Skip to content

v0.5.0

Choose a tag to compare

View all tags
@kenithphilip kenithphilip released this 21 Apr 20:06
· 18 commits to main since this release
v0.5.0
6c538a9

v0.5.0 - Sensitivity + destructive_guard redesign (breaking)

This release reworks the two Sondera-inspired primitives based on design feedback. The old stub APIs are gone; both primitives now match how a production proxy actually needs them to behave.

Sensitivity (breaking)

Trajectory-keyed high-water-mark. Multiple concurrent sessions each get their own watermark; the old single-context model could not support shared proxy deployments.

  • `HWMStore` protocol with `InMemoryHWMStore` default. Swap for Redis without touching the policy code.
  • `SensitivityClassifier` with pluggable rules. Defaults cover AWS/GCP/JWT/PEM/GitHub/Slack tokens, bearer headers, SSN, Aadhaar, credit cards, and explicit CONFIDENTIAL/INTERNAL markers.
  • `OutboundPolicy.check(tool_name, hwm)` is a pure function. The HWM is mutated only by `/v1/sensitivity/classify`, so evaluator reads are reproducible from audit data.
  • Per-tool `ToolClassification(outbound, max_sensitivity)` registry replaces the hardcoded glob list.
  • Four labels: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED.

Destructive guard (breaking)

Every pattern is a named hard deny. No severity axis, no score.

  • `DestructiveGuard.check(tool_name, args)` returns `GuardResult` with `allowed` and `matches[i]` carrying `pattern_id`, `category`, `description`, `arg_path`, `matched_text`.
  • Args flattener handles nested dicts/lists so audit logs report `headers.x-run` instead of a concatenated blob.
  • Expanded patterns: fork bomb, shutdown/halt/poweroff, find -delete at root, chmod -R 777 at root, git clean -fdx, kubectl delete --all --force, aws s3 rb --force, --force-with-lease explicitly allowed.
  • `fs.rm_rf_root` only blocks terminally-root targets. `rm -rf node_modules` stays legitimate.

Reference evaluator

New `agentmesh.evaluate.ToolCallEvaluator` shows the correct layer ordering:

  1. destructive_guard (explicit deny, highest audit signal)
  2. sensitivity / outbound (pure HWM read)
  3. your existing scanners (directive, intent, heuristic)
  4. irreversibility scorer (threshold-based, runs last)

Test `test_destructive_wins_over_sensitivity` verifies that when a call is both destructive AND a leak, the audit attributes it to the destructive pattern.

API changes

  • `POST /v1/sensitivity/classify` now takes `{content, trajectory_id?}`. Only mutates HWM when trajectory_id is present.
  • `GET /v1/sensitivity/status?trajectory_id=...` reports HWM for that trajectory.
  • `DELETE /v1/sensitivity/status?trajectory_id=...` resets a trajectory HWM.
  • `POST /v1/destructive/check` response shape: `{allowed, primary_reason, matches:[{pattern_id, category, description, arg_path, matched_text}]}`.
  • `destructive_guard_block_severity` config removed.
  • `outbound_tool_registry` config replaces `outbound_tool_patterns`.
  • `scan_and_label` and `reset_context` now take `session_id`.

Tests

  • AgentMesh: 177 passing (was 167)
  • Tessera: 83 passing for the two rewritten modules

Install

```bash
pip install -U agentmesh-mesh tessera-mesh
```

Assets 2
Loading