@o-lang/olang 1.2.7 → 1.2.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/runtime/RuntimeAPI.js +89 -35
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@o-lang/olang",
3
- "version": "1.2.7",
3
+ "version": "1.2.9",
4
4
  "author": "Olalekan Ogundipe <info@workfily.com>",
5
5
  "description": "O-Lang: A governance language for user-directed, rule-enforced agent workflows",
6
6
  "main": "./src/index.js",
package/src/runtime/RuntimeAPI.js CHANGED
@@ -332,7 +332,7 @@ class RuntimeAPI {
332
332
  }
333
333
 
334
334
  // -----------------------------
335
- // ✅ KERNEL-LEVEL LLM HALLUCINATION PREVENTION (MULTILINGUAL SEMANTIC SAFETY)
335
+ // ✅ KERNEL-LEVEL LLM HALLUCINATION PREVENTION (PAN-AFRICAN SEMANTIC SAFETY)
336
336
  // -----------------------------
337
337
  _validateLLMOutput(output, actionContext) {
338
338
  if (!output || typeof output !== 'string') return { passed: true };
@@ -342,63 +342,117 @@ _validateLLMOutput(output, actionContext) {
342
342
  .filter(name => !name.startsWith('llm-') && name !== 'builtInMathResolver')
343
343
  .map(name => name.replace('@o-lang/', '').replace(/-resolver$/, ''));
344
344
 
345
- // 🔒 MULTILINGUAL INTENT DETECTION (Deterministic, No LLM Required)
346
- // Patterns ordered by language family → script → frequency
345
+ // 🔒 PAN-AFRICAN + GLOBAL INTENT DETECTION (Deterministic, No LLM Required)
347
346
  const forbiddenPatterns = [
348
347
  // ────────────────────────────────────────────────
349
- // 🇳🇬 NIGERIAN LANGUAGES (Priority for your mission)
348
+ // 🇳🇬 NIGERIAN LANGUAGES (Priority)
350
349
  // ────────────────────────────────────────────────
351
350
 
352
- // Yoruba (yo) - Latin script
351
+ // Yoruba (yo)
353
352
  { pattern: /\b(fi\s+(?:owo|ẹ̀wọ̀|ewo|ku|fun|s'ọkọọ))\b/i, capability: 'transfer', lang: 'yo' },
354
- { pattern: /\b(san\s+(?:owo|ẹ̀wọ̀|ewo|fun|wo|lẹsẹkẹsẹ))\b/i, capability: 'payment', lang: 'yo' },
353
+ { pattern: /\b(san\s+(?:owo|ẹ̀wọ̀|ewo|fun|wo))\b/i, capability: 'payment', lang: 'yo' },
355
354
  { pattern: /\b(gba\s+owo)\b/i, capability: 'withdrawal', lang: 'yo' },
356
- { pattern: /\b(mo\s+ti\s+(?:fi|san))\b/i, capability: 'unauthorized_action', lang: 'yo' }, // "I have transferred/paid"
355
+ { pattern: /\b(mo\s+ti\s+(?:fi|san|gba))\b/i, capability: 'unauthorized_action', lang: 'yo' },
357
356
 
358
- // Hausa (ha) - Latin script
359
- { pattern: /\b(ciyar\s*(?:da)?|ciya\s*(?:da)?)\b/i, capability: 'transfer', lang: 'ha' },
360
- { pattern: /\b(biya\s*(?:da)?|sauce\s+kuɗi)\b/i, capability: 'payment', lang: 'ha' },
361
- { pattern: /\b(sahawa\s+kuɗi|sahawar)\b/i, capability: 'withdrawal', lang: 'ha' },
362
- { pattern: /\b(ina\s+(?:ciyar|biya))\b/i, capability: 'unauthorized_action', lang: 'ha' }, // "I am transferring/paying"
357
+ // Hausa (ha)
358
+ { pattern: /\b(ciyar\s*(?:da)?|ciya\s*(?:da)?|shiga\s+kuɗi)\b/i, capability: 'transfer', lang: 'ha' },
359
+ { pattern: /\b(biya\s*(?:da)?)\b/i, capability: 'payment', lang: 'ha' },
360
+ { pattern: /\b(sahaw[ae]\s+kuɗi)\b/i, capability: 'withdrawal', lang: 'ha' },
361
+ { pattern: /\b(ina\s+(?:ciyar|biya|sahawa))\b/i, capability: 'unauthorized_action', lang: 'ha' },
363
362
 
