@lumoai/cli 1.66.0 → 1.69.0

package/dist/cli/src/lib/scan-format.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatScanLayerTail = formatScanLayerTail;
+exports.formatHuntCoverageLine = formatHuntCoverageLine;
+const sanitize_1 = require("./sanitize");
+const security_scan_1 = require("../../../shared/src/security-scan");
+const EXTERNAL_ERROR_TAIL = 200;
+function tail(s, max) {
+    return s.length > max ? `…${s.slice(-max)}` : s;
+}
+/**
+ * ` · Secrets: checked · Code scan: checked (2 external findings) ·
+ * Dependencies: checked (1 dependency finding, 1 already on main) ·
+ * AI review: checked · Exploit paths: checked · partial · 3 left the queue
+ * (2 resolved on main, 1 merged unreviewed) — <scrubbed reason>`, or `''`
+ * when the scan carries no stage at all. The caller prefixes its own head
+ * (`  PR #945 · scan CLEAN` / `Scan abc1234 · FINDINGS`).
+ *
+ * Stage segments only for keys present, in secrets/external/supplyChain/
+ * judge/hunt order; the `(N external findings)` count only decorates the
+ * Code scan segment, the dependency count (with its already-on-main share)
+ * only the Dependencies segment, and each only when N > 0.
+ */
+function formatScanLayerTail(s) {
+    const segments = [];
+    for (const key of security_scan_1.SCAN_STAGE_KEYS) {
+        const state = s.stages[key];
+        if (!state)
+            continue;
+        const head = `${(0, security_scan_1.scanStageLabel)(key)}: ${(0, security_scan_1.scanStageStateLabel)(state)}`;
+        if (key === 'external' && s.externalFindings > 0) {
+            const noun = s.externalFindings === 1 ? 'finding' : 'findings';
+            segments.push(`${head} (${s.externalFindings} external ${noun})`);
+        }
+        else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
+            const n = s.dependencyFindings ?? 0;
+            const noun = n === 1 ? 'finding' : 'findings';
+            const persisting = s.persistingFindings ?? 0;
+            const tail = persisting > 0 ? `, ${persisting} already on main` : '';
+            segments.push(`${head} (${n} dependency ${noun}${tail})`);
+        }
+        else {
+            segments.push(head);
+        }
+    }
+    let line = '';
+    if (segments.length > 0)
+        line += ` · ${segments.join(' · ')}`;
+    if (s.partial)
+        line += ' · partial';
+    // LUM-775: what left the queue because the PR merged / closed, and why —
+    // so a merged PR's line explains where its findings went instead of
+    // silently listing fewer open rows than the scan found.
+    const exits = (0, security_scan_1.formatQueueExits)(s.queueExits);
+    if (exits)
+        line += ` · ${exits}`;
+    // LUM-756 (P8): only the prefixed, scrubbed scanner reason is printed, and
+    // only the text after the prefix (the caller has already applied the rule).
+    if (s.externalFailureReason) {
+        line += ` — ${(0, sanitize_1.sanitizeField)(tail(s.externalFailureReason, EXTERNAL_ERROR_TAIL))}`;
+    }
+    return line;
+}
+/**
+ * LUM-762 — the hunt's per-task read-out, one line under its scan:
+ * `Exploit paths 2/3 done · t1 idor 41.2s done · t2 injection 72.0s done
+ * (2 attempts) · t3 race skipped`. Headed by the same display label as the
+ * layer's own segment (LUM-763) — the detail line and the line above it
+ * must not name the layer two different ways. Elapsed time is summed over a
+ * task's attempts; a skipped task has none to print.
+ *
+ * LUM-758: a plan may hold two tasks of the same category, so the row is led
+ * by its task id. Pre-task-graph audits carry no id — the row then prints
+ * exactly as it always did.
