Ë
    ÛJêjk  ã                  ó¼  — U d Z ddlmZ ddlZddlZddlmZmZ ddlm	Z	 ddl
mZ  ej                  e«      Z G d„ dee	«      Z G d	„ d
ee	«      Z G d„ dee	«      Z G d„ dee	«      Ze G d„ d«      «       Ze G d„ d«      «       Zg d¢Zded<    ej0                  dej2                  «      Zg d¢Zded<   g d¢Zded<   g d¢Zded<   dgZded<    G d„ d «      Zg d!¢Z y)"u?  AI Firewall â€” AI-specific threat detection and blocking.

The AI Firewall inspects the AI pipeline for threats that traditional
security controls cannot detect:

INPUT â†’ MODEL â†’ OUTPUT â†’ TOOL CALL â†’ TOOL RESULT â†’ MEMORY WRITE â†’ EXTERNAL EGRESS

Threats detected:
- prompt injection
- indirect prompt injection
- tool poisoning
- MCP poisoning
- malicious documents
- malicious URLs
- data exfiltration
- credential access
- excessive agency
- agent hijacking
- suspicious agent-to-agent communication
- memory poisoning
- unsafe tool calls
- suspicious outputs
é    )ÚannotationsN)Ú	dataclassÚfield)ÚEnum)ÚAnyc                  óH   — e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZy)Ú
ThreatTypezTypes of AI-specific threats.Úprompt_injectionÚindirect_prompt_injectionÚtool_poisoningÚmcp_poisoningÚmalicious_documentÚmalicious_urlÚdata_exfiltrationÚcredential_accessÚexcessive_agencyÚagent_hijackingÚsuspicious_agent_communicationÚmemory_poisoningÚunsafe_tool_callÚsuspicious_outputN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚPROMPT_INJECTIONÚINDIRECT_PROMPT_INJECTIONÚTOOL_POISONINGÚMCP_POISONINGÚMALICIOUS_DOCUMENTÚMALICIOUS_URLÚDATA_EXFILTRATIONÚCREDENTIAL_ACCESSÚEXCESSIVE_AGENCYÚAGENT_HIJACKINGÚSUSPICIOUS_AGENT_COMMUNICATIONÚMEMORY_POISONINGÚUNSAFE_TOOL_CALLÚSUSPICIOUS_OUTPUT© ó    úS/home/oem/CyberBrain26-unified/src/cyberbrain26/security_plane/firewall/__init__.pyr	   r	   $   sU   „ Ù'à)ÐØ ;ÐØ%€NØ#€MØ-ÐØ#€MØ+ÐØ+ÐØ)ÐØ'€OØ%EÐ"Ø)ÐØ)ÐØ+Ñr+   r	   c                  ó    — e Zd ZdZdZdZdZdZy)ÚThreatLevelzSeverity of a detected threat.ÚlowÚmediumÚhighÚcriticalN)r   r   r   r   ÚLOWÚMEDIUMÚHIGHÚCRITICALr*   r+   r,   r.   r.   7   s   „ Ù(à
€CØ€FØ€DØ�Hr+   r.   c                  ó,   — e Zd ZdZdZdZdZdZdZdZ	dZ
y	)
ÚPipelineStagez;Stages in the AI pipeline where the firewall inspects data.ÚinputÚmodelÚoutputÚ	tool_callÚtool_resultÚmemory_writeÚexternal_egressN)r   r   r   r   ÚINPUTÚMODELÚOUTPUTÚ	TOOL_CALLÚTOOL_RESULTÚMEMORY_WRITEÚEXTERNAL_EGRESSr*   r+   r,   r8   r8   @   s(   „ ÙEà€EØ€EØ€FØ€IØ€KØ!€LØ'�Or+   r8   c                  ó    — e Zd ZdZdZdZdZdZy)ÚFirewallDecisionz!Decision made by the AI Firewall.ÚallowÚblockÚflagÚ
quarantineN)r   r   r   r   ÚALLOWÚBLOCKÚFLAGÚ
QUARANTINEr*   r+   r,   rH   rH   L   s   „ Ù+à€EØ€EØ€DØ�Jr+   rH   c                  ó†   — e Zd ZU dZded<   ded<   ded<   ded	<   d
Zded<   ej                  Zded<    e	e
¬«      Zded<   y)ÚAIFirewallThreatz%A detected threat in the AI pipeline.r	   Úthreat_typer.   Úlevelr8   ÚstageÚstrÚdescriptionÚ ÚevidencerH   Úaction©Údefault_factoryúdict[str, Any]ÚmetadataN)r   r   r   r   Ú__annotations__rY   rH   rO   rZ   r   Údictr^   r*   r+   r,   rR   rR   U   sG   … á/àÓØÓØÓØÓØ€HˆcÓØ/×4Ñ4€FÐÓ4Ù$°TÔ:€HˆnÔ:r+   rR   c                  ó~   — e Zd ZU dZded<    ee¬«      Zded<   dZded	<   dZ	ded
<   dZ
