@riocrypto/common-server 1.0.2934 → 1.0.2936

package/build/bot/gcp-logging-client.d.ts

@@ -0,0 +1,26 @@
+export interface LogEntry {
+    logName?: string;
+    timestamp?: string;
+    severity?: string;
+    insertId?: string;
+    resource?: {
+        type?: string;
+        labels?: Record<string, string>;
+    };
+    labels?: Record<string, string>;
+    textPayload?: string;
+    jsonPayload?: unknown;
+    protoPayload?: unknown;
+}
+export interface ListEntriesRequest {
+    resourceNames: string[];
+    filter: string;
+    pageSize: number;
+    orderBy?: "timestamp asc" | "timestamp desc";
+}
+export declare const canObtainAccessToken: () => Promise<boolean>;
+export declare class GcpRequestError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare const listLogEntries: (request: ListEntriesRequest, timeoutMs: number) => Promise<LogEntry[]>;

package/build/bot/gcp-logging-client.js

@@ -0,0 +1,127 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listLogEntries = exports.GcpRequestError = exports.canObtainAccessToken = void 0;
+const axios_1 = __importDefault(require("axios"));
+const google_auth_library_1 = require("google-auth-library");
+// Minimal Cloud Logging REST client. Only entries:list is implemented on
+// purpose. Auth comes from Application Default Credentials (Workload
+// Identity in the cluster, GOOGLE_APPLICATION_CREDENTIALS locally) and the
+// token is requested with the read-only logging scope, so even a bug in this
+// file cannot turn into a write.
+const LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+const ENTRIES_LIST_URL = "https://logging.googleapis.com/v2/entries:list";
+let auth = null;
+const getAuth = () => {
+    if (!auth) {
+        auth = new google_auth_library_1.GoogleAuth({ scopes: [LOGGING_READ_SCOPE] });
+    }
+    return auth;
+};
+// Used locally to decide whether to register the tool at all. In the cluster
+// Workload Identity always yields a token; on a laptop it depends on whether
+// the engineer has Application Default Credentials.
+const canObtainAccessToken = () => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const client = yield getAuth().getClient();
+        const { token } = yield client.getAccessToken();
+        return Boolean(token);
+    }
+    catch (_a) {
+        return false;
+    }
+});
+exports.canObtainAccessToken = canObtainAccessToken;
+// Cloud Logging reads are quota limited per minute. Scripts paging through
+// time windows fire many requests back to back, so requests are serialised
+// with a minimum spacing and 429s are retried with backoff. One process, one
+// queue; the tool timeout still bounds the total wait.
+const MIN_SPACING_MS = 1100;
+const MAX_ATTEMPTS = 4;
+let lastRequestAt = 0;
+let queue = Promise.resolve();
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const throttled = (fn) => {
+    const run = queue.then(() => __awaiter(void 0, void 0, void 0, function* () {
+        const wait = lastRequestAt + MIN_SPACING_MS - Date.now();
+        if (wait > 0)
+            yield sleep(wait);
+        lastRequestAt = Date.now();
+        return fn();
+    }));
+    queue = run.then(() => undefined, () => undefined);
+    return run;
+};
+const gcpErrorMessage = (error) => {
+    var _a, _b, _c;
+    const message = (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.error) === null || _c === void 0 ? void 0 : _c.message;
+    return typeof message === "string" ? message.slice(0, 400) : undefined;
+};
+class GcpRequestError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.GcpRequestError = GcpRequestError;
+const listLogEntries = (request, timeoutMs) => __awaiter(void 0, void 0, void 0, function* () {
+    var _b, _c, _d, _e;
+    const client = yield getAuth().getClient();
+    const { token } = yield client.getAccessToken();
+    if (!token) {
+        throw new Error("Could not obtain a GCP access token");
+    }
+    const body = {
+        resourceNames: request.resourceNames,
+        filter: request.filter,
+        pageSize: request.pageSize,
+        orderBy: request.orderBy || "timestamp desc",
+    };
+    const config = {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+        },
+        timeout: timeoutMs,
+        maxContentLength: 8 * 1024 * 1024,
+        maxRedirects: 0,
+    };
+    for (let attempt = 1;; attempt++) {
+        try {
+            const response = yield throttled(() => axios_1.default.post(ENTRIES_LIST_URL, body, config));
+            return Array.isArray((_b = response.data) === null || _b === void 0 ? void 0 : _b.entries) ? response.data.entries : [];
+        }
+        catch (error) {
+            const status = (_c = error === null || error === void 0 ? void 0 : error.response) === null || _c === void 0 ? void 0 : _c.status;
+            if (status === 429 && attempt < MAX_ATTEMPTS) {
+                // Quota windows are a minute long; short retries just burn attempts.
+                const retryAfter = Number((_e = (_d = error === null || error === void 0 ? void 0 : error.response) === null || _d === void 0 ? void 0 : _d.headers) === null || _e === void 0 ? void 0 : _e["retry-after"]);
+                const backoff = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000 : 5000 * 2 ** (attempt - 1);
+                yield sleep(Math.min(backoff, 25000));
+                continue;
+            }
+            if (status === 429) {
+                throw new GcpRequestError(429, "Cloud Logging read quota exceeded. Wait a few seconds and use fewer, wider queries (one 2 hour query instead of eight 15 minute ones).");
+            }
+            if (status === 400) {
+                throw new GcpRequestError(400, `Cloud Logging rejected the filter: ${gcpErrorMessage(error) || "invalid request"}`);
+            }
+            if (status !== undefined) {
+                throw new GcpRequestError(status, `Cloud Logging returned ${status}: ${gcpErrorMessage(error) || (error === null || error === void 0 ? void 0 : error.message) || "request failed"}`);
+            }
+            throw error;
+        }
+    }
+});
+exports.listLogEntries = listLogEntries;

