@weave_protocol/mund 0.5.2 → 0.6.0

package/DETECTION_CLAIMS.md

@@ -43,6 +43,74 @@ Tested against a local fake MCP server ([`fake-mcp-server.mjs`](tests/fixtures/p
 | Mund never starts a project server you haven't approved; it checks it statically | — |
 | Mund never starts a server whose package or URL it already distrusts | — |
 
+## Local classifier (0.6.0)
+
+A small offline model (hashed word and character n-grams, logistic regression, 80,000 weights, 208 KB) backs up the injection rules. It scores text in windows and sentences, so an injection appended to a normal question, or buried in a long page, isn't diluted. A hit is **warn** (medium severity, `alert`); the classifier never blocks on its own. Turn it off with `MUND_CLASSIFIER=0` or by disabling the `injection_classifier` rule.
+
+**Method.** The [training scripts](training/README.md) fetch public datasets and train on fixed, deterministic splits. The threshold (0.978) was chosen on validation data only, as the lowest that kept benign false positives at or below 0.25%. The numbers below are from the shipped model, run through `scan()` and counting medium severity or higher, as the self red-team does. Test rows that duplicate a training row were dropped.
+
+The test sets were scored twice during development. The first model flagged 4 of 2,062 benign texts, including one in Mund's benign corpus. The fix was broader benign training data (OpenAssistant assistant replies), not changes aimed at the flagged texts. The model was retrained and its threshold re-picked on validation, and the test sets were scored a second and final time. That model gave up a few points of detection: Gandalf 92.9% → 88.4%, jackhhao 84.4% → 77.0%.
+
+| Test set | What it is | Rules only | Rules + classifier |
+|---|---|---|---|
+| Gandalf test (Lakera) | Players trying to override a password guard | 73/112 (65.2%) | **99/112 (88.4%)** |
+| jackhhao test | Jailbreak prompts | 77/135 (57.0%) | **104/135 (77.0%)** |
+| SPML ¹ | Prompts that break a chatbot's system prompt | 565/2342 (24.1%) | **897/2342 (38.3%)** |
+| deepset test | Off-task and override requests to a news QA bot | 23/60 (38.3%) | 24/60 (40.0%) |
+| Mosscap ¹ | Password-game turns, many only meaningful in context | 52/999 (5.2%) | 77/999 (7.7%) |
+| InjecAgent, enhanced ¹ | Attacker instruction with an explicit override, inside a tool output | 1054/1054 (100%) | 1054/1054 (100%) |
+| InjecAgent, base ¹ | Attacker instruction alone, as a polite sentence inside a tool output | 17/1054 (1.6%) | 17/1054 (1.6%) |
+
+¹ A source the classifier was never trained on.
+
+Benign texts flagged rose from **0 of 2,062 to 2 of 2,062 (0.10%)**: two README paragraphs, one of badge links and one of TypeScript, both full of the word "ignore". The sets:
+
+| Benign set | Flagged |
+|---|---|
+| OpenAssistant prompts | 0/290 |
+| README paragraphs from packages not trained on | 2/750 |
+| SPML benign | 0/658 |
+| jackhhao benign | 0/122 |
+| InjecAgent tool outputs | 0/85 |
+| deepset benign | 0/56 |
+| InjecAgent user requests | 0/17 |
+| Mund's benign corpus | 0/84 |
+
+Scoring takes about 0.4 ms per text.
+
+**What this does and doesn't show:**
+- The classifier helps most against direct override and jailbreak attempts, including paraphrases.
+- It helps less on sources it hasn't seen. The gains on SPML and Mosscap are real but modest.
+- On Weave's own red-team corpus it adds nothing (94.1% either way), because the rules already catch those payloads.
+- It does nothing for an attacker's request phrased as an ordinary sentence inside data (InjecAgent base). Such text reads like a legitimate request, and no content scanner can tell the difference without knowing what the user asked for. For that, enforce what tools may do with [Ward](../ward), and compare calls against declared intent with [Hundredmen](../hundredmen).
+
+## Guardrail mapping and malicious-artifact requests (0.6.0)
+
+Two narrow rules close the last gaps in Weave's red-team corpus. Both are **warn** (medium, `alert`).
+
+| Rule | Catches | Leaves alone |
+|---|---|---|
+| `prompt_injection_policy_probe` | Asking which tools, URLs or commands the agent may use and, in the same request, which are denied or need approval; or asking for its hidden reasoning together with the rules it follows | "What tools are you allowed to use?" (stays low severity), questions about which files are editable, "show your reasoning step by step" |
+| `harmful_artifact_request` | An imperative request to write or build a keylogger, ransomware, phishing email or kit, credential harvester or similar, with a cue that it should work for real (complete, convincing, undetectable, in full technical detail) | Descriptions of such tools, threat-intel prose, detection rules, YARA/Sigma signatures, filters, incident summaries |
+
+**Results:**
+- **Red-team corpus:** with both rules, Mund flags all 68 payloads, every category at 100% (jailbreak was 80%, extraction 60%), with 0 of 84 benign texts flagged.
+- **Held-out sets:** neither rule fires on any of them, attacks or benign. They cost nothing in false positives, and they show no gain outside Weave's corpus, because the public sets don't contain these request shapes.
+- **Security writing:** the hard benign test is 5,825 texts: MITRE ATT&CK technique, malware and tool descriptions, and OWASP Cheat Sheet paragraphs. Neither rule fires on any of them.
+
+Mund as a whole now flags **15 of those 5,825 texts, down from 86** before 0.6.0. All 15 are AI-security pages that quote real injection strings: OWASP's prompt-injection, RAG and model-ops cheat sheets, and ATT&CK's prompt-injection technique. None is threat-intel or guidance prose.
+
+Two heuristics were fixed in 0.6.0:
+- **Role-switch** read titles that start with a role word ("[System Information Discovery]", "[Systemd Service]", "[admin@338]") as role markers. It now needs a bare tag like `[SYSTEM]`, or one naming an override or message.
+- **Markup** flagged every `<script>`, `javascript:` and `data:text/html` at medium. These are ordinary in web pages and security writing, so a mention is now low. A script that reads cookies or storage and sends them off the page is high.
+
+Five phrase rules also stopped firing on descriptions of what malware or systems do: authority, decode-and-execute, concealment, data harvest and jailbreak. Some examples:
+- "a loader… designed to decrypt and execute";
+- "allows the system to verify identity without asking the user";
+- "it will… send information, including the user's hashed credentials".
+
+A match is now skipped when the same sentence says what something can, may, will, was designed to or allows. "System command" in prose no longer counts as an authority claim. "AI agents should…" counts only when what follows is an instruction to the agent ("…should recommend our product"), not guidance about agents ("…should undergo security testing"). None of this changed detection on any held-out set or on the red-team corpus.
+
 ## Limits
 