+ */
+function formatHuntCoverageLine(hunt) {
+    const parts = hunt.categories.map(c => {
+        const attempts = c.attempts > 1 ? ` (${c.attempts} attempts)` : '';
+        const spent = c.stopped === 'skipped' ? '' : `${(c.elapsedMs / 1000).toFixed(1)}s `;
+        const id = c.taskId === undefined ? '' : `${(0, sanitize_1.sanitizeField)(c.taskId)} `;
+        return `${id}${(0, sanitize_1.sanitizeField)(c.category)} ${spent}${(0, sanitize_1.sanitizeField)(c.stopped)}${attempts}`;
+    });
+    return `${(0, security_scan_1.scanStageLabel)('hunt')} ${hunt.done}/${hunt.total} done · ${parts.join(' · ')}`;
+}

package/dist/lib/acceptance/unmet-display.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUnmetForDisplay = isUnmetForDisplay;
+/** PASS 与 PASS_WITH_FOLLOWUP 都算通过（与 verification-run 仓库的
+ *  isPassVerdict 同义；这里本地实现以保持本模块零依赖）。 */
+function isPass(verdict) {
+    return verdict === 'PASS' || verdict === 'PASS_WITH_FOLLOWUP';
+}
+/**
+ * LUM-789 渲染口径：一条 criterion 是否该呈现为「未满足」。
+ *
+ * 未裁定的 HUMAN 项是 **tacit pass** —— 没人送回就是默认通过，与 DONE 闸
+ * 早已采用的口径一致（task-state.service.ts 的 assertNoUnresolvedSendBack
+ * 只对明确 FAIL 返回 409）。把它呈现成待办是纯摩擦：一个总会通过的闸产出
+ * 的不是信号，是伪装成信号的噪音。
+ *
+ * ⚠️ 这是 **渲染** 口径，不是裁决口径。裁决用的是
+ * task-human-verdict.service.ts 的 `allMet`（every criterion isPassVerdict），
+ * 它必须保持「未裁定 ≠ 通过」，否则在 web 上点一条 PASS 会把整个任务推成
+ * DONE。两者不得合并。
+ */
+function isUnmetForDisplay(criterion, latest) {
+    if (isPass(latest?.verdict))
+        return false;
+    if (latest === undefined && criterion.verifierType === 'HUMAN')
+        return false;
+    return true;
+}

package/dist/shared/src/hunt-audit.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * LUM-788 — the per-task hunt read-out, shared by the CLI (`lumo pr scan
+ * --full`) and the lum739 analysis script. One implementation: the CLI is a
+ * separate package that cannot import `lib/` or `scripts/`, and a second copy
+ * of this printer is exactly how the audit lost four fields to "computed,
+ * carried, never read" before LUM-758.
+ *
+ * Pure formatting over the raw `PrSecurityScan.huntAudit.tasks[]` rows. Every
+ * field is optional by construction: the column is Json written by past
+ * versions of the workflow, and a row written before a field existed prints
+ * exactly as it always did — nothing is guessed, nothing is thrown over.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatHuntTaskDetail = formatHuntTaskDetail;
+exports.formatShellDetail = formatShellDetail;
+/** One line of prose, flattened, for a fixed-width read-out. */
+function oneLine(text, max) {
+    const flat = text.replace(/\s+/g, ' ').trim();
+    return flat.length > max ? `${flat.slice(0, max)}…` : flat;
+}
+/**
+ * The per-task listing for EVERY task handed in, idle ones included — the
+ * `lumo pr scan --full` shape. A task that never asked the shell for anything
+ * still has a stop line, a model and the sites it was briefed on, and "this
+ * task ran two steps and submitted nothing" is a fact the reader came for.
+ *
+ * Lines per task: a header (`t1 done · <model> · 3 sites · 2 cmds (gate
+ * refused …)`), one line per command (`✗` = the gate refused it, with its
+ * reason), one line per trace step, then the stop arithmetic and the
+ * wrap-up outcome — each only when the row carries it.
+ */
+function formatHuntTaskDetail(tasks, maxTasks) {
+    const out = [];
+    for (const t of tasks.slice(0, maxTasks)) {
+        const sh = t.shell;
+        // LUM-787 — the model and the sites print only when the row carries them;
+        // the clip count likewise: an older row, and a row from a search that
+        // never hit the ceiling, read as before.
