@amaster.ai/pi-shared 0.1.6 → 0.1.8

package/dist/network.js

@@ -0,0 +1,219 @@
+import { lookup as nodeLookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { Readable } from 'node:stream';
+const defaultLookup = async (hostname) => nodeLookup(hostname, { all: true, verbatim: true });
+const wellKnownNat64Addresses = new BlockList();
+wellKnownNat64Addresses.addSubnet('64:ff9b::', 96, 'ipv6');
+const globalIpv6Addresses = new BlockList();
+globalIpv6Addresses.addSubnet('2000::', 3, 'ipv6');
+const nonGlobalIpv6Addresses = new BlockList();
+nonGlobalIpv6Addresses.addSubnet('2001::', 23, 'ipv6');
+nonGlobalIpv6Addresses.addSubnet('2001:db8::', 32, 'ipv6');
+nonGlobalIpv6Addresses.addSubnet('2002::', 16, 'ipv6');
+nonGlobalIpv6Addresses.addSubnet('3fff::', 20, 'ipv6');
+// IANA marks 2001::/23 non-global except for these more-specific allocations.
+const globalIetfProtocolAddresses = new BlockList();
+globalIetfProtocolAddresses.addAddress('2001:1::1', 'ipv6');
+globalIetfProtocolAddresses.addAddress('2001:1::2', 'ipv6');
+globalIetfProtocolAddresses.addAddress('2001:1::3', 'ipv6');
+globalIetfProtocolAddresses.addSubnet('2001:3::', 32, 'ipv6');
+globalIetfProtocolAddresses.addSubnet('2001:4:112::', 48, 'ipv6');
+globalIetfProtocolAddresses.addSubnet('2001:20::', 28, 'ipv6');
+globalIetfProtocolAddresses.addSubnet('2001:30::', 28, 'ipv6');
+function isPublicIpv4(address) {
+    const octets = address.split('.').map(Number);
+    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part)))
+        return false;
+    const [a, b, c] = octets;
+    if (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        a >= 224 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        (a === 192 && b === 0 && c === 0) ||
+        (a === 192 && b === 0 && c === 2) ||
+        (a === 192 && b === 88 && c === 99) ||
+        (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||
+        (a === 203 && b === 0 && c === 113)) {
+        return false;
+    }
+    return true;
+}
+function mappedIpv4(address) {
+    const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+    if (dotted)
+        return dotted[1];
+    const hex = /^(?:::ffff:|(?:0{1,4}:){5}ffff:)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(address);
+    if (!hex)
+        return undefined;
+    const value = Number.parseInt(hex[1], 16) * 65_536 + Number.parseInt(hex[2], 16);
+    return [value >>> 24, (value >>> 16) & 255, (value >>> 8) & 255, value & 255].join('.');
+}
+function nat64Ipv4(address) {
+    if (!wellKnownNat64Addresses.check(address, 'ipv6'))
+        return undefined;
+    let canonical;
+    try {
+        canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+    }
+    catch {
+        return undefined;
+    }
+    const hex = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
+    if (!hex)
+        return undefined;
+    const value = Number.parseInt(hex[1], 16) * 65_536 + Number.parseInt(hex[2], 16);
+    return [value >>> 24, (value >>> 16) & 255, (value >>> 8) & 255, value & 255].join('.');
+}
+function isPublicIp(address) {
+    const normalized = address.toLowerCase().replace(/^\[|\]$/g, '');
+    const family = isIP(normalized);
+    if (family === 4)
+        return isPublicIpv4(normalized);
+    if (family !== 6)
+        return false;
+    const embeddedIpv4 = mappedIpv4(normalized) ?? nat64Ipv4(normalized);
+    if (embeddedIpv4)
+        return isPublicIpv4(embeddedIpv4);
+    if (!globalIpv6Addresses.check(normalized, 'ipv6'))
+        return false;
+    return (globalIetfProtocolAddresses.check(normalized, 'ipv6') ||
+        !nonGlobalIpv6Addresses.check(normalized, 'ipv6'));
+}
+/**
+ * Parse an outbound URL once using Node's WHATWG parser and require every DNS
+ * answer to be globally routable. Call this again for every redirect target.