-Detection is pattern-based. These claims cover the attack shapes listed, not every variant: a paraphrased instruction with no hidden characters, URL or secret won't be caught by these checks. See the [OWASP coverage tables](README.md#️-owasp-coverage) for what is and isn't covered.
+Detection is pattern-based, plus the classifier above. These claims cover the attack shapes listed, not every variant: a paraphrased instruction with no hidden characters, URL or secret won't be caught by these checks. See the [OWASP coverage tables](README.md#️-owasp-coverage) for what is and isn't covered.

package/README.md

@@ -5,25 +5,55 @@
 [![npm version](https://img.shields.io/npm/v/@weave_protocol/mund.svg)](https://www.npmjs.com/package/@weave_protocol/mund)
 [![npm downloads](https://img.shields.io/npm/dm/@weave_protocol/mund.svg)](https://www.npmjs.com/package/@weave_protocol/mund)
 [![MCP Registry](https://img.shields.io/badge/MCP-Registry-blue)](https://registry.modelcontextprotocol.io/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
 Mund (Old English: "protection, guardian") is a real-time security scanner for AI agent systems. It detects prompt injection, secrets, PII, dangerous code patterns, and data exfiltration attempts.
 
-**🆕 New in v0.3.1:** [Canary tokens](#-canary-tokens-system-prompt-leakage) catch leaked system prompts, and [rug-pull detection](#rug-pull-detection) flags MCP servers whose tools change after you approved them.
+## 🆕 What's new
 
-**v0.3.0:** `mund-mcp scan` scans files on disk and outputs text, JSON, or **SARIF for GitHub code scanning**. It checks npm dependencies against **OSV.dev**, with an offline cache. Every scan gets a **0–100 risk score**, and the README adds [OWASP coverage tables](#️-owasp-coverage). This release also fixes 23 secret rules that had never matched anything.
+**0.6.0: a local injection classifier.** A small model now backs up the rules. It runs offline in under a millisecond, with no API key or download, and catches paraphrased overrides that no pattern names. Measured on public test sets: Gandalf goes from 65% to 88%, jackhhao jailbreaks from 57% to 77%, and SPML (a source it never trained on) from 24% to 38%. Benign texts flagged rose from 0 to 2 of 2,062 (0.10%), and none of Mund's benign corpus. It warns and never blocks on its own; `MUND_CLASSIFIER=0` turns it off. Method, every number, and what it can't catch: [DETECTION_CLAIMS.md](DETECTION_CLAIMS.md#local-classifier-060).
 
