@hoilab/ada-cli 0.84.21 → 0.85.0

package/dist/core/memory-engine/refinements.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Refinements — historial deshacible de los cambios automáticos de memoria.
+ *
+ * El engine revisa y edita la memoria solo (cada 10 turnos o 15 tool calls, más
+ * la ruta de corrección instantánea). Eso es potente y es la razón de que la
+ * memoria mejore sola, pero hasta ahora era IRREVERSIBLE: si guardaba algo
+ * incorrecto, el usuario solo podía borrar por substring y esperar.
+ *
+ * La cadena hash de `audit.ts` NO sirve para esto: `AuditEntry` registra qué
+ * pasó (acción, target, resultado) pero no el CONTENIDO, así que es
+ * tamper-evidence, no un almacén de versiones. Esto es lo segundo.
+ *
+ * RIESGO DE CUMPLIMIENTO, cerrado aquí mismo: guardar el texto previo
+ * reintroduce en disco exactamente lo que el scanner se negó a almacenar. Por
+ * eso todo pasa por `redactSensitive` y el fichero se crea con modo 0600. Sin
+ * eso estaríamos abriendo un agujero de privacidad para vender una feature de
+ * privacidad.
+ */
+import { type PrivacyLevel } from "./security.ts";
+import type { MemoryTarget } from "./types.ts";
+export interface RefinementOp {
+    action: "add" | "replace" | "remove";
+    target: MemoryTarget;
+    /** Texto previo (redactado). Ausente en `add`. */
+    before?: string;
+    /** Texto nuevo (redactado). Ausente en `remove`. */
+    after?: string;
+}
+export interface RefinementBatch {
+    /** Identificador corto y estable del lote, para `/memory diff|rollback`. */
+    id: string;
+    ts: string;
+    /** Qué disparó el lote: revisión periódica, corrección del usuario, flush. */
+    source: string;
+    ops: RefinementOp[];
+}
+/** Invierte un lote: lo que habría que aplicar para deshacerlo. */
+export declare function invertBatch(batch: RefinementBatch): RefinementOp[];
+export declare class RefinementJournal {
+    private path;
+    private privacyLevel;
+    constructor(rootDir: string, privacyLevel?: PrivacyLevel);
+    /** Registra un lote. Redacta antes de tocar el disco. */
+    append(batch: RefinementBatch): Promise<void>;
+    /** Lotes más recientes primero. */
+    list(limit?: number): Promise<RefinementBatch[]>;
+    get(id: string): Promise<RefinementBatch | null>;
+    /** Diff legible de un lote. Un rollback que nadie puede inspeccionar es teatro. */
+    static renderDiff(batch: RefinementBatch): string;
+}
+//# sourceMappingURL=refinements.d.ts.map

package/dist/core/memory-engine/refinements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refinements.d.ts","sourceRoot":"","sources":["../../../src/core/memory-engine/refinements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,KAAK,YAAY,EAAmB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC/B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,mFAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,YAAY,EAAE,CAAC;CACpB;AAED,oEAAmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,YAAY,EAAE,CAclE;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAe;IAEnC,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,YAAuB,EAGjE;IAED,yDAAyD;IACnD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;IAED,oCAAmC;IAC7B,IAAI,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAkBjD;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAErD;IAED,mFAAmF;IACnF,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAShD;CACD","sourcesContent":["/**\n * Refinements — historial deshacible de los cambios automáticos de memoria.\n *\n * El engine revisa y edita la memoria solo (cada 10 turnos o 15 tool calls, más\n * la ruta de corrección instantánea). Eso es potente y es la razón de que la\n * memoria mejore sola, pero hasta ahora era IRREVERSIBLE: si guardaba algo\n * incorrecto, el usuario solo podía borrar por substring y esperar.\n *\n * La cadena hash de `audit.ts` NO sirve para esto: `AuditEntry` registra qué\n * pasó (acción, target, resultado) pero no el CONTENIDO, así que es\n * tamper-evidence, no un almacén de versiones. Esto es lo segundo.\n *\n * RIESGO DE CUMPLIMIENTO, cerrado aquí mismo: guardar el texto previo\n * reintroduce en disco exactamente lo que el scanner se negó a almacenar. Por\n * eso todo pasa por `redactSensitive` y el fichero se crea con modo 0600. Sin\n * eso estaríamos abriendo un agujero de privacidad para vender una feature de\n * privacidad.\n */\n\nimport { appendFile, chmod, mkdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { type PrivacyLevel, redactSensitive } from \"./security.ts\";\nimport type { MemoryTarget } from \"./types.ts\";\n\nexport interface RefinementOp {\n\taction: \"add\" | \"replace\" | \"remove\";\n\ttarget: MemoryTarget;\n\t/** Texto previo (redactado). Ausente en `add`. */\n\tbefore?: string;\n\t/** Texto nuevo (redactado). Ausente en `remove`. */\n\tafter?: string;\n}\n\nexport interface RefinementBatch {\n\t/** Identificador corto y estable del lote, para `/memory diff|rollback`. */\n\tid: string;\n\tts: string;\n\t/** Qué disparó el lote: revisión periódica, corrección del usuario, flush. */\n\tsource: string;\n\tops: RefinementOp[];\n}\n\n/** Invierte un lote: lo que habría que aplicar para deshacerlo. */\nexport function invertBatch(batch: RefinementBatch): RefinementOp[] {\n\t// Orden inverso: si un lote hizo A y luego B, deshacer exige B' y luego A'.\n\treturn [...batch.ops].reverse().flatMap((op): RefinementOp[] => {\n\t\tif (op.action === \"add\") {\n\t\t\treturn op.after ? [{ action: \"remove\", target: op.target, before: op.after }] : [];\n\t\t}\n\t\tif (op.action === \"remove\") {\n\t\t\treturn op.before ? [{ action: \"add\", target: op.target, after: op.before }] : [];\n\t\t}\n\t\t// replace: volver a poner el anterior en lugar del nuevo\n\t\treturn op.before && op.after\n\t\t\t? [{ action: \"replace\", target: op.target, before: op.after, after: op.before }]\n\t\t\t: [];\n\t});\n}\n\nexport class RefinementJournal {\n\tprivate path: string;\n\tprivate privacyLevel: PrivacyLevel;\n\n\tconstructor(rootDir: string, privacyLevel: PrivacyLevel = \"strict\") {\n\t\tthis.path = join(rootDir, \"refinements.jsonl\");\n\t\tthis.privacyLevel = privacyLevel;\n\t}\n\n\t/** Registra un lote. Redacta antes de tocar el disco. */\n\tasync append(batch: RefinementBatch): Promise<void> {\n\t\tconst safe: RefinementBatch = {\n\t\t\t...batch,\n\t\t\tops: batch.ops.map((op) => ({\n\t\t\t\t...op,\n\t\t\t\tbefore: op.before === undefined ? undefined : redactSensitive(op.before, this.privacyLevel),\n\t\t\t\tafter: op.after === undefined ? undefined : redactSensitive(op.after, this.privacyLevel),\n\t\t\t})),\n\t\t};\n\t\tawait mkdir(dirname(this.path), { recursive: true });\n\t\tawait appendFile(this.path, `${JSON.stringify(safe)}\\n`, { encoding: \"utf-8\", mode: 0o600 });\n\t\t// appendFile solo aplica `mode` al crear; forzamos por si ya existía.\n\t\tawait chmod(this.path, 0o600).catch(() => {});\n\t}\n\n\t/** Lotes más recientes primero. */\n\tasync list(limit = 20): Promise<RefinementBatch[]> {\n\t\ttry {\n\t\t\tconst raw = await readFile(this.path, \"utf-8\");\n\t\t\tconst all = raw\n\t\t\t\t.split(\"\\n\")\n\t\t\t\t.filter(Boolean)\n\t\t\t\t.map((line) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn JSON.parse(line) as RefinementBatch;\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\t.filter((b): b is RefinementBatch => b !== null);\n\t\t\treturn all.reverse().slice(0, limit);\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n\n\tasync get(id: string): Promise<RefinementBatch | null> {\n\t\treturn (await this.list(100000)).find((b) => b.id === id) ?? null;\n\t}\n\n\t/** Diff legible de un lote. Un rollback que nadie puede inspeccionar es teatro. */\n\tstatic renderDiff(batch: RefinementBatch): string {\n\t\tconst lines = [`Lote ${batch.id} — ${batch.ts} (${batch.source})`, \"\"];\n\t\tfor (const op of batch.ops) {\n\t\t\tlines.push(`[${op.action}] ${op.target}`);\n\t\t\tif (op.before) lines.push(...op.before.split(\"\\n\").map((l) => `  - ${l}`));\n\t\t\tif (op.after) lines.push(...op.after.split(\"\\n\").map((l) => `  + ${l}`));\n\t\t\tlines.push(\"\");\n\t\t}\n\t\treturn lines.join(\"\\n\").trimEnd();\n\t}\n}\n"]}

package/dist/core/memory-engine/refinements.js

@@ -0,0 +1,99 @@
+/**
+ * Refinements — historial deshacible de los cambios automáticos de memoria.
+ *
+ * El engine revisa y edita la memoria solo (cada 10 turnos o 15 tool calls, más
+ * la ruta de corrección instantánea). Eso es potente y es la razón de que la
+ * memoria mejore sola, pero hasta ahora era IRREVERSIBLE: si guardaba algo
+ * incorrecto, el usuario solo podía borrar por substring y esperar.
+ *
+ * La cadena hash de `audit.ts` NO sirve para esto: `AuditEntry` registra qué
+ * pasó (acción, target, resultado) pero no el CONTENIDO, así que es
+ * tamper-evidence, no un almacén de versiones. Esto es lo segundo.
+ *
+ * RIESGO DE CUMPLIMIENTO, cerrado aquí mismo: guardar el texto previo
+ * reintroduce en disco exactamente lo que el scanner se negó a almacenar. Por
+ * eso todo pasa por `redactSensitive` y el fichero se crea con modo 0600. Sin
+ * eso estaríamos abriendo un agujero de privacidad para vender una feature de
+ * privacidad.
+ */
+import { appendFile, chmod, mkdir, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { redactSensitive } from "./security.js";
+/** Invierte un lote: lo que habría que aplicar para deshacerlo. */
+export function invertBatch(batch) {
+    // Orden inverso: si un lote hizo A y luego B, deshacer exige B' y luego A'.
+    return [...batch.ops].reverse().flatMap((op) => {
+        if (op.action === "add") {
+            return op.after ? [{ action: "remove", target: op.target, before: op.after }] : [];
+        }
+        if (op.action === "remove") {
+            return op.before ? [{ action: "add", target: op.target, after: op.before }] : [];
+        }
+        // replace: volver a poner el anterior en lugar del nuevo
+        return op.before && op.after
+            ? [{ action: "replace", target: op.target, before: op.after, after: op.before }]
+            : [];
+    });
+}
+export class RefinementJournal {
+    path;
+    privacyLevel;
+    constructor(rootDir, privacyLevel = "strict") {
+        this.path = join(rootDir, "refinements.jsonl");
+        this.privacyLevel = privacyLevel;
+    }
+    /** Registra un lote. Redacta antes de tocar el disco. */
+    async append(batch) {
+        const safe = {
+            ...batch,
+            ops: batch.ops.map((op) => ({
+                ...op,
+                before: op.before === undefined ? undefined : redactSensitive(op.before, this.privacyLevel),
+                after: op.after === undefined ? undefined : redactSensitive(op.after, this.privacyLevel),
+            })),
+        };
+        await mkdir(dirname(this.path), { recursive: true });
+        await appendFile(this.path, `${JSON.stringify(safe)}\n`, { encoding: "utf-8", mode: 0o600 });
+        // appendFile solo aplica `mode` al crear; forzamos por si ya existía.