ded<   dZded<   dZded<   y)ÚAIFirewallResultz$Result of an AI Firewall inspection.rH   Údecisionr[   úlist[AIFirewallThreat]ÚthreatsFÚboolÚblockedÚflaggedÚquarantinedNúPipelineStage | NonerU   ú
str | NoneÚ
input_text)r   r   r   r   r_   r   Úlistre   rg   rh   ri   rU   rl   r*   r+   r,   rb   rb   b   sN   … á.àÓÙ&+¸DÔ&A€GÐ#ÓAØ€GˆTÓØ€GˆTÓØ€K�ÓØ"&€EÐÓ&Ø!€J�
Ô!r+   rb   )zX(?i)(ignore\s+(all\s+)?previous|forget\s+your|you\s+are\s+now|system\s+message|act\s+as)zb(?i)(drop\s+the|bypass\s+the|override\s+the|circumvent\s+the)\s+(safety|restrictions|rules|policy)z8(?i)(new\s+instructions|newly\s+instructed|reprogrammed)zB(?i)(as\s+an?\s+AI|as\s+an?\s+assistant|as\s+a\s+language\s+model)z6(?i)(pretend\s+to|simulate|roleplay|play\s+the\s+role)zT(?i)(disregard|ignore|neglect)\s+(your|the)\s+(instructions|guidelines|rules|policy)zB(?i)(output\s+regardless|answer\s+regardless|respond\s+regardless)z8(?i)(jailbreak|root\s+access|full\s+access|unrestricted)z	list[str]ÚPROMPT_INJECTION_PATTERNSzhttps?://[^\s<>\"']+)zbit.lyÚtinyurlÚshorturlzt.coÚSUSPICIOUS_URL_INDICATORS)	z@(?i)(password|passwd|secret|api[_-]?key|token|auth)\s*[:=]\s*\S+z(?i)aws_(access|secret)z(?i)ghp_[a-f0-9]{36}z(?i)github_pat_[a-f0-9_]+z(?i)sk-[a-f0-9]{20,}úK(?i)-----BEGIN\s+(RSA\s+|EC\s+|DSA\s+|OPENSSH\s+|PGP\s+)?PRIVATE\s+KEY-----ú>(?i)eyJ[a-zA-Z0-9_-]{2,}\.eyJ[a-zA-Z0-9_-]{2,}\.[a-zA-Z0-9_-]+ú7(?i)(bearer\s+|authorization\s*:)\s*[a-zA-Z0-9._-]{20,}zL(?i)(mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp)://[^:]+:[^@]+@[^/]+ÚCREDENTIAL_PATTERNS)rr   rs   rt   zN(?i)(ghp_|github_pat_|sk-|AKIA|AGPA|AIDA|AROA|ANPA|AWSS|aws_secret|aws_access)zD(?i)(mysql|postgres(?:ql)?|mongodb|redis)://[^/\s]+:[^/\s@]+@[^/\s]+ÚSECRET_LEAK_PATTERNSzG(?i)(agent\s*[-:]\s*|to\s+agent|from\s+agent)\s*(execute|run|do|action)ÚSUSPICIOUS_AGENT_COMM_PATTERNSc                  óJ  — e Zd ZdZd d!d„Z	 d"	 	 	 	 	 d#d„Z	 d"	 	 	 	 	 d#d„Z	 	 d$	 	 	 	 	 	 	 d%d„Z	 d"	 	 	 	 	 d&d„Z	 d"	 	 	 	 	 d'd„Z		 d$	 	 	 	 	 	 	 d(d	„Z
	 d"	 	 	 	 	 	 	 d)d
„Z	 	 d$	 	 	 	 	 	 	 d*d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d,d„Z	 	 	 	 	 	 	 	 d-d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d.d„Z	 	 	 	 	 	 d/d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Z	 	 	 	 	 	 d+d„Zed0d„«       Zed1d„«       Zd2d„Zd2d„Z d3d„Z!y)4Ú
AIFirewallap  AI Firewall for detecting AI-specific threats.

    Inspects data at each pipeline stage and detects threats
    like prompt injection, data exfiltration, credential access, etc.

    Usage:
        firewall = AIFirewall()
        result = firewall.inspect_input(user_text)
        if result.blocked:
            raise SecurityError(result.threats[0].description)
    c                ó<   — || _         g | _        d| _        d| _        y )Nr   )Ústrict_modeÚ_threat_logÚ_blocked_countÚ_flagged_count)Úselfr{   s     r,   Ú__init__zAIFirewall.__init__¨   s"   € Ø&ˆÔØ35ˆÔØ#$ˆÔØ#$ˆÕr+   Nc                óÂ  — g }|j                  | j                  |t        j                  «      «       |j                  | j	                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       | j                  |t        j                  |¬«      S )zªInspect user input at the INPUT stage.