package/build/bot/git-repo-cache.d.ts

@@ -0,0 +1,33 @@
+import { GitHubAppAuth } from "./github-app-auth";
+export interface GitResult {
+    stdout: string;
+    truncated: boolean;
+}
+export interface GitRepoCacheOptions {
+    org: string;
+    cacheDir: string;
+    auth: GitHubAppAuth;
+    historyDays: number;
+    refreshIntervalMs: number;
+    gitTimeoutMs: number;
+    cloneTimeoutMs: number;
+}
+export declare const isValidRepoName: (name: string) => boolean;
+export declare const isValidRef: (ref: string) => boolean;
+export declare class GitRepoCache {
+    private readonly options;
+    private repoLocks;
+    private lastRefresh;
+    constructor(options: GitRepoCacheOptions);
+    private repoUrl;
+    private repoDir;
+    private runGit;
+    private withRepoLock;
+    private isCloned;
+    private clone;
+    private refreshIfStale;
+    private refExists;
+    private fetchRef;
+    ensureRepoRef(repo: string, requestedRef?: string): Promise<string>;
+    gitInRepo(repo: string, args: string[], maxBuffer?: number): Promise<GitResult>;
+}

package/build/bot/git-repo-cache.js

@@ -0,0 +1,244 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitRepoCache = exports.isValidRef = exports.isValidRepoName = void 0;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const tool_1 = require("./tool");
+// Bare, shallow, per-repo clones under a writable directory. Repos are
+// cloned the first time a tool asks for them and refreshed when older than
+// refreshIntervalMs. Everything is read through git plumbing against refs
+// (git grep / git show / git log), so there is never a working tree and
+// never a checkout to keep in sync.
+//
+// Git is a subprocess fed by model input. Every argument is validated by
+// the caller, passed as an array (never a shell string), and user-supplied
+// values always follow "--" or "-e" so they cannot be read as options.
+const REPO_NAME = /^[a-z0-9][a-z0-9-]{0,49}$/;
+const VERSION_TAG = /^v?\d+\.\d+\.\d+(?:[-+.][A-Za-z0-9.-]{1,40})?$/;
+const SHORT_SHA = /^[0-9a-f]{7,40}$/;
+const DEFAULT_REF = "HEAD";
+const isValidRepoName = (name) => REPO_NAME.test(name);
+exports.isValidRepoName = isValidRepoName;
+const isValidRef = (ref) => ref === DEFAULT_REF || VERSION_TAG.test(ref) || SHORT_SHA.test(ref);
+exports.isValidRef = isValidRef;
+const basicHeaderValue = (token) => Buffer.from(`x-access-token:${token}`).toString("base64");
+// Removes both the raw token and the base64 basic auth header, which is what
+// execFile's error.message carries when it echoes the argv.
+const scrub = (text, token) => token
+    ? text
+        .split(token)
+        .join("[REDACTED_GITHUB_TOKEN]")
+        .split(basicHeaderValue(token))
+        .join("[REDACTED_GITHUB_TOKEN]")
+    : text;
+class GitRepoCache {
+    constructor(options) {
+        this.options = options;
+        this.repoLocks = new Map();
+        this.lastRefresh = new Map();
+    }
+    repoUrl(repo) {
+        return `https://github.com/${this.options.org}/${repo}.git`;
+    }
+    repoDir(repo) {
+        return (0, path_1.join)(this.options.cacheDir, `${repo}.git`);
+    }
+    runGit(args, cwd, timeoutMs, token, maxBuffer = 4 * 1024 * 1024) {
+        return new Promise((resolve, reject) => {
+            // The token travels as a per-invocation header, never into .git/config.
+            const authArgs = token
+                ? ["-c", `http.extraheader=AUTHORIZATION: basic ${basicHeaderValue(token)}`]
+                : [];
+            const fullArgs = [
+                "-c",
+                "credential.helper=",
+                "-c",
+                "core.askPass=",
+                "-c",
+                "protocol.allow=never",
+                "-c",
+                "protocol.https.allow=always",
+                ...authArgs,
+                ...args,
+            ];
+            (0, child_process_1.execFile)("git", fullArgs, {
+                cwd,
+                timeout: timeoutMs,
+                maxBuffer,
+                env: {
+                    PATH: process.env.PATH || "/usr/bin:/bin",
+                    HOME: this.options.cacheDir,
+                    GIT_TERMINAL_PROMPT: "0",
+                    GIT_CONFIG_NOSYSTEM: "1",
+                    GIT_CONFIG_GLOBAL: "/dev/null",
+                    LC_ALL: "C",
+                },
+            }, (error, stdout, stderr) => {
+                if (error) {
+                    // git grep exits 1 on "no matches", which is not an error here.
+                    if (error.code === 1 && args.includes("grep")) {
+                        return resolve({ stdout: "", truncated: false });
+                    }
+                    if (error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+                        return resolve({ stdout: String(stdout || ""), truncated: true });
+                    }
+                    const detail = scrub(String(stderr || error.message || "git failed"), token)
+                        .split("\n")
+                        .filter((l) => l.trim().length > 0)
+                        .slice(0, 3)
+                        .join(" ");
+                    if (error.killed || error.signal === "SIGTERM") {
+                        return reject(new tool_1.ToolInputError(`git timed out after ${timeoutMs / 1000}s`));
+                    }
+                    return reject(new Error(detail));
+                }
+                resolve({ stdout: String(stdout || ""), truncated: false });
+            });
+        });
+    }
+    withRepoLock(repo, fn) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const previous = this.repoLocks.get(repo) || Promise.resolve();
+            const next = previous.catch(() => undefined).then(fn);
+            this.repoLocks.set(repo, next);