+        await chmod(this.path, 0o600).catch(() => { });
+    }
+    /** Lotes más recientes primero. */
+    async list(limit = 20) {
+        try {
+            const raw = await readFile(this.path, "utf-8");
+            const all = raw
+                .split("\n")
+                .filter(Boolean)
+                .map((line) => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter((b) => b !== null);
+            return all.reverse().slice(0, limit);
+        }
+        catch {
+            return [];
+        }
+    }
+    async get(id) {
+        return (await this.list(100000)).find((b) => b.id === id) ?? null;
+    }
+    /** Diff legible de un lote. Un rollback que nadie puede inspeccionar es teatro. */
+    static renderDiff(batch) {
+        const lines = [`Lote ${batch.id} — ${batch.ts} (${batch.source})`, ""];
+        for (const op of batch.ops) {
+            lines.push(`[${op.action}] ${op.target}`);
+            if (op.before)
+                lines.push(...op.before.split("\n").map((l) => `  - ${l}`));
+            if (op.after)
+                lines.push(...op.after.split("\n").map((l) => `  + ${l}`));
+            lines.push("");
+        }
+        return lines.join("\n").trimEnd();
+    }
+}
+//# sourceMappingURL=refinements.js.map

package/dist/core/memory-engine/refinements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refinements.js","sourceRoot":"","sources":["../../../src/core/memory-engine/refinements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAqB,eAAe,EAAE,MAAM,eAAe,CAAC;AAqBnE,oEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,KAAsB,EAAkB;IACnE,4EAA4E;IAC5E,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAkB,EAAE,CAAC;QAC/D,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,yDAAyD;QACzD,OAAO,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK;YAC3B,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC,CAAC,EAAE,CAAC;IAAA,CACN,CAAC,CAAC;AAAA,CACH;AAED,MAAM,OAAO,iBAAiB;IACrB,IAAI,CAAS;IACb,YAAY,CAAe;IAEnC,YAAY,OAAe,EAAE,YAAY,GAAiB,QAAQ,EAAE;QACnE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAAA,CACjC;IAED,yDAAyD;IACzD,KAAK,CAAC,MAAM,CAAC,KAAsB,EAAiB;QACnD,MAAM,IAAI,GAAoB;YAC7B,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE;gBACL,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC3F,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC;aACxF,CAAC,CAAC;SACH,CAAC;QACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,uEAAsE;QACtE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;IAAA,CAC9C;IAED,oCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,EAA8B;QAClD,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG;iBACb,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACd,IAAI,CAAC;oBACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,IAAI,CAAC;gBACb,CAAC;YAAA,CACD,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;QACX,CAAC;IAAA,CACD;IAED,KAAK,CAAC,GAAG,CAAC,EAAU,EAAmC;QACtD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IAAA,CAClE;IAED,mFAAmF;IACnF,MAAM,CAAC,UAAU,CAAC,KAAsB,EAAU;QACjD,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,QAAM,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,IAAI,EAAE,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3E,IAAI,EAAE,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IAAA,CAClC;CACD","sourcesContent":["/**\n * Refinements — historial deshacible de los cambios automáticos de memoria.\n *\n * El engine revisa y edita la memoria solo (cada 10 turnos o 15 tool calls, más\n * la ruta de corrección instantánea). Eso es potente y es la razón de que la\n * memoria mejore sola, pero hasta ahora era IRREVERSIBLE: si guardaba algo\n * incorrecto, el usuario solo podía borrar por substring y esperar.\n *\n * La cadena hash de `audit.ts` NO sirve para esto: `AuditEntry` registra qué\n * pasó (acción, target, resultado) pero no el CONTENIDO, así que es\n * tamper-evidence, no un almacén de versiones. Esto es lo segundo.\n *\n * RIESGO DE CUMPLIMIENTO, cerrado aquí mismo: guardar el texto previo\n * reintroduce en disco exactamente lo que el scanner se negó a almacenar. Por\n * eso todo pasa por `redactSensitive` y el fichero se crea con modo 0600. Sin\n * eso estaríamos abriendo un agujero de privacidad para vender una feature de\n * privacidad.\n */\n\nimport { appendFile, chmod, mkdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { type PrivacyLevel, redactSensitive } from \"./security.ts\";\nimport type { MemoryTarget } from \"./types.ts\";\n\nexport interface RefinementOp {\n\taction: \"add\" | \"replace\" | \"remove\";\n\ttarget: MemoryTarget;\n\t/** Texto previo (redactado). Ausente en `add`. */\n\tbefore?: string;\n\t/** Texto nuevo (redactado). Ausente en `remove`. */\n\tafter?: string;\n}\n\nexport interface RefinementBatch {\n\t/** Identificador corto y estable del lote, para `/memory diff|rollback`. */\n\tid: string;\n\tts: string;\n\t/** Qué disparó el lote: revisión periódica, corrección del usuario, flush. */\n\tsource: string;\n\tops: RefinementOp[];\n}\n\n/** Invierte un lote: lo que habría que aplicar para deshacerlo. */\nexport function invertBatch(batch: RefinementBatch): RefinementOp[] {\n\t// Orden inverso: si un lote hizo A y luego B, deshacer exige B' y luego A'.\n\treturn [...batch.ops].reverse().flatMap((op): RefinementOp[] => {\n\t\tif (op.action === \"add\") {\n\t\t\treturn op.after ? [{ action: \"remove\", target: op.target, before: op.after }] : [];\n\t\t}\n\t\tif (op.action === \"remove\") {\n\t\t\treturn op.before ? [{ action: \"add\", target: op.target, after: op.before }] : [];\n\t\t}\n\t\t// replace: volver a poner el anterior en lugar del nuevo\n\t\treturn op.before && op.after\n\t\t\t? [{ action: \"replace\", target: op.target, before: op.after, after: op.before }]\n\t\t\t: [];\n\t});\n}\n\nexport class RefinementJournal {\n\tprivate path: string;\n\tprivate privacyLevel: PrivacyLevel;\n\n\tconstructor(rootDir: string, privacyLevel: PrivacyLevel = \"strict\") {\n\t\tthis.path = join(rootDir, \"refinements.jsonl\");\n\t\tthis.privacyLevel = privacyLevel;\n\t}\n\n\t/** Registra un lote. Redacta antes de tocar el disco. */\n\tasync append(batch: RefinementBatch): Promise<void> {\n\t\tconst safe: RefinementBatch = {\n\t\t\t...batch,\n\t\t\tops: batch.ops.map((op) => ({\n\t\t\t\t...op,\n\t\t\t\tbefore: op.before === undefined ? undefined : redactSensitive(op.before, this.privacyLevel),\n\t\t\t\tafter: op.after === undefined ? undefined : redactSensitive(op.after, this.privacyLevel),\n\t\t\t})),\n\t\t};\n\t\tawait mkdir(dirname(this.path), { recursive: true });\n\t\tawait appendFile(this.path, `${JSON.stringify(safe)}\\n`, { encoding: \"utf-8\", mode: 0o600 });\n\t\t// appendFile solo aplica `mode` al crear; forzamos por si ya existía.\n\t\tawait chmod(this.path, 0o600).catch(() => {});\n\t}\n\n\t/** Lotes más recientes primero. */\n\tasync list(limit = 20): Promise<RefinementBatch[]> {\n\t\ttry {\n\t\t\tconst raw = await readFile(this.path, \"utf-8\");\n\t\t\tconst all = raw\n\t\t\t\t.split(\"\\n\")\n\t\t\t\t.filter(Boolean)\n\t\t\t\t.map((line) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn JSON.parse(line) as RefinementBatch;\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t}\n\t\t\t\t})\n\t\t\t\t.filter((b): b is RefinementBatch => b !== null);\n\t\t\treturn all.reverse().slice(0, limit);\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n\n\tasync get(id: string): Promise<RefinementBatch | null> {\n\t\treturn (await this.list(100000)).find((b) => b.id === id) ?? null;\n\t}\n\n\t/** Diff legible de un lote. Un rollback que nadie puede inspeccionar es teatro. */\n\tstatic renderDiff(batch: RefinementBatch): string {\n\t\tconst lines = [`Lote ${batch.id} — ${batch.ts} (${batch.source})`, \"\"];\n\t\tfor (const op of batch.ops) {\n\t\t\tlines.push(`[${op.action}] ${op.target}`);\n\t\t\tif (op.before) lines.push(...op.before.split(\"\\n\").map((l) => `  - ${l}`));\n\t\t\tif (op.after) lines.push(...op.after.split(\"\\n\").map((l) => `  + ${l}`));\n\t\t\tlines.push(\"\");\n\t\t}\n\t\treturn lines.join(\"\\n\").trimEnd();\n\t}\n}\n"]}

package/dist/core/memory-engine/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/core/memory-engine/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkDH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB1D","sourcesContent":["/**\n * Content scanner — blocks prompt-injection, exfiltration and secret leaks\n * from ever being persisted into memory (pattern set captured from\n * pi-hermes-memory's content-scanner, which ported it from Hermes).\n */\n\ninterface ScanIssue {\n\tpattern: RegExp;\n\tid: string;\n\tseverity: \"high\" | \"medium\";\n}\n\nconst THREAT_PATTERNS: ScanIssue[] = [\n\t{ pattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i, id: \"prompt_injection\", severity: \"high\" },\n\t{ pattern: /you\\s+are\\s+now\\s+/i, id: \"role_hijack\", severity: \"high\" },\n\t{ pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, id: \"deception_hide\", severity: \"high\" },\n\t{ pattern: /system\\s+prompt\\s+override/i, id: \"sys_prompt_override\", severity: \"high\" },\n\t{ pattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i, id: \"disregard_rules\", severity: \"high\" },\n\t{ pattern: /act\\s+as\\s+(if|though)\\s+you\\s+(have\\s+no|don'?t\\s+have)\\s+(restrictions|limits|rules)/i, id: \"bypass_restrictions\", severity: \"high\" },\n\t{ pattern: /curl\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_curl\", severity: \"high\" },\n\t{ pattern: /wget\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_wget\", severity: \"high\" },\n\t{ pattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i, id: \"read_secrets\", severity: \"high\" },\n\t{ pattern: /authorized_keys/i, id: \"ssh_backdoor\", severity: \"high\" },\n\t{ pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, id: \"ssh_access\", severity: \"high\" },\n];\n\nconst SECRET_PATTERNS: ScanIssue[] = [\n\t{ pattern: /\\bsk-ant-api\\S{10,}\\b/, id: \"anthropic_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-or-v1-\\S{10,}\\b/, id: \"openrouter_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-\\S{20,}\\b/, id: \"openai_api_key\", severity: \"high\" },\n\t{ pattern: /\\bAKIA[0-9A-Z]{16}\\b/, id: \"aws_access_key\", severity: \"high\" },\n\t{ pattern: /\\bghp_\\S{10,}\\b/, id: \"github_personal_token\", severity: \"high\" },\n\t{ pattern: /\\bghu_\\S{10,}\\b/, id: \"github_user_token\", severity: \"high\" },\n\t{ pattern: /\\bxoxb-\\S{10,}\\b/, id: \"slack_bot_token\", severity: \"high\" },\n\t{ pattern: /\\bxapp-\\S{10,}\\b/, id: \"slack_app_token\", severity: \"high\" },\n\t{ pattern: /\\bntn_\\S{10,}\\b/, id: \"notion_token\", severity: \"high\" },\n\t{ pattern: /\\bBearer\\s+\\S{20,}\\b/, id: \"bearer_auth_token\", severity: \"high\" },\n\t{ pattern: /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\sKEY-----/, id: \"private_key_block\", severity: \"high\" },\n\t{ pattern: /\\bANTHROPIC_API_KEY\\b/, id: \"env_anthropic_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENAI_API_KEY\\b/, id: \"env_openai_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENROUTER_API_KEY\\b/, id: \"env_openrouter_key\", severity: \"medium\" },\n\t{ pattern: /\\bGITHUB_TOKEN\\b/, id: \"env_github_token\", severity: \"medium\" },\n\t{ pattern: /\\bAWS_SECRET_ACCESS_KEY\\b/, id: \"env_aws_secret\", severity: \"medium\" },\n\t{ pattern: /\\bDATABASE_URL\\b/, id: \"env_database_url\", severity: \"medium\" },\n\t{ pattern: /\\bpassword\\s*[=:]\\s*\\S{6,}\\b/i, id: \"password_assignment\", severity: \"medium\" },\n\t{ pattern: /\\bsecret\\s*[=:]\\s*\\S{6,}\\b/i, id: \"secret_assignment\", severity: \"medium\" },\n\t{ pattern: /\\btoken\\s*[=:]\\s*\\S{10,}\\b/i, id: \"token_assignment\", severity: \"medium\" },\n];\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\", \"\\u200c\", \"\\u200d\", \"\\u2060\", \"\\ufeff\",\n\t\"\\u202a\", \"\\u202b\", \"\\u202c\", \"\\u202d\", \"\\u202e\",\n]);\n\n/**\n * Scan memory content before persisting. Returns an error message when the\n * content must be rejected, or null when it is safe to store.\n */\nexport function scanContent(content: string): string | null {\n\tconst visible = [...content].filter((ch) => !INVISIBLE_CHARS.has(ch)).join(\"\");\n\tif (visible !== content) {\n\t\treturn \"Content contains invisible/zero-width characters and was rejected for safety.\";\n\t}\n\tfor (const issue of THREAT_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: looks like prompt injection or data exfiltration (${issue.id}).`;\n\t\t}\n\t}\n\tfor (const issue of SECRET_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: possible secret/credential detected (${issue.id}). Secrets are never stored in memory.`;\n\t\t}\n\t}\n\treturn null;\n}\n"]}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/core/memory-engine/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsEH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB1D","sourcesContent":["/**\n * Content scanner — blocks prompt-injection, exfiltration and secret leaks\n * from ever being persisted into memory (pattern set captured from\n * pi-hermes-memory's content-scanner, which ported it from Hermes).\n */\n\ninterface ScanIssue {\n\tpattern: RegExp;\n\tid: string;\n\tseverity: \"high\" | \"medium\";\n}\n\nconst THREAT_PATTERNS: ScanIssue[] = [\n\t{ pattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i, id: \"prompt_injection\", severity: \"high\" },\n\t{ pattern: /you\\s+are\\s+now\\s+/i, id: \"role_hijack\", severity: \"high\" },\n\t{ pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, id: \"deception_hide\", severity: \"high\" },\n\t{ pattern: /system\\s+prompt\\s+override/i, id: \"sys_prompt_override\", severity: \"high\" },\n\t{\n\t\tpattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i,\n\t\tid: \"disregard_rules\",\n\t\tseverity: \"high\",\n\t},\n\t{\n\t\tpattern: /act\\s+as\\s+(if|though)\\s+you\\s+(have\\s+no|don'?t\\s+have)\\s+(restrictions|limits|rules)/i,\n\t\tid: \"bypass_restrictions\",\n\t\tseverity: \"high\",\n\t},\n\t{ pattern: /curl\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_curl\", severity: \"high\" },\n\t{ pattern: /wget\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_wget\", severity: \"high\" },\n\t{\n\t\tpattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i,\n\t\tid: \"read_secrets\",\n\t\tseverity: \"high\",\n\t},\n\t{ pattern: /authorized_keys/i, id: \"ssh_backdoor\", severity: \"high\" },\n\t{ pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, id: \"ssh_access\", severity: \"high\" },\n];\n\nconst SECRET_PATTERNS: ScanIssue[] = [\n\t{ pattern: /\\bsk-ant-api\\S{10,}\\b/, id: \"anthropic_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-or-v1-\\S{10,}\\b/, id: \"openrouter_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-\\S{20,}\\b/, id: \"openai_api_key\", severity: \"high\" },\n\t{ pattern: /\\bAKIA[0-9A-Z]{16}\\b/, id: \"aws_access_key\", severity: \"high\" },\n\t{ pattern: /\\bghp_\\S{10,}\\b/, id: \"github_personal_token\", severity: \"high\" },\n\t{ pattern: /\\bghu_\\S{10,}\\b/, id: \"github_user_token\", severity: \"high\" },\n\t{ pattern: /\\bxoxb-\\S{10,}\\b/, id: \"slack_bot_token\", severity: \"high\" },\n\t{ pattern: /\\bxapp-\\S{10,}\\b/, id: \"slack_app_token\", severity: \"high\" },\n\t{ pattern: /\\bntn_\\S{10,}\\b/, id: \"notion_token\", severity: \"high\" },\n\t{ pattern: /\\bBearer\\s+\\S{20,}\\b/, id: \"bearer_auth_token\", severity: \"high\" },\n\t{ pattern: /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\sKEY-----/, id: \"private_key_block\", severity: \"high\" },\n\t{ pattern: /\\bANTHROPIC_API_KEY\\b/, id: \"env_anthropic_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENAI_API_KEY\\b/, id: \"env_openai_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENROUTER_API_KEY\\b/, id: \"env_openrouter_key\", severity: \"medium\" },\n\t{ pattern: /\\bGITHUB_TOKEN\\b/, id: \"env_github_token\", severity: \"medium\" },\n\t{ pattern: /\\bAWS_SECRET_ACCESS_KEY\\b/, id: \"env_aws_secret\", severity: \"medium\" },\n\t{ pattern: /\\bDATABASE_URL\\b/, id: \"env_database_url\", severity: \"medium\" },\n\t{ pattern: /\\bpassword\\s*[=:]\\s*\\S{6,}\\b/i, id: \"password_assignment\", severity: \"medium\" },\n\t{ pattern: /\\bsecret\\s*[=:]\\s*\\S{6,}\\b/i, id: \"secret_assignment\", severity: \"medium\" },\n\t{ pattern: /\\btoken\\s*[=:]\\s*\\S{10,}\\b/i, id: \"token_assignment\", severity: \"medium\" },\n];\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\",\n\t\"\\u200c\",\n\t\"\\u200d\",\n\t\"\\u2060\",\n\t\"\\ufeff\",\n\t\"\\u202a\",\n\t\"\\u202b\",\n\t\"\\u202c\",\n\t\"\\u202d\",\n\t\"\\u202e\",\n]);\n\n/**\n * Scan memory content before persisting. Returns an error message when the\n * content must be rejected, or null when it is safe to store.\n */\nexport function scanContent(content: string): string | null {\n\tconst visible = [...content].filter((ch) => !INVISIBLE_CHARS.has(ch)).join(\"\");\n\tif (visible !== content) {\n\t\treturn \"Content contains invisible/zero-width characters and was rejected for safety.\";\n\t}\n\tfor (const issue of THREAT_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: looks like prompt injection or data exfiltration (${issue.id}).`;\n\t\t}\n\t}\n\tfor (const issue of SECRET_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: possible secret/credential detected (${issue.id}). Secrets are never stored in memory.`;\n\t\t}\n\t}\n\treturn null;\n}\n"]}

package/dist/core/memory-engine/scanner.js

@@ -8,11 +8,23 @@ const THREAT_PATTERNS = [
     { pattern: /you\s+are\s+now\s+/i, id: "role_hijack", severity: "high" },
     { pattern: /do\s+not\s+tell\s+the\s+user/i, id: "deception_hide", severity: "high" },
     { pattern: /system\s+prompt\s+override/i, id: "sys_prompt_override", severity: "high" },
-    { pattern: /disregard\s+(your|all|any)\s+(instructions|rules|guidelines)/i, id: "disregard_rules", severity: "high" },
-    { pattern: /act\s+as\s+(if|though)\s+you\s+(have\s+no|don'?t\s+have)\s+(restrictions|limits|rules)/i, id: "bypass_restrictions", severity: "high" },
+    {
+        pattern: /disregard\s+(your|all|any)\s+(instructions|rules|guidelines)/i,
+        id: "disregard_rules",
+        severity: "high",
+    },
+    {
+        pattern: /act\s+as\s+(if|though)\s+you\s+(have\s+no|don'?t\s+have)\s+(restrictions|limits|rules)/i,
+        id: "bypass_restrictions",
+        severity: "high",
+    },
     { pattern: /curl\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: "exfil_curl", severity: "high" },
     { pattern: /wget\s+[^\n]*\$\{?\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: "exfil_wget", severity: "high" },
-    { pattern: /cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i, id: "read_secrets", severity: "high" },
+    {
+        pattern: /cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i,
+        id: "read_secrets",
+        severity: "high",
+    },
     { pattern: /authorized_keys/i, id: "ssh_backdoor", severity: "high" },
     { pattern: /\$HOME\/\.ssh|~\/\.ssh/i, id: "ssh_access", severity: "high" },
 ];
@@ -39,8 +51,16 @@ const SECRET_PATTERNS = [
     { pattern: /\btoken\s*[=:]\s*\S{10,}\b/i, id: "token_assignment", severity: "medium" },
 ];
 const INVISIBLE_CHARS = new Set([
-    "\u200b", "\u200c", "\u200d", "\u2060", "\ufeff",
-    "\u202a", "\u202b", "\u202c", "\u202d", "\u202e",
+    "\u200b",
+    "\u200c",
+    "\u200d",
+    "\u2060",
+    "\ufeff",
+    "\u202a",
+    "\u202b",
+    "\u202c",
+    "\u202d",
+    "\u202e",
 ]);
 /**
  * Scan memory content before persisting. Returns an error message when the