        Checks for prompt injection, indirect prompt injection,
        malicious URLs, and credential exposure in input.
        ©re   rU   rl   )ÚextendÚ_check_prompt_injectionr8   r@   Ú _check_indirect_prompt_injectionÚ_check_malicious_urlsÚ_check_credential_accessÚ_build_result©r   ÚtextÚcontextre   s       r,   Úinspect_inputzAIFirewall.inspect_input®   s¬   € ð +-ˆà�‰�t×3Ñ3°D¼-×:MÑ:MÓNÔOØ�‰�t×<Ñ<¸TÄ=×CVÑCVÓWÔXØ�‰�t×1Ñ1°$¼×8KÑ8KÓLÔMØ�‰�t×4Ñ4°T¼=×;NÑ;NÓOÔPà×!Ñ!ØÜ×%Ñ%Øð "ó 
ð 	
r+   c                óÂ  — g }|j                  | j                  |t        j                  «      «       |j                  | j	                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       | j                  |t        j                  |¬«      S )z•Inspect model output at the OUTPUT stage.

        Checks for suspicious outputs that may indicate
        model compromise or data leakage.
        r‚   )rƒ   Ú_check_suspicious_outputr8   rB   r‡   Ú_check_secret_leakÚ_check_data_exfiltrationrˆ   r‰   s       r,   Úinspect_model_outputzAIFirewall.inspect_model_outputÃ   s¬   € ð +-ˆà�‰�t×4Ñ4°T¼=×;OÑ;OÓPÔQØ�‰�t×4Ñ4°T¼=×;OÑ;OÓPÔQØ�‰�t×.Ñ.¨t´]×5IÑ5IÓJÔKØ�‰�t×4Ñ4°T¼=×;OÑ;OÓPÔQà×!Ñ!ØÜ×&Ñ&Øð "ó 
ð 	
r+   c                óà  — g }t        |xs i «      }|j                  | j                  |t        j                  «      «       |j                  | j                  ||t        j                  «      «       |j                  | j                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       | j                  |t        j                  ¬«      S )z˜Inspect a tool call at the TOOL_CALL stage.

        Checks for unsafe tool calls, tool poisoning,
        and credential access in parameters.
        )re   rU   )	rV   rƒ   Ú_check_unsafe_tool_callr8   rC   Ú_check_tool_poisoningr‡   r�   rˆ   )r   Ú	tool_nameÚ
parametersr‹   re   Ú	param_strs         r,   Úinspect_tool_callzAIFirewall.inspect_tool_callØ   sº   € ð +-ˆÜ˜
Ò( bÓ)ˆ	à�‰�t×3Ñ3°I¼}×?VÑ?VÓWÔXØ�‰�t×1Ñ1°)¸YÌ×H_ÑH_Ó`ÔaØ�‰�t×4Ñ4°YÄ×@WÑ@WÓXÔYØ�‰�t×4Ñ4°YÄ×@WÑ@WÓXÔYà×!Ñ!ØÜ×)Ñ)ð "ó 
ð 	
r+   c                ód  — g }|j                  | j                  |t        j                  «      «       |j                  | j	                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       | j                  |t        j                  |¬«      S )zpInspect a tool result at the TOOL_RESULT stage.

        Checks for suspicious content in tool results.
        r‚   )rƒ   rŽ   r8   rD   r‡   r�   rˆ   )r   Úresultr‹   re   s       r,   Úinspect_tool_resultzAIFirewall.inspect_tool_resultð   s�   € ð +-ˆà�‰�t×4Ñ4°V¼]×=VÑ=VÓWÔXØ�‰�t×4Ñ4°V¼]×=VÑ=VÓWÔXØ�‰�t×.Ñ.¨v´}×7PÑ7PÓQÔRà×!Ñ!ØÜ×+Ñ+Øð "ó 
ð 	
r+   c                ó  — g }|j                  | j                  |t        j                  «      «       |j                  | j	                  |t        j                  «      «       | j                  |t        j                  |¬«      S )zxInspect a memory write at the MEMORY_WRITE stage.

        Checks for memory poisoning and credential exposure.
        r‚   )rƒ   Ú_check_memory_poisoningr8   rE   r‡   rˆ   )r   Úcontentr‹   re   s       r,   Úinspect_memory_writezAIFirewall.inspect_memory_write  sn   € ð +-ˆà�‰�t×3Ñ3°G¼]×=WÑ=WÓXÔYØ�‰�t×4Ñ4°W¼m×>XÑ>XÓYÔZà×!Ñ!ØÜ×,Ñ,Øð "ó 
ð 	
r+   c                óÆ  — g }|j                  | j                  |t        j                  «      «       |j                  | j	                  |t        j                  «      «       |j                  | j                  |t        j                  «      «       |r/|j                  | j                  |t        j                  «      «       | j                  |t        j                  |¬«      S )z®Inspect data leaving the system at the EXTERNAL_EGRESS stage.

