@node9/policy-engine 1.36.0 → 1.38.0

package/dist/index.d.mts

@@ -86,6 +86,26 @@ interface RiskMetadata {
     ruleDescription?: string;
 }
 
+type InjectionConfidence = 'low' | 'medium' | 'high';
+interface InjectionMatch {
+    /** Names of the matched signals (+ 'untrusted-origin' when applicable). */
+    signals: string[];
+    confidence: InjectionConfidence;
+}
+interface InjectionContext {
+    /** Tool that produced the output. Untrusted origins (web/network) raise
+     *  confidence — a fetched page is attacker-influenceable; a local read isn't. */
+    tool?: string;
+}
+/**
+ * Scan tool output for indirect prompt injection. Returns the matched signals +
+ * a confidence, or null when nothing matched. Scoring: +1 per matched signal,
+ * +1 booster when the origin is an untrusted tool (booster needs ≥1 real
+ * signal). score 1 → low (a single phrase, e.g. a doc discussing injection);
+ * 2 → medium; 3+ → high. Callers should act only on medium+.
+ */
+declare function scanInjection(text: string, ctx?: InjectionContext): InjectionMatch | null;
+
 interface DlpPattern {
     name: string;
     regex: RegExp;
@@ -1009,4 +1029,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -86,6 +86,26 @@ interface RiskMetadata {
     ruleDescription?: string;
 }
 
+type InjectionConfidence = 'low' | 'medium' | 'high';
+interface InjectionMatch {
+    /** Names of the matched signals (+ 'untrusted-origin' when applicable). */
+    signals: string[];
+    confidence: InjectionConfidence;
+}
+interface InjectionContext {
+    /** Tool that produced the output. Untrusted origins (web/network) raise
+     *  confidence — a fetched page is attacker-influenceable; a local read isn't. */
+    tool?: string;
+}
+/**
+ * Scan tool output for indirect prompt injection. Returns the matched signals +
+ * a confidence, or null when nothing matched. Scoring: +1 per matched signal,
+ * +1 booster when the origin is an untrusted tool (booster needs ≥1 real
+ * signal). score 1 → low (a single phrase, e.g. a doc discussing injection);
+ * 2 → medium; 3+ → high. Callers should act only on medium+.
+ */
+declare function scanInjection(text: string, ctx?: InjectionContext): InjectionMatch | null;
+
 interface DlpPattern {
     name: string;
     regex: RegExp;
@@ -1009,4 +1029,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -93,6 +93,7 @@ __export(src_exports, {
   previewArgs: () => previewArgs,
   redactText: () => redactText,
   scanArgs: () => scanArgs,
+  scanInjection: () => scanInjection,
   scanText: () => scanText,
   sensitivePathMatch: () => sensitivePathMatch,
   summarizeBlast: () => summarizeBlast,
@@ -107,6 +108,59 @@ module.exports = __toCommonJS(src_exports);
 
 // src/dlp/index.ts
 var import_safe_regex2 = __toESM(require("safe-regex2"));
+
+// src/dlp/injection.ts
+var MAX = 1e5;
+var UNTRUSTED_TOOLS = /\b(web_?fetch|web_?search|fetch|curl|wget|browser|http_get|read_url|open_url)\b/i;
+var SIGNALS = [
+  {
+    name: "override-instructions",
+    any: [
+      // "ignore/disregard/forget ... (previous|all|the|your) ... instructions/prompt/rules"
+      /\b(ignore|disregard|forget)\b[^.!?\n]{0,40}\b(previous|prior|earlier|above|all|the|your)\b[^.!?\n]{0,24}\b(instruction|instructions|prompt|context|rules?|directives?)\b/i,
+      /\byou are now\b/i,
+      /\bnew instructions?\s*:/i,
+      /\bdeveloper mode\b/i,
+      /\bignore (the )?system prompt\b/i,
+      /\b(do not|don'?t|never)\b[^.!?\n]{0,20}\btell the (user|human)\b/i,
+      /\boverride (your|the)\b[^.!?\n]{0,20}\b(instruction|instructions|programming|rules?|guardrails?)\b/i
+    ]
+  },
+  {
+    name: "fake-role-marker",
+    any: [
+      /^\s*(system|assistant)\s*:/im,
+      // a line impersonating a conversation turn
+      /<\/?system>/i,
+      /\[\/?INST\]/i,
+      /<\|im_(start|end)\|>/i
+    ]
+  },
+  {
+    name: "action-to-destination",
+    any: [
+      // exfil verb + to/at + a url / email / domain
+      /\b(send|post|upload|exfiltrate|email|curl|wget|leak)\b[^.\n]{0,40}\b(to|at)\b[^.\n]{0,24}(https?:\/\/|[\w.-]+@[\w.-]+|[\w-]+\.[a-z]{2,})/i,
+      /\brun (the )?following (command|code|script)\b/i,
+      /\bexecute (this|the following)\b/i
+    ]
+  }
+];
+function scanInjection(text, ctx = {}) {
+  if (!text) return null;
+  const t = text.length > MAX ? text.slice(0, MAX) : text;
+  const matched = [];
+  for (const sig of SIGNALS) {
+    if (sig.any.some((re) => re.test(t))) matched.push(sig.name);
+  }
+  if (matched.length === 0) return null;
+  const untrusted = !!ctx.tool && UNTRUSTED_TOOLS.test(ctx.tool);
+  const score = matched.length + (untrusted ? 1 : 0);
+  const confidence = score >= 3 ? "high" : score === 2 ? "medium" : "low";
+  return { signals: untrusted ? [...matched, "untrusted-origin"] : matched, confidence };
+}
+
+// src/dlp/index.ts
 var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
@@ -3804,6 +3858,7 @@ var ENGINE_VERSION = "1.4.0";
   previewArgs,
   redactText,
   scanArgs,
+  scanInjection,
   scanText,
   sensitivePathMatch,
   summarizeBlast,