package/dist/core/memory-engine/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/core/memory-engine/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,eAAe,GAAgB;IACpC,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvE,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpF,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvF,EAAE,OAAO,EAAE,+DAA+D,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrH,EAAE,OAAO,EAAE,yFAAyF,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnJ,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnH,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnH,EAAE,OAAO,EAAE,oEAAoE,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvH,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC1E,CAAC;AAEF,MAAM,eAAe,GAAgB;IACpC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/E,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/E,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC3E,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7E,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACzE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACxE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACxE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC9E,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnG,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACnF,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAClF,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3F,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACvF,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;CACtF,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IAChD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;CAChD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAiB;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,+EAA+E,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,2EAA2E,KAAK,CAAC,EAAE,IAAI,CAAC;QAChG,CAAC;IACF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,8DAA8D,KAAK,CAAC,EAAE,wCAAwC,CAAC;QACvH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ","sourcesContent":["/**\n * Content scanner — blocks prompt-injection, exfiltration and secret leaks\n * from ever being persisted into memory (pattern set captured from\n * pi-hermes-memory's content-scanner, which ported it from Hermes).\n */\n\ninterface ScanIssue {\n\tpattern: RegExp;\n\tid: string;\n\tseverity: \"high\" | \"medium\";\n}\n\nconst THREAT_PATTERNS: ScanIssue[] = [\n\t{ pattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i, id: \"prompt_injection\", severity: \"high\" },\n\t{ pattern: /you\\s+are\\s+now\\s+/i, id: \"role_hijack\", severity: \"high\" },\n\t{ pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, id: \"deception_hide\", severity: \"high\" },\n\t{ pattern: /system\\s+prompt\\s+override/i, id: \"sys_prompt_override\", severity: \"high\" },\n\t{ pattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i, id: \"disregard_rules\", severity: \"high\" },\n\t{ pattern: /act\\s+as\\s+(if|though)\\s+you\\s+(have\\s+no|don'?t\\s+have)\\s+(restrictions|limits|rules)/i, id: \"bypass_restrictions\", severity: \"high\" },\n\t{ pattern: /curl\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_curl\", severity: \"high\" },\n\t{ pattern: /wget\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_wget\", severity: \"high\" },\n\t{ pattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i, id: \"read_secrets\", severity: \"high\" },\n\t{ pattern: /authorized_keys/i, id: \"ssh_backdoor\", severity: \"high\" },\n\t{ pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, id: \"ssh_access\", severity: \"high\" },\n];\n\nconst SECRET_PATTERNS: ScanIssue[] = [\n\t{ pattern: /\\bsk-ant-api\\S{10,}\\b/, id: \"anthropic_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-or-v1-\\S{10,}\\b/, id: \"openrouter_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-\\S{20,}\\b/, id: \"openai_api_key\", severity: \"high\" },\n\t{ pattern: /\\bAKIA[0-9A-Z]{16}\\b/, id: \"aws_access_key\", severity: \"high\" },\n\t{ pattern: /\\bghp_\\S{10,}\\b/, id: \"github_personal_token\", severity: \"high\" },\n\t{ pattern: /\\bghu_\\S{10,}\\b/, id: \"github_user_token\", severity: \"high\" },\n\t{ pattern: /\\bxoxb-\\S{10,}\\b/, id: \"slack_bot_token\", severity: \"high\" },\n\t{ pattern: /\\bxapp-\\S{10,}\\b/, id: \"slack_app_token\", severity: \"high\" },\n\t{ pattern: /\\bntn_\\S{10,}\\b/, id: \"notion_token\", severity: \"high\" },\n\t{ pattern: /\\bBearer\\s+\\S{20,}\\b/, id: \"bearer_auth_token\", severity: \"high\" },\n\t{ pattern: /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\sKEY-----/, id: \"private_key_block\", severity: \"high\" },\n\t{ pattern: /\\bANTHROPIC_API_KEY\\b/, id: \"env_anthropic_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENAI_API_KEY\\b/, id: \"env_openai_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENROUTER_API_KEY\\b/, id: \"env_openrouter_key\", severity: \"medium\" },\n\t{ pattern: /\\bGITHUB_TOKEN\\b/, id: \"env_github_token\", severity: \"medium\" },\n\t{ pattern: /\\bAWS_SECRET_ACCESS_KEY\\b/, id: \"env_aws_secret\", severity: \"medium\" },\n\t{ pattern: /\\bDATABASE_URL\\b/, id: \"env_database_url\", severity: \"medium\" },\n\t{ pattern: /\\bpassword\\s*[=:]\\s*\\S{6,}\\b/i, id: \"password_assignment\", severity: \"medium\" },\n\t{ pattern: /\\bsecret\\s*[=:]\\s*\\S{6,}\\b/i, id: \"secret_assignment\", severity: \"medium\" },\n\t{ pattern: /\\btoken\\s*[=:]\\s*\\S{10,}\\b/i, id: \"token_assignment\", severity: \"medium\" },\n];\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\", \"\\u200c\", \"\\u200d\", \"\\u2060\", \"\\ufeff\",\n\t\"\\u202a\", \"\\u202b\", \"\\u202c\", \"\\u202d\", \"\\u202e\",\n]);\n\n/**\n * Scan memory content before persisting. Returns an error message when the\n * content must be rejected, or null when it is safe to store.\n */\nexport function scanContent(content: string): string | null {\n\tconst visible = [...content].filter((ch) => !INVISIBLE_CHARS.has(ch)).join(\"\");\n\tif (visible !== content) {\n\t\treturn \"Content contains invisible/zero-width characters and was rejected for safety.\";\n\t}\n\tfor (const issue of THREAT_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: looks like prompt injection or data exfiltration (${issue.id}).`;\n\t\t}\n\t}\n\tfor (const issue of SECRET_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: possible secret/credential detected (${issue.id}). Secrets are never stored in memory.`;\n\t\t}\n\t}\n\treturn null;\n}\n"]}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/core/memory-engine/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,eAAe,GAAgB;IACpC,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvE,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpF,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACvF;QACC,OAAO,EAAE,+DAA+D;QACxE,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAM;KAChB;IACD;QACC,OAAO,EAAE,yFAAyF;QAClG,EAAE,EAAE,qBAAqB;QACzB,QAAQ,EAAE,MAAM;KAChB;IACD,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnH,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnH;QACC,OAAO,EAAE,oEAAoE;QAC7E,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,MAAM;KAChB;IACD,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC1E,CAAC;AAEF,MAAM,eAAe,GAAgB;IACpC,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/E,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC/E,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC3E,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7E,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACzE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACxE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACxE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE;IACpE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC9E,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACnG,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACjF,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACnF,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAClF,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3F,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACvF,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;CACtF,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAiB;IAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,+EAA+E,CAAC;IACxF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,2EAA2E,KAAK,CAAC,EAAE,IAAI,CAAC;QAChG,CAAC;IACF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,8DAA8D,KAAK,CAAC,EAAE,wCAAwC,CAAC;QACvH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ","sourcesContent":["/**\n * Content scanner — blocks prompt-injection, exfiltration and secret leaks\n * from ever being persisted into memory (pattern set captured from\n * pi-hermes-memory's content-scanner, which ported it from Hermes).\n */\n\ninterface ScanIssue {\n\tpattern: RegExp;\n\tid: string;\n\tseverity: \"high\" | \"medium\";\n}\n\nconst THREAT_PATTERNS: ScanIssue[] = [\n\t{ pattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i, id: \"prompt_injection\", severity: \"high\" },\n\t{ pattern: /you\\s+are\\s+now\\s+/i, id: \"role_hijack\", severity: \"high\" },\n\t{ pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, id: \"deception_hide\", severity: \"high\" },\n\t{ pattern: /system\\s+prompt\\s+override/i, id: \"sys_prompt_override\", severity: \"high\" },\n\t{\n\t\tpattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i,\n\t\tid: \"disregard_rules\",\n\t\tseverity: \"high\",\n\t},\n\t{\n\t\tpattern: /act\\s+as\\s+(if|though)\\s+you\\s+(have\\s+no|don'?t\\s+have)\\s+(restrictions|limits|rules)/i,\n\t\tid: \"bypass_restrictions\",\n\t\tseverity: \"high\",\n\t},\n\t{ pattern: /curl\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_curl\", severity: \"high\" },\n\t{ pattern: /wget\\s+[^\\n]*\\$\\{?