@jokerized/getresearchdone 0.4.1

package/lib/scan/ignorefile.ts

@@ -0,0 +1,109 @@
+"use strict";
+
+/**
+ * GRD Scan/Ignorefile -- Parser for .prompt-injection-scanignore files.
+ *
+ * Format compatible with gsd-2 v2.67:
+ *   - '#' prefixed lines are comments
+ *   - blank lines are ignored
+ *   - 'filepath:regex' is a file-scoped entry (exact filepath match)
+ *   - bare 'regex' is a global entry
+ *
+ * Heuristic for splitting a line: find the first ':'. If the left side looks
+ * like a file path (contains '/' or '.' and does not start with a regex
+ * metacharacter), treat as file-scoped; otherwise treat as global.
+ */
+
+const fs = require("fs") as typeof import("fs");
+
+export type IgnoreEntry =
+  | { type: "file"; filePath: string; pattern: RegExp }
+  | { type: "global"; pattern: RegExp };
+
+export function parseIgnoreFile(raw: string): IgnoreEntry[] {
+  const entries: IgnoreEntry[] = [];
+  const lines = raw.split("\n");
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#")) continue;
+
+    const colonIdx = line.indexOf(":");
+    if (colonIdx > 0) {
+      const left = line.slice(0, colonIdx);
+      const right = line.slice(colonIdx + 1);
+      if (_looksLikeFilePath(left)) {
+        const pat = _compileOrWarn(right, rawLine);
+        if (pat) entries.push({ type: "file", filePath: left, pattern: pat });
+        continue;
+      }
+    }
+
+    const pat = _compileOrWarn(line, rawLine);
+    if (pat) entries.push({ type: "global", pattern: pat });
+  }
+  return entries;
+}
+
+export function loadIgnoreFile(filePath: string): IgnoreEntry[] {
+  if (!fs.existsSync(filePath)) return [];
+  const raw = fs.readFileSync(filePath, "utf8");
+  return parseIgnoreFile(raw);
+}
+
+/**
+ * Check whether a hit should be suppressed by any ignorefile entry.
+ *
+ * The `matchText` parameter is the SCANNED content that produced the hit:
+ *   - For prose hits: the full source line
+ *   - For base64 hits: the full decoded content of the base64 blob
+ *
+ * This is intentionally wider than the reported `match` field on ScanHit
+ * (which is truncated to 80 chars for display). Ignorefile entries should
+ * be written against the scanned content — see `.prompt-injection-scanignore`
+ * for examples.
+ *
+ * @param file - the file where the hit was found (may be absolute or relative;
+ *   suffix-matching supported)
+ * @param matchText - the scanned content (full source line or full decoded blob)
+ * @param entries - parsed ignorefile entries from loadIgnoreFile
+ * @returns true if any entry matches and the hit should be suppressed
+ */
+export function isIgnored(
+  file: string,
+  matchText: string,
+  entries: IgnoreEntry[],
+): boolean {
+  for (const e of entries) {
+    if (e.type === "file") {
+      const fileMatches =
+        e.filePath === file || file.endsWith("/" + e.filePath);
+      if (fileMatches && e.pattern.test(matchText)) return true;
+    } else {
+      if (e.pattern.test(matchText)) return true;
+    }
+  }
+  return false;
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function _looksLikeFilePath(s: string): boolean {
+  if (s.length === 0) return false;
+  const first = s[0];
+  if (first === "(" || first === "[" || first === "^" || first === "\\")
+    return false;
+  return s.includes("/") || s.includes(".");
+}
+
+function _compileOrWarn(pattern: string, sourceLine: string): RegExp | null {
+  try {
+    return new RegExp(pattern);
+  } catch (e) {
+    process.stderr.write(
+      `warning: invalid regex in ignorefile: ${sourceLine} (${(e as Error).message})\n`,
+    );
+    return null;
+  }
+}
+
+module.exports = { parseIgnoreFile, loadIgnoreFile, isIgnored };