-**v0.2.0:** Automated threat intelligence with MITRE ATT&CK mapping and community feeds.
+Two new rules flag requests that map an agent's guardrails, and requests for working malware or phishing kits. Descriptions and defensive work stay clean. Across 5,825 MITRE ATT&CK and OWASP texts, the texts Mund flags fell from 86 to 15, and all 15 are pages quoting real injection strings. With them, Mund flags every payload in Weave's red-team corpus.
+
+**0.5.2: injection detection by intent.** Mund now looks for what an injection is trying to do, not one fixed phrase. That covers:
+- overriding instructions, in six languages;
+- hijacking the task;
+- text written to an AI reader;
+- hiding actions from the user;
+- false authority;
+- persona jailbreaks;
+- extracting the system prompt;
+- payment and exfiltration directives.
+
+It also reads text a person never sees: hidden HTML, base64, Unicode tag characters, and words split by zero-width characters.
+
+| Detected at medium or higher | 0.5.1 | 0.5.2 |
+|---|---|---|
+| [Lakera Gandalf](https://huggingface.co/datasets/Lakera/gandalf_ignore_instructions) injections | 17.9% | **65.2%** |
+| [jackhhao](https://huggingface.co/datasets/jackhhao/jailbreak-classification) jailbreaks | 30.9% | **58.3%** |
+| [deepset](https://huggingface.co/datasets/deepset/prompt-injections) prompt injections (mostly German) | 4.9% | **24.6%** |
+| False positives, 466 benign prompts from those sets | 0 | **0** |
+
+These sets were not used to write the rules. A fix to the `shell_injection` rule also stops it flagging every line that contains braces. See [what the injection rules look for](#what-the-injection-rules-look-for-052).
+
+**0.5.0: library API.** `scan(content)` returns findings and a 0–100 risk score, using the same analyzers and rules as the MCP tool.
+
+**0.4.0: pre-install checks.** Mund checks skills and MCP servers before they're installed. See [pre-install checks](#-pre-install-checks-for-skills-and-mcp-servers).
+
+**Earlier:**
+- 0.3.1 added [canary tokens](#-canary-tokens-system-prompt-leakage) and [rug-pull detection](#rug-pull-detection).
+- 0.3.0 added `mund-mcp scan` with SARIF output, OSV.dev dependency checks and risk scores.
+- 0.2.0 added threat intelligence with MITRE ATT&CK mapping.
 
 ## ✨ Features
 
 | Category | What It Detects |
 |----------|-----------------|
-| **Prompt Injection** | Role manipulation, instruction override, jailbreak attempts, hidden Unicode |
+| **Prompt Injection** | Instruction override in six languages, task hijack, concealment, false authority, persona jailbreaks, system-prompt extraction, and text hidden in HTML, base64, Unicode tags or zero-width characters |
 | **Secrets** | API keys (OpenAI, Anthropic, AWS, GitHub, Stripe), tokens, private keys, database URLs |
 | **PII** | SSN, credit cards, emails, phone numbers, IP addresses |
-| **Code Patterns** | Shell injection, SQL injection, dangerous chmod, curl\|bash, eval |
-| **Exfiltration** | Suspicious URLs, DNS tunneling, base64-encoded data blocks |
+| **Code Patterns** | Shell injection, SQL injection, dangerous chmod, curl\|bash, eval, plus requests to read credential files, dump the environment, clear security logs or escalate privileges |
+| **Exfiltration** | Directives to send private data to a URL or address, URLs with `{SESSION_TOKEN}`-style placeholders, suspicious URLs, DNS tunneling, encoded data blocks |
 | **MCP Servers** | Malicious tool descriptions, typosquatting, dangerous permissions, embedded secrets |
 | **Dependencies** | Known-vulnerable npm packages in `package-lock.json`, via OSV.dev with an offline cache |
 | **Threat Intel** | 20+ built-in patterns, MITRE ATT&CK mapping, auto-updating community feeds |
@@ -60,16 +90,21 @@ Restart Claude Desktop. Mund's security tools are now available.
 ### Programmatic Usage
 
 ```typescript
-import { AnalyzerEngine, getAnalyzers } from '@weave_protocol/mund';
+import { scan } from '@weave_protocol/mund';
 
-const engine = new AnalyzerEngine(getAnalyzers());
-const issues = await engine.analyzeAll(content, rules);
+const { issues, risk } = await scan(untrustedText);
+// risk: { score: 0-100, label: 'none' | 'low' | 'medium' | 'high' | 'critical', counts }
 
-if (issues.some(i => i.severity === 'critical')) {
-  console.error('Critical security issues detected!');
+if (risk.label === 'high' || risk.label === 'critical') {
+  throw new Error(`Blocked: ${issues.map(i => i.rule_name).join(', ')}`);
 }
+
+// Only some analyzers, or your own rules
+await scan(text, { types: ['injection', 'exfiltration'] });
 ```
 
+Treat findings at `medium` or higher as actionable. `AnalyzerEngine`, the individual analyzers, `DEFAULT_RULES` and `computeRiskScore` are exported for lower-level use.
+
 ### Scan Files and Upload to GitHub Code Scanning
 
 `mund-mcp scan` checks files on disk, plus the npm dependencies in any
@@ -127,7 +162,7 @@ for severe findings and never goes past 100.
 