        Checks for data exfiltration, credential exposure,
        and suspicious egress destinations.
        r‚   )rƒ   r�   r8   rF   r‡   r†   Ú_check_suspicious_destinationrˆ   )r   ÚdataÚdestinationr‹   re   s        r,   Úinspect_external_egressz"AIFirewall.inspect_external_egress  s¯   € ð +-ˆà�‰�t×4Ñ4°T¼=×;XÑ;XÓYÔZØ�‰�t×4Ñ4°T¼=×;XÑ;XÓYÔZØ�‰�t×1Ñ1°$¼×8UÑ8UÓVÔWáØ�N‰N˜4×=Ñ=¸kÌ=×KhÑKhÓiÔjà×!Ñ!ØÜ×/Ñ/Øð "ó 
ð 	
r+   c                ó  — |t         j                  k(  r| j                  ||«      S |t         j                  k(  s|t         j                  k(  r| j                  ||«      S |t         j                  k(  r| j                  di |«      S |t         j                  k(  r| j                  ||«      S |t         j                  k(  r| j                  ||«      S |t         j                  k(  r| j                  ||¬«      S t        t        j                   ¬«      S )zsGeneric inspection at any pipeline stage.

        Dispatches to the appropriate stage-specific inspector.
        Úunknown)r‹   )rc   )r8   r@   rŒ   rA   rB   r‘   rC   r˜   rD   r›   rE   rŸ   rF   r¤   rb   rH   rM   )r   rU   r¢   r‹   s       r,   ÚinspectzAIFirewall.inspect,  sî   € ð ”M×'Ñ'Ò'Ø×%Ñ% d¨GÓ4Ð4Ø”m×)Ñ)Ò)¨U´m×6JÑ6JÒ-JØ×,Ñ,¨T°7Ó;Ð;Ø”m×-Ñ-Ò-Ø×)Ñ)¨)°R¸ÓAÐAØ”m×/Ñ/Ò/Ø×+Ñ+¨D°'Ó:Ð:Ø”m×0Ñ0Ò0Ø×,Ñ,¨T°7Ó;Ð;Ø”m×3Ñ3Ò3Ø×/Ñ/°¸gÐ/ÓFÐFä#Ô-=×-CÑ-CÔDÐDr+   c           	     óþ  — |st        t        j                  ||¬«      S t        d„ |D «       «      }t        d„ |D «       «      }|rt        j                  }nR|s| j
                  rt        j                  }n3t        d„ |D «       «      rt        j                  }nt        j                  }|D ]x  }| j                  j                  |«       |j                  t        j                  k(  s|t        j                  k(  r| xj                  dz  c_        Œd| xj                  dz  c_        Œz t        |||t        j                  k(  |t        j                  k(  xs |t        j                  k(  |t        j                  k(  ||¬«      S )z.Build a firewall result from detected threats.)rc   rU   rl   c              3  óV   K  — | ]!  }|j                   t        j                  k(  –— Œ# y ­w©N)rT   r.   r6   ©Ú.0Úts     r,   ú	<genexpr>z+AIFirewall._build_result.<locals>.<genexpr>S  s   è ø€ ÒL¸q˜1Ÿ7™7¤k×&:Ñ&:Õ:ÑLùó   ‚')c              3  óV   K  — | ]!  }|j                   t        j                  k(  –— Œ# y ­wrª   )rT   r.   r5   r«   s     r,   r®   z+AIFirewall._build_result.<locals>.<genexpr>T  s   è ø€ ÒD°q�q—w‘w¤+×"2Ñ"2Õ2ÑDùr¯   c              3  óV   K  — | ]!  }|j                   t        j                  k(  –— Œ# y ­wrª   )rT   r.   r4   r«   s     r,   r®   z+AIFirewall._build_result.<locals>.<genexpr>Z  s   è ø€ Ò@°1�—‘œK×.Ñ.Õ.Ñ@ùr¯   é   )rc   re   rg   rh   ri   rU   rl   )rb   rH   rM   ÚanyrN   r{   rP   rO   r|   ÚappendrZ   r}   r~   )r   re   rU   rl   Úhas_criticalÚhas_highrc   Úthreats           r,   rˆ   zAIFirewall._build_resultE  sL  € ñ Ü#Ü)×/Ñ/ØØ%ôð ô ÑLÀGÔLÓLˆÜÑD¸GÔDÓDˆáÜ'×-Ñ-‰HÙ˜×)Ò)Ü'×2Ñ2‰HÜÑ@¸Ô@Ô@Ü'×,Ñ,‰Hä'×,Ñ,ˆHàò 	)ˆFØ×Ñ×#Ñ# FÔ+Ø�}‰}Ô 0× 6Ñ 6Ò6¸(ÔFV×F\ÑF\Ò:\Ø×#Ò# qÑ(Ö#à×#Ò# qÑ(Ö#ð	)ô  ØØØÔ 0× 6Ñ 6Ñ6ØÔ 0× 5Ñ 5Ñ5Ò`¸ÔEU×E`ÑE`Ñ9`Ø Ô$4×$?Ñ$?Ñ?ØØ!ô
ð 	
r+   c                ód  — g }t         D ]¤  }t        j                  ||«      }|sŒ|j                  t	        t
        j                  t        j                  |d|j                  «       dd › d�|j                  «       | j                  rt        j                  nt        j                  ¬«      «       Œ¦ |S )z+Check for direct prompt injection attempts.z$Prompt injection detected: pattern 'NéP   ú'©rS   rT   rU   rW   rY   rZ   )rn   ÚreÚsearchr´   rR   r	   r   r.   r5   Úgroupr{   rH   rN   rO   ©r   rŠ   rU   re   ÚpatternÚmatchs         r,   r„   z"AIFirewall._check_prompt_injectionp  sœ   € ð +-ˆÜ0ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× ;Ñ ;Ü%×*Ñ*ØØ"FÀuÇ{Á{Ã}ÐUXÐVXÐGYÐFZÐZ[Ð \Ø"Ÿ[™[›]Ø59×5EÒ5EÔ+×1Ò1ÔK[×K`ÑK`ô õ ð