+ */
+async function resolvePublicHttpUrl(value, lookup = defaultLookup) {
+    let url;
+    try {
+        url = value instanceof URL ? new URL(value) : new URL(value);
+    }
+    catch {
+        throw new Error('Outbound URL must use a public HTTP(S) destination.');
+    }
+    if ((url.protocol !== 'http:' && url.protocol !== 'https:') ||
+        url.username ||
+        url.password ||
+        !url.hostname ||
+        url.hostname === 'localhost' ||
+        url.hostname.endsWith('.localhost')) {
+        throw new Error('Outbound URL must use a public HTTP(S) destination.');
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, '');
+    const literalFamily = isIP(hostname);
+    const addresses = literalFamily
+        ? [{ address: hostname, family: literalFamily }]
+        : await lookup(hostname).catch(() => []);
+    if (addresses.length === 0 || addresses.some(({ address }) => !isPublicIp(address))) {
+        throw new Error('Outbound URL must use a public HTTP(S) destination.');
+    }
+    return { url, addresses };
+}
+export async function assertPublicHttpUrl(value, lookup = defaultLookup) {
+    return (await resolvePublicHttpUrl(value, lookup)).url;
+}
+export async function safeFetch(value, init = {}, options = {}) {
+    const lookup = options.lookup ?? defaultLookup;
+    const maxRedirects = options.maxRedirects ?? 5;
+    let resolved = await resolvePublicHttpUrl(value, lookup);
+    for (let redirects = 0;; redirects++) {
+        const response = await pinnedFetch(resolved.url, resolved.addresses[0], init);
+        if (![301, 302, 303, 307, 308].includes(response.status))
+            return response;
+        const location = response.headers.get('location');
+        if (!location || redirects >= maxRedirects) {
+            await response.body?.cancel().catch(() => { });
+            throw new Error('Outbound request exceeded the redirect limit.');
+        }
+        const next = new URL(location, resolved.url);
+        await response.body?.cancel().catch(() => { });
+        resolved = await resolvePublicHttpUrl(next, lookup);
+    }
+}
+async function pinnedFetch(url, target, init) {
+    const method = init.method?.toUpperCase() ?? 'GET';
+    if ((method === 'GET' || method === 'HEAD') && init.body) {
+        throw new Error(`${method} outbound requests cannot include a body.`);
+    }
+    if (init.body !== undefined &&
+        init.body !== null &&
+        typeof init.body !== 'string' &&
+        !(init.body instanceof Uint8Array)) {
+        throw new Error('Safe outbound fetch requires a replayable string or byte body.');
+    }
+    return new Promise((resolve, reject) => {
+        const headers = Object.fromEntries(new Headers(init.headers).entries());
+        const request = (url.protocol === 'https:' ? httpsRequest : httpRequest)(url, {
+            method,
+            headers,
+            signal: init.signal ?? undefined,
+            family: target.family,
+            lookup(_hostname, _options, callback) {
+                callback(null, target.address, target.family);
+            },
+        }, (incoming) => {
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (Array.isArray(value)) {
+                    for (const item of value)
+                        responseHeaders.append(name, item);
+                }
+                else if (value !== undefined) {
+                    responseHeaders.set(name, value);
+                }
+            }
+            const body = method === 'HEAD' || incoming.statusCode === 204 || incoming.statusCode === 304
+                ? null
+                : Readable.toWeb(incoming);
+            resolve(new Response(body, {
+                status: incoming.statusCode ?? 500,
+                statusText: incoming.statusMessage ?? '',
+                headers: responseHeaders,
+            }));
+        });
+        request.once('error', reject);
+        request.end(init.body ?? undefined);
+    });
+}
+export async function readResponseBytes(response, maxBytes) {
+    const contentLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        await response.body?.cancel().catch(() => { });
+        throw new Error('Remote response exceeds the size ceiling.');
+    }
+    if (!response.body)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new Error('Remote response exceeds the size ceiling.');
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
+//# sourceMappingURL=network.js.map

