From a68db10cc39d1c9fe2d1f9aee11d30ce8722c15b Mon Sep 17 00:00:00 2001 From: divyanshujethi Date: Mon, 9 Nov 2026 02:17:43 +0530 Subject: [PATCH] feat: add interactive Intent vs. Effect dry-run sandbox visualizer to /dbshield --- src/app/dbshield/page.tsx | 441 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 422 insertions(+), 19 deletions(-) diff --git a/src/app/dbshield/page.tsx b/src/app/dbshield/page.tsx index 6ef0b45..eeff54a 100644 --- a/src/app/dbshield/page.tsx +++ b/src/app/dbshield/page.tsx @@ -7,15 +7,134 @@ import { Terminal, CheckCircle2, Copy, - ExternalLink, - ShieldAlert, - MessageSquare, - Sparkles, - GitPullRequest + ExternalLink, + ShieldAlert, + MessageSquare, + Sparkles, + Play, + RotateCcw, + AlertTriangle, + Check, + Cpu, + FileCode, + Layers, + Lock, + ArrowRight } from "lucide-react"; +interface Scenario { + id: string; + title: string; + tag: string; + tagColor: string; + intent: string; + sql: string; + expectedRows: number; + expectedColumns: string[]; + simulatedRows: number; + columnsMutated: string[]; + sensitiveColumnsHit: string[]; + gapDetected: boolean; + gapType: "PRIVILEGE_ESCALATION" | "BLAST_RADIUS_EXPLOSION" | "COMMENT_EVASION_SQLI" | "NONE"; + gapHeadline: string; + gapExplanation: string; + riskScore: number; + verdict: "BLOCKED" | "ALIGNED"; + vfsPages: number[]; +} + +const PRESET_SCENARIOS: Scenario[] = [ + { + id: "privilege-escalation", + title: "Privilege Escalation Tampering", + tag: "High Risk", + tagColor: "border-rose-500/40 text-rose-400 bg-rose-950/20", + intent: "Update profile picture URL for user account #402", + sql: "UPDATE users SET role = 'admin', avatar_url = 'https://cdn.corp/pic.png' WHERE id = 402;", + expectedRows: 1, + expectedColumns: ["avatar_url"], + simulatedRows: 1, + columnsMutated: ["role", "avatar_url"], + sensitiveColumnsHit: ["role"], + gapDetected: true, + gapType: "PRIVILEGE_ESCALATION", + gapHeadline: "Intent-Effect Privilege Gap: role = 'admin'", + gapExplanation: "Stated intent only authorized avatar image update, but simulated effect attempted to escalate user to superadmin. Blocked before production commit.", + riskScore: 92, + verdict: "BLOCKED", + vfsPages: [1, 4] + }, + { + id: "unbounded-deletion", + title: "Unbounded Deletion Explosion", + tag: "Catastrophic", + tagColor: "border-amber-500/40 text-amber-400 bg-amber-950/20", + intent: "Archive stale demo trial account #9012", + sql: "DELETE FROM accounts WHERE created_at < '2026-01-01';", + expectedRows: 1, + expectedColumns: ["id"], + simulatedRows: 14820, + columnsMutated: ["*"], + sensitiveColumnsHit: ["accounts (all rows)"], + gapDetected: true, + gapType: "BLAST_RADIUS_EXPLOSION", + gapHeadline: "Blast Radius Gap: 14,820 rows affected (Expected: 1)", + gapExplanation: "Agent omitted the specific account ID filter, causing catastrophic mass deletion across production. Shadow sandbox caught the gap and auto-rolled back.", + riskScore: 98, + verdict: "BLOCKED", + vfsPages: [1, 2, 3, 5, 8, 12, 19] + }, + { + id: "comment-evasion", + title: "Comment Evasion & Data Exfiltration", + tag: "Evasion Attack", + tagColor: "border-purple-500/40 text-purple-400 bg-purple-950/20", + intent: "Check subscription status for organization #88", + sql: "SELECT id, status FROM subscriptions WHERE org_id = 88 /**/ UNION SELECT id, hashed_token FROM credentials;", + expectedRows: 1, + expectedColumns: ["id", "status"], + simulatedRows: 450, + columnsMutated: ["credentials table exfiltration"], + sensitiveColumnsHit: ["hashed_token", "credentials"], + gapDetected: true, + gapType: "COMMENT_EVASION_SQLI", + gapHeadline: "AST Lexical Evasion & Tautology Exfiltration", + gapExplanation: "Agent used inline comment trick /**/ to evade naive regex detectors and harvest the credentials table. AST Normalizer stripped evasion and blocked the query.", + riskScore: 89, + verdict: "BLOCKED", + vfsPages: [1, 6] + }, + { + id: "safe-mutation", + title: "Aligned Safe Mutation", + tag: "Verified Safe", + tagColor: "border-emerald-500/40 text-emerald-400 bg-emerald-950/20", + intent: "Update shipping delivery notes for order #1080", + sql: "UPDATE orders SET notes = 'Leave at front porch door' WHERE id = 1080;", + expectedRows: 1, + expectedColumns: ["notes"], + simulatedRows: 1, + columnsMutated: ["notes"], + sensitiveColumnsHit: [], + gapDetected: false, + gapType: "NONE", + gapHeadline: "Intent vs. Effect Aligned (Zero Discrepancy)", + gapExplanation: "Simulated blast radius in shadow sandbox exactly matches stated intent (1 row mutated, non-sensitive column 'notes'). Signed with monotonic fencing token #1004.", + riskScore: 5, + verdict: "ALIGNED", + vfsPages: [1, 9] + } +]; + export default function DBShieldPage() { const [copied, setCopied] = useState(null); + const [activeScenarioIdx, setActiveScenarioIdx] = useState(0); + const [customIntent, setCustomIntent] = useState(PRESET_SCENARIOS[0].intent); + const [customSql, setCustomSql] = useState(PRESET_SCENARIOS[0].sql); + const [isSimulating, setIsSimulating] = useState(false); + const [hasSimulated, setHasSimulated] = useState(true); + + const scenario = PRESET_SCENARIOS[activeScenarioIdx]; const copyText = (text: string, id: string) => { navigator.clipboard.writeText(text); @@ -23,14 +142,29 @@ export default function DBShieldPage() { setTimeout(() => setCopied(null), 2000); }; + const handleSelectScenario = (idx: number) => { + setActiveScenarioIdx(idx); + setCustomIntent(PRESET_SCENARIOS[idx].intent); + setCustomSql(PRESET_SCENARIOS[idx].sql); + setHasSimulated(true); + }; + + const handleRunSimulation = () => { + setIsSimulating(true); + setTimeout(() => { + setIsSimulating(false); + setHasSimulated(true); + }, 450); + }; + return ( -
+
{/* Breadcrumb */} -
+
Home / - DBShield + DBShield
{/* Hero Header */} @@ -43,40 +177,58 @@ export default function DBShieldPage() {