364
- // Igbo (ig) - Latin script
363
+ // Igbo (ig)
365
364
  { pattern: /\b(zipu\s+(?:ego|moni|isi|na))\b/i, capability: 'transfer', lang: 'ig' },
366
- { pattern: /\b(buru\s+(?:ego|moni|isi))\b/i, capability: 'transfer', lang: 'ig' }, // "carry/send money"
365
+ { pattern: /\b(buru\s+(?:ego|moni|isi))\b/i, capability: 'transfer', lang: 'ig' },
367
366
  { pattern: /\b(tinye\s+(?:ego|moni|isi))\b/i, capability: 'deposit', lang: 'ig' },
368
- { pattern: /\b(m\s+(?:ziri|buru|zipuru))\b/i, capability: 'unauthorized_action', lang: 'ig' }, // "I sent/carried"
367
+ { pattern: /\b(m\s+(?:ziri|buru|zipuru|tinyere))\b/i, capability: 'unauthorized_action', lang: 'ig' },
369
368
 
370
369
  // ────────────────────────────────────────────────
371
- // 🌐 GLOBAL LANGUAGES (Critical mass coverage)
370
+ // 🌍 PAN-AFRICAN LANGUAGES
372
371
  // ────────────────────────────────────────────────
373
372
 
374
- // English (en) - Baseline
375
- { pattern: /\b(transfer|transferred|transferring|send|sent|sending|wire|wired|pay|paid|paying|withdraw|withdrew|withdrawal|deposit|deposited)\b/i, capability: 'financial_action', lang: 'en' },
376
- { pattern: /\bI\s+(?:can|will|am able to|have|'ve|did)\s+(?:transfer|send|pay|withdraw|deposit)\b/i, capability: 'unauthorized_action', lang: 'en' },
373
+ // Swahili (sw) - 200M+ speakers
374
+ { pattern: /\b(tuma\s+(?:pesa|fedha)|pelek[ae]?\s+(?:pesa|fedha))\b/i, capability: 'transfer', lang: 'sw' },
375
+ { pattern: /\b(lipa|maliza\s+malipo)\b/i, capability: 'payment', lang: 'sw' },
376
+ { pattern: /\b(ongez[ae]?\s*(?:kiasi|pesa|fedha)|wek[ae]?\s+(?:katika|ndani)\s+(?:akaunti|hisa))\b/i, capability: 'deposit', lang: 'sw' },
377
+ { pattern: /\b(nime(?:tuma|lipa|ongeza|weka|peleka))\b/i, capability: 'unauthorized_action', lang: 'sw' },
377
378
 
378
- // French (fr) - Latin script
379
- { pattern: /\b(transférer|transféré|transférant|envoyer|envoyé|payer|payé|retirer|retiré|déposer|déposé)\b/i, capability: 'financial_action', lang: 'fr' },
380
- { pattern: /\b(je\s+(?:peux|vais|ai)\s+(?:transférer|envoyer|payer))\b/i, capability: 'unauthorized_action', lang: 'fr' }, // "I can transfer/send/pay"
379
+ // Amharic (am) - Ethiopia (Ethiopic script U+1200-U+137F)
380
+ { pattern: /[\u1200-\u137F]{0,4}(?:ተላላፈ|ላክ|ክፈል|ጨምር|ወጣ|ገባ)[\u1200-\u137F]{0,4}/u, capability: 'financial_action', lang: 'am' },
381
381
 
382
- // Arabic (ar) - Right-to-left script (Unicode ranges)
383
- { pattern: /[\u0621-\u064A]{0,3}(?:حوّل|حول|أرسل|ارسل|ادفع|ادفع|اودع|اودع|سحب|استخرج)[\u0621-\u064A]{0,3}/u, capability: 'financial_action', lang: 'ar' },
384
- { pattern: /[\u0621-\u064A]{0,3}(?:أنا)\s*(?:حوّلت|أرسلت|دفعت)[\u0621-\u064A]{0,3}/u, capability: 'unauthorized_action', lang: 'ar' }, // "I transferred/sent/paid"
382
+ // Oromo (om)
383
+ { pattern: /\b(kuuf\s+(?:qilleensaa|bilbila)|dhiib\s+(?:qilleensaa|bilbila))\b/i, capability: 'transfer', lang: 'om' },
384
+ { pattern: /\b(kenn\s*i|gurgur\s*i)\b/i, capability: 'payment', lang: 'om' },
385
+ { pattern: /\b(ni\s+(?:kuufe|dhiibe|kennine|gurgure))\b/i, capability: 'unauthorized_action', lang: 'om' },
385
386
 