package/dist/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../src/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE,CAClD,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,MAAM,uBAAuB,GAAG,IAAI,SAAS,EAAE,CAAC;AAChD,uBAAuB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,mBAAmB,GAAG,IAAI,SAAS,EAAE,CAAC;AAC5C,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACnD,MAAM,sBAAsB,GAAG,IAAI,SAAS,EAAE,CAAC;AAC/C,sBAAsB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,sBAAsB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3D,sBAAsB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,sBAAsB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvD,8EAA8E;AAC9E,MAAM,2BAA2B,GAAG,IAAI,SAAS,EAAE,CAAC;AACpD,2BAA2B,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5D,2BAA2B,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5D,2BAA2B,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5D,2BAA2B,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9D,2BAA2B,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAClE,2BAA2B,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/D,2BAA2B,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAE/D,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAC7D,IACE,CAAC,KAAK,CAAC;QACP,CAAC,KAAK,EAAE;QACR,CAAC,KAAK,GAAG;QACT,CAAC,IAAI,GAAG;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,4CAA4C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CACL,2BAA2B,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QACrD,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAmB,EACnB,SAAoB,aAAa;IAEjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACvD,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,QAAQ;QACb,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa;QAC7B,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAmB,EACnB,SAAoB,aAAa;IAEjC,OAAO,CAAC,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAmB,EACnB,OAAoB,EAAE,EACtB,UAGI,EAAE;IAEN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEzD,KAAK,IAAI,SAAS,GAAG,CAAC,GAAI,SAAS,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9C,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAQ,EACR,MAA2C,EAC3C,IAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,2CAA2C,CAAC,CAAC;IACxE,CAAC;IACD,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;QACvB,IAAI,CAAC,IAAI,KAAK,IAAI;QAClB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,YAAY,UAAU,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CACtE,GAAG,EACH;YACE,MAAM;YACN,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ;gBAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;SACF,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,KAAK,MAAM,IAAI,IAAI,KAAK;wBAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC/B,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GACR,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG;gBAC7E,CAAC,CAAC,IAAI;gBACN,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAgC,CAAC;YAC/D,OAAO,CACL,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;gBACxC,OAAO,EAAE,eAAe;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,QAAgB;IAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAC/D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/settings.d.ts

@@ -2,7 +2,16 @@ export type PiSettingsOptions = {
     cwd?: string;
     /** Override for the config directory. If not set, resolveConfigDir() is used. */
     configDir?: string;
+    /** Whether project-local settings and policies may be read. Defaults to false. */
+    projectTrusted?: boolean;
+    /** Whether to expand bare $ENV_VAR references in global and agent-dir settings. Defaults to true. */
+    expandBareEnvVars?: boolean;
+    /** Refuse malformed/unreadable trusted project settings instead of ignoring them. */
+    strictProjectSettings?: boolean;
 };
+export declare function isProjectTrusted(context: {
+    isProjectTrusted?: () => boolean;
+} | null | undefined): boolean;
 /**
  * Resolve the user data / runtime home directory.
  * Used for: memories, data, skills, logs.
@@ -17,8 +26,10 @@ export declare function resolveConfigDir(override?: string): string;
 export declare function resolveAgentDir(override?: string): string;
 /**
  * Load extension config from pi-agent settings files.
- * Reads from global (~/.pi/agent/settings.json), agentDir (env/param), and project (<cwd>/.pi/settings.json).
+ * Reads from global (~/.pi/agent/settings.json), agentDir (env/param), and trusted project
+ * (<cwd>/.pi/settings.json) settings.
  * Priority from low to high: global < agentDir < project.
+ * Environment variables are expanded only in the global and agentDir layers.
