Class AgentArmor

Get the current pattern database version.

Pre-execution action gate (#57). Check a proposed agent action against the configured allowedActions allowlist and return a deterministic verdict.

This is the positive-allowlist complement to the deny-list detector pipeline: it admits only explicitly permitted actions and fails closed on everything else, independent of any detector confidence threshold. With no allowedActions configured, every action is denied.

Load a custom pattern database (e.g. from a remote update). Rebuilds all detectors with the new patterns.

Scan arbitrary content for agent traps (async). Prefers scanAsync on detectors that support it.

Scan agent output before it reaches the user (async).

Scan agent output before it reaches the user (sync).

Scan retrieved RAG chunks before prompt assembly (async).

Scan retrieved RAG chunks before prompt assembly (sync).

Scan a multi-turn conversation for agent traps (sync).

Each turn is scanned independently (turns), and the recent turns are also scanned for cross-turn split payloads (crossTurnThreats). Cross-turn semantic accumulation is reserved for the ML classifier (see session.accumulation) and is inactive here.

Scan a multi-turn conversation for agent traps (async). Prefers scanAsync on detectors that support it (e.g. the ML classifier).

Scan arbitrary content for agent traps (sync).

Create an AgentArmor instance with optional ML classifier. Use this when ML detection is needed (async model loading).

Fetch the latest patterns from a remote URL. URL is required — there is no default endpoint.

Create a regex-only AgentArmor instance. Convenience method that makes the sync-only intent explicit.