@zerowidth/workbench-sdk 2.1.2 → 2.2.0

package/nodes/json-to-xml/json-to-xml.config.json

@@ -8,8 +8,8 @@
     {
       "name": "json",
       "display_name": "JSON",
-      "type": "object",
-      "description": "The JSON object to convert to XML",
+      "type": "object or array of objects",
+      "description": "The JSON object, or array of objects, to convert to XML",
       "required": true
     },
     {

package/nodes/json-to-yaml/json-to-yaml.config.json

@@ -8,8 +8,8 @@
     {
       "name": "json",
       "display_name": "JSON",
-      "type": "object",
-      "description": "The JSON object to convert to YAML",
+      "type": "object or array of objects",
+      "description": "The JSON object, or array of objects, to convert to YAML",
       "required": true
     },
     {

package/nodes/json-to-yaml/json-to-yaml.tests.json

@@ -97,5 +97,14 @@
     "expected": {
       "yaml": "null"
     }
+  },
+  {
+    "description": "Top-level array of objects",
+    "inputs": {
+      "json": [{"name": "Alice"}, {"name": "Bob"}]
+    },
+    "expected": {
+      "yaml": "- name: Alice\n- name: Bob"
+    }
   }
 ]

package/nodes/message/message.config.json

@@ -23,7 +23,7 @@
     {
       "name": "variables",
       "display_name": "Variables",
-      "type": "object",
+      "type": "object or array of objects",
       "allow_multiple": true,
       "description": "Connect key-value pairs to inject into any matched {{key}} in the text content."
     }

package/nodes/message/message.process.js

@@ -2,6 +2,23 @@
  * Process function for the Message node.
  * Outputs a message object, either from the input or from the settings.
  */
+/**
+ * Render a variable value for injection into message text.
+ * Strings pass through untouched; everything else is JSON encoded so that
+ * nested objects and arrays read as data instead of "[object Object]".
+ */
+const renderVariable = (value) => {
+  if (value === null || value === undefined) return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    // Circular structures (or anything else JSON can't encode) fall back to
+    // the default coercion rather than failing the whole message.
+    return String(value);
+  }
+};
+
 export default async ({inputs, settings, config}) => {
 
   // If an input value is provided, use it; otherwise use the value from settings
@@ -17,6 +34,12 @@ export default async ({inputs, settings, config}) => {
   if(!inputs.variables) {
     inputs.variables = [];
   }
+
+  // A single connection can deliver an array of key-value objects, so flatten
+  // one level before looking keys up.
+  const variables = (Array.isArray(inputs.variables) ? inputs.variables : [inputs.variables])
+    .flatMap(entry => Array.isArray(entry) ? entry : [entry])
+    .filter(entry => entry !== null && typeof entry === "object");
   
   // if we have variables and text content, we need to replace the text content with the variables
   // do we have a text content item and what index is it
@@ -25,9 +48,9 @@ export default async ({inputs, settings, config}) => {
     message.content[textContentIndex].text = message.content[textContentIndex].text.replace(/\{\{(.*?)\}\}/g, (match, p1) => {
       
       // look for a variable with the key p1
-      let variable = inputs.variables.find(variable => Object.keys(variable).find(key => key === p1));
+      let variable = variables.find(variable => Object.keys(variable).find(key => key === p1));
       if(variable) {
-        return variable[p1];
+        return renderVariable(variable[p1]);
       }
       return match;
     });