	ð ˆr+   c                ó  — g }g d¢}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z:Check for indirect prompt injection (hidden instructions).)z;(?i)(<!--\s*instructions|\[instructions\]|\{instructions\})zB(?i)(hidden\s+instruction|embedded\s+instruction|invisible\s+text)z0(?i)(base64|encoded\s+instruction|decode\s+this)z-Indirect prompt injection detected in contentr»   )r¼   r½   r´   rR   r	   r   r.   r5   r¾   rH   rO   )r   rŠ   rU   re   Úinjection_indicatorsrÀ   rÁ   s          r,   r…   z+AIFirewall._check_indirect_prompt_injection‚  sz   € ð +-ˆò 
Ðð
 ,ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× DÑ DÜ%×*Ñ*ØØ OØ"Ÿ[™[›]Ü+×0Ñ0ô õ ð
	ð ˆr+   c                ó   — g }t         j                  |«      }|D ]q  }t        D ]f  }||j                  «       v sŒ|j	                  t        t        j                  t        j                  |d|dd › �|t        j                  ¬«      «        Œq Œs |S )z'Check for malicious or suspicious URLs.zSuspicious URL detected: Néd   r»   )ÚURL_PATTERNÚfindallrq   Úlowerr´   rR   r	   r!   r.   r4   rH   rO   )r   rŠ   rU   re   ÚurlsÚurlÚ	indicators          r,   r†   z AIFirewall._check_malicious_urls™  s–   € ð +-ˆÜ×"Ñ" 4Ó(ˆØò 	ˆCÜ6ò 
�	Ø §	¡	£Ò+Ø—N‘NÔ#3Ü$.×$<Ñ$<Ü)×0Ñ0Ø#Ø&?ÀÀDÀSÀ	¸{Ð$KØ!$Ü/×4Ñ4ô$ô ñ ñ
ð	ð ˆr+   c                ó  — g }t         D ]v  }t        j                  ||«      }|sŒ|j                  t	        t
        j                  t        j                  |d|j                  «       dd t        j                  ¬«      «       Œx |S )z%Check for credential access attempts.z"Credential access attempt detectedNrÅ   r»   )ru   r¼   r½   r´   rR   r	   r#   r.   r6   r¾   rH   rN   r¿   s         r,   r‡   z#AIFirewall._check_credential_access­  sw   € ð +-ˆÜ*ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× <Ñ <Ü%×.Ñ.ØØ DØ"Ÿ[™[›]¨4¨CÐ0Ü+×1Ñ1ô õ ð
	ð ˆr+   c                ó  — g }t         D ]v  }t        j                  ||«      }|sŒ|j                  t	        t
        j                  t        j                  |d|j                  «       dd t        j                  ¬«      «       Œx |S )z.Check for secret/credential leakage in output.z,Secret/credential leakage detected in outputNrÅ   r»   )rv   r¼   r½   r´   rR   r	   r#   r.   r6   r¾   rH   rN   r¿   s         r,   r�   zAIFirewall._check_secret_leak¿  sw   € ð +-ˆÜ+ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× <Ñ <Ü%×.Ñ.ØØ NØ"Ÿ[™[›]¨4¨CÐ0Ü+×1Ñ1ô õ ð
	ð ˆr+   c                ó  — g }g d¢}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z'Check for data exfiltration indicators.)z>(?i)(exfiltrate|exfil|data\s+dump|bulk\s+export|mass\s+export)zE(?i)(download\s+(all|complete|full|entire)\s+(database|data|records))zP(?i)(send\s+(all|complete|full)\s+(data|records|files)\s+(outside|external|off))z"Data exfiltration attempt detectedr»   )r¼   r½   r´   rR   r	   r"   r.   r6   r¾   rH   rN   )r   rŠ   rU   re   Úexfil_indicatorsrÀ   rÁ   s          r,   r�   z#AIFirewall._check_data_exfiltrationÑ  sz   € ð +-ˆò
Ðð
 (ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× <Ñ <Ü%×.Ñ.ØØ DØ"Ÿ[™[›]Ü+×1Ñ1ô õ ð
	ð ˆr+   c           
     óÐ   — g }h d£}|j                  «       |v rM|j                  t        t        j                  t
        j                  |d|› �|t        j                  ¬«      «       |S )zCheck for unsafe tool calls.>   úrm_-rfÚshutdownÚ