\\w*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, id: \"exfil_wget\", severity: \"high\" },\n\t{\n\t\tpattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i,\n\t\tid: \"read_secrets\",\n\t\tseverity: \"high\",\n\t},\n\t{ pattern: /authorized_keys/i, id: \"ssh_backdoor\", severity: \"high\" },\n\t{ pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, id: \"ssh_access\", severity: \"high\" },\n];\n\nconst SECRET_PATTERNS: ScanIssue[] = [\n\t{ pattern: /\\bsk-ant-api\\S{10,}\\b/, id: \"anthropic_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-or-v1-\\S{10,}\\b/, id: \"openrouter_api_key\", severity: \"high\" },\n\t{ pattern: /\\bsk-\\S{20,}\\b/, id: \"openai_api_key\", severity: \"high\" },\n\t{ pattern: /\\bAKIA[0-9A-Z]{16}\\b/, id: \"aws_access_key\", severity: \"high\" },\n\t{ pattern: /\\bghp_\\S{10,}\\b/, id: \"github_personal_token\", severity: \"high\" },\n\t{ pattern: /\\bghu_\\S{10,}\\b/, id: \"github_user_token\", severity: \"high\" },\n\t{ pattern: /\\bxoxb-\\S{10,}\\b/, id: \"slack_bot_token\", severity: \"high\" },\n\t{ pattern: /\\bxapp-\\S{10,}\\b/, id: \"slack_app_token\", severity: \"high\" },\n\t{ pattern: /\\bntn_\\S{10,}\\b/, id: \"notion_token\", severity: \"high\" },\n\t{ pattern: /\\bBearer\\s+\\S{20,}\\b/, id: \"bearer_auth_token\", severity: \"high\" },\n\t{ pattern: /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\sKEY-----/, id: \"private_key_block\", severity: \"high\" },\n\t{ pattern: /\\bANTHROPIC_API_KEY\\b/, id: \"env_anthropic_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENAI_API_KEY\\b/, id: \"env_openai_key\", severity: \"medium\" },\n\t{ pattern: /\\bOPENROUTER_API_KEY\\b/, id: \"env_openrouter_key\", severity: \"medium\" },\n\t{ pattern: /\\bGITHUB_TOKEN\\b/, id: \"env_github_token\", severity: \"medium\" },\n\t{ pattern: /\\bAWS_SECRET_ACCESS_KEY\\b/, id: \"env_aws_secret\", severity: \"medium\" },\n\t{ pattern: /\\bDATABASE_URL\\b/, id: \"env_database_url\", severity: \"medium\" },\n\t{ pattern: /\\bpassword\\s*[=:]\\s*\\S{6,}\\b/i, id: \"password_assignment\", severity: \"medium\" },\n\t{ pattern: /\\bsecret\\s*[=:]\\s*\\S{6,}\\b/i, id: \"secret_assignment\", severity: \"medium\" },\n\t{ pattern: /\\btoken\\s*[=:]\\s*\\S{10,}\\b/i, id: \"token_assignment\", severity: \"medium\" },\n];\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\",\n\t\"\\u200c\",\n\t\"\\u200d\",\n\t\"\\u2060\",\n\t\"\\ufeff\",\n\t\"\\u202a\",\n\t\"\\u202b\",\n\t\"\\u202c\",\n\t\"\\u202d\",\n\t\"\\u202e\",\n]);\n\n/**\n * Scan memory content before persisting. Returns an error message when the\n * content must be rejected, or null when it is safe to store.\n */\nexport function scanContent(content: string): string | null {\n\tconst visible = [...content].filter((ch) => !INVISIBLE_CHARS.has(ch)).join(\"\");\n\tif (visible !== content) {\n\t\treturn \"Content contains invisible/zero-width characters and was rejected for safety.\";\n\t}\n\tfor (const issue of THREAT_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: looks like prompt injection or data exfiltration (${issue.id}).`;\n\t\t}\n\t}\n\tfor (const issue of SECRET_PATTERNS) {\n\t\tif (issue.pattern.test(content)) {\n\t\t\treturn `Content was rejected: possible secret/credential detected (${issue.id}). Secrets are never stored in memory.`;\n\t\t}\n\t}\n\treturn null;\n}\n"]}

package/dist/core/memory-engine/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/core/memory-engine/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAC1B,YAAY,GACZ,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,WAAW,GACX,QAAQ,GACR,UAAU,GACV,SAAS,GACT,WAAW,GACX,cAAc,CAAC;AAElB,MAAM,WAAW,iBAAiB;IACjC,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,OAAO,CAAC;CACpB;AAsJD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,YAAuB,EAAE,MAAM,GAAE,IAAI,GAAG,IAAW,GAAG,iBAAiB,CA+ChI;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,YAAuB,GAAG,MAAM,CAmBpF","sourcesContent":["/**\n * Security & privacy classification for the Ada Memory Engine.\n *\n * Enterprise-grade guards:\n * - Credentials/secrets/payment data are ALWAYS blocked at every level.\n * - PII (email, phone, national IDs, IBAN, DOB) blocking depends on the\n *   configured privacy level (RGPD / AI Act friendly).\n * - Every rejection is written to the audit log with a reason.\n * - Prompt-injection/exfiltration patterns are always blocked.\n */\n\nexport type PrivacyLevel = \"strict\" | \"balanced\" | \"permissive\";\n\nexport type SensitiveCategory =\n\t| \"credential\"\n\t| \"payment\"\n\t| \"secret-assignment\"\n\t| \"pii-email\"\n\t| \"pii-phone\"\n\t| \"pii-id\"\n\t| \"pii-bank\"\n\t| \"pii-dob\"\n\t| \"injection\"\n\t| \"exfiltration\";\n\nexport interface SensitivityResult {\n\t/** True when the content must NOT be stored. */\n\tblocked: boolean;\n\t/** Categories detected. */\n\tcategories: SensitiveCategory[];\n\t/** Human-readable reason (in the configured language). */\n\treason: string;\n\t/** True when content contains permitted-but-noteworthy categories. */\n\tnoteworthy: boolean;\n}\n\ninterface Pattern {\n\tcategory: SensitiveCategory;\n\tpattern: RegExp;\n\t/** Always blocked regardless of privacy level. */\n\talways?: boolean;\n\t/** Blocked at this level and stricter. */\n\tblockAt?: PrivacyLevel;\n\t/** English reason label. */\n\tlabel: string;\n}\n\n// ─── Credentials & secrets — ALWAYS blocked ───\nconst ALWAYS_BLOCKED: Pattern[] = [\n\t{ category: \"credential\", pattern: /\\bsk-ant-api\\S{10,}\\b/, always: true, label: \"Anthropic API key\" },\n\t{ category: \"credential\", pattern: /\\bsk-or-v1-\\S{10,}\\b/, always: true, label: \"OpenRouter API key\" },\n\t{ category: \"credential\", pattern: /\\bsk-[A-Za-z0-9]{20,}\\b/, always: true, label: \"OpenAI-style API key\" },\n\t{ category: \"credential\", pattern: /\\bAKIA[0-9A-Z]{16}\\b/, always: true, label: \"AWS access key\" },\n\t{ category: \"credential\", pattern: /\\bghp_[A-Za-z0-9]{20,}\\b/, always: true, label: \"GitHub personal token\" },\n\t{ category: \"credential\", pattern: /\\bghu_[A-Za-z0-9]{20,}\\b/, always: true, label: \"GitHub user token\" },\n\t{ category: \"credential\", pattern: /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/, always: true, label: \"Slack token\" },\n\t{ category: \"credential\", pattern: /\\bxapp-[A-Za-z0-9-]{10,}\\b/, always: true, label: \"Slack app token\" },\n\t{ category: \"credential\", pattern: /\\bntn_[A-Za-z0-9]{20,}\\b/, always: true, label: \"Notion token\" },\n\t{ category: \"credential\", pattern: /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}/, always: true, label: \"JWT token\" },\n\t{ category: \"credential\", pattern: /-----BEGIN\\s+(?:RSA\\s+|EC\\s+|OPENSSH\\s+)?PRIVATE\\s+KEY-----/, always: true, label: \"Private key block\" },\n\t{ category: \"credential\", pattern: /\\bBearer\\s+[A-Za-z0-9._~+/=-]{20,}\\b/i, always: true, label: \"Bearer auth token\" },\n\t{ category: \"credential\", pattern: /\\bapi[_-]?key\\s*[=:]\\s*[A-Za-z0-9_-]{16,}\\b/i, always: true, label: \"API key assignment\" },\n\t{ category: \"credential\", pattern: /\\b(client|app|consumer)_?secret\\s*[=:]\\s*[A-Za-z0-9_-]{16,}\\b/i, always: true, label: \"OAuth client secret\" },\n\t{ category: \"credential\", pattern: /\\bwebhook[_-]?url\\s*[=:]\\s*https?:\\/\\/[^\\s]+/i, always: true, label: \"Webhook URL\" },\n\t{ category: \"secret-assignment\", pattern: /\\b(password|passwd|pwd)\\s*[=:]\\s*\\S{6,}\\b/i, always: true, label: \"password value\" },\n\t{ category: \"secret-assignment\", pattern: /\\b(?:contraseña|contraseña|clave)\\s*[=:]\\s*\\S{6,}\\b/i, always: true, label: \"contraseña valor\" },\n\t{ category: \"secret-assignment\", pattern: /\\b(?:contraseña|password|passwd|pwd|clave)\\b[^\\n]{0,40}\\b\\d{6,}\\b/i, always: true, label: \"password-like value\" },\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\t// Secret keyword followed by a value on the same line: the match spans\n\t\t// keyword + value so redaction never leaves the value exposed. The\n\t\t// value must be an alnum token (≥4 chars) containing a digit or symbol,\n\t\t// which avoids false positives like \"contraseña por defecto\".\n\t\tpattern: /\\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key|secret)\\b[^\\n]{0,40}\\b(?=[A-Za-z0-9_\\-!@#$%^&*]*\\d)[A-Za-z0-9_\\-!@#$%^&*]{4,}/i,\n\t\talways: true,\n\t\tlabel: \"secret value after keyword\",\n\t},\n\t{ category: \"secret-assignment\", pattern: /\\b(?:recuerda|guarda|memoriza|remember|save|store)\\b.{0,50}\\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key)\\b/i, always: true, label: \"request to store a secret\" },\n\t{ category: \"secret-assignment\", pattern: /\\b(secret|token|api[_-]?key|access[_-]?key)\\s*[=:]\\s*\\S{10,}\\b/i, always: true, label: \"secret/token value\" },\n\t{ category: \"credential\", pattern: /\\b(ANTHROPIC|OPENAI|OPENROUTER|GEMINI|DEEPSEEK|MISTRAL|AZURE)_?(API)?_?KEY\\b/i, always: true, label: \"provider API key env var\" },\n\t{ category: \"credential\", pattern: /\\bGITHUB_TOKEN\\b|\\bAWS_SECRET_ACCESS_KEY\\b|\\bDATABASE_URL\\b/i, always: true, label: \"secret env var name\" },\n\t{ category: \"credential\", pattern: /(?:mongodb|postgres|mysql|redis|amqp):\\/\\/[^\\s]*:[^\\s@]+@/, always: true, label: \"connection string with credentials\" },\n];\n\n// ─── Payment data — ALWAYS blocked ───\nconst PAYMENT: Pattern[] = [\n\t{\n\t\tcategory: \"payment\",\n\t\tpattern: /\\b(?:4\\d{3}|5[1-5]\\d{2}|3[47]\\d{2}|6(?:011|5\\d{2}))[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b/,\n\t\talways: true,\n\t\tlabel: \"payment card number\",\n\t},\n\t{ category: \"payment\", pattern: /\\bcvv\\s*[=:]\\s*\\d{3,4}\\b/i, always: true, label: \"card verification value\" },\n\t{ category: \"payment\", pattern: /\\b(?:expiry|exp)\\s*[=:]\\s*(?:0[1-9]|1[0-2])\\/?\\d{2}\\b/i, always: true, label: \"card expiry\" },\n];\n\n// ─── PII — level-dependent ───\nconst PII: Pattern[] = [\n\t{\n\t\tcategory: \"pii-email\",\n\t\tpattern: /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b/,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"personal email address\",\n\t},\n\t{\n\t\tcategory: \"pii-phone\",\n\t\tpattern: /(?:\\+\\d{1,3}[\\s-]?)?(?:\\(?\\d{2,4}\\)?[\\s-]?)?\\d{3}[\\s-]?\\d{3}[\\s-]?\\d{3,4}\\b/,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"phone number\",\n\t},\n\t{\n\t\tcategory: \"pii-id\",\n\t\tpattern: /\\b\\d{8}[A-Z]\\b|\\b[A-Z]\\d{7}[A-Z0-9]\\b/, // DNI / NIE (Spain)\n\t\tblockAt: \"strict\",\n\t\tlabel: \"national ID (DNI/NIE)\",\n\t},\n\t{\n\t\tcategory: \"pii-bank\",\n\t\tpattern: /\\b[A-Z]{2}\\d{2}[A-Z0-9]{11,30}\\b/, // IBAN\n\t\tblockAt: \"balanced\",\n\t\tlabel: \"IBAN / bank account\",\n\t},\n\t{\n\t\tcategory: \"pii-dob\",\n\t\tpattern: /\\b(?:birth|birthday|born|nacimiento|fecha de nacimiento)\\s*[=:]\\s*(?:\\d{1,2}[\\/\\-.]\\d{1,2}[\\/\\-.]