package/nodes/message/message.tests.json

@@ -0,0 +1,85 @@
+[
+  {
+    "description": "String variable is injected as-is",
+    "inputs": {
+      "variables": [
+        {
+          "name": "Ada"
+        }
+      ]
+    },
+    "settings": {
+      "role": "user",
+      "content": "Hello {{name}}!"
+    },
+    "expected": {
+      "message": {
+        "role": "user",
+        "content": [
+          {
+            "type": "text",
+            "text": "Hello Ada!"
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "Nested object variable is JSON stringified, not [object Object]",
+    "inputs": {
+      "variables": [
+        {
+          "order": {
+            "id": 7,
+            "paid": true
+          }
+        }
+      ]
+    },
+    "settings": {
+      "role": "user",
+      "content": "Order: {{order}}"
+    },
+    "expected": {
+      "message": {
+        "role": "user",
+        "content": [
+          {
+            "type": "text",
+            "text": "Order: {\n  \"id\": 7,\n  \"paid\": true\n}"
+          }
+        ]
+      }
+    }
+  },
+  {
+    "description": "Array of objects delivered as a single connection is flattened",
+    "inputs": {
+      "variables": [
+        [
+          {
+            "first": "Ada"
+          },
+          {
+            "last": "Lovelace"
+          }
+        ]
+      ]
+    },
+    "settings": {
+      "role": "user",
+      "content": "{{first}} {{last}}"
+    },
+    "expected": {
+      "message": {
+        "role": "user",
+        "content": [
+          {
+            "type": "text",
+            "text": "Ada Lovelace"
+          }
+        ]
+      }
+    }
+  }
+]

package/nodes/object-merge/object-merge.config.json

@@ -8,8 +8,8 @@
     {
       "name": "objects",
       "display_name": "Objects",
-      "type": "object",
-      "description": "Objects to merge (later objects override earlier ones)",
+      "type": "object or array of objects",
+      "description": "Objects to merge, individually or as arrays of objects (later objects override earlier ones)",
       "required": true,
       "allow_multiple": true
     },

package/nodes/object-merge/object-merge.process.js

@@ -2,8 +2,12 @@ export default async ({ inputs, settings, config }) => {
   const objects = inputs.objects;
   const arrayMode = inputs.array_mode ?? "replace";
 
-  // Normalize to array
-  const objectList = Array.isArray(objects) ? objects : [objects];
+  // Normalize to a flat array. A single connection can deliver an array of
+  // objects, and a multi-connection input can deliver arrays alongside plain
+  // objects, so flatten one level before filtering.
+  const objectList = (Array.isArray(objects) ? objects : [objects]).flatMap(
+    (entry) => (Array.isArray(entry) ? entry : [entry])
+  );
 
   // Filter out non-objects
   const validObjects = objectList.filter(

package/nodes/object-merge/object-merge.tests.json

@@ -142,5 +142,17 @@
     "expected": {
       "merged": {"level1": {"level2": {"level3": {"a": 1, "b": 2, "c": 3}}}}
     }
+  },
+  {
+    "description": "Array of objects delivered as a single connection is flattened",
+    "inputs": {
+      "objects": [
+        [{"a": 1}, {"b": 2}],
+        {"c": 3}
+      ]
+    },
+    "expected": {
+      "merged": {"a": 1, "b": 2, "c": 3}
+    }
   }
 ]

package/nodes/prompt-injection-guard/prompt-injection-guard.config.json

@@ -0,0 +1,39 @@
+{
+  "display_name": "Prompt Injection Guard",
+  "tagline": "Withhold prompt injections",
+  "description": "Scans user messages in a conversation for prompt-injection attempts — instruction overrides, jailbreak personas, system-prompt extraction, safety-bypass requests, template-marker spoofing, typoglycemia-scrambled variants, and base64-smuggled payloads. Flagged messages are replaced with a neutral withholding note; the model naturally tells the user the message couldn't be delivered and continues with the task. Detection is heuristic (patterns inspired by the OWASP LLM Prompt Injection Prevention Cheat Sheet) and runs entirely offline — no model call, no keys.",
+  "icon": "shield-exclamation",
+  "category": "messages",
+  "inputs": [
+    {
+      "name": "messages",
+      "display_name": "Messages",
+      "type": "conversation",
+      "description": "Array of message objects to scan. Only user-role messages are analyzed; assistant, tool, and system messages pass through untouched.",
+      "required": true
+    }
+  ],
+  "outputs": [
+    {
+      "name": "messages",
+      "display_name": "Messages",
+      "type": "conversation",
+      "description": "The conversation with any flagged user messages replaced by the injection notice"
+    },
+    {
+      "name": "flagged_count",
+      "display_name": "Flagged Count",
+      "type": "number",
+      "description": "Number of user messages that were flagged and replaced in this pass"
+    }
+  ],
+  "settings": [
+    {
+      "name": "notice",
+      "display_name": "Notice",
+      "type": "string",
+      "description": "Custom replacement text for withheld messages. Leave unset to use the built-in neutral withholding note. Avoid instructional or authority-claiming text — models treat user-role commands from a claimed security layer as suspect.",
+      "required": false
+    }
+  ]
+}