 ## 🧠 Automated Threat Intelligence
 
-**New in v0.2.0:** Mund includes automated threat intelligence with MITRE ATT&CK mapping and auto-updating community feeds.
+Mund includes automated threat intelligence with MITRE ATT&CK mapping and auto-updating community feeds.
 
 ### Built-in Detection Patterns
 
@@ -527,26 +562,27 @@ MUND_WEBHOOK_URL=https://api.company.com/alerts
 
 ## 📜 Detection Rules
 
-Mund uses YAML-based rules in `rules/default.yaml`. Example:
+Mund's rules are built in and exported as `DEFAULT_RULES`. Add your own with the `mund_add_rule` tool, or pass them to `scan()`:
 
-```yaml
-- id: openai_api_key
-  name: OpenAI API Key
-  type: secret
-  severity: critical
-  pattern: 'sk-[a-zA-Z0-9]{48}'
-  action: alert
-  enabled: true
-
-- id: prompt_injection_ignore
-  name: Instruction Override Attempt
-  type: injection
-  severity: high
-  pattern: 'ignore\s+(previous|all|prior)\s+instructions'
-  action: alert
-  enabled: true
+```typescript
+import { scan, DEFAULT_RULES, type DetectionRule } from '@weave_protocol/mund';
+
+const internalHost: DetectionRule = {
+  id: 'internal_hostname',
+  name: 'Internal hostname',
+  description: 'Mentions of our internal network',
+  type: 'exfiltration',
+  pattern: '(?i)\\b[a-z0-9-]+\\.corp\\.example\\.com\\b',
+  severity: 'medium',
+  action: 'alert',
+  enabled: true,
+};
+
+await scan(text, { rules: [...DEFAULT_RULES, internalHost] });
 ```
 
+Patterns are JavaScript regular expressions. A leading `(?i)` makes one case-insensitive.
+
 ### What the injection rules look for (0.5.2)
 
 The injection rules look for intent, not a single phrase, and run on normalized text with zero-width characters removed and Unicode normalized. These families of rules fire on any phrasing that matches them:
@@ -602,14 +638,14 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
 │  ├── mund_scan_mcp_server    MCP server scanning              │
 │  ├── mund_check_typosquatting   Name verification             │
 │  ├── mund_audit_mcp_permissions Permission audit              │
-│  ├── mund_update_threat_intel   Pull latest patterns   [NEW]  │
-│  ├── mund_intel_status          Health & coverage      [NEW]  │
-│  ├── mund_list_intel_sources    Show intel sources     [NEW]  │
-│  ├── mund_threat_scan           Scan with intel        [NEW]  │
-│  ├── mund_add_intel_source      Add custom feed        [NEW]  │
-│  ├── mund_remove_intel_source   Remove feed            [NEW]  │
-│  ├── mund_list_patterns         Browse patterns        [NEW]  │
-│  └── mund_toggle_pattern        Enable/disable         [NEW]  │
+│  ├── mund_update_threat_intel   Pull latest patterns          │
+│  ├── mund_intel_status          Health & coverage             │
+│  ├── mund_list_intel_sources    Show intel sources            │
+│  ├── mund_threat_scan           Scan with intel               │
+│  ├── mund_add_intel_source      Add custom feed               │
+│  ├── mund_remove_intel_source   Remove feed                   │
+│  ├── mund_list_patterns         Browse patterns               │
+│  └── mund_toggle_pattern        Enable/disable                │
 ├───────────────────────────────────────────────────────────────┤
 │  Analyzers                                                    │
 │  ├── SecretScanner           API keys, tokens, credentials    │
@@ -618,7 +654,7 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
 │  ├── CodeAnalyzer            Dangerous code patterns          │
 │  ├── ExfiltrationDetector    Data exfiltration attempts       │
 │  ├── McpServerAnalyzer       MCP manifest security            │
-│  └── ThreatIntelManager      MITRE ATT&CK patterns     [NEW]  │
+│  └── ThreatIntelManager      MITRE ATT&CK patterns            │
 ├───────────────────────────────────────────────────────────────┤
 │  Notifications                                                │
 │  └── Slack, Teams, Email, Webhooks                            │
@@ -627,24 +663,31 @@ Treat a hit at `medium` or higher as actionable. That is the threshold Weave's C
 
 ---
 
-## 🔗 Part of Weave Protocol
+## 🕸️ Part of Weave Protocol
 
-Mund is the security layer of the [Weave Protocol](https://github.com/Tyox-all/Weave_Protocol) security suite:
+One [WARD.md](https://github.com/Tyox-all/Weave_Protocol) policy for every agent you run, locally or at scale, plus the tools around it.
 
-| Package | Purpose |
-|---------|---------|
-| **🛡️ Mund** | Security scanning, MCP server vetting, threat intelligence |
-| **🏛️ Hord** | Encrypted vault storage (Yoxallismus cipher) |
-| **⚖️ Domere** | Compliance & verification (PCI-DSS, ISO27001, GDPR) |
-| **👥 Witan** | Multi-agent consensus & governance |
-| **🔍 Hundredmen** | Real-time MCP proxy & drift detection |