  */
 export declare function loadPiSettings<T>(key: string, options?: PiSettingsOptions): T;
 export declare function loadJsonProfileDir<T>(dir: string): Record<string, T>;

package/dist/settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAsCF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAe7E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAsBpE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAatF"}
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/D,OAAO,CAET;AA2DD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,CAAC,CA4B7E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAsBpE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAgBtF"}

package/dist/settings.js

@@ -1,9 +1,14 @@
 import { readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
-function resolveEnvVars(value) {
+export function isProjectTrusted(context) {
+    return context?.isProjectTrusted?.() === true;
+}
+function resolveEnvVars(value, expandBareEnvVars) {
     if (typeof value === 'string') {
-        return value.replace(/\$\{([^}]+)\}/g, (_match, expr) => {
+        const pattern = expandBareEnvVars ? /\$\{([^}]+)\}|\$([A-Z_][A-Z0-9_]*)/g : /\$\{([^}]+)\}/g;
+        return value.replace(pattern, (_match, braced, bare) => {
+            const expr = braced ?? bare ?? '';
             const [name, ...rest] = expr.split(':-');
             const fallback = rest.join(':-');
             const envVal = process.env[name];
@@ -13,27 +18,40 @@ function resolveEnvVars(value) {
         });
     }
     if (Array.isArray(value)) {
-        return value.map(resolveEnvVars);
+        return value.map((item) => resolveEnvVars(item, expandBareEnvVars));
     }
     if (value && typeof value === 'object') {
         const result = {};
         for (const [k, v] of Object.entries(value)) {
-            result[k] = resolveEnvVars(v);
+            result[k] = resolveEnvVars(v, expandBareEnvVars);
         }
         return result;
     }
     return value;
 }
-function readSettingsSection(filePath, key) {
+function readSettingsSection(filePath, key, options) {
     try {
         const raw = readFileSync(filePath, 'utf-8');
         const parsed = JSON.parse(raw);
         if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-            return resolveEnvVars(parsed[key] ?? {});
+            const section = parsed[key] ?? {};
+            if (!section || typeof section !== 'object' || Array.isArray(section)) {
+                if (options.strict)
+                    throw new Error('project settings section must be an object');
+                return {};
+            }
+            return (options.expandEnv ? resolveEnvVars(section, options.expandBareEnvVars) : section);
         }
+        if (options.strict)
+            throw new Error('project settings root must be an object');
         return {};
     }
-    catch {
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        if (options.strict) {
+            throw new Error('Trusted project settings are unreadable or malformed.', { cause: error });
+        }
         return {};
     }
 }
@@ -60,18 +78,32 @@ export function resolveAgentDir(override) {
 }
 /**
  * Load extension config from pi-agent settings files.
- * Reads from global (~/.pi/agent/settings.json), agentDir (env/param), and project (<cwd>/.pi/settings.json).
+ * Reads from global (~/.pi/agent/settings.json), agentDir (env/param), and trusted project
+ * (<cwd>/.pi/settings.json) settings.
  * Priority from low to high: global < agentDir < project.
+ * Environment variables are expanded only in the global and agentDir layers.