+        const cmds = sh?.calls
+            ? `${sh.calls} cmds (gate refused ${sh.refused ?? 0}, sandbox failed ${sh.failed ?? 0}, not found ${sh.notFound ?? 0}, empty ${sh.empty ?? 0}${sh.stepClipped ? `, step-clipped ${sh.stepClipped}` : ''})`
+            : 'no shell commands';
+        out.push(`${String(t.taskId)} ${String(t.stopped)}${t.model ? ` · ${t.model}` : ''}${typeof t.sites === 'number' ? ` · ${t.sites} sites` : ''} · ${cmds}`);
+        for (const c of sh?.commands ?? []) {
+            const cost = typeof c.chars === 'number'
+                ? `  [${c.chars} chars${c.compressed ? ', compressed' : ''}${c.clipped ? ', clipped' : ''}]`
+                : '';
+            out.push(`    ${c.denied ? '✗' : ' '} ${c.cmd ?? ''}${cost}${c.reason ? `   ← ${c.reason}` : ''}`);
+        }
+        // LUM-781 — the model's side, step by step, then how it ended. Only when
+        // the row carries them: an older row prints exactly as before.
+        for (const st of t.trace ?? []) {
+            out.push(`    #${st.i ?? '?'} tool=${st.tool ?? '(none)'} in=${st.inputTokens ?? '?'} out=${st.outputTokens ?? '?'}${st.reasoningTokens ? ` reasoning=${st.reasoningTokens}` : ''}${st.elidedChars ? ` elided=${st.elidedChars}` : ''}${st.finishReason ? ` finish=${st.finishReason}` : ''}${st.text ? ` "${oneLine(st.text, 160)}"` : ''}`);
+        }
+        if (t.stop) {
+            const s = t.stop;
+            out.push(`    stop: ${s.by ?? '?'} · spent ${s.spent ?? '?'}/${s.budget ?? '?'} · reserve ${s.reserve ?? 0} · last step ${s.lastStep ?? '?'}${typeof s.next === 'number' ? ` · next ${s.next}` : ''} · ${s.steps ?? '?'} steps`);
+        }
+        if (t.wrapUp) {
+            const w = t.wrapUp;
+            out.push(w.ran
+                ? `    wrap-up: ran · submitted ${w.submitted ?? 0} · ${w.tokens ?? '?'} tokens${w.finishReason ? ` · finish=${w.finishReason}` : ''}${w.text ? ` · "${oneLine(w.text, 200)}"` : ''}`
+                : w.error
+                    ? `    wrap-up: attempted, failed — ${oneLine(w.error, 160)}`
+                    : `    wrap-up: not made (${w.skipped ?? 'unknown'})`);
+        }
+    }
+    return out;
+}
+/**
+ * The per-task, command-by-command listing of the lum739 audit report —
+ * only tasks that actually asked the shell for something.
+ *
+ * The run-level `shell:` line says HOW MUCH; only this says WHAT — and telling
+ * "mapped the repo and ran out" from "the gate rejected everything" from
+ * "looked and found nothing" is the entire reason the field exists. Extracted
+ * as a pure function so it can be tested: a read-out nothing exercises is the
+ * same "computed, carried, never read" shape this layer has already lost four
+ * fields to.
+ */
+function formatShellDetail(tasks, maxTasks) {
+    return formatHuntTaskDetail(tasks.filter(x => x.shell?.calls), maxTasks);
+}

package/dist/shared/src/untrusted-content.js

@@ -30,12 +30,29 @@
  *
  * Layered on top of `sanitizeField`, never instead of it: callers strip
  * control characters first, then guard.
+ *
+ * LUM-791 — the signal patterns match a *normalized copy* of the text
+ * (`normalizeForMatching`) while every reported offset and excerpt comes from
+ * the original. Before that, one invisible character bought a full bypass:
+ * `ig<U+200B>nore all previous instructions` matched no imperative pattern,
+ * and a lone zero-width is deliberately below `WEAK_INVISIBLE_MIN_RUN`, so
+ * both defences missed it at once. Normalization is orthogonal to precision —
+ * it widens no pattern, it only stops padding characters from being a bypass.
+ *
+ * LUM-792 — the wrapper half needed the same medicine, on the harder path:
+ * `escapesWrapper` matched the tag name literally, so
+ * `</untrusted<U+200B>-team-memory>` — which an LLM reads as a closing tag —
+ * was not one, and the fence could be closed early. Tag matching now runs on
+ * the normalized copy as well, while the rewrite still happens in the
+ * original text. The same round widened the ZH imperatives from word-level to
+ * character-level separator tolerance.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INJECTION_SIGNAL_LABEL = exports.INJECTION_SIGNAL_KINDS = void 0;
+exports.NORMALIZE_MAX_CHARS = exports.INJECTION_SIGNAL_LABEL = exports.INJECTION_SIGNAL_KINDS = void 0;
 exports.escapesWrapper = escapesWrapper;
 exports.countWrapperEscapes = countWrapperEscapes;
 exports.neutralizeWrapperEscapes = neutralizeWrapperEscapes;
+exports.normalizeForMatching = normalizeForMatching;
 exports.detectInjectionSignals = detectInjectionSignals;
 exports.summarizeContentSignals = summarizeContentSignals;
 exports.isContentSignals = isContentSignals;
@@ -72,35 +89,109 @@ const WRAPPER_NAME = 'untrusted-[a-z0-9_-]*|system[-_]reminder|function_results?
