public launch.
 
 - [x] Repair control-plane syntax and restore test collection.
 - [x] Make optional-dependency tests and typing deterministic with or without MCP installed.
-- [x] Enforce an 80% branch-aware coverage floor (current local result: 85%).
+- [x] Enforce an 80% branch-aware coverage floor (current local result: 86%).
 - [x] Test every declared Python runtime, 3.10 through 3.14, in CI.
 - [x] Build and validate both distribution formats and smoke-test the installed wheel.
 - [x] Audit declared dependencies in CI (local audit: no known vulnerabilities).
@@ -61,6 +62,23 @@ items require an explicit operator or maintainer decision before public launch.
   push-protection, and repository-level enforcement of full-SHA Action pins.
 - [x] Publish a third independently authored blind snapshot and reject—not
   tune—the first frozen candidate when it missed the predeclared FPR/accuracy bar.
+- [x] Make documented session guard calls record clean and blocked turns exactly
+  once so multi-turn and alignment checks receive the advertised trace.
+- [x] Surface bounded, content-free detector failures in every result, audit,
+  benchmark, control event, and Prometheus metric; make strict mode fail closed.
+- [x] Coalesce HTTP request frames, cap fragmentation, and apply one total body
+  deadline so authenticated slow/chunked bodies cannot pin all scan slots;
+  authenticate protected non-preflight methods before body/admission work.
+- [x] Hash-lock release build and container dependencies, pin the Dockerfile
+  frontend, remove the unused mandatory tokenizer dependency, and require two
+  byte-identical distribution builds.
+- [x] Upgrade maintained Actions to their Node 24 generations, bound every CI
+  job with a timeout, and refuse conflicting image tags or release assets while
+  allowing only attested exact-source digest recovery of an interrupted
+  container publication.
+- [x] Make benchmark evidence fail visibly on warmup, readiness, or detector
+  errors and report class-conditional per-slice confusion metrics with 95%
+  Wilson confidence intervals.
 
 ## P1 — launch procedure (operator-owned)
 
@@ -73,7 +91,8 @@ items require an explicit operator or maintainer decision before public launch.
 - [ ] Set an explicit CORS allowlist or leave CORS disabled.
 - [ ] Run the adversarial and application-specific eval sets in permissive/shadow mode.
 - [ ] Choose thresholds from measured false-positive cost; record the accepted baseline.
-- [ ] Connect Prometheus and content-free telemetry; alert on error, block-rate, and latency shifts.
+- [ ] Connect Prometheus and content-free telemetry; alert on detector errors,
+  readiness, block-rate, and latency shifts.
 - [ ] Load-test representative payload sizes and concurrency on the target instance class.
 - [ ] Record the deployed image digest and CI SBOM, then rehearse backup/restore
   and rollback against the target environment.
@@ -89,7 +108,11 @@ items require an explicit operator or maintainer decision before public launch.
 5. Split the current administrator credential into narrower observe and mutation scopes.
 6. Design cross-process model/index coordination and durable Reporter spooling.
 7. Split unprivileged container build/scan from the write/OIDC publication job.
-8. Refactor release evidence into a draft-first pipeline, then enable immutable releases.
+8. Refactor release evidence into a draft-first pipeline with independently
+   promoted, already-scanned OCI artifacts.
+9. Pin optional model revisions, pre-cache them for offline production startup,
+   and bound model-loading time.
+10. Add vulnerability-audit matrices for every supported optional dependency stack.
 
 ## Go / no-go gates
 

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/RELEASING.md

@@ -13,6 +13,10 @@ provenance and CycloneDX attestations through GitHub's Sigstore-backed OIDC
 service, verifies the signed provenance and an anonymous pull by digest, and
 attaches `container-digest.txt` plus the SBOM to the GitHub Release.
 