package/lib/scan/injection.ts

@@ -0,0 +1,67 @@
+"use strict";
+
+/**
+ * GRD Scan/Injection -- Prose-level prompt injection scanner.
+ *
+ * Applies the INJECTION_PATTERNS to markdown content after stripping fenced
+ * code blocks and inline backtick spans. Integrates with the ignorefile
+ * system to suppress known false positives.
+ */
+
+import type { IgnoreEntry } from "./ignorefile";
+import type { InjectionPattern } from "./patterns";
+import type { ScanHit } from "./types";
+
+const { INJECTION_PATTERNS } = require("./patterns") as {
+  INJECTION_PATTERNS: ReadonlyArray<InjectionPattern>;
+};
+const { stripCodeBlocks } = require("./strip-markdown") as {
+  stripCodeBlocks: (raw: string) => string;
+};
+const { isIgnored } = require("./ignorefile") as {
+  isIgnored: (
+    file: string,
+    matchText: string,
+    entries: IgnoreEntry[],
+  ) => boolean;
+};
+const { _readUtf8OrNull, _truncate } = require("./_utils") as {
+  _readUtf8OrNull: (file: string) => string | null;
+  _truncate: (s: string, max: number) => string;
+};
+
+export interface ScanProseOpts {
+  ignoreEntries: IgnoreEntry[];
+}
+
+export function scanProse(files: string[], opts: ScanProseOpts): ScanHit[] {
+  const hits: ScanHit[] = [];
+  for (const file of files) {
+    const raw = _readUtf8OrNull(file);
+    if (raw === null) continue;
+    const stripped = stripCodeBlocks(raw);
+    const lines = stripped.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const pattern of INJECTION_PATTERNS) {
+        const m = line.match(pattern.regex);
+        if (m) {
+          const match = _truncate(m[0], 80);
+          hits.push({
+            file,
+            line: i + 1,
+            pattern: pattern.id,
+            label: pattern.label,
+            category: pattern.category,
+            match,
+            ignored: isIgnored(file, line, opts.ignoreEntries),
+            source: "prose",
+          });
+        }
+      }
+    }
+  }
+  return hits;
+}
+
+module.exports = { scanProse };

package/lib/scan/patterns.ts

@@ -0,0 +1,139 @@
+"use strict";
+
+/**
+ * GRD Scan/Patterns -- Prompt injection pattern definitions.
+ *
+ * Pattern set adopted from gsd-2 v2.67+ (scripts/docs-prompt-injection-scan.sh
+ * and scripts/base64-scan.sh at https://github.com/gsd-build/gsd-2).
+ * Reimplemented in TypeScript for GRD; see
+ * docs/superpowers/specs/2026-04-11-gsd2-prompt-injection-scan-design.md
+ * for the full adoption story.
+ */
+
+export interface InjectionPattern {
+  readonly id: string;
+  readonly label: string;
+  readonly category: string;
+  readonly regex: RegExp;
+}
+
+export const INJECTION_PATTERNS: readonly InjectionPattern[] = [
+  // System prompt markers
+  {
+    id: "system_prompt_tag",
+    label: "System prompt tag",
+    category: "System prompt markers",
+    regex: /<system-prompt>/i,
+  },
+  {
+    id: "im_start_system",
+    label: "im_start system",
+    category: "System prompt markers",
+    regex: /<\|im_start\|>system/i,
+  },
+  {
+    id: "system_label",
+    label: "SYSTEM label",
+    category: "System prompt markers",
+    regex: /\[SYSTEM\]\s*:/i,
+  },
+  // Role injection
+  {
+    id: "you_are_now",
+    label: "You are now",
+    category: "Role injection",
+    regex: /you are now [a-z]/i,
+  },
+  // Instruction override
+  {
+    id: "ignore_previous",
+    label: "Ignore previous",
+    category: "Instruction override",
+    regex: /ignore (all )?previous instructions/i,
+  },
+  {
+    id: "ignore_prior",
+    label: "Ignore prior",
+    category: "Instruction override",
+    regex: /ignore (all )?prior instructions/i,
+  },
+  {
+    id: "disregard_above",
+    label: "Disregard above",
+    category: "Instruction override",
+    regex: /disregard (all )?(above|previous|prior)/i,
+  },
+  {
+    id: "forget_above",
+    label: "Forget above",
+    category: "Instruction override",
+    regex: /forget (all )?(above|previous|prior) (instructions|context|rules)/i,
+  },
+  {
+    id: "new_instructions",
+    label: "New instructions",
+    category: "Instruction override",
+    regex: /new instructions:/i,
+  },
+  {
+    id: "override_instructions",
+    label: "Override instructions",
+    category: "Instruction override",
+    regex: /override (all )?instructions/i,
+  },
+  {
+    id: "new_role_is",
+    label: "Your new role is",
+    category: "Instruction override",
+    regex: /your new role is/i,
+  },
+  {
+    id: "from_now_on",
+    label: "From now on",
+    category: "Instruction override",
+    regex: /from now on,? (you (are|will|must|should)|act as)/i,
+  },
+  // Hidden HTML directives
+  {
+    id: "html_prompt_comment",
+    label: "HTML prompt comment",
+    category: "Hidden HTML directives",
+    regex: /<!--\s*(PROMPT|INSTRUCTION|SYSTEM|OVERRIDE|INJECT)\s*:/,
+  },
+  {
+    id: "html_ignore_comment",
+    label: "HTML ignore comment",
+    category: "Hidden HTML directives",
+    regex: /<!--\s*(ignore|disregard|forget|override)/,
+  },
+  // Tool call injection
+  {
+    id: "tool_call_tag",
+    label: "Tool call tag",
+    category: "Tool call injection",
+    regex: /(<tool_call>|<function_call>|<tool_use>)/,
+  },
+  {
+    id: "invoke_tag",
+    label: "Invoke tag",
+    category: "Tool call injection",
+    regex: /(<invoke|<function_calls>)/,
+  },
+  // Encoded payload
+  {
+    id: "encoded_payload",
+    label: "Encoded payload",
+    category: "Encoded payload",
+    regex: /(eval|exec|decode)\((base64|atob|btoa)/i,
+  },
+  // Obfuscation
+  {
+    id: "invisible_unicode",
+    label: "Invisible unicode",
+    category: "Obfuscation",
+    // eslint-disable-next-line no-misleading-character-class
+    regex: /[\u200B\u200C\u200D\uFEFF]/,
+  },
+] as const;
+
+module.exports = { INJECTION_PATTERNS };