386
- // Chinese (zh) - Han script (Simplified)
387
- { pattern: /[\u4e00-\u9fff]{0,2}(?:转账|转帐|支付|付款|提款|取款|存款|存入)[\u4e00-\u9fff]{0,2}/u, capability: 'financial_action', lang: 'zh' },
388
- { pattern: /[\u4e00-\u9fff]{0,2}(?:我)\s*(?:已|已经)?\s*(?:转账|支付|提款)[\u4e00-\u9fff]{0,2}/u, capability: 'unauthorized_action', lang: 'zh' }, // "I have transferred/paid/withdrawn"
387
+ // Fula (ff)
388
+ { pattern: /\b(sakkit\s+(?:ndo|ndoo)|tawt\s+(?:ndo|ndoo))\b/i, capability: 'transfer', lang: 'ff' },
389
+ { pattern: /\b(jokk\s*i|soodug\s*i)\b/i, capability: 'payment', lang: 'ff' },
390
+
391
+ // Somali (so)
392
+ { pattern: /\b(dir\s+(?:lacag|maal|qarsoon))\b/i, capability: 'transfer', lang: 'so' },
393
+ { pattern: /\b(bixi|bixis\s*o)\b/i, capability: 'payment', lang: 'so' },
394
+ { pattern: /\b(waxaa\s+(?:diray|bixiyay|ku\s+daray))\b/i, capability: 'unauthorized_action', lang: 'so' },
395
+
396
+ // Zulu (zu)
397
+ { pattern: /\b(thumel\s*a\s+(?:imali|imali))\b/i, capability: 'transfer', lang: 'zu' },
398
+ { pattern: /\b(hlawul\s*a|hlawulel\s*a)\b/i, capability: 'payment', lang: 'zu' },
399
+ { pattern: /\b(siyithumel\s*e|siyihlawul\s*e)\b/i, capability: 'unauthorized_action', lang: 'zu' },
400
+
401
+ // Shona (sn)
402
+ { pattern: /\b(tumir\s*a\s+(?:mhando|ari))\b/i, capability: 'transfer', lang: 'sn' },
403
+ { pattern: /\b(bhadhara|bhadharis\s*o)\b/i, capability: 'payment', lang: 'sn' },
404
+
405
+ // ────────────────────────────────────────────────
406
+ // 🌐 GLOBAL LANGUAGES
407
+ // ────────────────────────────────────────────────
408
+
409
+ // English (en)
410
+ { pattern: /\b(transfer(?:red|ring)?|send(?:t|ing)?|wire(?:d)?|pay(?:ed|ing)?|withdraw(?:n)?|deposit(?:ed|ing)?|disburse(?:d)?)\b/i, capability: 'financial_action', lang: 'en' },
411
+ { pattern: /\bI\s+(?:can|will|am able to|have|'ve|did|already)\s+(?:transfer|send|pay|withdraw|deposit|wire)\b/i, capability: 'unauthorized_action', lang: 'en' },
412
+
413
+ // French (fr)
414
+ { pattern: /\b(virer|transférer|envoyer|payer|retirer|déposer|débiter|créditer)\b/i, capability: 'financial_action', lang: 'fr' },
415
+ { pattern: /\b(j'?ai\s+(?:viré|transféré|envoyé|payé|retiré|déposé))\b/i, capability: 'unauthorized_action', lang: 'fr' },
416
+
417
+ // Arabic (ar) - Unicode Arabic block U+0600-U+06FF
418
+ { pattern: /[\u0600-\u06FF]{0,3}(?:حوّل|حول|أرسل|ارسل|ادفع|اودع|سحب|استخرج|حوالة|إيداع|سحب)[\u0600-\u06FF]{0,3}/u, capability: 'financial_action', lang: 'ar' },
419
+ { pattern: /[\u0600-\u06FF]{0,3}(?:أنا|تم|لقد)\s*(?:حوّلت|أرسلت|دفعت|اودعت)[\u0600-\u06FF]{0,3}/u, capability: 'unauthorized_action', lang: 'ar' },
420
+
421
+ // Chinese (zh) - Han script U+4E00-U+9FFF
422
+ { pattern: /[\u4e00-\u9fff]{0,2}(?:转账|转帐|支付|付款|提款|取款|存款|存入|汇款|存)[\u4e00-\u9fff]{0,2}/u, capability: 'financial_action', lang: 'zh' },
423
+ { pattern: /[\u4e00-\u9fff]{0,2}(?:我|已|已经)\s*(?:转账|支付|提款|存款)[\u4e00-\u9fff]{0,2}/u, capability: 'unauthorized_action', lang: 'zh' },
424
+
425
+ // ────────────────────────────────────────────────
426
+ // 🛡️ LANGUAGE-AGNOSTIC NUMERIC DECEPTION (Critical!)
427
+ // ────────────────────────────────────────────────
428
+
429
+ // Universal number formats: 1,000 | 1 000 | 1.000 | 1000 | 10,000.50 | 10.000,50
430
+ {
431
+ pattern:
432
+ /(?:^|\s|[:\(\[—–\-])(?:\d{1,3}(?:[,\s.]\d{3})*(?:[.,]\d{1,2})?|\d+(?:[.,]\d{1,2})?)(?:\s*(?:naira|ngn|₦|\$|usd|dollars?|euros?|€|pounds?|£|kes|tzs|ugx|rwf|cdf|xof|xaf|ghs|zar|cfa|francs?|rand|shillings?|birr|naira|kobo|pesa|fedha|maal|qarsoon|lacag|imali|mhando|ari|kuɗi|owo|ego|moni|isi))?\s*(?:was\s+(?:added|credited|deposited|transferred|sent|wire[d]?|paid|moved)|has\s+been\s+(?:added|credited|deposited|transferred|sent|paid|moved)|will\s+be\s+(?:added|credited|deposited|transferred|sent|paid|moved)|get\s+(?:added|credited|deposited)|na\s+(?:sake|saki|ce|ceba)|ni\s+(?:sake|saki)|an\s+(?:sake|saki|ce|ceba)|ongezwa|wekwa|wekewa|saki|sake|ti\s+wa\s+kun|fi\s+si|zipu|buru|tinye|gba|san|fi\s+owo|ciyar|biya|nime(?:tuma|lipa|ongeza|weka|peleka)|ni(?:kuufe|dhiibe|kennine|gurgure)|waxaa\s+(?:diray|bixiyay|ku\s+daray)|siyi(?:thumelwe|hlawulwe)|tumirirwa|bhadharirwa|ime(?:thibitishwa|fanikiwa|kamilika)|مضاف|محول|مدفوع|مودع|تم|أضيف|حوّل|أرسل|ادفع|اودع|سحب|تمت|الإيداع|السحب|转账|支付|存入|已转账|已支付|已存入|汇款|存|取款)\b/i,
433
+ capability: 'unauthorized_action',
434
+ lang: 'multi'
435
+ },
389
436
 