+Build tooling and the production container dependency graph are version- and
+hash-locked in `requirements/build.lock` and `requirements/container.lock`.
+Release jobs build the sdist and wheel twice and require byte-identical outputs.
+
 ## One-time setup (PyPI account owner only)
 
 This must be done in the PyPI web UI by the account that will own the project —
@@ -42,8 +46,15 @@ workflow deliberately fails its anonymous-pull gate if that happens.
 1. Let the first `Publish release container` run push the package.
 2. If the anonymous-pull step fails, open the `shadowshield` package settings
    under the `0xsl1m` account and change visibility to **Public**.
-3. Re-run the failed workflow job. Do not publish the release digest to operators
-   until the anonymous pull and evidence-attachment steps are green.
+3. Re-run the failed workflow job. It will reuse an existing image only when the
+   version and exact-commit tags resolve to the same digest and its revision and
+   version labels match the release **and** that digest already has trusted source
+   provenance from this workflow for the exact commit. It never overwrites a
+   conflicting or unattested tag. If an interruption happens after an image push
+   but before provenance is attached, delete the incomplete version/commit tags
+   from GHCR and re-run; the workflow deliberately refuses to bless them.
+   Do not publish the digest to operators until the anonymous-pull and
+   evidence-attachment steps are green.
 
 ## Cutting a release
 
@@ -59,9 +70,13 @@ gh release create vX.Y.Z --target "$merge_sha" \
 # -> PyPI publishing and exact-image scan/publish run independently
 ```
 
-Do not create the release while required checks are pending. A partial release
-is recoverable by fixing the failed workflow and re-running it, but the PyPI
-version itself cannot be replaced.
+Do not create the release while required checks are pending. Once trusted source
+provenance exists, a partial container release is recoverable by fixing the
+failed workflow and re-running it: exact matching registry content is pulled,
+rescanned, re-attested, and reused. An interruption between the first image push
+and provenance attachment intentionally needs the incomplete GHCR tags removed
+before retry. Conflicting tags and existing evidence assets are never
+overwritten. The PyPI version itself cannot be replaced.
 
 Both publication workflows independently reject non-stable tags, tag/source
 version mismatches, commits outside `main`, and commits without a successful
@@ -99,6 +114,8 @@ gh attestation verify "oci://$image" \
 
 - **Versions are immutable.** A published version can never be re-uploaded, only
   *yanked*. Always confirm `twine check` is green (CI does this) before releasing.
+- Regenerate dependency locks only in a dedicated reviewed PR, using the exact
+  commands recorded at the top of each lock file; CI audits both locked graphs.
 - Deploy the container by the exact `image@sha256` value in
   `container-digest.txt`, never by a mutable version tag or a local Compose
   rebuild. The release SBOM describes that exact pre-push-scanned image.

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/configuration.md

@@ -19,11 +19,11 @@ Generate an annotated starter file with `shadowshield init > shield.yaml`.
 
 ## Modes
 
-| Mode | block_threshold | medium→ | LLM check | rate limit |
-|---|---|---|---|---|
-| `strict` | 0.45 | block | on | on (30/60s) |
-| `balanced` | 0.65 | sanitize | off | off |
-| `permissive` | 0.85 | flag | off | off |
+| Mode | block_threshold | medium→ | detector failure | LLM check | rate limit |
+|---|---|---|---|---|---|
+| `strict` | 0.45 | block | block | on | on (30/60s) |
+| `balanced` | 0.65 | sanitize | report | off | off |
+| `permissive` | 0.85 | flag | report | off | off |
 
 A mode seeds every default; any field you set in YAML or `for_mode(..., **kw)`
 layers on top.
@@ -34,6 +34,7 @@ layers on top.
 |---|---|
 | `mode` | preset posture (strict/balanced/permissive) |
 | `raise_on_block` | make `Shield.scan()` raise on a block (default false) |
+| `fail_closed_on_detector_error` | block if any detector raises; failures are always reported as content-free metadata (strict defaults true) |