\\d{2,4})/i,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"date of birth\",\n\t},\n];\n\n// ─── Prompt injection / exfiltration — ALWAYS blocked ───\nconst INJECTION: Pattern[] = [\n\t{ category: \"injection\", pattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i, always: true, label: \"prompt injection\" },\n\t{ category: \"injection\", pattern: /you\\s+are\\s+now\\s+/i, always: true, label: \"role hijack\" },\n\t{ category: \"injection\", pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, always: true, label: \"deceptive instruction\" },\n\t{ category: \"injection\", pattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i, always: true, label: \"instruction override\" },\n\t{ category: \"injection\", pattern: /system\\s+prompt\\s+override/i, always: true, label: \"system prompt override\" },\n\t{ category: \"exfiltration\", pattern: /curl\\s+[^\\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, always: true, label: \"credential exfiltration (curl)\" },\n\t{ category: \"exfiltration\", pattern: /wget\\s+[^\\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, always: true, label: \"credential exfiltration (wget)\" },\n\t{ category: \"exfiltration\", pattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i, always: true, label: \"secret file read\" },\n\t{ category: \"exfiltration\", pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, always: true, label: \"SSH key path\" },\n];\n\nconst LEVEL_ORDER: Record<PrivacyLevel, number> = { strict: 0, balanced: 1, permissive: 2 };\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\", \"\\u200c\", \"\\u200d\", \"\\u2060\", \"\\ufeff\",\n\t\"\\u202a\", \"\\u202b\", \"\\u202c\", \"\\u202d\", \"\\u202e\",\n]);\n\nconst REASON_EN = {\n\tcredential: \"Looks like a credential or secret (secrets are never stored in memory)\",\n\tpayment: \"Looks like payment card data (never stored in memory)\",\n\t\"secret-assignment\": \"Looks like a password/secret/token value (never stored in memory)\",\n\t\"pii-email\": \"Looks like a personal email address (blocked by the strict privacy level)\",\n\t\"pii-phone\": \"Looks like a phone number (blocked by the strict privacy level)\",\n\t\"pii-id\": \"Looks like a national ID (DNI/NIE) (blocked by the strict privacy level)\",\n\t\"pii-bank\": \"Looks like a bank account / IBAN (blocked by the privacy level)\",\n\t\"pii-dob\": \"Looks like a date of birth (blocked by the strict privacy level)\",\n\tinjection: \"Looks like a prompt-injection attempt (never stored)\",\n\texfiltration: \"Looks like data exfiltration (never stored)\",\n};\n\nconst REASON_ES: Record<SensitiveCategory, string> = {\n\tcredential: \"Parece una credencial o secreto (los secretos nunca se almacenan en memoria)\",\n\tpayment: \"Parecen datos de tarjeta de pago (nunca se almacenan en memoria)\",\n\t\"secret-assignment\": \"Parece una contraseña/secreto/token (nunca se almacena en memoria)\",\n\t\"pii-email\": \"Parece un correo electrónico personal (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-phone\": \"Parece un número de teléfono (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-id\": \"Parece un documento de identidad (DNI/NIE) (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-bank\": \"Parece una cuenta bancaria / IBAN (bloqueado por el nivel de privacidad)\",\n\t\"pii-dob\": \"Parece una fecha de nacimiento (bloqueada por el nivel de privacidad estricto)\",\n\tinjection: \"Parece un intento de prompt injection (nunca se almacena)\",\n\texfiltration: \"Parece exfiltración de datos (nunca se almacena)\",\n};\n\nfunction testPattern(pattern: Pattern, content: string): boolean {\n\ttry {\n\t\treturn pattern.pattern.test(content);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Classify content against the security policy.\n *\n * @param content   Text to classify.\n * @param level     Configured privacy level.\n * @param locale    \"es\" or \"en\" for the reason language.\n */\nexport function classifySensitive(content: string, level: PrivacyLevel = \"strict\", locale: \"es\" | \"en\" = \"es\"): SensitivityResult {\n\tconst categories = new Set<SensitiveCategory>();\n\tconst reasons: string[] = [];\n\tconst labels: string[] = [];\n\n\t// Invisible characters are always suspicious (injection vectors).\n\tif ([...content].some((ch) => INVISIBLE_CHARS.has(ch))) {\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tcategories: [\"injection\"],\n\t\t\treason: locale === \"es\"\n\t\t\t\t? \"El contenido contiene caracteres invisibles/zero-width y fue rechazado por seguridad.\"\n\t\t\t\t: \"Content contains invisible/zero-width characters and was rejected for security.\",\n\t\t\tnoteworthy: true,\n\t\t};\n\t}\n\n\tconst allPatterns = [...ALWAYS_BLOCKED, ...PAYMENT, ...PII, ...INJECTION];\n\tfor (const pattern of allPatterns) {\n\t\tif (!testPattern(pattern, content)) continue;\n\t\tconst levelIdx = LEVEL_ORDER[level];\n\t\tconst blockAtIdx = pattern.blockAt ? LEVEL_ORDER[pattern.blockAt] : 0;\n\t\tconst blocked = pattern.always === true || levelIdx <= blockAtIdx;\n\t\tcategories.add(pattern.category);\n\t\tif (blocked) {\n\t\t\tlabels.push(pattern.label);\n\t\t\tif (!reasons.includes(pattern.category)) reasons.push(pattern.category);\n\t\t}\n\t}\n\n\tif (reasons.length > 0) {\n\t\tconst localeMap = locale === \"es\" ? REASON_ES : REASON_EN;\n\t\tconst detail = reasons.map((r) => localeMap[r as SensitiveCategory]).join(\"; \");\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tcategories: [...categories],\n\t\t\treason: detail,\n\t\t\tnoteworthy: true,\n\t\t};\n\t}\n\n\treturn {\n\t\tblocked: false,\n\t\tcategories: [...categories],\n\t\treason: \"\",\n\t\tnoteworthy: categories.size > 0,\n\t};\n}\n\n/**\n * Redact sensitive data from user text so it never reaches the LLM, the\n * session file, or the chat transcript. Only high-confidence patterns are\n * redacted (credentials, payment data, explicit secret assignments, and\n * PII like emails / national IDs / IBANs / DOB).\n */\nexport function redactSensitive(text: string, level: PrivacyLevel = \"strict\"): string {\n\tlet out = text;\n\tconst levelIdx = LEVEL_ORDER[level];\n\tfor (const pattern of [...ALWAYS_BLOCKED, ...PAYMENT, ...PII]) {\n\t\tif (pattern.category === \"pii-phone\") {\n\t\t\t// Phone redaction requires separators or a + prefix to avoid\n\t\t\t// mangling ordinary numbers in code.\n\t\t\tif (!/(?:\\+|\\s|\\()?\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{3,4}/.test(text)) continue;\n\t\t}\n\t\tconst blockAtIdx = pattern.blockAt ? LEVEL_ORDER[pattern.blockAt] : 0;\n\t\tconst active = pattern.always === true || levelIdx <= blockAtIdx;\n\t\tif (!active) continue;\n\t\ttry {\n\t\t\tout = out.replace(pattern.pattern, (match) => \"█\".repeat(Math.min(match.length, 14)));\n\t\t} catch {\n\t\t\t// A bad pattern must never break redaction.\n\t\t}\n\t}\n\treturn out;\n}\n"]}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/core/memory-engine/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAC1B,YAAY,GACZ,SAAS,GACT,mBAAmB,GACnB,WAAW,GACX,WAAW,GACX,QAAQ,GACR,UAAU,GACV,SAAS,GACT,WAAW,GACX,cAAc,CAAC;AAElB,MAAM,WAAW,iBAAiB;IACjC,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,OAAO,CAAC;CACpB;AAqQD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,YAAuB,EAC9B,MAAM,GAAE,IAAI,GAAG,IAAW,GACxB,iBAAiB,CAgDnB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,YAAuB,GAAG,MAAM,CAmBpF","sourcesContent":["/**\n * Security & privacy classification for the Ada Memory Engine.\n *\n * Enterprise-grade guards:\n * - Credentials/secrets/payment data are ALWAYS blocked at every level.\n * - PII (email, phone, national IDs, IBAN, DOB) blocking depends on the\n *   configured privacy level (RGPD / AI Act friendly).\n * - Every rejection is written to the audit log with a reason.\n * - Prompt-injection/exfiltration patterns are always blocked.\n */\n\nexport type PrivacyLevel = \"strict\" | \"balanced\" | \"permissive\";\n\nexport type SensitiveCategory =\n\t| \"credential\"\n\t| \"payment\"\n\t| \"secret-assignment\"\n\t| \"pii-email\"\n\t| \"pii-phone\"\n\t| \"pii-id\"\n\t| \"pii-bank\"\n\t| \"pii-dob\"\n\t| \"injection\"\n\t| \"exfiltration\";\n\nexport interface SensitivityResult {\n\t/** True when the content must NOT be stored. */\n\tblocked: boolean;\n\t/** Categories detected. */\n\tcategories: SensitiveCategory[];\n\t/** Human-readable reason (in the configured language). */\n\treason: string;\n\t/** True when content contains permitted-but-noteworthy categories. */\n\tnoteworthy: boolean;\n}\n\ninterface Pattern {\n\tcategory: SensitiveCategory;\n\tpattern: RegExp;\n\t/** Always blocked regardless of privacy level. */\n\talways?: boolean;\n\t/** Blocked at this level and stricter. */\n\tblockAt?: PrivacyLevel;\n\t/** English reason label. */\n\tlabel: string;\n}\n\n// ─── Credentials & secrets — ALWAYS blocked ───\nconst ALWAYS_BLOCKED: Pattern[] = [\n\t{ category: \"credential\", pattern: /\\bsk-ant-api\\S{10,}\\b/, always: true, label: \"Anthropic API key\" },\n\t{ category: \"credential\", pattern: /\\bsk-or-v1-\\S{10,}\\b/, always: true, label: \"OpenRouter API key\" },\n\t{ category: \"credential\", pattern: /\\bsk-[A-Za-z0-9]{20,}\\b/, always: true, label: \"OpenAI-style API key\" },\n\t{ category: \"credential\", pattern: /\\bAKIA[0-9A-Z]{16}\\b/, always: true, label: \"AWS access key\" },\n\t{ category: \"credential\", pattern: /\\bghp_[A-Za-z0-9]{20,}\\b/, always: true, label: \"GitHub personal token\" },\n\t{ category: \"credential\", pattern: /\\bghu_[A-Za-z0-9]{20,}\\b/, always: true, label: \"GitHub user token\" },\n\t{ category: \"credential\", pattern: /\\bxox[baprs]-[A-Za-z0-9-]{10,}\\b/, always: true, label: \"Slack token\" },\n\t{ category: \"credential\", pattern: /\\bxapp-[A-Za-z0-9-]{10,}\\b/, always: true, label: \"Slack app token\" },\n\t{ category: \"credential\", pattern: /\\bntn_[A-Za-z0-9]{20,}\\b/, always: true, label: \"Notion token\" },\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}/,\n\t\talways: true,\n\t\tlabel: \"JWT token\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /-----BEGIN\\s+(?:RSA\\s+|EC\\s+|OPENSSH\\s+)?PRIVATE\\s+KEY-----/,\n\t\talways: true,\n\t\tlabel: \"Private key block\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\bBearer\\s+[A-Za-z0-9._~+/=-]{20,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"Bearer auth token\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\bapi[_-]?key\\s*[=:]\\s*[A-Za-z0-9_-]{16,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"API key assignment\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\b(client|app|consumer)_?secret\\s*[=:]\\s*[A-Za-z0-9_-]{16,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"OAuth client secret\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\bwebhook[_-]?url\\s*[=:]\\s*https?:\\/\\/[^\\s]+/i,\n\t\talways: true,\n\t\tlabel: \"Webhook URL\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\tpattern: /\\b(password|passwd|pwd)\\s*[=:]\\s*\\S{6,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"password value\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\tpattern: /\\b(?:contraseña|contraseña|clave)\\s*[=:]\\s*\\S{6,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"contraseña valor\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\tpattern: /\\b(?:contraseña|password|passwd|pwd|clave)\\b[^\\n]{0,40}\\b\\d{6,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"password-like value\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\t// Secret keyword followed by a value on the same line: the match spans\n\t\t// keyword + value so redaction never leaves the value exposed. The\n\t\t// value must be an alnum token (≥4 chars) containing a digit or symbol,\n\t\t// which avoids false positives like \"contraseña por defecto\".