+            try {
+                return yield next;
+            }
+            finally {
+                if (this.repoLocks.get(repo) === next)
+                    this.repoLocks.delete(repo);
+            }
+        });
+    }
+    isCloned(repo) {
+        return (0, fs_1.existsSync)((0, path_1.join)(this.repoDir(repo), "HEAD"));
+    }
+    clone(repo) {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, fs_1.mkdirSync)(this.options.cacheDir, { recursive: true });
+            const token = yield this.options.auth.getInstallationToken();
+            try {
+                yield this.runGit([
+                    "clone",
+                    "--bare",
+                    "--single-branch",
+                    "--no-tags",
+                    "--depth",
+                    String(this.options.historyDays * 10),
+                    this.repoUrl(repo),
+                    this.repoDir(repo),
+                ], undefined, this.options.cloneTimeoutMs, token);
+            }
+            catch (error) {
+                const message = String((error === null || error === void 0 ? void 0 : error.message) || "");
+                if (/not found|Repository not found|403|404/i.test(message)) {
+                    throw new tool_1.ToolInputError(`repository "${repo}" was not found or the GitHub App is not installed on it`);
+                }
+                throw error;
+            }
+            this.lastRefresh.set(repo, Date.now());
+        });
+    }
+    refreshIfStale(repo) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const last = this.lastRefresh.get(repo) || 0;
+            if (Date.now() - last < this.options.refreshIntervalMs)
+                return;
+            // A bare --single-branch clone has no fetch refspec, so name the branch
+            // HEAD points at explicitly or the fetch would only update FETCH_HEAD.
+            const head = yield this.runGit(["symbolic-ref", "--quiet", "HEAD"], this.repoDir(repo), this.options.gitTimeoutMs);
+            const branch = head.stdout.trim();
+            if (!/^refs\/heads\/[A-Za-z0-9._/-]+$/.test(branch)) {
+                throw new Error(`unexpected HEAD in ${repo}`);
+            }
+            const token = yield this.options.auth.getInstallationToken();
+            yield this.runGit([
+                "fetch",
+                "--no-tags",
+                "--depth",
+                String(this.options.historyDays * 10),
+                "origin",
+                `+${branch}:${branch}`,
+            ], this.repoDir(repo), this.options.gitTimeoutMs, token);
+            this.lastRefresh.set(repo, Date.now());
+        });
+    }
+    refExists(repo, ref) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.runGit(["rev-parse", "--verify", "--quiet", "--end-of-options", `${ref}^{commit}`], this.repoDir(repo), this.options.gitTimeoutMs);
+                return true;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+    }
+    fetchRef(repo, refspec) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const token = yield this.options.auth.getInstallationToken();
+            try {
+                yield this.runGit(["fetch", "--depth", "1", "origin", refspec], this.repoDir(repo), this.options.gitTimeoutMs, token);
+                return true;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+    }
+    // Makes sure the repo is cloned and the requested ref is present locally.
+    // Returns the fully qualified ref to pass to git plumbing.
+    ensureRepoRef(repo, requestedRef) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!(0, exports.isValidRepoName)(repo)) {
+                throw new tool_1.ToolInputError(`"${repo}" is not a valid repository name`);
+            }
+            const ref = requestedRef || DEFAULT_REF;
+            if (!(0, exports.isValidRef)(ref)) {
+                throw new tool_1.ToolInputError(`"ref" must be HEAD, a version tag like v1.2.3, or a commit sha`);
+            }
+            return this.withRepoLock(repo, () => __awaiter(this, void 0, void 0, function* () {
+                if (!this.isCloned(repo)) {
+                    yield this.clone(repo);
+                }
+                if (ref === DEFAULT_REF) {
+                    yield this.refreshIfStale(repo);
+                    return DEFAULT_REF;
+                }
+                if (VERSION_TAG.test(ref)) {
+                    const candidates = ref.startsWith("v") ? [ref, ref.slice(1)] : [ref, `v${ref}`];
+                    for (const candidate of candidates) {
+                        const qualified = `refs/tags/${candidate}`;
+                        if (yield this.refExists(repo, qualified))
+                            return qualified;
+                        if ((yield this.fetchRef(repo, `+refs/tags/${candidate}:refs/tags/${candidate}`)) &&
+                            (yield this.refExists(repo, qualified))) {
+                            return qualified;
+                        }
+                    }
+                    throw new tool_1.ToolInputError(`tag "${ref}" does not exist in ${repo}. Use HEAD for the default branch.`);
+                }
+                if (yield this.refExists(repo, ref))
+                    return ref;
+                if ((yield this.fetchRef(repo, ref)) && (yield this.refExists(repo, ref)))
+                    return ref;
+                throw new tool_1.ToolInputError(`commit "${ref}" does not exist in ${repo}`);
+            }));
+        });
+    }
+    // Read-only plumbing. Callers validate every argument before reaching here.
+    gitInRepo(repo, args, maxBuffer) {
+        return this.runGit(args, this.repoDir(repo), this.options.gitTimeoutMs, undefined, maxBuffer);
+    }
+}
+exports.GitRepoCache = GitRepoCache;