 | `block_threshold` | aggregate score that forces a block regardless of policy |
 | `policy.{none..critical}` | severity → decision mapping |
 | `detectors.<name>.enabled` | per-detector toggle |

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/plugins.md

@@ -56,7 +56,9 @@ shield = Shield.for_mode(
 
 A plugin that fails to import is **skipped**, not fatal — one broken third-party
 plugin can never disable the shield. A plugin detector that *raises during a scan*
-is caught by the engine's fail-safe wrapper and drops only its own contribution.
+is caught by the engine's fail-safe wrapper, reported through bounded content-free
+error metadata and metrics, and forces a block when
+`fail_closed_on_detector_error` is enabled.
 
 ## Security note
 

{shadowshield-0.6.2 → shadowshield-0.6.3}/docs/security-model.md

@@ -67,8 +67,10 @@ identity to block on its own.
 
 ## Fail-safe defaults
 
-- **Detector errors fail safe.** A detector that raises drops only its own
-  contribution; the scan continues with the other layers.
+- **Detector errors are visible.** The other independent layers continue, while
+  bounded content-free metadata and metrics identify the failed detector. Strict
+  mode forces a block; balanced/permissive report the failure unless configured
+  to fail closed.
 - **`guard()` fails closed** (raises), **`filter()` fails soft** (returns the safe
   fallback). You choose per call site.
 - **Secrets are never echoed.** Secret matches are redacted from `Threat` records

{shadowshield-0.6.2 → shadowshield-0.6.3}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["hatchling>=1.21"]
+requires = ["hatchling==1.31.0"]
 build-backend = "hatchling.build"
 
 [project]
 name = "shadowshield"
-version = "0.6.2"
+version = "0.6.3"
 description = "Unified open-source security shield for agentic AI systems — inspired by Sentinel & ShadowClaw."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -43,7 +43,6 @@ dependencies = [
     "structlog>=24.1",
     "pyyaml>=6.0",
     "httpx>=0.27",
-    "tiktoken>=0.6",
 ]
 
 [project.optional-dependencies]
@@ -142,8 +141,17 @@ python_version = "3.10"
 strict = true
 warn_unused_ignores = true
 ignore_missing_imports = true
+# Allow targeted external-stub exclusions to respect ``follow_imports = skip``.
+follow_imports_for_stubs = true
 files = ["src/shadowshield"]
 
+[[tool.mypy.overrides]]
+# NumPy 2.5 publishes PEP 695 aliases that cannot be parsed while mypy checks
+# our Python 3.10 syntax target. The optional dependency boundary stays Any;
+# every ShadowShield source module is still checked explicitly and strictly.
+module = ["numpy", "numpy.*"]
+follow_imports = "skip"
+
 [tool.coverage.run]
 source = ["shadowshield"]
 branch = true

{shadowshield-0.6.2 → shadowshield-0.6.3}/src/shadowshield/__init__.py

@@ -71,7 +71,7 @@ from .plugins import PluginManager, ShadowShieldPlugin
 from .reporter import Reporter, attach_reporter
 from .responders import Responder, spotlight
 
-__version__ = "0.6.2"
+__version__ = "0.6.3"
 
 __all__ = [
     "__version__",

{shadowshield-0.6.2 → shadowshield-0.6.3}/src/shadowshield/_security.py

@@ -28,9 +28,13 @@ import hmac
 import json
 import os
 from collections.abc import Sequence
+from math import isfinite
+from time import monotonic
 from typing import Any
 
 MAX_HTTP_BODY_BYTES = 1_048_576
+MAX_HTTP_BODY_FRAMES = 8_192
+HTTP_BODY_READ_TIMEOUT_SECONDS = 15.0
 MAX_CONCURRENT_SCANS = 16
 
 
@@ -138,16 +142,39 @@ def is_loopback(host: str) -> bool:
 
 
 class RequestBodyLimitMiddleware:
-    """Buffer and reject oversized HTTP bodies before framework JSON parsing.
+    """Coalesce and reject unsafe HTTP bodies before framework JSON parsing.
 
-    These endpoints accept bounded JSON rather than streaming uploads. Buffering
-    at most ``max_bytes`` gives deterministic 413 behavior even for chunked
-    requests without a ``Content-Length`` header.
+    These endpoints accept bounded JSON rather than streaming uploads. The
+    aggregate buffer never exceeds ``max_bytes``, so many tiny ASGI frames cannot
+    amplify a legal body into unbounded Python object overhead. A frame ceiling
+    bounds receive-loop work, and one total deadline covers the complete body
+    rather than resetting for every chunk.
     """
 