  * stops `system-reminderx` from matching while still letting the greedy
  * `untrusted-[…]*` end on a `-` (the legacy regex matched `<untrusted->`).
  *
- * Built from a source string so the two consumers can hold a `g` and a
- * non-`g` instance: a shared `/g` regex advances `lastIndex` on `.test()` and
- * would make `escapesWrapper` flip-flop on repeated calls (the trap
- * `prompt-safety.ts` documents).
+ * Built from a source string, and every consumer compiles its own instance
+ * rather than sharing one: a shared `/g` regex advances `lastIndex` on
+ * `.test()` and would make `escapesWrapper` flip-flop on repeated calls (the
+ * trap `prompt-safety.ts` documents).
  */
 const WRAPPER_TAG_SOURCE = `<\\s*(\\/?)\\s*(${WRAPPER_NAME})(?=[\\s>\\/])([^<>]*)>`;
-const WRAPPER_TAG = new RegExp(WRAPPER_TAG_SOURCE, 'i');
-const WRAPPER_TAG_G = new RegExp(WRAPPER_TAG_SOURCE, 'gi');
+/**
+ * The same shape anchored to a whole string. It answers one question about a
+ * span: is this *literally* a tag, or does it only read as one once padding
+ * has been normalized away?
+ */
+const WRAPPER_TAG_EXACT = new RegExp(`^${WRAPPER_TAG_SOURCE}$`, 'i');
+/** Angle brackets, including the full-width forms NFKC folds into them. */
+const ANGLE_OPEN = /[<\uFF1C]/g;
+const ANGLE_CLOSE = /[>\uFF1E]/g;
+/**
+ * Every fence-shaped tag in `text`.
+ *
+ * LUM-792 — matched against the NORMALIZED copy, for the same reason the
+ * signal patterns are (LUM-791): the literal regex read the tag name and
+ * nothing else, so one invisible character inside it bought a full bypass —
+ * and on *this* path the consequence is not one missing advisory, it is a
+ * fence the content can close early. An LLM reads
+ * `</untrusted<U+200B>-team-memory>` as a closing tag; so must we.
+ *
+ * Spans come back in ORIGINAL coordinates because the caller rewrites the
+ * real text, not the copy. The end offset is mapped from the match's LAST
+ * character rather than from the position after it: an offset sitting exactly
+ * on a rewrite checkpoint resolves to the far side of it, which would swallow
+ * whatever padding happens to follow the tag.
+ */
+function findWrapperTags(text) {
+    if (!text)
+        return [];
+    const norm = normalizeForMatching(text);
+    const re = new RegExp(WRAPPER_TAG_SOURCE, 'gi');
+    const spans = [];
+    let m;
+    while ((m = re.exec(norm.text)) !== null) {
+        const length = m[0].length;
+        if (length === 0) {
+            re.lastIndex++;
+            continue;
+        }
+        const start = norm.toOriginalIndex(m.index);
+        const end = Math.min(norm.toOriginalIndex(m.index + length - 1) + 1, text.length);
+        const prev = spans[spans.length - 1];
+        if (end <= start || (prev !== undefined && start < prev.end))
+            continue;
+        spans.push({ start, end });
+    }
+    return spans;
+}
 /** True when the text carries any fence-shaped tag, opening or closing. */
 function escapesWrapper(text) {
-    return WRAPPER_TAG.test(text);
+    return findWrapperTags(text).length > 0;
 }
 /** How many fence-shaped tags the text carries. */
 function countWrapperEscapes(text) {
-    return text.match(WRAPPER_TAG_G)?.length ?? 0;
+    return findWrapperTags(text).length;
+}
+/**
+ * The inert form of one tag span.