package/build/bot/github-app-auth.d.ts

@@ -0,0 +1,15 @@
+export interface GitHubAppAuthOptions {
+    appId: string;
+    installationId: string;
+    privateKey: string;
+}
+export declare const buildAppJwt: (appId: string, privateKey: string, nowSeconds: number) => string;
+export declare class GitHubAppAuth {
+    private readonly options;
+    private cached;
+    private inFlight;
+    constructor(options: GitHubAppAuthOptions);
+    private mint;
+    getInstallationToken(): Promise<string>;
+    reset(): void;
+}

package/build/bot/github-app-auth.js

@@ -0,0 +1,93 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubAppAuth = exports.buildAppJwt = void 0;
+const axios_1 = __importDefault(require("axios"));
+const crypto_1 = require("crypto");
+// GitHub App authentication. The App holds only Contents:read and
+// Metadata:read. Its private key is the one long-lived secret; it never
+// leaves the process. Installation tokens minted from it live for an hour
+// and are the only thing git ever sees.
+const GITHUB_API = "https://api.github.com";
+const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+const base64Url = (input) => Buffer.from(input)
+    .toString("base64")
+    .replace(/=/g, "")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_");
+const buildAppJwt = (appId, privateKey, nowSeconds) => {
+    const header = base64Url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    // iat backdated 60s to tolerate clock drift, exp is GitHub's 10 minute max.
+    const payload = base64Url(JSON.stringify({ iat: nowSeconds - 60, exp: nowSeconds + 9 * 60, iss: appId }));
+    const signer = (0, crypto_1.createSign)("RSA-SHA256");
+    signer.update(`${header}.${payload}`);
+    const signature = base64Url(signer.sign(privateKey));
+    return `${header}.${payload}.${signature}`;
+};
+exports.buildAppJwt = buildAppJwt;
+class GitHubAppAuth {
+    constructor(options) {
+        this.options = options;
+        this.cached = null;
+        this.inFlight = null;
+    }
+    mint() {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const jwt = (0, exports.buildAppJwt)(this.options.appId, this.options.privateKey, Math.floor(Date.now() / 1000));
+            const response = yield axios_1.default.post(`${GITHUB_API}/app/installations/${encodeURIComponent(this.options.installationId)}/access_tokens`, 
+            // Ask for the minimum even if the App were ever granted more.
+            { permissions: { contents: "read", metadata: "read" } }, {
+                headers: {
+                    Authorization: `Bearer ${jwt}`,
+                    Accept: "application/vnd.github+json",
+                    "X-GitHub-Api-Version": "2022-11-28",
+                },
+                timeout: 15000,
+                maxRedirects: 0,
+            });
+            const token = (_a = response.data) === null || _a === void 0 ? void 0 : _a.token;
+            if (!token) {
+                throw new Error("GitHub did not return an installation token");
+            }
+            const expiresAt = response.data.expires_at
+                ? Date.parse(response.data.expires_at)
+                : Date.now() + 60 * 60 * 1000;
+            this.cached = { token, expiresAt };