  */
 export function loadPiSettings(key, options) {
     const globalDir = resolve(join(homedir(), '.pi', 'agent'));
     const configDir = resolveConfigDir(options?.configDir);
     const cwd = options?.cwd ?? process.cwd();
-    const globalSettings = readSettingsSection(join(globalDir, 'settings.json'), key);
+    const globalSettings = readSettingsSection(join(globalDir, 'settings.json'), key, {
+        expandEnv: true,
+        expandBareEnvVars: options?.expandBareEnvVars !== false,
+    });
     const configSettings = configDir === globalDir
         ? {}
-        : readSettingsSection(join(configDir, 'settings.json'), key);
-    const projectSettings = readSettingsSection(join(cwd, '.pi', 'settings.json'), key);
+        : readSettingsSection(join(configDir, 'settings.json'), key, {
+            expandEnv: true,
+            expandBareEnvVars: options?.expandBareEnvVars !== false,
+        });
+    const projectSettings = options?.projectTrusted === true
+        ? readSettingsSection(join(cwd, '.pi', 'settings.json'), key, {
+            expandEnv: false,
+            expandBareEnvVars: false,
+            strict: options?.strictProjectSettings === true,
+        })
+        : {};
     return { ...globalSettings, ...configSettings, ...projectSettings };
 }
 export function loadJsonProfileDir(dir) {
@@ -108,7 +140,9 @@ export function loadPiPolicyProfiles(options) {
     const configPolicies = configPolicyDir === globalDir
         ? {}
         : loadJsonProfileDir(configPolicyDir);
-    const projectPolicies = loadJsonProfileDir(projectDir);
+    const projectPolicies = options?.projectTrusted === true
+        ? loadJsonProfileDir(projectDir)
+        : {};
     return { ...globalPolicies, ...configPolicies, ...projectPolicies };
 }
 //# sourceMappingURL=settings.js.map

package/dist/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;YAC9D,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;YACzD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAI,QAAgB,EAAE,GAAW;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAiB;IAC3C,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,OAAO,CACZ,QAAQ;QACN,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAI,GAAW,EAAE,OAA2B;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1C,MAAM,cAAc,GAAG,mBAAmB,CAAI,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IAErF,MAAM,cAAc,GAClB,SAAS,KAAK,SAAS;QACrB,CAAC,CAAE,EAAiB;QACpB,CAAC,CAAC,mBAAmB,CAAI,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IAEpE,MAAM,eAAe,GAAG,mBAAmB,CAAI,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IAEvF,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,EAAO,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,GAAW;IAC/C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAW,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,OAA2B;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjF,MAAM,cAAc,GAAG,kBAAkB,CAAI,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAClB,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAE,EAAwB;QAC3B,CAAC,CAAC,kBAAkB,CAAI,eAAe,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,kBAAkB,CAAI,UAAU,CAAC,CAAC;IAE1D,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,EAAE,CAAC;AACtE,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpD,MAAM,UAAU,gBAAgB,CAC9B,OAAgE;IAEhE,OAAO,OAAO,EAAE,gBAAgB,EAAE,EAAE,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,iBAA0B;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC7F,OAAO,KAAK,CAAC,OAAO,CAClB,OAAO,EACP,CAAC,MAAM,EAAE,MAA0B,EAAE,IAAwB,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;YACzD,OAAO,QAAQ,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,GAAW,EACX,OAA6E;IAE7E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,IAAI,OAAO,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAClF,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CACnE,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAiB;IAC3C,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,OAAO,OAAO,CACZ,QAAQ;QACN,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,QAAiB;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAI,GAAW,EAAE,OAA2B;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1C,MAAM,cAAc,GAAG,mBAAmB,CAAI,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE;QACnF,SAAS,EAAE,IAAI;QACf,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,KAAK,KAAK;KACxD,CAAC,CAAC;IAEH,MAAM,cAAc,GAClB,SAAS,KAAK,SAAS;QACrB,CAAC,CAAE,EAAiB;QACpB,CAAC,CAAC,mBAAmB,CAAI,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE;YAC5D,SAAS,EAAE,IAAI;YACf,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,KAAK,KAAK;SACxD,CAAC,CAAC;IAET,MAAM,eAAe,GACnB,OAAO,EAAE,cAAc,KAAK,IAAI;QAC9B,CAAC,CAAC,mBAAmB,CAAI,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE;YAC7D,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,KAAK;YACxB,MAAM,EAAE,OAAO,EAAE,qBAAqB,KAAK,IAAI;SAChD,CAAC;QACJ,CAAC,CAAE,EAAiB,CAAC;IAEzB,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,EAAO,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,GAAW;IAC/C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAW,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAI,OAA2B;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjF,MAAM,cAAc,GAAG,kBAAkB,CAAI,SAAS,CAAC,CAAC;IACxD,MAAM,cAAc,GAClB,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAE,EAAwB;QAC3B,CAAC,CAAC,kBAAkB,CAAI,eAAe,CAAC,CAAC;IAC7C,MAAM,eAAe,GACnB,OAAO,EAAE,cAAc,KAAK,IAAI;QAC9B,CAAC,CAAC,kBAAkB,CAAI,UAAU,CAAC;QACnC,CAAC,CAAE,EAAwB,CAAC;IAEhC,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,cAAc,EAAE,GAAG,eAAe,EAAE,CAAC;AACtE,CAAC"}

package/dist/threat-patterns.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Shared threat-pattern library for memory content scanning.