+ *
+ * A span that is literally a tag gets the canonical LUM-783 rendering —
+ * `<x a="1">` → `(x a="1")`, `</x>` → `(/x)`, whitespace collapsed — which is
+ * what keeps the `untrusted-*` subset byte-identical to LUM-758's
+ * `neutralizeUntrustedTags`.
+ *
+ * A span that only reads as a tag once normalized was padded on purpose.
+ * There the brackets are defanged and every other character is kept, the
+ * padding included: the reason this module neutralizes rather than drops is
+ * that a reviewer gets to see what the content tried to do, and stripping the
+ * invisible characters would erase exactly the part worth seeing. Nothing
+ * that can parse as a tag survives either way — the brackets are gone.
+ */
+function inertTag(raw) {
+    const literal = WRAPPER_TAG_EXACT.exec(raw);
+    if (literal) {
+        const attrs = (literal[3] ?? '').trim().replace(/\s+/g, ' ');
+        return `(${literal[1] ?? ''}${literal[2] ?? ''}${attrs ? ` ${attrs}` : ''})`;
+    }
+    return raw.replace(ANGLE_OPEN, '(').replace(ANGLE_CLOSE, ')');
 }
 /**
- * Turn every fence-shaped tag into inert text: `<x>` → `(x)`, `</x>` → `(/x)`,
- * whitespace collapsed, attributes kept (a reviewer should still see what the
- * content tried to do). Iterates to a fixpoint so removing an inner tag can
- * never reassemble an outer one.
+ * Turn every fence-shaped tag into inert text. Iterates to a fixpoint so
+ * removing an inner tag can never reassemble an outer one.
  */
 function neutralizeWrapperEscapes(text) {
     let out = text;
     for (let i = 0; i < 8; i++) {
-        const next = out.replace(WRAPPER_TAG_G, (_m, slash, name, attrs) => {
-            const a = attrs.trim().replace(/\s+/g, ' ');
-            return `(${slash}${name}${a ? ` ${a}` : ''})`;
-        });
+        const spans = findWrapperTags(out);
+        if (spans.length === 0)
+            return out;
+        let next = '';
+        let cursor = 0;
+        for (const span of spans) {
+            next +=
+                out.slice(cursor, span.start) +
+                    inertTag(out.slice(span.start, span.end));
+            cursor = span.end;
+        }
+        next += out.slice(cursor);
         if (next === out)
             return out;
         out = next;
@@ -133,21 +224,43 @@ const IMPERATIVE_EN = [
     // run / execute the following command
     /\b(?:run|execute)\s+(?:the\s+following|this|these|the\s+below)\s+(?:commands?|scripts?|code|instructions?|steps?|payload)\b/i,
 ];
+/**
+ * Chinese is normally written without spaces between words, so inserting one
+ * costs a human reader nothing and used to break a contiguous character class
+ * outright (`忽略 之前 的所有指令` → no match). Every ZH pattern therefore
+ * joins its parts with a bounded separator class instead of butting them
+ * together. `{0,3}` keeps the gap too small to bridge unrelated sentences.
+ *
+ * LUM-792 — the same trick one level down. `忽 略 之 前 的 所 有 指 令`
+ * separates every *character*, which the word-level tolerance above does not
+ * cover; a human reads straight through it, and on origin/main it produced
+ * zero signals. `looseZh` therefore also admits a separator between two
+ * adjacent CJK characters — **at most one**, which is the whole precision
+ * story: a run would let ordinary prose drift into a match, and
+ * `忽 然 想 起 之 前 的 那 些 指 令` has to stay clean. English is
+ * space-delimited already and none of this touches it.