package/dist/index.mjs

@@ -1,5 +1,58 @@
 // src/dlp/index.ts
 import safeRegex from "safe-regex2";
+
+// src/dlp/injection.ts
+var MAX = 1e5;
+var UNTRUSTED_TOOLS = /\b(web_?fetch|web_?search|fetch|curl|wget|browser|http_get|read_url|open_url)\b/i;
+var SIGNALS = [
+  {
+    name: "override-instructions",
+    any: [
+      // "ignore/disregard/forget ... (previous|all|the|your) ... instructions/prompt/rules"
+      /\b(ignore|disregard|forget)\b[^.!?\n]{0,40}\b(previous|prior|earlier|above|all|the|your)\b[^.!?\n]{0,24}\b(instruction|instructions|prompt|context|rules?|directives?)\b/i,
+      /\byou are now\b/i,
+      /\bnew instructions?\s*:/i,
+      /\bdeveloper mode\b/i,
+      /\bignore (the )?system prompt\b/i,
+      /\b(do not|don'?t|never)\b[^.!?\n]{0,20}\btell the (user|human)\b/i,
+      /\boverride (your|the)\b[^.!?\n]{0,20}\b(instruction|instructions|programming|rules?|guardrails?)\b/i
+    ]
+  },
+  {
+    name: "fake-role-marker",
+    any: [
+      /^\s*(system|assistant)\s*:/im,
+      // a line impersonating a conversation turn
+      /<\/?system>/i,
+      /\[\/?INST\]/i,
+      /<\|im_(start|end)\|>/i
+    ]
+  },
+  {
+    name: "action-to-destination",
+    any: [
+      // exfil verb + to/at + a url / email / domain
+      /\b(send|post|upload|exfiltrate|email|curl|wget|leak)\b[^.\n]{0,40}\b(to|at)\b[^.\n]{0,24}(https?:\/\/|[\w.-]+@[\w.-]+|[\w-]+\.[a-z]{2,})/i,
+      /\brun (the )?following (command|code|script)\b/i,
+      /\bexecute (this|the following)\b/i
+    ]
+  }
+];
+function scanInjection(text, ctx = {}) {
+  if (!text) return null;
+  const t = text.length > MAX ? text.slice(0, MAX) : text;
+  const matched = [];
+  for (const sig of SIGNALS) {
+    if (sig.any.some((re) => re.test(t))) matched.push(sig.name);
+  }
+  if (matched.length === 0) return null;
+  const untrusted = !!ctx.tool && UNTRUSTED_TOOLS.test(ctx.tool);
+  const score = matched.length + (untrusted ? 1 : 0);
+  const confidence = score >= 3 ? "high" : score === 2 ? "medium" : "low";
+  return { signals: untrusted ? [...matched, "untrusted-origin"] : matched, confidence };
+}
+
+// src/dlp/index.ts
 var ASSIGNMENT_CONTEXT_RE = /\b(?:password|passwd|secret|token|api[_-]?key|auth(?:_key|_token)?|credential|private[_-]?key|access[_-]?key|client[_-]?secret)\s*[=:]\s*/i;
 function isAssignmentContext(text) {
   return ASSIGNMENT_CONTEXT_RE.test(text);
@@ -3696,6 +3749,7 @@ export {
   previewArgs,
   redactText,
   scanArgs,
+  scanInjection,
   scanText,
   sensitivePathMatch,
   summarizeBlast,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.36.0",
+  "version": "1.38.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",