-| **🔌 API** | REST interface for all packages |
+| Package | What it does |
+|---|---|
+| [Ward](https://www.npmjs.com/package/@weave_protocol/ward) | The WARD.md policy standard and the tool-call evaluator every adapter shares |
+| [Mund](https://www.npmjs.com/package/@weave_protocol/mund) | Scans content for prompt injection, secrets, PII and exfiltration |
+| [Hord](https://www.npmjs.com/package/@weave_protocol/hord) | Encrypted vaults, PII tokenization, sandboxes, capability tokens, attestations |
+| [Dōmere](https://www.npmjs.com/package/@weave_protocol/domere) | Audit threads, compliance checkpoints, GDPR and CCPA records, anchoring |
+| [Witan](https://www.npmjs.com/package/@weave_protocol/witan) | Multi-agent consensus and spending caps |
+| [Hundredmen](https://www.npmjs.com/package/@weave_protocol/hundredmen) | MCP proxy that enforces WARD.md on tool calls |
+| [Tollere](https://www.npmjs.com/package/@weave_protocol/tollere) | Supply-chain checks: typosquats, CVEs, suspicious version diffs |
+| [Browser](https://www.npmjs.com/package/@weave_protocol/browser) | WARD.md and injection scanning for Playwright browser agents |
+| Adapters | WARD.md in [Claude Code](https://www.npmjs.com/package/@weave_protocol/adapter-claudecode), [Antigravity](https://www.npmjs.com/package/@weave_protocol/adapter-antigravity), [MSAF](https://www.npmjs.com/package/@weave_protocol/adapter-msaf), [Gemini CLI](https://www.npmjs.com/package/@weave_protocol/adapter-geminicli), [Codex](https://www.npmjs.com/package/@weave_protocol/adapter-codex), [OpenCode](https://www.npmjs.com/package/@weave_protocol/adapter-opencode) and [Cursor](https://www.npmjs.com/package/@weave_protocol/adapter-cursor) |
+| [Adversary](https://www.npmjs.com/package/@weave_protocol/adversary) · [AgentSecBench](https://www.npmjs.com/package/@weave_protocol/agentsecbench) | Red-team engine and locked benchmark |
+| [API](https://www.npmjs.com/package/@weave_protocol/api) · [CLI](https://www.npmjs.com/package/@weave_protocol/cli) · [LangChain](https://www.npmjs.com/package/@weave_protocol/langchain) | REST API and dashboard, setup CLI, LangChain.js integration |
+| [full](https://www.npmjs.com/package/@weave_protocol/full) | Every defensive package in one install |
+| [Yoxallismus](https://www.npmjs.com/package/@weave_protocol/yoxallismus) | Post-quantum hybrid cipher (experimental beta) |
 
 ---
 
 ## 📄 License
 
-MIT License - see [LICENSE](LICENSE)
+Apache-2.0 — see [LICENSE](LICENSE)
 
 ---
 

package/dist/analyzers/classifier.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Mund - local prompt-injection classifier (Mund 0.6.0)
+ *
+ * A small linear model over hashed word and character n-grams. It runs
+ * offline in microseconds, needs no API key or download, and catches
+ * paraphrased injections that no fixed pattern names. It backs up the
+ * rules; it never replaces them.
+ *
+ * The same featurizer is used to train the shipped weights and to score at
+ * runtime, so the two can't drift apart.
+ */
+export declare const FEATURE_BITS = 18;
+export interface InjectionModel {
+    version: string;
+    bits: number;
+    bias: number;
+    /** Decision threshold on the probability, chosen on validation data */
+    threshold: number;
+    /** Sparse weights: feature index -> weight */
+    weights: Map<number, number>;
+}
+export declare function normalizeForModel(text: string): string;
+/**
+ * Features of a text: word unigrams and bigrams, and character 3-5-grams
+ * within words. Binary, L2-normalized, hashed into 2^18 buckets.
+ */
+export declare function featurize(text: string): Map<number, number>;
+/** Probability that one window of text is a prompt injection. */
+export declare function scoreWindow(text: string, model: InjectionModel): number;
+/**
+ * Long content (a web page, a tool result) is scored in windows of about
+ * 800 characters, cut at paragraph or sentence breaks; the highest window
+ * counts, so an injection buried in a long document isn't averaged away.
+ */
+export declare function windows(text: string, size?: number): string[];
+/**
+ * Sentences (and pairs of neighbours) inside a window, so an injection
+ * appended to an innocent question isn't diluted by it.
+ */
+export declare function sentences(text: string): string[];
+export declare function scoreInjection(text: string, model: InjectionModel, opts?: {
+    sentences?: boolean;
+}): {
+    score: number;
+    window: string;
+};
+/**
+ * Decode the shipped model: base64 of [u32 count][u32 index, i8 weight]...
+ * with a float scale, kept compact so the package stays small.
+ */
+export declare function decodeModel(encoded: {
+    version: string;
+    bits: number;
+    bias: number;
+    threshold: number;
+    scale: number;