delete_allÚformat_diskÚdrop_databasezUnsafe tool call: r»   )	rÈ   r´   rR   r	   r(   r.   r5   rH   rN   )r   r•   rU   re   Úunsafe_toolss        r,   r“   z"AIFirewall._check_unsafe_tool_callè  sc   € ð +-ˆÚ[ˆØ�?‰?Ó Ñ,Ø�N‰NÔ+Ü&×7Ñ7Ü!×&Ñ&ØØ0°°Ð<Ø"Ü'×-Ñ-ôô ð ˆr+   c                ó  — g }|s|S ddg}|D ]v  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|› �|j                  «       t        j                  ¬«      «       Œx |S )z0Check for tool poisoning attempts in parameters.z3(?i)(inject|poison|override|tamper|modify\s+system)z=(?i)(system\s+prompt|hidden\s+instruction|meta\s+instruction)zTool poisoning detected in r»   )r¼   r½   r´   rR   r	   r   r.   r5   r¾   rH   rN   )r   r•   r–   rU   re   Úpoisoning_indicatorsrÀ   rÁ   s           r,   r”   z AIFirewall._check_tool_poisoningù  s�   € ð +-ˆÙØˆNàBØLð 
Ðð ,ò 
	ˆGÜ—I‘I˜g zÓ2ˆEÚØ—‘Ô/Ü *× 9Ñ 9Ü%×*Ñ*ØØ"=¸i¸[Ð IØ"Ÿ[™[›]Ü+×1Ñ1ô õ ð
	ð ˆr+   c                ó  — g }ddg}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z!Check for MCP poisoning attempts.z,(?i)(mcp\s+inject|mcp\s+poison|mcp\s+tamper)z;(?i)(server\s+override|tool\s+override|resource\s+override)zMCP poisoning detectedr»   )r¼   r½   r´   rR   r	   r   r.   r5   r¾   rH   rN   )r   rŠ   rU   re   Úmcp_indicatorsrÀ   rÁ   s          r,   Ú_check_mcp_poisoningzAIFirewall._check_mcp_poisoning  s   € ð +-ˆà;ØJð
ˆð &ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× 8Ñ 8Ü%×*Ñ*ØØ 8Ø"Ÿ[™[›]Ü+×1Ñ1ô õ ð
	ð ˆr+   c                ó  — g }g d¢}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z#Check for suspicious model outputs.)zA(?i)(I\s+am\s+(now|currently)\s+(unrestricted|jailbroken|hacked))z:(?i)(my\s+instructions\s+have\s+changed|new\s+rules\s+are)z9(?i)(ignore\s+all\s+previous|disregard\s+your\s+training)z Suspicious model output detectedr»   )r¼   r½   r´   rR   r	   r)   r.   r5   r¾   rH   rO   )r   rŠ   rU   re   Úsuspicious_patternsrÀ   rÁ   s          r,   rŽ   z#AIFirewall._check_suspicious_output'  sz   € ð +-ˆò
Ðð
 +ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× <Ñ <Ü%×*Ñ*ØØ BØ"Ÿ[™[›]Ü+×0Ñ0ô õ ð
	ð ˆr+   c                ó
  — g }|s|S g d¢}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z$Check for memory poisoning attempts.)z=(?i)(inject\s+into\s+memory|poison\s+memory|corrupt\s+memory)z=(?i)(override\s+memory|modify\s+stored\s+data|alter\s+memory)z<(?i)(malicious\s+instruction|hidden\s+command)\s+in\s+memoryz!Memory poisoning attempt detectedr»   )r¼   r½   r´   rR   r	   r'   r.   r5   r¾   rH   rN   )r   rž   rU   re   Úpoison_indicatorsrÀ   rÁ   s          r,   r�   z"AIFirewall._check_memory_poisoning>  s‚   € ð +-ˆÙØˆNò
Ðð
 )ò 
	ˆGÜ—I‘I˜g wÓ/ˆEÚØ—‘Ô/Ü *× ;Ñ ;Ü%×*Ñ*ØØ CØ"Ÿ[™[›]Ü+×1Ñ1ô õ ð
	ð ˆr+   c           
     ó´   — g }g d¢}||v rM|j                  t        t        j                  t        j
                  |d|› �|t        j                  ¬«      «       |S )z+Check for suspicious external destinations.)z	127.0.0.1Ú	localhostz0.0.0.0zSuspicious egress destination: r»   )r´   rR   r	   r&   r.   r4   rH   rO   )r   r£   rU   re   Úsuspicious_destinationss        r,   r¡   z(AIFirewall._check_suspicious_destinationW  s^   € ð +-ˆÚ"GÐØÐ1Ñ1Ø�N‰NÔ+Ü&×EÑEÜ!×(Ñ(ØØ=¸k¸]ÐKØ$Ü'×,Ñ,ôô ð ˆr+   c                ó
  — g }ddg}|D ]w  }t        j                  ||xs d«      }|sŒ |j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œy |S )z$Check for excessive agency requests.zN(?i)(act\s+autonomously|full\s+autonomy|unrestricted\s+agency|self\s+directed)zC(?i)(never\s+stop|always\s+continue|infinite\s+loop|never\s+ending)rX   z!Excessive agency request detectedr»   )r¼   r½   r´   rR   r	   r$   r.   r4   r¾   rH   rO   )r   rŠ   rU   re   Úagency_patternsrÀ   rÁ   s          r,   Ú_check_excessive_agencyz"AIFirewall._check_excessive_agencyh  sƒ   € ð +-ˆà]ØRð
