Function toolCallDetect

layers/exec-control.ts:270–318

(
  toolName: string,
  params: Record<string, unknown>
)

}

export function toolCallDetect(
  toolName: string,
  params: Record<string, unknown>
): DetectionResult | null {
  if (toolName !== "exec") return null;

  const command = params.command;
  if (typeof command !== "string") return null;

  // System destruction detection
  if (matchesAnyPattern(command, SYSTEM_DESTRUCTION_PATTERNS)) {
    return detectBlock(SYSTEM_DESTRUCTION_DETECTED);
  }

  // Privilege escalation detection
  if (matchesAnyPattern(command, PRIVILEGE_ESCALATION_PATTERNS)) {
    return detectBlock(PRIVILEGE_ESCALATION_DETECTED);
  }

  // Remote code execution detection
  if (matchesAnyPattern(command, REMOTE_CODE_EXECUTION_PATTERNS)) {
    return detectBlock(REMOTE_CODE_EXECUTION_DETECTED);
  }

  // Reverse shell detection
  if (matchesAnyPattern(command, REVERSE_SHELL_PATTERNS)) {
    return detectBlock(REVERSE_SHELL_DETECTED);
  }

  // Sensitive data access detection
  if (matchesAnyPattern(command, SENSITIVE_DATA_ACCESS_PATTERNS)) {
    // Medium severity: require explicit operator approval.
    return detectApprove(SENSITIVE_DATA_ACCESS_DETECTED, { timeoutMs: 300000, timeoutBehavior: "deny" });
  }

  // Resource exhaustion detection
  if (matchesAnyPattern(command, RESOURCE_EXHAUSTION_PATTERNS)) {
    // Potentially dangerous, but can be legitimate in limited contexts.
    // For demo policy: require approval instead of auto-deny.
    return detectApprove(RESOURCE_EXHAUSTION_DETECTED, { timeoutMs: 300000, timeoutBehavior: "deny" });
  }

  // Infinite loop detection
  if (matchesAnyPattern(command, INFINITE_LOOP_PATTERNS)) {
    return detectApprove(INFINITE_LOOP_DETECTED, { timeoutMs: 300000, timeoutBehavior: "deny" });
  }

  return null;
}