+    data: string;
+}): InjectionModel;
+export declare function encodeModel(model: {
+    version: string;
+    bias: number;
+    threshold: number;
+    weights: Map<number, number>;
+}): {
+    version: string;
+    bits: number;
+    bias: number;
+    threshold: number;
+    scale: number;
+    data: string;
+};
+//# sourceMappingURL=classifier.d.ts.map

package/dist/analyzers/classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../src/analyzers/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,YAAY,KAAK,CAAC;AAG/B,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAYD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB3D;AAID,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM,GAAG,MAAM,EAAE,CAY1D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CASzI;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAcpJ;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAetN"}

package/dist/analyzers/classifier.js

@@ -0,0 +1,164 @@
+/**
+ * Mund - local prompt-injection classifier (Mund 0.6.0)
+ *
+ * A small linear model over hashed word and character n-grams. It runs
+ * offline in microseconds, needs no API key or download, and catches
+ * paraphrased injections that no fixed pattern names. It backs up the
+ * rules; it never replaces them.
+ *
+ * The same featurizer is used to train the shipped weights and to score at
+ * runtime, so the two can't drift apart.
+ */
+export const FEATURE_BITS = 18;
+const DIM = 1 << FEATURE_BITS;
+/** FNV-1a 32-bit */
+function hash(s) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return h >>> 0;
+}
+export function normalizeForModel(text) {
+    return text
+        .normalize('NFKC')
+        .replace(/[​-‍⁠­]/g, '')
+        .toLowerCase()
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/**
+ * Features of a text: word unigrams and bigrams, and character 3-5-grams
+ * within words. Binary, L2-normalized, hashed into 2^18 buckets.
+ */
+export function featurize(text) {
+    const t = normalizeForModel(text);
+    const words = t.match(/[\p{L}\p{N}']+/gu) ?? [];
+    const keys = new Set();
+    const add = (k) => keys.add(hash(k) & (DIM - 1));
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        add(`w:${w}`);
+        if (i + 1 < words.length)
+            add(`b:${w} ${words[i + 1]}`);
+        const padded = ` ${w} `;
+        if (padded.length <= 40) {
+            for (let n = 3; n <= 5; n++)
+                for (let j = 0; j + n <= padded.length; j++)
+                    add(`c:${padded.slice(j, j + n)}`);
+        }
+    }
+    const v = new Map();
+    if (!keys.size)
+        return v;
+    const x = 1 / Math.sqrt(keys.size);
+    for (const k of keys)
+        v.set(k, x);
+    return v;
+}
+const sigmoid = (z) => 1 / (1 + Math.exp(-z));
+/** Probability that one window of text is a prompt injection. */
+export function scoreWindow(text, model) {
+    let z = model.bias;
+    for (const [k, x] of featurize(text))
+        z += (model.weights.get(k) ?? 0) * x;
+    return sigmoid(z);
+}
+/**
+ * Long content (a web page, a tool result) is scored in windows of about
+ * 800 characters, cut at paragraph or sentence breaks; the highest window
+ * counts, so an injection buried in a long document isn't averaged away.
+ */
+export function windows(text, size = 800) {
+    if (text.length <= size * 1.5)
+        return [text];
+    const parts = text.split(/(?<=\n\s*\n)|(?<=[.!?])\s+/);
+    const out = [];
+    let cur = '';
+    for (const p of parts) {
+        if (cur && cur.length + p.length > size) {
+            out.push(cur);
+            cur = '';
+        }
+        cur += (cur ? ' ' : '') + p;
+        while (cur.length > size * 2) {
+            out.push(cur.slice(0, size));
+            cur = cur.slice(size);
+        }
+    }
+    if (cur.trim())
+        out.push(cur);
+    return out;
+}
+/**
+ * Sentences (and pairs of neighbours) inside a window, so an injection
+ * appended to an innocent question isn't diluted by it.
+ */
+export function sentences(text) {
+    const parts = text.split(/(?<=[.!?])\s+|\n+|(?<=\?)(?=\S)/).map((s) => s.trim()).filter((s) => s.length >= 12);
+    if (parts.length < 2)
+        return [];
+    const out = [...parts];
+    for (let i = 0; i + 1 < parts.length; i++)
+        out.push(`${parts[i]} ${parts[i + 1]}`);
+    return out;
+}
+export function scoreInjection(text, model, opts = {}) {
+    let best = { score: 0, window: '' };
+    for (const w of windows(text)) {
+        for (const piece of [w, ...(opts.sentences === false ? [] : sentences(w))]) {
+            const score = scoreWindow(piece, model);
+            if (score > best.score)
+                best = { score, window: piece };
+        }
+    }
+    return best;
+}
+/**