ˆð 'ò 
	ˆGÜ—I‘I˜g t¢z¨rÓ2ˆEÚØ—‘Ô/Ü *× ;Ñ ;Ü%×,Ñ,ØØ CØ"Ÿ[™[›]Ü+×0Ñ0ô õ ð
	ð ˆr+   c                ó
  — g }ddg}|D ]w  }t        j                  ||xs d«      }|sŒ |j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œy |S )z#Check for agent hijacking attempts.z;(?i)(takeover|hijack\s+agent|control\s+agent|steer\s+agent)z1(?i)(force\s+agent|compel\s+agent|coerce\s+agent)rX   z Agent hijacking attempt detectedr»   )r¼   r½   r´   rR   r	   r%   r.   r6   r¾   rH   rN   )r   rŠ   rU   re   Úhijack_patternsrÀ   rÁ   s          r,   Ú_check_agent_hijackingz!AIFirewall._check_agent_hijacking~  sƒ   € ð +-ˆàJØ@ð
ˆð 'ò 
	ˆGÜ—I‘I˜g t¢z¨rÓ2ˆEÚØ—‘Ô/Ü *× :Ñ :Ü%×.Ñ.ØØ BØ"Ÿ[™[›]Ü+×1Ñ1ô õ ð
	ð ˆr+   c                ó
  — g }|s|S ddg}|D ]s  }t        j                  ||«      }|sŒ|j                  t        t        j
                  t        j                  |d|j                  «       t        j                  ¬«      «       Œu |S )z2Check for suspicious agent-to-agent communication.z5(?i)(agent\s+to\s+agent|a2a\s+(request|message|call))z2(?i)(inter\s+agent|between\s+agents|cross\s+agent)z0Suspicious agent-to-agent communication detectedr»   )r¼   r½   r´   rR   r	   r&   r.   r4   r¾   rH   rO   )r   rŠ   rU   re   Úcomm_patternsrÀ   rÁ   s          r,   Ú%_check_suspicious_agent_communicationz0AIFirewall._check_suspicious_agent_communication”  s‡   € ð +-ˆÙØˆNàDØAð
ˆð %ò 
	ˆGÜ—I‘I˜g tÓ,ˆEÚØ—‘Ô/Ü *× IÑ IÜ%×,Ñ,ØØ RØ"Ÿ[™[›]Ü+×0Ñ0ô õ ð
	ð ˆr+   c                ó,   — t        | j                  «      S )z'Return the log of all detected threats.)rm   r|   ©r   s    r,   Ú
threat_logzAIFirewall.threat_log¬  s   € ô �D×$Ñ$Ó%Ð%r+   c                ó˜   — t        | j                  «      | j                  | j                  | j	                  «       | j                  «       dœS )zReturn firewall statistics.)Útotal_threatsrg   rh   Úby_typeÚby_level)Úlenr|   r}   r~   Ú_count_by_typeÚ_count_by_levelrí   s    r,   ÚstatszAIFirewall.stats±  sF   € ô ! ×!1Ñ!1Ó2Ø×*Ñ*Ø×*Ñ*Ø×*Ñ*Ó,Ø×,Ñ,Ó.ñ
ð 	
r+   c                ó¬   — i }| j                   D ]B  }|j                  |j                  j                  d«      dz   ||j                  j                  <   ŒD |S ©Nr   r²   )r|   ÚgetrS   Úvalue©r   Úcountsr·   s      r,   rô   zAIFirewall._count_by_type¼  sW   € Ø!#ˆØ×&Ñ&ò 	[ˆFØ/5¯z©z¸&×:LÑ:L×:RÑ:RÐTUÓ/VÐYZÑ/ZˆF�6×%Ñ%×+Ñ+Ò,ð	[àˆr+   c                ó¬   — i }| j                   D ]B  }|j                  |j                  j                  d«      dz   ||j                  j                  <   ŒD |S rø   )r|   rù   rT   rú   rû   s      r,   rõ   zAIFirewall._count_by_levelÂ  sQ   € Ø!#ˆØ×&Ñ&ò 	OˆFØ)/¯©°F·L±L×4FÑ4FÈÓ)JÈQÑ)NˆF�6—<‘<×%Ñ%Ò&ð	Oàˆr+   c                óT   — | j                   j                  «        d| _        d| _        y)zClear the threat log.r   N)r|   Úclearr}   r~   rí   s    r,   Ú	clear_logzAIFirewall.clear_logÈ  s$   € à×Ñ×ÑÔ ØˆÔØˆÕr+   )F)r{   rf   ÚreturnÚNonerª   )rŠ   rV   r‹   údict[str, Any] | Noner  rb   )NN)r•   rV   r–   r  r‹   r  r  rb   )rš   rV   r‹   r  r  rb   )rž   rV   r‹   r  r  rb   )r¢   rV   r£   rk   r‹   r  r  rb   )rU   r8   r¢   rV   r‹   r  r  rb   )re   rd   rU   rj   rl   rk   r  rb   )rŠ   rV   rU   r8   r  rd   )r•   rV   rU   r8   r  rd   )r•   rV   r–   rV   rU   r8   r  rd   )rž   rV   rU   r8   r  rd   )r£   rV   rU   r8   r  rd   )r  rd   )r  r]   )r  zdict[str, int])r  r  )"r   r   r   r   r€   rŒ   r‘   r˜   r›   rŸ   r¤   r§   rˆ   r„   r…   r†   r‡   r�   r�   r“   r”   rÛ   rŽ   r�   r¡   rå   rè   rë   Úpropertyrî   rö   rô   rõ   r   r*   r+   r,   ry   ry   ›   sP  „ ñ
ô%ð ;?ð
Øð
Ø"7ð
à	ó
ð, ;?ð
Øð
Ø"7ð
à	ó
ð0 -1Ø)-ð	
àð
ð *ð
ð 'ð	
ð
 