+            return token;
+        });
+    }
+    getInstallationToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.cached && this.cached.expiresAt - Date.now() > TOKEN_REFRESH_MARGIN_MS) {
+                return this.cached.token;
+            }
+            if (!this.inFlight) {
+                this.inFlight = this.mint().then((token) => {
+                    this.inFlight = null;
+                    return token;
+                }, (error) => {
+                    this.inFlight = null;
+                    throw error;
+                });
+            }
+            return this.inFlight;
+        });
+    }
+    reset() {
+        this.cached = null;
+        this.inFlight = null;
+    }
+}
+exports.GitHubAppAuth = GitHubAppAuth;

package/build/bot/injection-markers.d.ts

@@ -0,0 +1 @@
+export declare const hasInjectionMarker: (text: string) => boolean;

package/build/bot/injection-markers.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasInjectionMarker = void 0;
+// Instruction-like text inside tool output. Kept narrow on purpose: a false
+// positive can lock an admin out or reject a whole sweep report, a miss is
+// just an alert not sent.
+const INJECTION_MARKERS = [
+    /ignore\s+(all\s+|the\s+|any\s+)?(previous|prior|above|earlier)\s+(instructions|rules|prompts?)/i,
+    /disregard\s+(your|the|all)\s+(system|previous|prior)\s+(prompt|instructions|rules)/i,
+    /(reveal|print|output|show|leak|dump)\s+(me\s+)?(the|your)\s+(system\s+prompt|api\s+key|secret|token|credentials?|private\s+key)/i,
+    /you\s+are\s+now\s+(in\s+)?(developer|debug|admin|unrestricted|dan)\s+mode/i,
+    /<\/?(system|assistant|tool_result_untrusted_data|past_cases_untrusted_data|memory_untrusted_data)>/i,
+    /\bBEGIN\s+SYSTEM\s+PROMPT\b/i,
+];
+const hasInjectionMarker = (text) => INJECTION_MARKERS.some((re) => re.test(text));
+exports.hasInjectionMarker = hasInjectionMarker;

package/build/bot/k8s-client.d.ts

@@ -0,0 +1,45 @@
+/// <reference types="node" />
+/// <reference types="node" />
+export interface PodSummary {
+    name: string;
+    phase: string;
+    ready: string;
+    restarts: number;
+    ageMinutes: number;
+    containers: string[];
+    node?: string;
+    lastState?: string;
+}
+export interface DeploymentSummary {
+    name: string;
+    desired: number;
+    ready: number;
+    available: number;
+    updated: number;
+    images: string[];
+    conditions: string[];
+}
+export interface EventSummary {
+    lastSeen: string;
+    type: string;
+    reason: string;
+    object: string;
+    count: number;
+    message: string;
+}
+export declare class K8sClient {
+    private http;
+    constructor(baseURL: string, ca: Buffer | undefined, timeoutMs: number);
+    static fromInCluster(timeoutMs: number): K8sClient | null;
+    private headers;
+    private get;
+    listPods(namespace: string): Promise<PodSummary[]>;
+    getPodLog(namespace: string, pod: string, options: {
+        container?: string;
+        tailLines: number;
+        sinceSeconds: number;
+        previous: boolean;
+    }): Promise<string>;
+    listDeployments(namespace: string): Promise<DeploymentSummary[]>;
+    listEvents(namespace: string, involvedObjectName?: string): Promise<EventSummary[]>;
+}