package/nodes/prompt-injection-guard/prompt-injection-guard.process.js

@@ -0,0 +1,269 @@
+// Heuristic prompt-injection detector. Patterns and layering follow the
+// OWASP LLM Prompt Injection Prevention Cheat Sheet: normalization to
+// defeat trivial obfuscation, direct-injection pattern families, fuzzy
+// token matching for typoglycemia-scrambled variants, and decoding of
+// base64 runs to catch encoding-smuggled payloads. Detection is
+// deliberately conservative — patterns require an instruction aimed at
+// the assistant, not mere mention of a keyword — because a false
+// positive silently eats a legitimate user message.
+
+// The replacement text is deliberately a neutral, third-person
+// withholding note — no channel markers, no meta-authority framing,
+// no instructions aimed at the model. A user-role message that
+// *commands* the model while claiming to be a security layer reads
+// exactly like an injection itself; live A/B against Claude models
+// showed the instructional variant triggering "this looks like a
+// simulated system prompt" skepticism, while this neutral note gets
+// a clean "your message couldn't be delivered, please rephrase"
+// response. The marker prefix doubles as the idempotency check.
+const NOTICE_MARKER = "(Message withheld:";
+
+const DEFAULT_NOTICE =
+  NOTICE_MARKER +
+  " this workspace's prompt-injection filter flagged the original" +
+  " content of this message, so it was not delivered. The original" +
+  " text is unavailable.)";
+
+// ── Normalization ──────────────────────────────────────────────────
+// NFKC folds fullwidth/compatibility characters, invisible characters
+// are stripped (zero-width joiners are a documented smuggling channel),
+// then casefold + whitespace collapse so patterns see one canonical
+// form regardless of spacing or capitalization games.
+
+const INVISIBLE_CHARS = /[\u00AD\u200B\u200C\u200D\u2060\uFEFF]/g;
+
+function normalize(text) {
+  return text
+    .normalize("NFKC")
+    .replace(INVISIBLE_CHARS, "")
+    .toLowerCase()
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+// ── Pattern families ───────────────────────────────────────────────
+// All patterns run against normalized text (lowercase, single-spaced).
+
+const PATTERNS = [
+  // Instruction override: "ignore all previous instructions", ...
+  /(ignore|disregard|forget|discard|overrule|override)\s((all|any|the|your|my|every|each)\s)*((previous|prior|earlier|above|preceding|original|initial|system|these|those)\s)+(instructions?|prompts?|rules?|directives?|guidelines?|context|messages?|programming|training|constraints?)/,
+  // "ignore everything above" / "forget your training"
+  /(ignore|disregard)\severything\s(above|before|else|prior)/,
+  /forget\s(all\s)?(your|the)\s(instructions?|rules?|training|programming|guidelines?)/,
+  // Replacement-instruction framing: "your new instructions are:"
+  /(new|updated|revised|real|actual|true)\s(system\s)?(instructions?|prompt|rules?|directives?)\s*(:|are\s|follow)/,
+  // Spoofed template / role markers: "[system]", "<sys>", "[INST]"
+  /(\[|<)\s*\/?\s*(system|sys|inst)\s*(\]|>)/,
+  // Jailbreak personas aimed at the assistant
+  /(you\sare\snow|you're\snow|youre\snow|from\snow\son\syou\sare)\s((in|into|the)\s)?(developer|dev|god|dan|jailbreak|jailbroken|unrestricted|unfiltered|admin|root)\s?mode/,
+  /\bdan\smode\b|\bdo\sanything\snow\b|\bact\sas\sdan\b|\bjailbreak\smode\b|\bjailbroken\b/,
+  /you\sare\s(now\s)?dan\b/,
+  // No-rules role hijack
+  /pretend\s(that\s)?(you|there)\s(are|have|were)\sno\s(rules?|restrictions?|guidelines?|limits?|filters?)/,
+  /you\shave\sno\s(rules?|restrictions?|guidelines?|limits?|filters?)/,