-    def __init__(self, app: Any, max_bytes: int = MAX_HTTP_BODY_BYTES) -> None:
+    def __init__(
+        self,
+        app: Any,
+        max_bytes: int = MAX_HTTP_BODY_BYTES,
+        *,
+        max_frames: int = MAX_HTTP_BODY_FRAMES,
+        read_timeout_seconds: float = HTTP_BODY_READ_TIMEOUT_SECONDS,
+    ) -> None:
+        if isinstance(max_frames, bool) or not isinstance(max_frames, int) or max_frames <= 0:
+            raise ValueError("max_frames must be a positive integer")
+        if isinstance(read_timeout_seconds, bool) or not isinstance(
+            read_timeout_seconds, (int, float)
+        ):
+            raise ValueError("read_timeout_seconds must be a finite positive number")
+        try:
+            normalized_timeout = float(read_timeout_seconds)
+        except OverflowError:
+            raise ValueError("read_timeout_seconds must be a finite positive number") from None
+        if not isfinite(normalized_timeout) or normalized_timeout <= 0:
+            raise ValueError("read_timeout_seconds must be a finite positive number")
         self.app = app
         self.max_bytes = max_bytes
+        self.max_frames = max_frames
+        self.read_timeout_seconds = normalized_timeout
 
     async def __call__(self, scope: dict[str, Any], receive: Any, send: Any) -> None:
         if scope.get("type") != "http":
@@ -165,27 +192,53 @@ class RequestBodyLimitMiddleware:
                 await self._reject(send)
                 return
 
-        buffered: list[dict[str, Any]] = []
-        received = 0
+        body = bytearray()
+        frame_count = 0
+        body_complete = False
+        terminal_message: dict[str, Any] | None = None
+        deadline = monotonic() + self.read_timeout_seconds
         while True:
-            message = dict(await receive())
-            buffered.append(message)
+            remaining = deadline - monotonic()
+            if remaining <= 0:
+                await self._reject_timeout(send)
+                return
+            try:
+                message = dict(await asyncio.wait_for(receive(), timeout=remaining))
+            except asyncio.TimeoutError:
+                await self._reject_timeout(send)
+                return
             if message.get("type") != "http.request":
+                terminal_message = message
                 break
-            received += len(message.get("body", b""))
-            if received > self.max_bytes:
+
+            frame_count += 1
+            if frame_count > self.max_frames:
+                await self._reject_fragmented(send)
+                return
+            chunk = message.get("body", b"")
+            if len(body) + len(chunk) > self.max_bytes:
                 await self._reject(send)
                 return
+            body.extend(chunk)
             if not message.get("more_body", False):
+                body_complete = True
                 break
 
-        index = 0
+        aggregate_pending = bool(body) or body_complete
+        aggregate = bytes(body)
 
         async def replay_receive() -> dict[str, Any]:
-            nonlocal index
-            if index < len(buffered):
-                message = buffered[index]
-                index += 1
+            nonlocal aggregate_pending, terminal_message
+            if aggregate_pending:
+                aggregate_pending = False
+                return {
+                    "type": "http.request",
+                    "body": aggregate,
+                    "more_body": not body_complete,
+                }
+            if terminal_message is not None:
+                message = terminal_message
+                terminal_message = None
                 return message
             return {"type": "http.request", "body": b"", "more_body": False}
 
@@ -206,6 +259,36 @@ class RequestBodyLimitMiddleware:
         )
         await send({"type": "http.response.body", "body": body})
 
+    @staticmethod
+    async def _reject_fragmented(send: Any) -> None:
+        body = b'{"detail":"request body too fragmented"}'
+        await send(
+            {
+                "type": "http.response.start",
+                "status": 413,
+                "headers": [
+                    (b"content-type", b"application/json"),
+                    (b"content-length", str(len(body)).encode("ascii")),