+ */
+const ZH_SEP = '[\\s、,，]{0,3}';
+const ZH_CHAR_SEP = '[\\s、,，]?';
+const ADJACENT_ZH = /[\u4e00-\u9fff](?=[\u4e00-\u9fff])/gu;
+/** Admit one separator between each pair of adjacent CJK characters. */
+const looseZh = (source) => source.replace(ADJACENT_ZH, m => `${m}${ZH_CHAR_SEP}`);
+const zh = (...parts) => new RegExp(parts.map(looseZh).join(ZH_SEP));
 const IMPERATIVE_ZH = [
     // 忽略 / 无视 … 之前 … 指令
-    /(?:忽略|无视|忘记|忘掉|抛弃|放弃|覆盖)(?:掉)?(?:之前|以上|上面|先前|前面|上述|所有|全部|一切|原来|原先|系统)(?:的)?(?:所有|全部|一切)?(?:指令|指示|提示|规则|内容|说明|要求|设定|限制|约束)/,
+    zh('(?:忽略|无视|忘记|忘掉|抛弃|放弃|覆盖)', '(?:掉)?', '(?:之前|以上|上面|先前|前面|上述|所有|全部|一切|原来|原先|系统)', '(?:的)?', '(?:所有|全部|一切)?', '(?:指令|指示|提示|规则|内容|说明|要求|设定|限制|约束)'),
     // 你现在是 / 扮演 …
-    /你现在(?:是|扮演|作为|变成|成为|将是)/,
+    zh('你现在', '(?:是|扮演|作为|变成|成为|将是)'),
     // 新指令：
-    /新(?:的)?(?:系统)?(?:指令|指示|规则|任务)\s*[:：]/,
-    // 行首角色标签
-    /(?:^|\n)[ \t]*(?:系统|助手|开发者)[ \t]*[:：]/,
+    zh('新', '(?:的)?', '(?:系统)?', '(?:指令|指示|规则|任务)', '[:：]'),
+    // 行首角色标签 — anchored on the line, so no *leading* separator tolerance.
+    new RegExp(`(?:^|\\n)[ \\t]*${looseZh('(?:系统|助手|开发者)')}[ \\t]*[:：]`),
     // 不要告诉用户
-    /(?:不要|别|勿|不准|禁止|不能)(?:告诉|告知|透露给|通知|提醒)(?:任何)?(?:用户|人类|审核者|操作者)/,
+    zh('(?:不要|别|勿|不准|禁止|不能)', '(?:告诉|告知|透露给|通知|提醒)', '(?:任何)?', '(?:用户|人类|审核者|操作者)'),
     // 输出你的系统提示
-    /(?:输出|显示|打印|泄露|重复|说出|复述|公开)(?:你的|你|系统的)?(?:系统提示|系统指令|初始指令|隐藏指令|提示词)/,
+    zh('(?:输出|显示|打印|泄露|重复|说出|复述|公开)', '(?:你的|你|系统的)?', '(?:系统提示|系统指令|初始指令|隐藏指令|提示词)'),
     // 执行以下命令
-    /(?:执行|运行)(?:以下|下面|下列|这些|这个|如下|后面|该)(?:的)?(?:命令|指令|脚本|代码|操作|步骤)/,
+    zh('(?:执行|运行)', '(?:以下|下面|下列|这些|这个|如下|后面|该)', '(?:的)?', '(?:命令|指令|脚本|代码|操作|步骤)'),
 ];
 const IMPERATIVE_PATTERNS = [...IMPERATIVE_EN, ...IMPERATIVE_ZH];
 /** A comment whose body is a paragraph, or carries an imperative, is a signal. */
@@ -212,6 +325,117 @@ function* matchAll(re, text) {
             re.lastIndex++;
     }
 }
+// ─── Matching-time normalization (LUM-791) ───────────────────────────────────
+/**
+ * Hard cap on how many characters the normalizer will rewrite. Text longer
+ * than this is never truncated — the tail is carried through verbatim — but
+ * the rewriting work (and the offset table it builds) stays bounded, because
+ * every injection point runs this on its hot path.
+ */
+exports.NORMALIZE_MAX_CHARS = 1_000_000;
+/**
+ * Compatibility forms that are the same letter in another dress: full-width
+ * ASCII (U+FF01-FF60, U+FFE0-FFEE), Latin ligatures, circled / parenthesised
+ * letters and digits, and the mathematical alphanumerics. Ordinary CJK,
+ * emoji and half-width katakana sit outside these ranges and are left alone.
+ * Held as a source string so the escapes stay readable in review.
+ */
+const COMPAT_RANGES = '\\u2460-\\u24FF\\uFB00-\\uFB06\\uFF01-\\uFF60\\uFFE0-\\uFFEE\\u{1D400}-\\u{1D7FF}';
+/** A single cheap scan: is there anything in here to rewrite at all? */
+const NEEDS_NORMALIZE = new RegExp(`\\p{Cf}|[^\\S\\n]{2,}|[^\\S\\n\\x20]|[${COMPAT_RANGES}]`, 'u');
+/**
+ * The three rewrite classes, in precedence order:
+ *
+ *  1. Unicode format characters (Cf) — zero-width, bidi controls, unicode
+ *     tags, soft hyphen, BOM. Dropped: none of them carry meaning to a reader,
+ *     all of them break a literal match.
