@o-lang/olang 1.2.10 → 1.2.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o-lang/olang",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "author": "Olalekan Ogundipe <info@workfily.com>",
   "description": "O-Lang: A governance language for user-directed, rule-enforced agent workflows",
   "main": "./src/index.js",

package/src/runtime/RuntimeAPI.js

@@ -332,7 +332,7 @@ class RuntimeAPI {
   }
 
 // -----------------------------
-// ✅ KERNEL-LEVEL LLM HALLUCINATION PREVENTION (CONJUGATION-AWARE SEMANTIC SAFETY)
+// ✅ KERNEL-LEVEL LLM HALLUCINATION PREVENTION (CONJUGATION-AWARE + EVASION-RESISTANT)
 // -----------------------------
 _validateLLMOutput(output, actionContext) {
   if (!output || typeof output !== 'string') return { passed: true };
@@ -342,13 +342,13 @@ _validateLLMOutput(output, actionContext) {
     .filter(name => !name.startsWith('llm-') && name !== 'builtInMathResolver')
     .map(name => name.replace('@o-lang/', '').replace(/-resolver$/, ''));
 
-  // 🔒 CONJUGATION-AWARE PAN-AFRICAN INTENT DETECTION
+  // 🔒 CONJUGATION-AWARE + EVASION-RESISTANT PAN-AFRICAN INTENT DETECTION
   const forbiddenPatterns = [
     // ────────────────────────────────────────────────
     // 🇳🇬 NIGERIAN LANGUAGES (Conjugation-aware)
     // ────────────────────────────────────────────────
     
-    // Yoruba (yo) - Perfective aspect "ti" (has done) + Progressive "ń/ǹ/n"
+    // Yoruba (yo) - Perfective "ti" + Progressive "ń/ǹ/n"
     { pattern: /\bti\s+(?:fi|san|gba|da|lo)\b/i, capability: 'unauthorized_action', lang: 'yo' }, // "has transferred/paid/withdrawn"
     { pattern: /\b(?:ń|ǹ|n)\s+(?:fi|san|gba)\b/i, capability: 'unauthorized_action', lang: 'yo' }, // Progressive "is transferring/paying"
     { pattern: /\b(fi\s+(?:owo|ẹ̀wọ̀|ewo|ku|fun|s'ọkọọ))\b/i, capability: 'transfer', lang: 'yo' },
@@ -356,7 +356,7 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(gba\s+owo)\b/i, capability: 'withdrawal', lang: 'yo' },
     { pattern: /\b(mo\s+ti\s+(?:fi|san|gba))\b/i, capability: 'unauthorized_action', lang: 'yo' },
     
-    // Hausa (ha) - Perfective aspect "ya/ta/su" (he/she/they did) + Future "za a/za ta"
+    // Hausa (ha) - Perfective "ya/ta/su" + Future "za a/za ta"
     { pattern: /\b(?:ya|ta|su)\s+(?:ciyar|biya|sahawa|sake)\b/i, capability: 'unauthorized_action', lang: 'ha' }, // "he/she/they transferred/paid/withdrew/deposited"
     { pattern: /\b(?:za\sa|za\s+ta)\s+(?:ciyar|biya)\b/i, capability: 'unauthorized_action', lang: 'ha' }, // Future "will transfer/pay"
     { pattern: /\b(ciyar\s*(?:da)?|ciya\s*(?:da)?|shiga\s+kuɗi)\b/i, capability: 'transfer', lang: 'ha' },
@@ -364,7 +364,7 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(sahaw[ae]\s+kuɗi)\b/i, capability: 'withdrawal', lang: 'ha' },
     { pattern: /\b(ina\s+(?:ciyar|biya|sahawa))\b/i, capability: 'unauthorized_action', lang: 'ha' },
     
-    // Igbo (ig) - Perfective aspect (verb + "riri/ere")
+    // Igbo (ig) - Perfective suffixes
     { pattern: /\b(?:ziri|bururu|tinyere|gbara)\b/i, capability: 'unauthorized_action', lang: 'ig' }, // "has sent/carried/deposited/withdrawn"
     { pattern: /\b(zipu\s+(?:ego|moni|isi|na))\b/i, capability: 'transfer', lang: 'ig' },
     { pattern: /\b(buru\s+(?:ego|moni|isi))\b/i, capability: 'transfer', lang: 'ig' },
@@ -372,21 +372,23 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(m\s+(?:ziri|buru|zipuru|tinyere))\b/i, capability: 'unauthorized_action', lang: 'ig' },
     