+                ],
+            }
+        )
+        await send({"type": "http.response.body", "body": body})
+
+    @staticmethod
+    async def _reject_timeout(send: Any) -> None:
+        body = b'{"detail":"request body read timed out"}'
+        await send(
+            {
+                "type": "http.response.start",
+                "status": 408,
+                "headers": [
+                    (b"content-type", b"application/json"),
+                    (b"content-length", str(len(body)).encode("ascii")),
+                ],
+            }
+        )
+        await send({"type": "http.response.body", "body": body})
+
 
 class ConcurrencyLimitMiddleware:
     """Bound expensive scan/benchmark work while leaving health responsive."""
@@ -257,7 +340,13 @@ class ConcurrencyLimitMiddleware:
 
 
 class EarlyAuthMiddleware:
-    """Authenticate protected routes before reading or parsing their bodies."""
+    """Authenticate protected routes before reading or parsing their bodies.
+
+    Configured CORS middleware sits outside this boundary and handles valid
+    browser preflights. Arbitrary ``OPTIONS`` requests that reach this layer are
+    authenticated like every other protected request, so they cannot consume
+    body-read or scan-admission capacity anonymously.
+    """
 
     def __init__(
         self,
@@ -279,10 +368,8 @@ class EarlyAuthMiddleware:
         protected = path in self.protected_paths or any(
             path.startswith(prefix) for prefix in self.protected_prefixes
         )
-        method = str(scope.get("method", "GET")).upper()
         if (
             scope.get("type") == "http"
-            and method != "OPTIONS"
             and protected
             and self.deny_when_unconfigured
             and not self.api_keys
@@ -300,7 +387,7 @@ class EarlyAuthMiddleware:
             )
             await send({"type": "http.response.body", "body": body})
             return
-        if scope.get("type") == "http" and method != "OPTIONS" and protected and self.api_keys:
+        if scope.get("type") == "http" and protected and self.api_keys:
             headers = {
                 key.decode("latin-1").lower(): value.decode("latin-1")
                 for key, value in scope.get("headers", [])

{shadowshield-0.6.2 → shadowshield-0.6.3}/src/shadowshield/cli.py

@@ -111,11 +111,16 @@ def _cmd_benchmark(args: argparse.Namespace) -> int:
     else:
         examples = load_builtin()
 
-    shield = Shield(
-        ShieldConfig.for_mode(Mode(args.mode)),
-        use_transformer=args.transformer or False,
-    )
-    report = evaluate_shield(shield, examples)
+    benchmark_config = ShieldConfig.for_mode(Mode(args.mode))
+    # Audit output is unrelated to detector quality, distorts latency, and can
+    # corrupt the benchmark command's JSON stdout. Benchmark reports still
+    # retain bounded runtime-integrity counters.
+    benchmark_config.logging.enabled = False
+    shield = Shield(benchmark_config, use_transformer=args.transformer or False)
+    # Model/index initialization is deliberately outside timed scans. Any
+    # warmup, readiness, or per-scan detector failure makes the benchmark
+    # explicitly unreliable and produces a non-zero exit status.
+    report = evaluate_shield(shield, examples, warmup=True)
 
     if args.json:
         print(json.dumps(report.to_dict(), indent=2))
@@ -128,7 +133,7 @@ def _cmd_benchmark(args: argparse.Namespace) -> int:
         )
         print(f"dataset: {src}   mode: {args.mode}")
         print(report.format_text())
-    return 0
+    return 0 if report.reliable else 1
 
 
 def _cmd_serve(args: argparse.Namespace) -> int:

{shadowshield-0.6.2 → shadowshield-0.6.3}/src/shadowshield/config/default.yaml

@@ -14,6 +14,10 @@ mode: balanced
 # is non-throwing; use Shield.guard() for fail-closed ergonomics instead).
 raise_on_block: false
 
+# Surface detector failures as content-free result metadata. Set true to force
+# BLOCK after the other independent detectors finish (the strict preset does).
+fail_closed_on_detector_error: false
+
 # Aggregate score (0..1) at/above which a payload is forced to BLOCK regardless
 # of the per-severity policy below. Lower = more cautious.
 block_threshold: 0.65