Coverage for src/local_deep_research/security/egress/__init__.py: 100%

1"""Egress policy subsystem. 

2 

3A self-contained guardrail that constrains where a research run's traffic, 

4LLM calls, embeddings, and URL fetches may go. See ``README.md`` in this 

5package for the full design, threat model, and the list of enforcement 

6points (PEPs) scattered across the codebase. 

7 

8This ``__init__`` re-exports the public API so callers can simply do 

9``from local_deep_research.security.egress import evaluate_url, EgressScope``. 

10The implementation lives in: 

11 - ``policy.py`` — the PDP (decisions) + context construction 

12 - ``audit_hook.py`` — the process-wide PEP-578 socket.connect net 

13""" 

14 

15from .policy import ( 

16 Decision, 

17 EngineClassification, 

18 EgressContext, 

19 EgressScope, 

20 MAX_DENIED_FETCHES_PER_RUN, 

21 PolicyDeniedError, 

22 context_from_snapshot, 

23 build_run_egress_context, 

24 classify_engine, 

25 evaluate_embeddings, 

26 evaluate_engine, 

27 evaluate_llm_endpoint, 

28 evaluate_retriever, 

29 evaluate_url, 

30 filter_candidates_by_egress, 

31 filter_engines_by_egress, 

32) 

33from .audit_hook import ( 

34 active_egress_context, 

35 clear_active_context, 

36 get_active_context, 

37 install_audit_hook, 

38 is_installed, 

39 set_active_context, 

40) 

41 

42__all__ = [ 

43 # policy / PDP 

44 "Decision", 

45 "EngineClassification", 

46 "EgressContext", 

47 "EgressScope", 

48 "MAX_DENIED_FETCHES_PER_RUN", 

49 "PolicyDeniedError", 

50 "context_from_snapshot", 

51 "build_run_egress_context", 

52 "classify_engine", 

53 "evaluate_embeddings", 

54 "evaluate_engine", 

55 "evaluate_llm_endpoint", 

56 "evaluate_retriever", 

57 "evaluate_url", 

58 "filter_candidates_by_egress", 

59 "filter_engines_by_egress", 

60 # audit hook / process-wide PEP 

61 "active_egress_context", 

62 "clear_active_context", 

63 "get_active_context", 

64 "install_audit_hook", 

65 "is_installed", 

66 "set_active_context", 

67]