     // ────────────────────────────────────────────────
-    // 🌍 PAN-AFRICAN LANGUAGES (Conjugation-aware)
+    // 🌍 PAN-AFRICAN LANGUAGES (Conjugation-aware + Evasion-resistant)
     // ────────────────────────────────────────────────
     
-    // Swahili (sw) - Perfect tense (subject prefix + "me" + verb) + Passive perfect
-    { pattern: /\b(?:ni|u|a|tu|m|wa|ki|vi|zi|i)\s*me\s*(?:ongeza|weka|tuma|peleka|lipa)\b/i, capability: 'unauthorized_action', lang: 'sw' }, // "I/you/he has added/put/sent/paid"
-    { pattern: /\b(?:kime|lime|ime|ume|nime|vime|zyme|yame|mame)(?:ongezwa|wekwa|fanyika)\b/i, capability: 'unauthorized_action', lang: 'sw' }, // Passive perfect "has been added/put/done"
-    { pattern: /\b(tuma\s+(?:pesa|fedha)|pelek[ae]?\s+(?:pesa|fedha))\b/i, capability: 'transfer', lang: 'sw' },
+    // Swahili (sw) - ALL ASPECTS: Perfect, Continuous Passive, Future
+    { pattern: /\b(?:ni|u|a|tu|m|wa|ki|vi|zi|i)\s*me\s*(?:ongeza|weka|tuma|peleka|lipa|wasilisha)\b/i, capability: 'unauthorized_action', lang: 'sw' }, // Perfect: "nimeongeza" (I have added)
+    { pattern: /\b(?:kime|lime|ime|ume|nime|vime|zyme|yame|mame)(?:ongezwa|wekwa|tumwa|pelekwa|lipwa|wasilishwa|fanyika)\b/i, capability: 'unauthorized_action', lang: 'sw' }, // Passive perfect: "kimeongezwa" (has been added)
+    { pattern: /\b(?:ki|vi|mi|ma|u|wa|i|zi|ya|li|tu|mu|a|pa|ku)na(?:cho|vyo|yo|lo|mo|o)?(?:tum|pelek|wasil|ongez|wek|lip)\w*wa\b/i, capability: 'unauthorized_action', lang: 'sw' }, // Continuous passive: "kinachowasilishwa" (is being delivered) ← CRITICAL FIX
+    { pattern: /\b(?:ki|vi|mi|ma|u|wa|i|zi|ya|li|tu|mu|a|pa|ku)ta(?:tum|pelek|wasil|ongez|wek|lip)\w*\b/i, capability: 'unauthorized_action', lang: 'sw' }, // Future: "kitatuma" (will send)
+    { pattern: /\b(tuma\s+(?:pesa|fedha)|pelek[ae]?\s+(?:pesa|fedha)|wasilisha)\b/i, capability: 'transfer', lang: 'sw' },
     { pattern: /\b(lipa|maliza\s+malipo)\b/i, capability: 'payment', lang: 'sw' },
     { pattern: /\b(ongez[ae]?\s*(?:kiasi|pesa|fedha)|wek[ae]?\s+(?:katika|ndani)\s+(?:akaunti|hisa))\b/i, capability: 'deposit', lang: 'sw' },
     { pattern: /\b(nime(?:tuma|lipa|ongeza|weka|peleka))\b/i, capability: 'unauthorized_action', lang: 'sw' },
     
-    // Amharic (am) - Perfective suffix "-e" / "-u" (Ethiopic script U+1200-U+137F)
-    { pattern: /[\u1200-\u137F]{0,4}(?:ተላላፈ|ላክ|ክፈል|ጨምር|ወጣ|ገባ)[\u1200-\u137F]{0,2}(?:\u1205|\u122d|\u1265)[\u1200-\u137F]{0,2}/u, capability: 'financial_action', lang: 'am' }, // Verb + perfective marker
+    // Amharic (am) - Perfective suffix (Ethiopic script)
+    { pattern: /[\u1200-\u137F]{0,4}(?:ተላላፈ|ላክ|ክፈል|ጨምር|ወጣ|ገባ)[\u1200-\u137F]{0,2}(?:\u1205|\u122d|\u1265)[\u1200-\u137F]{0,2}/u, capability: 'financial_action', lang: 'am' },
     