+ *  2. Horizontal whitespace runs — tabs, NBSP, the full-width space U+3000 —
+ *     folded to one ASCII space. Newlines are deliberately NOT folded: the
+ *     role-label patterns are anchored on the start of a line.
+ *  3. Compatibility forms (COMPAT_RANGES), folded with NFKC.
+ */
+const REWRITE = new RegExp(`\\p{Cf}+|[^\\S\\n]+|[${COMPAT_RANGES}]+`, 'gu');
+const ALL_FORMAT = /^\p{Cf}+$/u;
+const ALL_HORIZONTAL_WS = /^[^\S\n]+$/;
+function rewriteRun(run) {
+    if (ALL_FORMAT.test(run))
+        return '';
+    if (ALL_HORIZONTAL_WS.test(run))
+        return ' ';
+    return run.normalize('NFKC');
+}
+/**
+ * Build the copy the injection patterns are matched against, plus the offset
+ * table that maps every position in it back to the original text.
+ *
+ * Pure: no module state, no shared `lastIndex`, same input → same output.
+ * Never throws. Text that needs nothing takes a fast path and is returned
+ * as-is, which is the overwhelmingly common case on the hot path.
+ */
+function normalizeForMatching(text) {
+    if (!text || !NEEDS_NORMALIZE.test(text)) {
+        return {
+            text,
+            changed: false,
+            toOriginalIndex: (i) => Math.min(Math.max(i, 0), text.length),
+        };
+    }
+    const limit = Math.min(text.length, exports.NORMALIZE_MAX_CHARS);
+    const head = text.slice(0, limit);
+    const pieces = [];
+    // Checkpoints: normalized offset ↔ original offset, recorded at each
+    // rewrite. Between two checkpoints the mapping is a constant shift, so the
+    // table costs O(number of rewrites), not O(length).
+    const normAt = [0];
+    const origAt = [0];
+    let norm = 0;
+    let copied = 0;
+    const re = new RegExp(REWRITE.source, REWRITE.flags);
+    let m;
+    while ((m = re.exec(head)) !== null) {
+        const run = m[0];
+        if (run.length === 0) {
+            re.lastIndex++;
+            continue;
+        }
+        const replacement = rewriteRun(run);
+        if (replacement === run)
+            continue;
+        pieces.push(head.slice(copied, m.index), replacement);
+        norm += m.index - copied + replacement.length;
+        copied = m.index + run.length;
+        if (normAt[normAt.length - 1] === norm)
+            origAt[origAt.length - 1] = copied;
+        else {
+            normAt.push(norm);
+            origAt.push(copied);
+        }
+    }
+    // Everything left: the rest of the head plus any tail beyond the cap.
+    pieces.push(text.slice(copied));
+    const out = pieces.join('');
+    return {
+        text: out,
+        changed: out !== text,
+        toOriginalIndex: (i) => {
+            if (i <= 0)
+                return 0;
+            let lo = 0;
+            let hi = normAt.length - 1;
+            while (lo < hi) {
+                const mid = (lo + hi + 1) >> 1;
+                if (normAt[mid] <= i)
+                    lo = mid;
+                else
+                    hi = mid - 1;
+            }
+            // A compatibility fold can be longer than its source, so clamp to the
+            // next checkpoint rather than running past it.
+            const ceiling = lo + 1 < origAt.length ? origAt[lo + 1] : text.length;
+            return Math.min(origAt[lo] + (i - normAt[lo]), ceiling, text.length);
+        },
+    };
+}
 /**
  * Scan untrusted text for content shaped like an instruction to the model.
  * Pure; never throws; empty input yields no signals. Signals come back in
@@ -221,41 +445,47 @@ function detectInjectionSignals(text) {
     if (!text)
         return { signals: [] };
     const signals = [];
+    // Patterns run against the normalized copy; every offset and excerpt the
+    // caller sees is translated back to the original text (LUM-791).