+ * Decode the shipped model: base64 of [u32 count][u32 index, i8 weight]...
+ * with a float scale, kept compact so the package stays small.
+ */
+export function decodeModel(encoded) {
+    const buf = Buffer.from(encoded.data, 'base64');
+    const weights = new Map();
+    let prev = 0;
+    let i = 0;
+    while (i < buf.length) {
+        // delta-encoded index (varint), then an int8 weight
+        let delta = 0, shift = 0, b;
+        do {
+            b = buf[i++];
+            delta |= (b & 0x7f) << shift;
+            shift += 7;
+        } while (b & 0x80);
+        prev += delta;
+        const q = buf.readInt8(i++);
+        weights.set(prev, q * encoded.scale);
+    }
+    return { version: encoded.version, bits: encoded.bits, bias: encoded.bias, threshold: encoded.threshold, weights };
+}
+export function encodeModel(model) {
+    const entries = [...model.weights.entries()].filter(([, w]) => w !== 0).sort((a, b) => a[0] - b[0]);
+    const max = entries.reduce((m, [, w]) => Math.max(m, Math.abs(w)), 1e-9);
+    const scale = max / 127;
+    const bytes = [];
+    let prev = 0;
+    for (const [k, w] of entries) {
+        const q = Math.round(w / scale);
+        if (q === 0)
+            continue;
+        let delta = k - prev;
+        prev = k;
+        do {
+            let b = delta & 0x7f;
+            delta >>>= 7;
+            if (delta)
+                b |= 0x80;
+            bytes.push(b);
+        } while (delta);
+        bytes.push(q & 0xff);
+    }
+    return { version: model.version, bits: FEATURE_BITS, bias: model.bias, threshold: model.threshold, scale, data: Buffer.from(bytes).toString('base64') };
+}
+//# sourceMappingURL=classifier.js.map

package/dist/analyzers/classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../../src/analyzers/classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,GAAG,GAAG,CAAC,IAAI,YAAY,CAAC;AAY9B,oBAAoB;AACpB,SAAS,IAAI,CAAC,CAAS;IACrB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI;SACR,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,WAAW,EAAE;SACb,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;oBAAE,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtD,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAqB;IAC7D,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAI,GAAG,GAAG;IAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,GAAG,EAAE,CAAC;QAAC,CAAC;QACrE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/G,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAqB,EAAE,OAAgC,EAAE;IACpG,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK;gBAAE,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwG;IAClI,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,oDAAoD;QACpD,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAS,CAAC;QACpC,GAAG,CAAC;YAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;QAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE;QAChF,IAAI,IAAI,KAAK,CAAC;QACd,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;AACrH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyF;IACnH,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACtB,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;QACrB,IAAI,GAAG,CAAC,CAAC;QACT,GAAG,CAAC;YAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YAAC,KAAK,MAAM,CAAC,CAAC;YAAC,IAAI,KAAK;gBAAE,CAAC,IAAI,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,QAAQ,KAAK,EAAE;QAC9F,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1J,CAAC"}

package/dist/analyzers/injection-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"injection-detector.d.ts","sourceRoot":"","sources":["../../src/analyzers/injection-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAGrB,qBAAa,iBAAkB,YAAW,SAAS;IACjD,IAAI,SAAuB;IAC3B,IAAI,SAAe;IAEb,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAyBhF,OAAO,CAAC,UAAU;IA6BlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAexB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmIzB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAMjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;OAEG;IACH,OAAO,CAAC,aAAa;CAiBtB;AAWD,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBrD;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3D;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"injection-detector.d.ts","sourceRoot":"","sources":["../../src/analyzers/injection-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAQrB,qBAAa,iBAAkB,YAAW,SAAS;IACjD,IAAI,SAAuB;IAC3B,IAAI,SAAe;IAEb,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAgDhF,OAAO,CAAC,UAAU;IA6BlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAexB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA4IzB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAMjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;OAEG;IACH,OAAO,CAAC,aAAa;CAiBtB;AAWD,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBrD;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3D;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED,eAAe,iBAAiB,CAAC"}