package/lib/scan/strip-markdown.ts

@@ -0,0 +1,39 @@
+"use strict";
+
+/**
+ * GRD Scan/StripMarkdown -- Remove fenced code blocks and inline backtick
+ * spans from markdown while preserving line numbers.
+ *
+ * Matches gsd-2 v2.67 scripts/docs-prompt-injection-scan.sh strip_code_blocks
+ * behavior byte-for-byte, including the bug-compatible single-backtick-only
+ * inline stripping.
+ */
+
+const FENCE_RE = /^\s*```/;
+const INLINE_BACKTICK_RE = /`[^`]+`/g;
+
+/**
+ * Strip fenced code blocks and inline backtick spans from markdown content.
+ * Lines inside fenced blocks become empty lines (preserving line numbers for
+ * error reporting). Inline backtick spans are replaced with empty string.
+ */
+export function stripCodeBlocks(raw: string): string {
+  const lines = raw.split("\n");
+  const out: string[] = [];
+  let inCode = false;
+  for (const line of lines) {
+    if (FENCE_RE.test(line)) {
+      inCode = !inCode;
+      out.push("");
+      continue;
+    }
+    if (inCode) {
+      out.push("");
+      continue;
+    }
+    out.push(line.replace(INLINE_BACKTICK_RE, ""));
+  }
+  return out.join("\n");
+}
+
+module.exports = { stripCodeBlocks };

package/lib/scan/types.ts

@@ -0,0 +1,28 @@
+"use strict";
+
+/**
+ * GRD Scan/Types -- Shared output types for the prompt injection scanners.
+ *
+ * ScanHit is the common output shape produced by both scanProse (prose-level
+ * scan in injection.ts) and scanBase64 (decoded-base64 scan in base64.ts),
+ * and consumed by the orchestrator in lib/commands/scan.ts and the CLI
+ * dispatch layer in lib/cli/tools.ts.
+ *
+ * Keeping ScanHit here (rather than in a specific scanner module) avoids
+ * sibling-import awkwardness where base64.ts would have to reach into
+ * injection.ts just to get its own output type.
+ */
+
+export interface ScanHit {
+  file: string;
+  line: number;
+  pattern: string;
+  label: string;
+  category: string;
+  match: string;
+  ignored: boolean;
+  source: "prose" | "base64";
+}
+
+// Types are compile-time only — no module.exports needed. Consumers use
+// `import type { ScanHit } from './types'` which ts-jest erases at runtime.

package/lib/scheduler-wait.ts

@@ -0,0 +1,58 @@
+'use strict';
+
+/**
+ * GRD Scheduler/Wait -- Cancellable wait primitive for the scheduler's
+ * all-accounts-exhausted fallback.
+ *
+ * Sleeps until a target timestamp or SIGINT, whichever fires first.
+ * Registers a process-level SIGINT handler lazily on first use — GRD has
+ * no other SIGINT handlers in lib/, so this is the first. If another
+ * module adds one later they should coordinate via a shared registry.
+ *
+ * Pattern adopted from gsd-2 v2.67 auto-supervisor.ts signal handling.
+ */
+
+let _sigintRegistered = false;
+const _activeControllers: Set<AbortController> = new Set();
+
+function _ensureSigintHandler(): void {
+  if (_sigintRegistered) return;
+  _sigintRegistered = true;
+  process.on('SIGINT', () => {
+    for (const ctl of _activeControllers) ctl.abort();
+    _activeControllers.clear();
+  });
+}
+
+/**
+ * Sleep until `targetMs` (ms since epoch) or SIGINT, whichever fires first.
+ *
+ * @param targetMs - absolute timestamp at which to resume
+ * @returns 'waited' if the delay elapsed normally, 'aborted' if SIGINT was received
+ */
+async function waitUntilOrAbort(targetMs: number): Promise<'waited' | 'aborted'> {
+  _ensureSigintHandler();
+  const delay = Math.max(0, targetMs - Date.now());
+  if (delay === 0) return 'waited';
+
+  const controller = new AbortController();
+  _activeControllers.add(controller);
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(resolve, delay);
+      controller.signal.addEventListener('abort', () => {
+        clearTimeout(timer);
+        reject(new Error('SIGINT'));
+      });
+    });
+    return 'waited';
+  } catch (e) {
+    if ((e as Error).message === 'SIGINT') return 'aborted';
+    throw e;
+  } finally {
+    _activeControllers.delete(controller);
+  }
+}
+
+module.exports = { waitUntilOrAbort };