+  /(act|behave|respond|answer|reply)\s(as\sif\s)?([a-z']+\s){0,4}without\s(any\s)?(rules?|restrictions?|filters?|limitations?|guidelines?|censorship)/,
+  // System-prompt extraction (requires a system/hidden-style qualifier
+  // so "repeat the instructions for the recipe" stays clean)
+  /(reveal|show|print|display|output|repeat|recite|share|expose|leak|paste)\s(me\s)?(your|the)\s([a-z]+\s){0,2}system\s(prompt|instructions?|message)/,
+  /(reveal|show|print|display|output|repeat|recite|share|expose|leak|paste)\s(me\s)?(your|the)\s(hidden|initial|original|secret|internal|exact|full|complete|entire)\s(prompt|instructions?)/,
+  /(what\sis|what's|whats|tell\sme)\s(your|the)\s([a-z]+\s){0,2}system\s(prompt|instructions?|message)/,
+  /repeat\s(the\s)?(text|words?|everything|content|message)\s(above|before)/,
+  /starting\swith\s["']?(you\sare|i\sam)/,
+  // Safety-bypass requests
+  /(bypass|disable|remove|deactivate|circumvent|evade)\s((all|any|the|your)\s)*(safety|security|content|ethical|moral|alignment)\s?(measures?|filters?|checks?|guardrails?|guidelines?|restrictions?|protocols?|rules?|systems?)/,
+  /turn\soff\s((all|any|the|your)\s)*(safety|security|content)\s?(measures?|filters?|checks?|guardrails?|restrictions?)/,
+];
+
+// ── Typoglycemia layer ─────────────────────────────────────────────
+// Scrambled-middle attacks ("ignroe all prevoius systme instructions")
+// keep the first and last letters intact. Per OWASP, use an
+// established string metric rather than ad-hoc scramble detection:
+// restricted Damerau-Levenshtein (optimal string alignment), bounded
+// by 1 for short words and 2 for longer ones, gated on matching
+// first + last characters and near-equal length.
+
+function osaDistance(a, b) {
+  const al = a.length;
+  const bl = b.length;
+  const d = [];
+  for (let i = 0; i <= al; i++) d.push([i, ...new Array(bl).fill(0)]);
+  for (let j = 0; j <= bl; j++) d[0][j] = j;
+  for (let i = 1; i <= al; i++) {
+    for (let j = 1; j <= bl; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      d[i][j] = Math.min(
+        d[i - 1][j] + 1,
+        d[i][j - 1] + 1,
+        d[i - 1][j - 1] + cost
+      );
+      if (
+        i > 1 &&
+        j > 1 &&
+        a[i - 1] === b[j - 2] &&
+        a[i - 2] === b[j - 1]
+      ) {
+        d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+      }
+    }
+  }
+  return d[al][bl];
+}
+
+function wordMatches(word, target) {
+  if (word === target) return true;
+  if (word.length < 4 || target.length < 4) return false;
+  if (word[0] !== target[0]) return false;
+  if (word[word.length - 1] !== target[target.length - 1]) return false;
+  if (Math.abs(word.length - target.length) > 1) return false;
+  const threshold = target.length > 6 ? 2 : 1;
+  return osaDistance(word, target) <= threshold;
+}
+
+// Each sequence is a list of slots; a slot matches when any of its
+// target words fuzzy-matches the token. Up to two filler tokens are
+// allowed between consecutive slots ("ignore all of the previous
+// instructions" still matches slot-to-slot).
+const FUZZY_SEQUENCES = [
+  [
+    ["ignore", "disregard", "forget"],
+    ["previous", "prior", "earlier", "system", "above", "original"],
+    ["instructions", "instruction", "prompt", "prompts", "rules", "directives", "guidelines"],
+  ],
+  [
+    ["bypass", "disable", "circumvent"],
+    ["safety", "security", "content"],
+    ["filters", "filter", "measures", "checks", "guardrails", "restrictions"],
+  ],
+  [
+    ["reveal", "show", "repeat", "print", "display"],
+    ["system"],
+    ["prompt", "instructions", "message"],
+  ],
+];
+
+const MAX_FILLER_TOKENS = 2;
+
+function matchesFuzzySequence(tokens, sequence) {
+  for (let start = 0; start < tokens.length; start++) {