+ *
+ * Covers prompt injection, role hijack, C2 framework names, exfiltration,
+ * persistence (SSH backdoor, agent-config edits), and invisible unicode.
+ *
+ * Pattern philosophy: anchor on attack-specific vocabulary or unambiguous
+ * attack behavior, NOT on bossy English.  Multi-word filler is allowed via
+ * `(?:\w+\s+)*` between key tokens so attackers can't bypass with
+ * synonyms ("ignore all prior instructions").
+ */
+type Scope = 'all' | 'context' | 'strict';
+/**
+ * Invisible / bidirectional unicode characters used in injection attacks.
+ */
+export declare const INVISIBLE_CHARS: ReadonlySet<string>;
+/**
+ * Return matched pattern IDs in `content` at the given scope.
+ *
+ * - `all`: classic injection + exfil only (lowest false-positive set).
+ * - `context`: adds promptware / C2 / role-play patterns.
+ * - `strict`: adds persistence / SSH backdoor / exfil-URL patterns.
+ *
+ * Invisible-unicode hits are reported as `invisible_unicode_U+XXXX`.
+ */
+export declare function scanForThreats(content: string, scope?: Scope): string[];
+/**
+ * Return a human-readable error string for the first threat in `content`,
+ * or `null` when clean.  Convenience wrapper for paths that block on first
+ * hit (memory writes).
+ */
+export declare function firstThreatMessage(content: string, scope?: Scope): string | null;
+export {};
+//# sourceMappingURL=threat-patterns.d.ts.map

package/dist/threat-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-patterns.d.ts","sourceRoot":"","sources":["../src/threat-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,KAAK,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;AAmH1C;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAkB9C,CAAC;AA0BH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,KAAiB,GAAG,MAAM,EAAE,CA0BlF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,KAAgB,GAAG,MAAM,GAAG,IAAI,CAW1F"}

package/dist/threat-patterns.js

@@ -0,0 +1,211 @@
+/**
+ * Shared threat-pattern library for memory content scanning.
+ *
+ * Covers prompt injection, role hijack, C2 framework names, exfiltration,
+ * persistence (SSH backdoor, agent-config edits), and invisible unicode.
+ *
+ * Pattern philosophy: anchor on attack-specific vocabulary or unambiguous
+ * attack behavior, NOT on bossy English.  Multi-word filler is allowed via
+ * `(?:\w+\s+)*` between key tokens so attackers can't bypass with
+ * synonyms ("ignore all prior instructions").