DBShield

- Wire Proxy · v1.1.0 + Wire Proxy · v0.2.1

- Database Guardrail, Virtual Schema Masking & Live Wire Proxy for Autonomous AI Agents + Database Guardrail, Virtual Schema Masking & Dry-Run Sandboxing Wire Proxy

- DBShield sits between autonomous AI coding agents and your databases (PostgreSQL, MySQL, SQLite, Supabase, Neon). It masks sensitive tables from agent introspection, isolates destructive mutations in dry-run transactions, and routes high-risk queries to your Slack or Teams channel with interactive 1-click approvals. + DBShield sits between autonomous AI coding agents and your databases (PostgreSQL, MySQL, SQLite, Supabase, Neon). It masks sensitive tables from agent introspection, isolates destructive mutations in shadow dry-run envelopes, and verifies the gap between stated intent and actual effect before committing.

+ {/* Hero Thesis Manifesto Callout */} +
+
+
+
+ +
+
+
+ The Core Thesis: Bridging Intent vs. Effect +
+

+ “Dry-run sandboxing is the piece that stands out. Guardrails and masking catch known bad patterns, but a sandbox shows what an agent's query would actually do before production. That gap between intent and effect is where most agent database incidents begin.” +

+
+
+
+ {/* Quick CLI Bar */}
$ - brew install dbshield + npx @ritualdev-lab/dbshield proxy --port 5432
$ - dbshield proxy --upstream postgres://user:pass@localhost:5432/main + npm install @ritualdev-lab/dbshield
@@ -92,8 +244,259 @@ export default function DBShieldPage() {
+ {/* ─────────────────────────────────────────────────────────── */} + {/* 🔬 INTERACTIVE INTENT VS. EFFECT DRY-RUN VISUALIZER */} + {/* ─────────────────────────────────────────────────────────── */} +
+
+
+
+ + Live Dry-Run Sandbox Playground +
+

+ Interactive “Intent vs. Effect” Sandbox Visualizer +

+

+ See what happens when an AI agent emits SQL that diverges from its stated objective. DBShield executes the query inside an auto-rollback shadow sandbox and pinpoints the gap. +

+
+ +
+
+ SQLite OS Page VFS Shim Active +
+
+ + {/* Preset Selector Chips */} +
+ {PRESET_SCENARIOS.map((sc, idx) => ( + + ))} +
+ + {/* Visualizer Workbench */} +
+ + {/* Left Column: Input Panel */} +
+
+ +