+    let slotIndex = 0;
+    let i = start;
+    let fillersLeft = MAX_FILLER_TOKENS;
+    while (i < tokens.length && slotIndex < sequence.length) {
+      const slot = sequence[slotIndex];
+      if (slot.some((target) => wordMatches(tokens[i], target))) {
+        slotIndex++;
+        fillersLeft = MAX_FILLER_TOKENS;
+      } else if (slotIndex > 0) {
+        if (fillersLeft === 0) break;
+        fillersLeft--;
+      } else {
+        break;
+      }
+      i++;
+    }
+    if (slotIndex === sequence.length) return true;
+  }
+  return false;
+}
+
+// ── Base64 smuggling layer ─────────────────────────────────────────
+// Long base64 runs get decoded and re-checked against the exact
+// pattern list. Arbitrary base64 (file payloads, ids) that doesn't
+// decode to an injection never flags.
+
+const BASE64_RUN = /[A-Za-z0-9+/]{24,}={0,2}/g;
+
+function decodedBase64Hits(rawText) {
+  const runs = rawText.match(BASE64_RUN);
+  if (!runs) return false;
+  for (const run of runs) {
+    let decoded;
+    try {
+      decoded = Buffer.from(run, "base64").toString("utf8");
+    } catch {
+      continue;
+    }
+    if (decoded.length === 0) continue;
+    let printable = 0;
+    for (const ch of decoded) {
+      const code = ch.codePointAt(0);
+      if ((code >= 0x20 && code < 0x7f) || code === 0x09 || code === 0x0a || code === 0x0d) {
+        printable++;
+      }
+    }
+    if (printable / decoded.length < 0.8) continue;
+    const norm = normalize(decoded);
+    if (PATTERNS.some((p) => p.test(norm))) return true;
+  }
+  return false;
+}
+
+// ── Detection entry point ──────────────────────────────────────────
+
+function isInjection(rawText) {
+  const norm = normalize(rawText);
+  if (norm.length === 0) return false;
+  if (PATTERNS.some((p) => p.test(norm))) return true;
+  const tokens = norm.split(/[^a-z0-9']+/).filter((t) => t.length > 0);
+  if (FUZZY_SEQUENCES.some((seq) => matchesFuzzySequence(tokens, seq))) {
+    return true;
+  }
+  return decodedBase64Hits(rawText);
+}
+
+/** Pull the scannable text out of a message's content — plain string,
+ *  or the concatenated text parts of a multimodal array. */
+function extractText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    const parts = [];
+    for (const part of content) {
+      if (part && typeof part === "object" && part.type === "text" && typeof part.text === "string") {
+        parts.push(part.text);
+      }
+    }
+    return parts.join("\n");
+  }
+  return "";
+}
+
+export default async ({ inputs, settings }) => {
+  const messages = inputs.messages;
+
+  if (!Array.isArray(messages)) {
+    throw new Error("Messages input must be an array");
+  }
+
+  const notice =
+    typeof settings?.notice === "string" && settings.notice.trim().length > 0
+      ? settings.notice
+      : DEFAULT_NOTICE;
+
+  const result = [];
+  let flaggedCount = 0;
+
+  for (const message of messages) {
+    if (!message || typeof message !== "object" || message.role !== "user") {
+      result.push(message);
+      continue;
+    }
+    const text = extractText(message.content);
+    // Already-withheld messages (our own notice re-entering via
+    // conversation history) are never re-scanned — keeps the node
+    // idempotent across turns.
+    if (text.startsWith(NOTICE_MARKER) || !isInjection(text)) {
+      result.push(message);
+      continue;
+    }
+    // Replace the entire content — for multimodal messages the
+    // non-text parts are withheld too, since an image can carry the
+    // payload the flagged text was priming.
+    result.push({ ...message, content: notice });
+    flaggedCount++;
+  }
+
+  return {
+    messages: result,
+    flagged_count: flaggedCount,
+  };
+};