package/dist/analyzers/injection-detector.js

@@ -3,6 +3,10 @@
  * Injection Detector - Detects prompt injection attempts
  */
 import { compileRulePattern } from './regex.js';
+import { decodeModel, scoreInjection } from './classifier.js';
+import { INJECTION_MODEL } from './injection-model.js';
+let model;
+const loadModel = () => (model ??= decodeModel(INJECTION_MODEL));
 export class InjectionDetector {
     name = 'InjectionDetector';
     type = 'injection';
@@ -30,6 +34,29 @@ export class InjectionDetector {
         }
         // Additional heuristic checks
         issues.push(...this.heuristicAnalysis(content));
+        // The local classifier backs up the rules: one finding at most, for the
+        // view and window it scores highest.
+        const classifier = injectionRules.find((r) => r.id === 'injection_classifier');
+        if (classifier && process.env.MUND_CLASSIFIER !== '0') {
+            const m = loadModel();
+            let best = { score: 0, window: '' };
+            for (const view of views) {
+                const r = scoreInjection(view.text, m);
+                if (r.score > best.score)
+                    best = { ...r, via: view.via };
+            }
+            if (best.score >= m.threshold) {
+                issues.push({
+                    rule_id: classifier.id,
+                    rule_name: best.via ? `${classifier.name} (hidden in ${best.via})` : classifier.name,
+                    type: classifier.type,
+                    severity: classifier.severity,
+                    action: classifier.action,
+                    match: this.sanitizeMatch(best.window),
+                    suggestion: `The local classifier scored this ${best.score.toFixed(3)} (threshold ${m.threshold.toFixed(3)}). Treat it as untrusted data, not instructions.`
+                });
+            }
+        }
         return issues;
     }
     applyRules(original, text, rules, via) {
@@ -92,7 +119,11 @@ export class InjectionDetector {
         const roleSwitchPatterns = [
             [/<\|\s*(?:im_start|im_end|system|user|assistant|endoftext|start_header_id|end_header_id|eot_id)\s*\|>/i, 'high'],
             [/\[\/?INST\]|<<\/?SYS>>/, 'high'],
-            [/\[\s*(?:system|admin|administrator|developer)(?:\s+(?:override|message|prompt|note|instruction)s?)?[^\]\n]{0,30}\]/i, 'high'],
+            // A bare role tag ([SYSTEM], [admin]) or one naming an override or message.
+            // Titles that merely start with the word ("[System Information Discovery]",
+            // "[Systemd Service]", "[admin@338]") are not role markers.
+            // [DEVELOPER] alone is a common label (diagrams, tables), so it needs a qualifier.
+            [/\[\s*(?:(?:system|admin|administrator)\s*(?:(?:override|message|prompt|note|instruction|notice|command|update|mode)s?\b[^\]\n]{0,30})?|developer\s*(?:override|message|prompt|note|instruction|notice|command|update|mode)s?\b[^\]\n]{0,30})\]/i, 'high'],
             [/\<\|?system\|?\>/i, 'high'],
             [/\{system_prompt\}/i, 'high'],
             [/^\s*#{1,4}\s*(?:system|instruction)s?\s*:/im, 'high'],
@@ -176,14 +207,19 @@ export class InjectionDetector {
             /javascript:/i,
             /data:text\/html/i,
         ];
+        // Scripts are ordinary in web pages and security writing, so a mention is
+        // low severity. A script that reads cookies or storage and sends them off
+        // the page is an exfiltration attempt, and high.
+        const exfilScript = /\b(?:document\.cookie|localStorage|sessionStorage)\b/i.test(content)
+            && /\b(?:fetch\s*\(|XMLHttpRequest|sendBeacon|new\s+Image\b|\.src\s*=|location(?:\.href)?\s*=)/i.test(content);
         for (const pattern of markdownPatterns) {
             const match = content.match(pattern);
             if (match) {
                 issues.push({
                     rule_id: 'heuristic_markup_injection',
-                    rule_name: 'Markup Injection Attempt',
+                    rule_name: exfilScript ? 'Script That Sends Cookies or Storage Off the Page' : 'Markup Injection Attempt',
                     type: 'injection',
-                    severity: 'medium',
+                    severity: (exfilScript ? 'high' : pattern.source.includes('system') ? 'medium' : 'low'),
                     action: 'alert',
                     match: this.sanitizeMatch(match[0]),
                     suggestion: 'This content contains potentially dangerous markup or code injection.'