\n\t\tpattern:\n\t\t\t/\\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key|secret)\\b[^\\n]{0,40}\\b(?=[A-Za-z0-9_\\-!@#$%^&*]*\\d)[A-Za-z0-9_\\-!@#$%^&*]{4,}/i,\n\t\talways: true,\n\t\tlabel: \"secret value after keyword\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\tpattern:\n\t\t\t/\\b(?:recuerda|guarda|memoriza|remember|save|store)\\b.{0,50}\\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key)\\b/i,\n\t\talways: true,\n\t\tlabel: \"request to store a secret\",\n\t},\n\t{\n\t\tcategory: \"secret-assignment\",\n\t\tpattern: /\\b(secret|token|api[_-]?key|access[_-]?key)\\s*[=:]\\s*\\S{10,}\\b/i,\n\t\talways: true,\n\t\tlabel: \"secret/token value\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\b(ANTHROPIC|OPENAI|OPENROUTER|GEMINI|DEEPSEEK|MISTRAL|AZURE)_?(API)?_?KEY\\b/i,\n\t\talways: true,\n\t\tlabel: \"provider API key env var\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /\\bGITHUB_TOKEN\\b|\\bAWS_SECRET_ACCESS_KEY\\b|\\bDATABASE_URL\\b/i,\n\t\talways: true,\n\t\tlabel: \"secret env var name\",\n\t},\n\t{\n\t\tcategory: \"credential\",\n\t\tpattern: /(?:mongodb|postgres|mysql|redis|amqp):\\/\\/[^\\s]*:[^\\s@]+@/,\n\t\talways: true,\n\t\tlabel: \"connection string with credentials\",\n\t},\n];\n\n// ─── Payment data — ALWAYS blocked ───\nconst PAYMENT: Pattern[] = [\n\t{\n\t\tcategory: \"payment\",\n\t\tpattern: /\\b(?:4\\d{3}|5[1-5]\\d{2}|3[47]\\d{2}|6(?:011|5\\d{2}))[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}\\b/,\n\t\talways: true,\n\t\tlabel: \"payment card number\",\n\t},\n\t{ category: \"payment\", pattern: /\\bcvv\\s*[=:]\\s*\\d{3,4}\\b/i, always: true, label: \"card verification value\" },\n\t{\n\t\tcategory: \"payment\",\n\t\tpattern: /\\b(?:expiry|exp)\\s*[=:]\\s*(?:0[1-9]|1[0-2])\\/?\\d{2}\\b/i,\n\t\talways: true,\n\t\tlabel: \"card expiry\",\n\t},\n];\n\n// ─── PII — level-dependent ───\nconst PII: Pattern[] = [\n\t{\n\t\tcategory: \"pii-email\",\n\t\tpattern: /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b/,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"personal email address\",\n\t},\n\t{\n\t\tcategory: \"pii-phone\",\n\t\tpattern: /(?:\\+\\d{1,3}[\\s-]?)?(?:\\(?\\d{2,4}\\)?[\\s-]?)?\\d{3}[\\s-]?\\d{3}[\\s-]?\\d{3,4}\\b/,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"phone number\",\n\t},\n\t{\n\t\tcategory: \"pii-id\",\n\t\tpattern: /\\b\\d{8}[A-Z]\\b|\\b[A-Z]\\d{7}[A-Z0-9]\\b/, // DNI / NIE (Spain)\n\t\tblockAt: \"strict\",\n\t\tlabel: \"national ID (DNI/NIE)\",\n\t},\n\t{\n\t\tcategory: \"pii-bank\",\n\t\tpattern: /\\b[A-Z]{2}\\d{2}[A-Z0-9]{11,30}\\b/, // IBAN\n\t\tblockAt: \"balanced\",\n\t\tlabel: \"IBAN / bank account\",\n\t},\n\t{\n\t\tcategory: \"pii-dob\",\n\t\tpattern:\n\t\t\t/\\b(?:birth|birthday|born|nacimiento|fecha de nacimiento)\\s*[=:]\\s*(?:\\d{1,2}[/\\-.]\\d{1,2}[/\\-.]\\d{2,4})/i,\n\t\tblockAt: \"strict\",\n\t\tlabel: \"date of birth\",\n\t},\n];\n\n// ─── Prompt injection / exfiltration — ALWAYS blocked ───\nconst INJECTION: Pattern[] = [\n\t{\n\t\tcategory: \"injection\",\n\t\tpattern: /ignore\\s+(previous|all|above|prior)\\s+instructions/i,\n\t\talways: true,\n\t\tlabel: \"prompt injection\",\n\t},\n\t{ category: \"injection\", pattern: /you\\s+are\\s+now\\s+/i, always: true, label: \"role hijack\" },\n\t{ category: \"injection\", pattern: /do\\s+not\\s+tell\\s+the\\s+user/i, always: true, label: \"deceptive instruction\" },\n\t{\n\t\tcategory: \"injection\",\n\t\tpattern: /disregard\\s+(your|all|any)\\s+(instructions|rules|guidelines)/i,\n\t\talways: true,\n\t\tlabel: \"instruction override\",\n\t},\n\t{ category: \"injection\", pattern: /system\\s+prompt\\s+override/i, always: true, label: \"system prompt override\" },\n\t{\n\t\tcategory: \"exfiltration\",\n\t\tpattern: /curl\\s+[^\\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,\n\t\talways: true,\n\t\tlabel: \"credential exfiltration (curl)\",\n\t},\n\t{\n\t\tcategory: \"exfiltration\",\n\t\tpattern: /wget\\s+[^\\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,\n\t\talways: true,\n\t\tlabel: \"credential exfiltration (wget)\",\n\t},\n\t{\n\t\tcategory: \"exfiltration\",\n\t\tpattern: /cat\\s+[^\\n]*(\\.env|credentials|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc)/i,\n\t\talways: true,\n\t\tlabel: \"secret file read\",\n\t},\n\t{ category: \"exfiltration\", pattern: /\\$HOME\\/\\.ssh|~\\/\\.ssh/i, always: true, label: \"SSH key path\" },\n];\n\nconst LEVEL_ORDER: Record<PrivacyLevel, number> = { strict: 0, balanced: 1, permissive: 2 };\n\nconst INVISIBLE_CHARS = new Set([\n\t\"\\u200b\",\n\t\"\\u200c\",\n\t\"\\u200d\",\n\t\"\\u2060\",\n\t\"\\ufeff\",\n\t\"\\u202a\",\n\t\"\\u202b\",\n\t\"\\u202c\",\n\t\"\\u202d\",\n\t\"\\u202e\",\n]);\n\nconst REASON_EN = {\n\tcredential: \"Looks like a credential or secret (secrets are never stored in memory)\",\n\tpayment: \"Looks like payment card data (never stored in memory)\",\n\t\"secret-assignment\": \"Looks like a password/secret/token value (never stored in memory)\",\n\t\"pii-email\": \"Looks like a personal email address (blocked by the strict privacy level)\",\n\t\"pii-phone\": \"Looks like a phone number (blocked by the strict privacy level)\",\n\t\"pii-id\": \"Looks like a national ID (DNI/NIE) (blocked by the strict privacy level)\",\n\t\"pii-bank\": \"Looks like a bank account / IBAN (blocked by the privacy level)\",\n\t\"pii-dob\": \"Looks like a date of birth (blocked by the strict privacy level)\",\n\tinjection: \"Looks like a prompt-injection attempt (never stored)\",\n\texfiltration: \"Looks like data exfiltration (never stored)\",\n};\n\nconst REASON_ES: Record<SensitiveCategory, string> = {\n\tcredential: \"Parece una credencial o secreto (los secretos nunca se almacenan en memoria)\",\n\tpayment: \"Parecen datos de tarjeta de pago (nunca se almacenan en memoria)\",\n\t\"secret-assignment\": \"Parece una contraseña/secreto/token (nunca se almacena en memoria)\",\n\t\"pii-email\": \"Parece un correo electrónico personal (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-phone\": \"Parece un número de teléfono (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-id\": \"Parece un documento de identidad (DNI/NIE) (bloqueado por el nivel de privacidad estricto)\",\n\t\"pii-bank\": \"Parece una cuenta bancaria / IBAN (bloqueado por el nivel de privacidad)\",\n\t\"pii-dob\": \"Parece una fecha de nacimiento (bloqueada por el nivel de privacidad estricto)\",\n\tinjection: \"Parece un intento de prompt injection (nunca se almacena)\",\n\texfiltration: \"Parece exfiltración de datos (nunca se almacena)\",\n};\n\nfunction testPattern(pattern: Pattern, content: string): boolean {\n\ttry {\n\t\treturn pattern.pattern.test(content);\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Classify content against the security policy.\n *\n * @param content   Text to classify.\n * @param level     Configured privacy level.\n * @param locale    \"es\" or \"en\" for the reason language.\n */\nexport function classifySensitive(\n\tcontent: string,\n\tlevel: PrivacyLevel = \"strict\",\n\tlocale: \"es\" | \"en\" = \"es\",\n): SensitivityResult {\n\tconst categories = new Set<SensitiveCategory>();\n\tconst reasons: string[] = [];\n\tconst labels: string[] = [];\n\n\t// Invisible characters are always suspicious (injection vectors).\n\tif ([...content].some((ch) => INVISIBLE_CHARS.has(ch))) {\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tcategories: [\"injection\"],\n\t\t\treason:\n\t\t\t\tlocale === \"es\"\n\t\t\t\t\t? \"El contenido contiene caracteres invisibles/zero-width y fue rechazado por seguridad.\"\n\t\t\t\t\t: \"Content contains invisible/zero-width characters and was rejected for security.\",\n\t\t\tnoteworthy: true,\n\t\t};\n\t}\n\n\tconst allPatterns = [...ALWAYS_BLOCKED, ...PAYMENT, ...PII, ...INJECTION];\n\tfor (const pattern of allPatterns) {\n\t\tif (!testPattern(pattern, content)) continue;\n\t\tconst levelIdx = LEVEL_ORDER[level];\n\t\tconst blockAtIdx = pattern.blockAt ? LEVEL_ORDER[pattern.blockAt] : 0;\n\t\tconst blocked = pattern.always === true || levelIdx <= blockAtIdx;\n\t\tcategories.add(pattern.category);\n\t\tif (blocked) {\n\t\t\tlabels.push(pattern.label);\n\t\t\tif (!reasons.includes(pattern.category)) reasons.push(pattern.category);\n\t\t}\n\t}\n\n\tif (reasons.length > 0) {\n\t\tconst localeMap = locale === \"es\" ? REASON_ES : REASON_EN;\n\t\tconst detail = reasons.map((r) => localeMap[r as SensitiveCategory]).join(\"; \");\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tcategories: [...categories],\n\t\t\treason: detail,\n\t\t\tnoteworthy: true,\n\t\t};\n\t}\n\n\treturn {\n\t\tblocked: false,\n\t\tcategories: [...categories],\n\t\treason: \"\",\n\t\tnoteworthy: categories.size > 0,\n\t};\n}\n\n/**\n * Redact sensitive data from user text so it never reaches the LLM, the\n * session file, or the chat transcript. Only high-confidence patterns are\n * redacted (credentials, payment data, explicit secret assignments, and\n * PII like emails / national IDs / IBANs / DOB).\n */\nexport function redactSensitive(text: string, level: PrivacyLevel = \"strict\"): string {\n\tlet out = text;\n\tconst levelIdx = LEVEL_ORDER[level];\n\tfor (const pattern of [...ALWAYS_BLOCKED, ...PAYMENT, ...PII]) {\n\t\tif (pattern.category === \"pii-phone\") {\n\t\t\t// Phone redaction requires separators or a + prefix to avoid\n\t\t\t// mangling ordinary numbers in code.\n\t\t\tif (!/(?:\\+|\\s|\\()?\\d{3}[\\s.-]\\d{3}[\\s.-]\\d{3,4}/.test(text)) continue;\n\t\t}\n\t\tconst blockAtIdx = pattern.blockAt ? LEVEL_ORDER[pattern.blockAt] : 0;\n\t\tconst active = pattern.always === true || levelIdx <= blockAtIdx;\n\t\tif (!active) continue;\n\t\ttry {\n\t\t\tout = out.replace(pattern.pattern, (match) => \"█\".repeat(Math.min(match.length, 14)));\n\t\t} catch {\n\t\t\t// A bad pattern must never break redaction.\n\t\t}\n\t}\n\treturn out;\n}\n"]}