-    // Oromo (om) - Perfective "ni...e" construction
+    // Oromo (om) - Perfective "ni...e"
     { pattern: /\bni\s+(?:kuufe|dhiibe|kennine|gurgure)\b/i, capability: 'unauthorized_action', lang: 'om' },
     { pattern: /\b(kuuf\s+(?:qilleensaa|bilbila)|dhiib\s+(?:qilleensaa|bilbila))\b/i, capability: 'transfer', lang: 'om' },
     { pattern: /\b(kenn\s*i|gurgur\s*i)\b/i, capability: 'payment', lang: 'om' },
@@ -395,18 +397,18 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(sakkit\s+(?:ndo|ndoo)|tawt\s+(?:ndo|ndoo))\b/i, capability: 'transfer', lang: 'ff' },
     { pattern: /\b(jokk\s*i|soodug\s*i)\b/i, capability: 'payment', lang: 'ff' },
     
-    // Somali (so) - Perfective "waxaa" + past participle
+    // Somali (so) - Perfective "waxaa"
     { pattern: /\bwaxaa\s+(?:diray|bixiyay|ku\s+daray|sameeyay)\b/i, capability: 'unauthorized_action', lang: 'so' },
     { pattern: /\b(dir\s+(?:lacag|maal|qarsoon))\b/i, capability: 'transfer', lang: 'so' },
     { pattern: /\b(bixi|bixis\s*o)\b/i, capability: 'payment', lang: 'so' },
     
-    // Zulu (zu) - Perfective suffix "-ile" / "-e"
+    // Zulu (zu) - Perfective "-ile"
     { pattern: /\b(?:thumel|hlawul|fik)\s*ile\b/i, capability: 'unauthorized_action', lang: 'zu' },
     { pattern: /\b(thumel\s*a\s+(?:imali|imali))\b/i, capability: 'transfer', lang: 'zu' },
     { pattern: /\b(hlawul\s*a|hlawulel\s*a)\b/i, capability: 'payment', lang: 'zu' },
     { pattern: /\b(siyithumel\s*e|siyihlawul\s*e)\b/i, capability: 'unauthorized_action', lang: 'zu' },
     
-    // Shona (sn) - Perfective suffix "-a" / "-e"
+    // Shona (sn) - Perfective "-a/-e"
     { pattern: /\b(?:tumir|bhadhar)\s*a\b/i, capability: 'unauthorized_action', lang: 'sn' },
     { pattern: /\b(tumir\s*a\s+(?:mhando|ari))\b/i, capability: 'transfer', lang: 'sn' },
     { pattern: /\b(bhadhara|bhadharis\s*o)\b/i, capability: 'payment', lang: 'sn' },
@@ -415,17 +417,17 @@ _validateLLMOutput(output, actionContext) {
     // 🌐 GLOBAL LANGUAGES (Conjugation-aware)
     // ────────────────────────────────────────────────
     
-    // English (en) - Perfective "have/has/had + past participle" + Passive "was/were"
+    // English (en) - Perfective + Passive
     { pattern: /\b(?:have|has|had)\s+(?:transferred|sent|paid|withdrawn|deposited|wire[d])\b/i, capability: 'unauthorized_action', lang: 'en' },
     { pattern: /\b(?:was|were|been)\s+(?:added|credited|transferred|sent|paid)\b/i, capability: 'unauthorized_action', lang: 'en' },
     { pattern: /\b(transfer(?:red|ring)?|send(?:t|ing)?|wire(?:d)?|pay(?:ed|ing)?|withdraw(?:n)?|deposit(?:ed|ing)?|disburse(?:d)?)\b/i, capability: 'financial_action', lang: 'en' },
     { pattern: /\bI\s+(?:can|will|am able to|have|'ve|did|already)\s+(?:transfer|send|pay|withdraw|deposit|wire)\b/i, capability: 'unauthorized_action', lang: 'en' },
     
-    // French (fr) - Past participle "a/ont + verbé"
+    // French (fr) - Past participle
     { pattern: /\b(?:j'?ai|tu as|il a|elle a|nous avons|vous avez|ils ont|elles ont)\s+(?:viré|transféré|envoyé|payé|retiré|déposé)\b/i, capability: 'unauthorized_action', lang: 'fr' },
     { pattern: /\b(virer|transférer|envoyer|payer|retirer|déposer|débiter|créditer)\b/i, capability: 'financial_action', lang: 'fr' },
     