+ */
+const RAW_PATTERNS = [
+    // Classic prompt injection (applies everywhere)
+    [
+        String.raw `ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+(?:\w+\s+)*instructions`,
+        'prompt_injection',
+        'all',
+    ],
+    [String.raw `system\s+prompt\s+override`, 'sys_prompt_override', 'all'],
+    [
+        String.raw `disregard\s+(?:\w+\s+)*(your|all|any)\s+(?:\w+\s+)*(instructions|rules|guidelines)`,
+        'disregard_rules',
+        'all',
+    ],
+    [
+        String.raw `act\s+as\s+(if|though)\s+(?:\w+\s+)*you\s+(?:\w+\s+)*(have\s+no|don't\s+have)\s+(?:\w+\s+)*(restrictions|limits|rules)`,
+        'bypass_restrictions',
+        'all',
+    ],
+    ['<!--[^>]*(?:ignore|override|system|secret|hidden)[^>]*-->', 'html_comment_injection', 'all'],
+    [String.raw `<\s*div\s+style\s*=\s*["'][\s\S]*?display\s*:\s*none`, 'hidden_div', 'all'],
+    [String.raw `translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)`, 'translate_execute', 'all'],
+    [String.raw `do\s+not\s+(?:\w+\s+)*tell\s+(?:\w+\s+)*the\s+user`, 'deception_hide', 'all'],
+    // Role-play / identity hijack (context + strict)
+    [String.raw `you\s+are\s+(?:\w+\s+)*now\s+(?:a|an|the)\s+`, 'role_hijack', 'context'],
+    [String.raw `pretend\s+(?:\w+\s+)*(you\s+are|to\s+be)\s+`, 'role_pretend', 'context'],
+    [String.raw `output\s+(?:\w+\s+)*(system|initial)\s+prompt`, 'leak_system_prompt', 'context'],
+    [
+        String.raw `(respond|answer|reply)\s+without\s+(?:\w+\s+)*(restrictions|limitations|filters|safety)`,
+        'remove_filters',
+        'context',
+    ],
+    [
+        String.raw `you\s+have\s+been\s+(?:\w+\s+)*(updated|upgraded|patched)\s+to`,
+        'fake_update',
+        'context',
+    ],
+    [String.raw `\bname\s+yourself\s+\w+`, 'identity_override', 'context'],
+    // C2 / Brainworm-style promptware
+    [String.raw `register\s+(as\s+)?a?\s*node`, 'c2_node_registration', 'context'],
+    [String.raw `(heartbeat|beacon|check[\s\-]?in)\s+(to|with)\s+`, 'c2_heartbeat', 'context'],
+    [String.raw `pull\s+(down\s+)?(?:new\s+)?task(?:ing|s)?\b`, 'c2_task_pull', 'context'],
+    [String.raw `connect\s+to\s+the\s+network\b`, 'c2_network_connect', 'context'],
+    [
+        String.raw `you\s+must\s+(?:\w+\s+){0,3}(register|connect|report|beacon)\b`,
+        'forced_action',
+        'context',
+    ],
+    [String.raw `only\s+use\s+one[\s\-]?liners?\b`, 'anti_forensic_oneliner', 'context'],
+    [
+        String.raw `never\s+(?:\w+\s+)*(?:create|write)\s+(?:\w+\s+)*(?:script|file)\s+(?:\w+\s+)*disk`,
+        'anti_forensic_disk',
+        'context',
+    ],
+    [
+        String.raw `unset\s+\w*(?:CLAUDE|CODEX|HERMES|AGENT|OPENAI|ANTHROPIC|PI)\w*`,
+        'env_var_unset_agent',
+        'context',
+    ],
+    // Known C2 framework names
+    [
+        String.raw `\b(?:praxis|cobalt\s*strike|sliver|havoc|mythic|metasploit|brainworm)\b`,
+        'known_c2_framework',
+        'context',
+    ],
+    [String.raw `\bc2\s+(?:server|channel|infrastructure|beacon)\b`, 'c2_explicit', 'context'],
+    [String.raw `\bcommand\s+and\s+control\b`, 'c2_explicit_long', 'context'],
+    // Exfiltration via curl/wget/cat with secrets
+    [
+        String.raw `curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)`,
+        'exfil_curl',
+        'all',
+    ],
+    [
+        String.raw `wget\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)`,
+        'exfil_wget',
+        'all',
+    ],
+    [
+        String.raw `cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)`,
+        'read_secrets',
+        'all',
+    ],
+    [String.raw `(send|post|upload|transmit)\s+.*\s+(to|at)\s+https?://`, 'send_to_url', 'strict'],
+    [
+        String.raw `(include|output|print|share)\s+(?:\w+\s+)*(conversation|chat\s+history|previous\s+messages|full\s+context|entire\s+context)`,
+        'context_exfil',
+        'strict',
+    ],
+    // Persistence / SSH backdoor (strict scope)
+    ['authorized_keys', 'ssh_backdoor', 'strict'],
+    [String.raw `\$HOME/\.ssh|~/\.ssh`, 'ssh_access', 'strict'],
+    [String.raw `\$HOME/\.pi/\.env|~/\.pi/\.env`, 'pi_env', 'strict'],
+    [
+        String.raw `(update|modify|edit|write|change|append|add\s+to)\s+.*(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)`,
+        'agent_config_mod',
+        'strict',
+    ],
+    // Hardcoded secrets
+    [
+        String.raw `(?:api[_-]?key|token|secret|password)\s*[=:]\s*["'][A-Za-z0-9+/=_-]{20,}`,
+        'hardcoded_secret',
+        'strict',
+    ],
+];
+/**
+ * Invisible / bidirectional unicode characters used in injection attacks.
