LocalShield

Use LocalShield immediately before a production Agent moves local content outside the device. WorkBuddy contract and customer-document delivery is the primary workflow; Qoder and TRAE Work use the same entry contract.

LocalShield is an Agent decision service, not a system firewall. The host must call it and honor its result.

Fixed entry point

Expose only scripts\run.ps1 to the host. Run from the Skill directory.

| Intent | Command | |---|---| | Inspect a contract before sending | .\scripts\run.ps1 -InputPath .\examples\risky_contract.md -Action send -Destination external_partner -Mode gate -Policy workbuddy_contract_policy -Device AUTO | | Inspect inline text | .\scripts\run.ps1 -Text "请把客户电话 13800138000 发给外部供应商" -Action send -Destination external_partner -Mode gate | | Audit without enforcement | .\scripts\run.ps1 -InputPath .\examples\clean_public_note.md -Action publish -Destination public_web -Mode audit |

The first call creates .runtime\venv and installs pinned dependencies. Run .\scripts\setup.ps1 explicitly when preparing a demo. If setup was interrupted, run .\scripts\setup.ps1 -Continue or pass -Continue to the fixed entry point. After setup, runtime inference does not require network access.

Request behavior

• Provide exactly one of -InputPath or -Text.
• Use -Action audit|upload|publish|share|send|commit|summarize.
• Use -Destination local|internal|external_cloud|external_partner|public_web|public_repo|unknown.
• Use -Mode gate for production actions, sanitize to request a copy, and audit for observation only.
• Keep -Device AUTO unless the user asks to validate a detected CPU, GPU, or NPU.

Supported inputs are text, Markdown, JSON, CSV, common source files, text PDFs, and DOCX. DOCX scanning includes body paragraphs, tables, headers, and footers. DOCX sanitization creates a valid new Office document. PDF sanitization currently returns a text projection; do not represent it as a layout-preserving PDF.

Interpret the JSON result

• PASS: continue with the original input.
• WARN: explain the risk and ask the user before continuing.
• BLOCK: stop the original-file action. Use only a sanitized artifact whose sanitized_recheck.decision is PASS.
• REVIEW_REQUIRED: stop automation and request manual review.

The result includes masked findings, location, model/backend/device metadata, input hash, sanitized artifact metadata, and privacy invariants. A successful scan may return exit code 0 even when its semantic decision is BLOCK; parse the JSON decision.

Failure handling

Fail closed when input parsing, policy loading, model loading, or local service startup fails. Never retry against a remote URL. The client rejects non-loopback service addresses. Do not write original content or unmasked evidence to audit JSON or remote logs.

Validation and references

Read references/workbuddy_integration.md before WorkBuddy validation and references/host_validation.md for the PASS/WARN/BLOCK/REVIEW_REQUIRED matrix. Read references/architecture.md when changing transport, model, or privacy invariants. Read references/submission_checklist.md before publishing to ModelScope.