ó
ð2 =Að
Øð
Ø$9ð
à	ó
ð( >Bð
Øð
Ø%:ð
à	ó
ð& [_ð
Øð
Ø&0ð
ØBWð
à	ó
ð6 *.ð	EàðEð ðEð 'ð	Eð
 
óEð8 '+Ø!%ð	)
à'ð)
ð $ð)
ð ð	)
ð
 
ó)
ðVØðØ -ðà	óð$ØðØ -ðà	óð.ØðØ -ðà	óð(ØðØ -ðà	óð$ØðØ -ðà	óð$ØðØ -ðà	óð.ØðØ%2ðà	óð"ØðØ*-ðØ6Cðà	óð0ØðØ -ðà	óð,ØðØ -ðà	óð.ØðØ#0ðà	óð2ØðØ'4ðà	óð"ØðØ -ðà	óð,ØðØ -ðà	óð,ØðØ -ðà	óð0 ò&ó ð&ð ò
ó ð
óóô r+   ry   )ry   rb   rR   rH   r8   r.   r	   )!r   Ú
__future__r   Úloggingr¼   Údataclassesr   r   Úenumr   Útypingr   Ú	getLoggerr   ÚloggerrV   r	   r.   r8   rH   rR   rb   rn   r_   ÚcompileÚ
IGNORECASErÆ   rq   ru   rv   rw   ry   Ú__all__r*   r+   r,   ú<module>r     s  ðòõ0 #ã Û 	ß (Ý Ý à	ˆ×	Ñ	˜8Ó	$€ô,��dô ,ô&�#�tô ô	(�C˜ô 	(ô�s˜Dô ð ÷	;ð 	;ó ð	;ð ÷	"ð 	"ó ð	"ò	(Ð ˜9ó 	ð ˆb�j‰jØ˜RŸ]™]ó€ò(Ð ˜9ó ò
"Ð �Yó 
ò#Ð �ió ð Oð-Ð  	ó ÷
q ñ q òh�r+   