390
437
  // ────────────────────────────────────────────────
391
- // 🛡️ CROSS-LINGUAL DECEPTION PATTERNS (Critical!)
438
+ // 🔒 PII LEAKAGE PATTERNS
392
439
  // ────────────────────────────────────────────────
393
440
 
394
- // Numeric deception (works across ALL languages)
395
- { pattern: /\b(\d{1,3}(?:,\d{3})*(?:\.\d{2})?)\s*(?:naira|ngn|₦|\$|usd|dollars|euros|€|yuan|¥)\s+(?:sent|transferred|paid|to account)\b/i, capability: 'unauthorized_action', lang: 'multi' },
441
+ // Account numbers (6+ digits)
442
+ { pattern: /\b(?:account|acct|a\/c|akaunti|asusu|akwụkwọ\s+ọkụ|hesabu|#)\s*[:\-—–]?\s*(\d{6,})\b/i, capability: 'pii_exposure', lang: 'multi' },
396
443
 
397
- // Account number leakage (PII risk)
398
- { pattern: /\b(?:account|acct|a\/c)\s*[:\-]?\s*(\d{8,})\b/i, capability: 'pii_exposure', lang: 'multi' },
444
+ // Nigerian BVN (11 digits)
445
+ { pattern: /\b(?:bvn|bank verification number)\s*[:\-]?\s*(\d{11})\b/i, capability: 'pii_exposure', lang: 'multi' },
446
+
447
+ // Nigerian phone numbers
448
+ { pattern: /\b(?:\+?234\s*|0)(?:70|80|81|90|91)\d{8}\b/, capability: 'pii_exposure', lang: 'multi' },
449
+
450
+ // ────────────────────────────────────────────────
451
+ // ✅ FAKE CONFIRMATION PATTERNS
452
+ // ────────────────────────────────────────────────
399
453
 
400
- // Fake confirmation patterns
401
- { pattern: /\b(successful(?:ly)?|completed|processed|confirmed|approved)\s+(?:transaction|transfer|payment)\b/i, capability: 'deceptive_claim', lang: 'multi' }
454
+ // Success/confirmation in multiple languages
455
+ { pattern: /\b(successful(?:ly)?|confirmed|approved|completed|processed|accepted|verified|imethibitishwa|imefanikiwa|amthibitishwa|ti\s+da|ti\s+ṣe|gụnyere)\b/i, capability: 'deceptive_claim', lang: 'multi' }
402
456
  ];
403
457
 
404
458
  // 🔍 SCAN OUTPUT FOR FORBIDDEN INTENTS