[divyanshujethi]

Phase 3: Low-Level OS Kernel Primitives & High Availability

• Linux eBPF Socket Monitoring: Implemented EbpfSocketFilter via sys_enter_connect for kernel-level egress interception on kernels where Landlock v1 networking support is absent.
• macOS Endpoint Security Framework (ESF): Implemented MacOSEndpointSecurityManager with ES_EVENT_TYPE_AUTH_EXEC, AUTH_OPEN, and AUTH_CONNECT hooks, modernizing from deprecated sandbox-exec Scheme profiles.
• Windows WFP Callout Filter: Implemented WindowsWFPController pairing LowBox AppContainer with Windows Filtering Platform ALE connect layers for per-PID egress filtering without administrative rights.
• Tests: Added ests/kernel-primitives.test.ts (257 tests passing across suite, 0 lint errors).

[github-actions]

👋 Thanks for opening this Pull Request, @divyanshujethi!

Thank you for contributing to AgentShield! 🛡️

Here is what happens next:

1. 🧪 Automated Security Gate: Our CI workflow (pr-gate.yml) audits your diff for accidental credential exposure and runs test suites.
2. 🔍 Code & Security Review: A maintainer from @RitualDev-Lab will review your changes shortly.
3. 🌟 Contributor Recognition: Once merged, you'll be featured on our contributors list!

💡 Tip: Make sure secrets/mock API keys in tests are synthetic/redacted and tests pass locally (pnpm test).

[github-actions]

🛡️ AgentShield Pull Request Security Audit

✅ Security Gate Passed — No Exposed Secrets Detected

• Files Audited: 7
• Commit Evaluated: 94a8321
• Status: Diff is clean. Zero-leak credential policy verified for autonomous AI & developer tools.

---

Protected by AgentShield — Zero-Leak Security for AI Agents & Engineering Teams.