Add: ESLint-style per-rule build-time options (encoded-payload sub-rules)

[twschiller]

Summary

• Extends the --defaults / EXTENSION_DEFAULTS_FILE build-time override file to accept an ESLint-style object value { enabled?: boolean, ...subRuleOptions } for any rule that declares a sub-rule shape in RULE_OPTION_DEFAULTS. Plain booleans still work; the Options-page export shape stays flat-boolean and is untouched. Build-time only this iteration — no chrome.storage or Options-page UI changes.
• First (and only) consumer: encoded-payload-redact. Its seven detectors (base64, hex, percent, substitutionCipher, leetspeak, nato, morse) are now individually togglable. Operators can disable the higher-false-positive text ciphers (leetspeak / NATO / Morse) without losing coverage of the byte encodings.
• Validation is strict: object values for rules without declared options, unknown sub-rule keys, and non-boolean leaves all fail the build with path-qualified messages (e.g. encoded-payload-redact.subRules.bogus).

Example

{
  "encoded-payload-redact": {
    "enabled": true,
    "subRules": { "leetspeak": false, "nato": false, "morse": false }
  }
}

Implementation

• extension/src/rules/rule-metadata.ts — adds RULE_OPTION_DEFAULTS + RuleOptions type alongside the existing flat RULE_DEFAULTS. Pure data, service-worker-safe.
• extension/src/lib/rule-options.ts (new) — parses EXTENSION_RULE_OPTIONS once at content-script init, merges over defaults, exposes typed getRuleOptions(id). Malformed JSON silently degrades (mirrors lib/storage.ts, spec 0011 NFR-S-2).
• extension/scripts/load-default-overrides.ts — recursively walks per-rule option trees, accumulates path-qualified validation issues.
• extension/build.ts — passes RULE_OPTION_DEFAULTS to the loader and injects EXTENSION_RULE_OPTIONS via define:.
• extension/src/rules/encoded-payload-redact.ts — reads SUB_RULES at module init and gates each collectMatches step.
• Docs: specs/0011-build-time-customization.md (new FR-2a, updated FR-4 / NFR-S-2 / Current implementation), docs/src/content/docs/install.md, skills/agent-browser-shield-install/SKILL.md, extension/data/defaults-overrides.example.json.

Test plan

• bun run test — 1946 tests pass (12 new sub-rule / loader cases, 2 new catalog invariants).
• bun run check — biome + eslint clean.
• pre-commit run — markdown preflight clean (mdformat + markdownlint).
• End-to-end build smoke — bun run build --defaults /tmp/sub-rule-overrides.json logs Applying 2 build-time default override(s).
• Validation failure modes — four malformed inputs (object value for pii-redact, unknown sub-rule key, non-boolean leaf, unknown top-level group under a rule object) each fail with a clear path-qualified message.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-browser-shield-demo-site	Ready	Preview, Comment	Jun 9, 2026 3:24pm