+    const normalized = normalizeForMatching(text);
+    const scan = normalized.text;
+    const original = (start, end) => text.slice(normalized.toOriginalIndex(start), normalized.toOriginalIndex(end));
     // ① imperative directives (EN + ZH)
     for (const p of IMPERATIVE_PATTERNS) {
         const g = new RegExp(p.source, p.flags.includes('g') ? p.flags : `${p.flags}g`);
-        for (const m of matchAll(g, text)) {
+        for (const m of matchAll(g, scan)) {
             signals.push({
                 kind: 'IMPERATIVE',
-                index: m.index,
-                excerpt: excerpt(m[0]),
+                index: normalized.toOriginalIndex(m.index),
+                excerpt: excerpt(original(m.index, m.index + m[0].length)),
             });
         }
     }
     // ② text hidden in HTML / Markdown comments
-    for (const m of matchAll(HTML_COMMENT, text)) {
-        const body = m[1] ?? '';
-        const dense = body.replace(/\s+/g, '');
-        if (dense.length >= HIDDEN_COMMENT_MIN_CHARS || hasImperative(body)) {
-            signals.push({
-                kind: 'HIDDEN_COMMENT',
-                index: m.index,
-                excerpt: excerpt(body),
-            });
-        }
-    }
-    for (const m of matchAll(MARKDOWN_COMMENT, text)) {
-        const body = m[1] ?? m[2] ?? m[3] ?? '';
-        const dense = body.replace(/\s+/g, '');
-        if (dense.length >= HIDDEN_COMMENT_MIN_CHARS || hasImperative(body)) {
+    //    The body is *tested* on the normalized copy (so a zero-width inside the
+    //    comment cannot hide its imperative) and *shown* from the original.
+    const comment = (re, groups) => {
+        const d = new RegExp(re.source, `${re.flags}d`);
+        for (const m of matchAll(d, scan)) {
+            const g = groups.find(i => m[i] !== undefined);
+            if (g === undefined)
+                continue;
+            const body = m[g] ?? '';
+            const dense = body.replace(/\s+/g, '');
+            if (dense.length < HIDDEN_COMMENT_MIN_CHARS && !hasImperative(body))
+                continue;
+            const span = m.indices?.[g];
             signals.push({
                 kind: 'HIDDEN_COMMENT',
-                index: m.index,
-                excerpt: excerpt(body),
+                index: normalized.toOriginalIndex(m.index),
+                excerpt: excerpt(span ? original(span[0], span[1]) : body),
             });
         }
-    }
-    // ③ zero-width / bidi / tag characters
+    };
+    comment(HTML_COMMENT, [1]);
+    comment(MARKDOWN_COMMENT, [1, 2, 3]);
+    // ③ zero-width / bidi / tag characters — on the ORIGINAL text by
+    //    definition: these are exactly the characters normalization removes.
     {
         const strong = [...matchAll(STRONG_INVISIBLE, text)];
         // A leading BOM is a file artefact, not a hidden character.
@@ -276,7 +506,8 @@ function detectInjectionSignals(text) {
             });
         }
     }
-    // ④ long high-entropy base64 / hex runs
+    // ④ long high-entropy base64 / hex runs — on the ORIGINAL text: the length
+    //    floor and the entropy floors are calibrated against raw runs.
     for (const m of matchAll(ENCODED_RUN, text)) {
         const run = m[0];
         const floor = HEX_ONLY.test(run) ? HEX_MIN_ENTROPY : BASE64_MIN_ENTROPY;
@@ -288,14 +519,15 @@ function detectInjectionSignals(text) {
             });
         }
     }
-    // ⑤ javascript: / vbscript: / data:<mime> links
+    // ⑤ javascript: / vbscript: / data:<mime> links — also on the normalized
+    //    copy, so `java<U+200B>script:` cannot slip past the `\s*` tolerance.
     for (const p of SCRIPT_LINK_PATTERNS) {
         const g = new RegExp(p.source, `${p.flags}g`);
-        for (const m of matchAll(g, text)) {
+        for (const m of matchAll(g, scan)) {
             signals.push({
                 kind: 'SCRIPT_LINK',
-                index: m.index,
-                excerpt: excerpt(m[0]),
+                index: normalized.toOriginalIndex(m.index),
+                excerpt: excerpt(original(m.index, m.index + m[0].length)),
             });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.66.0",
+  "version": "1.69.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",