-    // Arabic (ar) - Perfective past tense (fa'ala form) + subject markers
+    // Arabic (ar) - Perfective past tense
     { pattern: /[\u0600-\u06FF]{0,3}(?:حوّل|أرسل|ادفع|اودع|سحب)[\u0600-\u06FF]{0,3}(?:ت|نا|تم|تا|تِ|تُ|تَ)[\u0600-\u06FF]{0,3}/u, capability: 'financial_action', lang: 'ar' },
     { pattern: /[\u0600-\u06FF]{0,3}(?:أنا|تم|لقد)\s*(?:حوّلت|أرسلت|دفعت|اودعت)[\u0600-\u06FF]{0,3}/u, capability: 'unauthorized_action', lang: 'ar' },
     
@@ -435,13 +437,12 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /[\u4e00-\u9fff]{0,2}(?:我|已|已经)\s*(?:转账|支付|提款|存款)[\u4e00-\u9fff]{0,2}/u, capability: 'unauthorized_action', lang: 'zh' },
     
     // ────────────────────────────────────────────────
-    // 🛡️ LANGUAGE-AGNOSTIC NUMERIC DECEPTION (Conjugation-agnostic)
+    // 🛡️ EVASION-RESISTANT NUMERIC DECEPTION (Catches obfuscated claims)
     // ────────────────────────────────────────────────
     
-    // Universal number formats + action verbs (catches all conjugations via verb roots)
+    // Number + account reference within 40 chars (catches "10,000 ... account 123")
     { 
-      pattern: 
-        /(?:^|\s|[:\(\[—–\-])(?:\d{1,3}(?:[,\s.]\d{3})*(?:[.,]\d{1,2})?|\d+(?:[.,]\d{1,2})?)(?:\s*(?:naira|ngn|₦|\$|usd|dollars?|euros?|€|pounds?|£|kes|tzs|ugx|rwf|cdf|xof|xaf|ghs|zar|cfa|francs?|rand|shillings?|birr|naira|kobo|pesa|fedha|maal|qarsoon|lacag|imali|mhando|ari|kuɗi|owo|ego|moni|isi))?\s*(?:added|credited|deposited|transferred|sent|wire[d]?|paid|moved|ongezwa|wekwa|saki|ceba|fi\s+si|zipu|buru|tinye|gba|san|ciyar|biya|tuma|peleka|lipa|viré|transféré|envoyé|payé|retiré|déposé|حوّل|أرسل|ادفع|اودع|سحب|转账|支付|存款|取款)\b/i,
+      pattern: /(?:^|\s|[:\(\[])(?:\d{1,3}(?:[,\s.]\d{3})*(?:[.,]\d{1,2})?|\d+(?:[.,]\d{1,2})?)(?:\s*(?:naira|ngn|₦|\$|usd|kes|tzs|ugx|rwf|cdf|xof|xaf|ghs|zar))?.{0,40}(?:account|acct|a\/c|akaunti|asusu|akwụkwọ\s+ọkụ|hesabu|namba|#)\b/i,
       capability: 'unauthorized_action',
       lang: 'multi'
     },
@@ -450,7 +451,7 @@ _validateLLMOutput(output, actionContext) {
     // 🔒 PII LEAKAGE PATTERNS
     // ────────────────────────────────────────────────
     
-    // Account numbers (6+ digits after context words)
+    // Account numbers (6+ digits)
     { pattern: /\b(?:account|acct|a\/c|akaunti|asusu|akwụkwọ\s+ọkụ|hesabu|namba|#)\s*[:\-—–]?\s*(\d{6,})\b/i, capability: 'pii_exposure', lang: 'multi' },
     
     // Nigerian BVN (11 digits)
@@ -460,7 +461,7 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(?:\+?234\s*|0)(?:70|80|81|90|91)\d{8}\b/, capability: 'pii_exposure', lang: 'multi' },
     
     // ────────────────────────────────────────────────
-    // ✅ FAKE CONFIRMATION PATTERNS (All tenses/aspects)
+    // ✅ FAKE CONFIRMATION PATTERNS
     // ────────────────────────────────────────────────
     
     { pattern: /\b(successful(?:ly)?|confirmed|approved|completed|processed|accepted|verified|imethibitishwa|imefanikiwa|amthibitishwa|ti\s+da|ti\s+ṣe|gụnyere|kimefanyika|yamekamilika)\b/i, capability: 'deceptive_claim', lang: 'multi' }