+ */
+export const INVISIBLE_CHARS = new Set([
+    '​', // zero-width space
+    '‌', // zero-width non-joiner
+    '‍', // zero-width joiner
+    '⁠', // word joiner
+    '⁢', // invisible times
+    '⁣', // invisible separator
+    '⁤', // invisible plus
+    '', // zero-width no-break space (BOM)
+    '‪', // left-to-right embedding
+    '‫', // right-to-left embedding
+    '‬', // pop directional formatting
+    '‭', // left-to-right override
+    '‮', // right-to-left override
+    '⁦', // left-to-right isolate
+    '⁧', // right-to-left isolate
+    '⁨', // first strong isolate
+    '⁩', // pop directional isolate
+]);
+function buildScopeSets() {
+    const all = [];
+    const context = [];
+    const strict = [];
+    for (const [pattern, id, scope] of RAW_PATTERNS) {
+        const compiled = [new RegExp(pattern, 'i'), id];
+        if (scope === 'all') {
+            all.push(compiled);
+            context.push(compiled);
+            strict.push(compiled);
+        }
+        else if (scope === 'context') {
+            context.push(compiled);
+            strict.push(compiled);
+        }
+        else {
+            strict.push(compiled);
+        }
+    }
+    return { all, context, strict };
+}
+const COMPILED = buildScopeSets();
+/**
+ * Return matched pattern IDs in `content` at the given scope.
+ *
+ * - `all`: classic injection + exfil only (lowest false-positive set).
+ * - `context`: adds promptware / C2 / role-play patterns.
+ * - `strict`: adds persistence / SSH backdoor / exfil-URL patterns.
+ *
+ * Invisible-unicode hits are reported as `invisible_unicode_U+XXXX`.
+ */
+export function scanForThreats(content, scope = 'context') {
+    if (!content) {
+        return [];
+    }
+    const findings = [];
+    for (const ch of content) {
+        if (INVISIBLE_CHARS.has(ch)) {
+            const code = ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0');
+            const finding = `invisible_unicode_U+${code}`;
+            if (!findings.includes(finding)) {
+                findings.push(finding);
+            }
+        }
+    }
+    const patterns = COMPILED[scope];
+    if (!patterns) {
+        throw new Error(`scanForThreats: unknown scope '${scope}'`);
+    }
+    for (const [regex, id] of patterns) {
+        if (regex.test(content)) {
+            findings.push(id);
+        }
+    }
+    return findings;
+}
+/**
+ * Return a human-readable error string for the first threat in `content`,
+ * or `null` when clean.  Convenience wrapper for paths that block on first
+ * hit (memory writes).
+ */
+export function firstThreatMessage(content, scope = 'strict') {
+    const findings = scanForThreats(content, scope);
+    if (findings.length === 0) {
+        return null;
+    }
+    const id = findings[0];
+    if (id.startsWith('invisible_unicode_')) {
+        const codepoint = id.replace('invisible_unicode_', '');
+        return `Blocked: content contains invisible unicode character ${codepoint} (possible injection).`;
+    }
+    return `Blocked: content matches threat pattern '${id}'. Content is injected into the system prompt and must not contain injection or exfiltration payloads.`;
+}
+//# sourceMappingURL=threat-patterns.js.map