package/dist/core/memory-engine/security.js

@@ -19,15 +19,60 @@ const ALWAYS_BLOCKED = [
     { category: "credential", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, always: true, label: "Slack token" },
     { category: "credential", pattern: /\bxapp-[A-Za-z0-9-]{10,}\b/, always: true, label: "Slack app token" },
     { category: "credential", pattern: /\bntn_[A-Za-z0-9]{20,}\b/, always: true, label: "Notion token" },
-    { category: "credential", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, always: true, label: "JWT token" },
-    { category: "credential", pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+)?PRIVATE\s+KEY-----/, always: true, label: "Private key block" },
-    { category: "credential", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/i, always: true, label: "Bearer auth token" },
-    { category: "credential", pattern: /\bapi[_-]?key\s*[=:]\s*[A-Za-z0-9_-]{16,}\b/i, always: true, label: "API key assignment" },
-    { category: "credential", pattern: /\b(client|app|consumer)_?secret\s*[=:]\s*[A-Za-z0-9_-]{16,}\b/i, always: true, label: "OAuth client secret" },
-    { category: "credential", pattern: /\bwebhook[_-]?url\s*[=:]\s*https?:\/\/[^\s]+/i, always: true, label: "Webhook URL" },
-    { category: "secret-assignment", pattern: /\b(password|passwd|pwd)\s*[=:]\s*\S{6,}\b/i, always: true, label: "password value" },
-    { category: "secret-assignment", pattern: /\b(?:contraseña|contraseña|clave)\s*[=:]\s*\S{6,}\b/i, always: true, label: "contraseña valor" },
-    { category: "secret-assignment", pattern: /\b(?:contraseña|password|passwd|pwd|clave)\b[^\n]{0,40}\b\d{6,}\b/i, always: true, label: "password-like value" },
+    {
+        category: "credential",
+        pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+        always: true,
+        label: "JWT token",
+    },
+    {
+        category: "credential",
+        pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+)?PRIVATE\s+KEY-----/,
+        always: true,
+        label: "Private key block",
+    },
+    {
+        category: "credential",
+        pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/i,
+        always: true,
+        label: "Bearer auth token",
+    },
+    {
+        category: "credential",
+        pattern: /\bapi[_-]?key\s*[=:]\s*[A-Za-z0-9_-]{16,}\b/i,
+        always: true,
+        label: "API key assignment",
+    },
+    {
+        category: "credential",
+        pattern: /\b(client|app|consumer)_?secret\s*[=:]\s*[A-Za-z0-9_-]{16,}\b/i,
+        always: true,
+        label: "OAuth client secret",
+    },
+    {
+        category: "credential",
+        pattern: /\bwebhook[_-]?url\s*[=:]\s*https?:\/\/[^\s]+/i,
+        always: true,
+        label: "Webhook URL",
+    },
+    {
+        category: "secret-assignment",
+        pattern: /\b(password|passwd|pwd)\s*[=:]\s*\S{6,}\b/i,
+        always: true,
+        label: "password value",
+    },
+    {
+        category: "secret-assignment",
+        pattern: /\b(?:contraseña|contraseña|clave)\s*[=:]\s*\S{6,}\b/i,
+        always: true,
+        label: "contraseña valor",
+    },
+    {
+        category: "secret-assignment",
+        pattern: /\b(?:contraseña|password|passwd|pwd|clave)\b[^\n]{0,40}\b\d{6,}\b/i,
+        always: true,
+        label: "password-like value",
+    },
     {
         category: "secret-assignment",
         // Secret keyword followed by a value on the same line: the match spans
@@ -38,11 +83,36 @@ const ALWAYS_BLOCKED = [
         always: true,
         label: "secret value after keyword",
     },
-    { category: "secret-assignment", pattern: /\b(?:recuerda|guarda|memoriza|remember|save|store)\b.{0,50}\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key)\b/i, always: true, label: "request to store a secret" },
-    { category: "secret-assignment", pattern: /\b(secret|token|api[_-]?key|access[_-]?key)\s*[=:]\s*\S{10,}\b/i, always: true, label: "secret/token value" },
-    { category: "credential", pattern: /\b(ANTHROPIC|OPENAI|OPENROUTER|GEMINI|DEEPSEEK|MISTRAL|AZURE)_?(API)?_?KEY\b/i, always: true, label: "provider API key env var" },
-    { category: "credential", pattern: /\bGITHUB_TOKEN\b|\bAWS_SECRET_ACCESS_KEY\b|\bDATABASE_URL\b/i, always: true, label: "secret env var name" },
-    { category: "credential", pattern: /(?:mongodb|postgres|mysql|redis|amqp):\/\/[^\s]*:[^\s@]+@/, always: true, label: "connection string with credentials" },
+    {
+        category: "secret-assignment",
+        pattern: /\b(?:recuerda|guarda|memoriza|remember|save|store)\b.{0,50}\b(?:contraseña|password|passwd|pwd|clave|token|api[_-]?key)\b/i,
+        always: true,
+        label: "request to store a secret",
+    },
+    {
+        category: "secret-assignment",
+        pattern: /\b(secret|token|api[_-]?key|access[_-]?key)\s*[=:]\s*\S{10,}\b/i,
+        always: true,
+        label: "secret/token value",
+    },
+    {
+        category: "credential",
+        pattern: /\b(ANTHROPIC|OPENAI|OPENROUTER|GEMINI|DEEPSEEK|MISTRAL|AZURE)_?(API)?_?KEY\b/i,
+        always: true,
+        label: "provider API key env var",
+    },
+    {
+        category: "credential",
+        pattern: /\bGITHUB_TOKEN\b|\bAWS_SECRET_ACCESS_KEY\b|\bDATABASE_URL\b/i,
+        always: true,
+        label: "secret env var name",
+    },
+    {
+        category: "credential",
+        pattern: /(?:mongodb|postgres|mysql|redis|amqp):\/\/[^\s]*:[^\s@]+@/,
+        always: true,
+        label: "connection string with credentials",
+    },
 ];
 // ─── Payment data — ALWAYS blocked ───
 const PAYMENT = [
@@ -53,7 +123,12 @@ const PAYMENT = [
         label: "payment card number",
     },
     { category: "payment", pattern: /\bcvv\s*[=:]\s*\d{3,4}\b/i, always: true, label: "card verification value" },
-    { category: "payment", pattern: /\b(?:expiry|exp)\s*[=:]\s*(?:0[1-9]|1[0-2])\/?\d{2}\b/i, always: true, label: "card expiry" },
+    {
+        category: "payment",
+        pattern: /\b(?:expiry|exp)\s*[=:]\s*(?:0[1-9]|1[0-2])\/?\d{2}\b/i,
+        always: true,
+        label: "card expiry",
+    },
 ];
 // ─── PII — level-dependent ───
 const PII = [
@@ -83,27 +158,60 @@ const PII = [
     },
     {
         category: "pii-dob",
-        pattern: /\b(?:birth|birthday|born|nacimiento|fecha de nacimiento)\s*[=:]\s*(?:\d{1,2}[\/\-.]\d{1,2}[\/\-.]\d{2,4})/i,
+        pattern: /\b(?:birth|birthday|born|nacimiento|fecha de nacimiento)\s*[=:]\s*(?:\d{1,2}[/\-.]\d{1,2}[/\-.]\d{2,4})/i,
         blockAt: "strict",
         label: "date of birth",
     },
 ];
 // ─── Prompt injection / exfiltration — ALWAYS blocked ───
 const INJECTION = [
-    { category: "injection", pattern: /ignore\s+(previous|all|above|prior)\s+instructions/i, always: true, label: "prompt injection" },
+    {
+        category: "injection",
+        pattern: /ignore\s+(previous|all|above|prior)\s+instructions/i,
+        always: true,
+        label: "prompt injection",
+    },
     { category: "injection", pattern: /you\s+are\s+now\s+/i, always: true, label: "role hijack" },
     { category: "injection", pattern: /do\s+not\s+tell\s+the\s+user/i, always: true, label: "deceptive instruction" },
-    { category: "injection", pattern: /disregard\s+(your|all|any)\s+(instructions|rules|guidelines)/i, always: true, label: "instruction override" },
+    {
+        category: "injection",
+        pattern: /disregard\s+(your|all|any)\s+(instructions|rules|guidelines)/i,
+        always: true,
+        label: "instruction override",
+    },
     { category: "injection", pattern: /system\s+prompt\s+override/i, always: true, label: "system prompt override" },
-    { category: "exfiltration", pattern: /curl\s+[^\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, always: true, label: "credential exfiltration (curl)" },
-    { category: "exfiltration", pattern: /wget\s+[^\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i, always: true, label: "credential exfiltration (wget)" },
-    { category: "exfiltration", pattern: /cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i, always: true, label: "secret file read" },
+    {
+        category: "exfiltration",
+        pattern: /curl\s+[^\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,
+        always: true,
+        label: "credential exfiltration (curl)",
+    },
+    {
+        category: "exfiltration",
+        pattern: /wget\s+[^\n]*(KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,
+        always: true,
+        label: "credential exfiltration (wget)",
+    },
+    {
+        category: "exfiltration",
+        pattern: /cat\s+[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i,
+        always: true,
+        label: "secret file read",
+    },
     { category: "exfiltration", pattern: /\$HOME\/\.ssh|~\/\.ssh/i, always: true, label: "SSH key path" },
 ];
 const LEVEL_ORDER = { strict: 0, balanced: 1, permissive: 2 };
 const INVISIBLE_CHARS = new Set([
-    "\u200b", "\u200c", "\u200d", "\u2060", "\ufeff",
-    "\u202a", "\u202b", "\u202c", "\u202d", "\u202e",
+    "\u200b",
+    "\u200c",
+    "\u200d",
+    "\u2060",
+    "\ufeff",
+    "\u202a",
+    "\u202b",
+    "\u202c",
+    "\u202d",
+    "\u202e",
 ]);
 const REASON_EN = {
     credential: "Looks like a credential or secret (secrets are never stored in memory)",