Coverage for src/local_deep_research/security/egress/__init__.py: 100%

1"""Egress policy subsystem. 

2 

3A self-contained guardrail that constrains where a research run's traffic, 

4LLM calls, embeddings, and URL fetches may go. See ``README.md`` in this 

5package for the full design, threat model, and the list of enforcement 

6points (PEPs) scattered across the codebase. 

7 

8This ``__init__`` re-exports the public API so callers can simply do 

9``from local_deep_research.security.egress import evaluate_url, EgressScope``. 

10The implementation lives in: 

11 - ``policy.py`` — the PDP (decisions) + context construction 

12 - ``audit_hook.py`` — the process-wide PEP-578 socket.connect net 

13""" 

14 

15from .policy import ( 

16 Decision, 

17 EgressContext, 

18 EgressScope, 

19 MAX_DENIED_FETCHES_PER_RUN, 

20 PolicyDeniedError, 

21 context_from_snapshot, 

22 evaluate_embeddings, 

23 evaluate_engine, 

24 evaluate_llm_endpoint, 

25 evaluate_retriever, 

26 evaluate_url, 

27 filter_candidates_by_egress, 

28 filter_engines_by_egress, 

29) 

30from .audit_hook import ( 

31 active_egress_context, 

32 clear_active_context, 

33 get_active_context, 

34 install_audit_hook, 

35 is_installed, 

36 set_active_context, 

37) 

38 

39__all__ = [ 

40 # policy / PDP 

41 "Decision", 

42 "EgressContext", 

43 "EgressScope", 

44 "MAX_DENIED_FETCHES_PER_RUN", 

45 "PolicyDeniedError", 

46 "context_from_snapshot", 

47 "evaluate_embeddings", 

48 "evaluate_engine", 

49 "evaluate_llm_endpoint", 

50 "evaluate_retriever", 

51 "evaluate_url", 

52 "filter_candidates_by_egress", 

53 "filter_engines_by_egress", 

54 # audit hook / process-wide PEP 

55 "active_egress_context", 

56 "clear_active_context", 

57 "get_active_context", 

58 "install_audit_hook", 

59 "is_installed", 

60 "set_active_context", 

61]