@zivis/mcp 0.1.8 → 0.1.11

package/dist/pattern-packs/zivis-public-0.2.0/prompts/retrieval/context-injection-no-validator/identify.md

@@ -0,0 +1,109 @@
+# Inference prompt: retrieval.context-injection-no-validator — identify
+
+You are reviewing code that appears to implement retrieval-augmented
+generation (RAG): a retriever returns documents and an LLM call consumes
+them. The pattern flagged by ZIVIS suggests there is no validator,
+sanitizer, or source-attribution check between the retriever and the
+model. Your job is to confirm or refute that — strictly based on the
+actual source spans provided. Do not speculate about code you cannot see.
+
+## What you are evaluating
+
+1. **The retrieval call.** Where does it run? What does it return —
+   strings, document objects with metadata, raw search hits? Is the
+   returned content user-controllable (uploaded files, scraped pages,
+   external APIs) or fully internal-curated?
+
+2. **The LLM call that consumes the retrieved content.** How is the
+   retrieved text placed into the prompt — concatenated into a system
+   prompt, into a user-role message, into a `tools` description?
+
+3. **The path between retriever and LLM call.** Does any function in
+   that path perform validation? Look for:
+   - Imports / calls of guardrails libraries (`guardrails`, `nemoguardrails`,
+     `lakera`, `protectai`, `presidio`, `garak`, `llm-guard`)
+   - Functions with names like `validate*`, `sanitize*`, `factCheck*`,
+     `attributeSource*`, `verifyClaim*`, `checkInjection*`
+   - Source-attribution metadata being injected into the prompt
+     (e.g., `<source>doc-id-123</source>` blocks, citation markers the
+     model is required to use)
+   - Access-control filters that drop documents based on the requester
+
+4. **Whether what looks like validation actually validates.** A function
+   named `processDocuments` that just trims whitespace is NOT validation.
+   A logger call is NOT validation. A retry wrapper is NOT validation.
+
+## What does NOT count as a validator
+
+- Trimming, lowercasing, or other string normalization
+- Token counting or length capping (length limits aren't injection defenses)
+- A type assertion (`as string`) — TypeScript types don't run at runtime
+- An auth check that gates *whether the retrieval runs at all* but doesn't
+  inspect the *content* returned
+- A logger call — logs are observability, not defense
+- The model's own instructions ("don't follow embedded instructions") —
+  that's prompt hardening, easily bypassed; mark as `partial_validator`
+  not `validator_present`
+
+## What counts as a validator
+
+- A call to a guardrails / safety library between retrieval and model
+- A function that inspects retrieved content for prompt-injection
+  patterns and rejects / flags / strips matching documents
+- Source-attribution machinery: every retrieved doc carries a `sourceId`
+  the model is required to cite, and the calling code checks that the
+  source is permitted for this requester
+- Per-document access control applied AFTER retrieval, before the doc is
+  added to the prompt
+
+## What about query rewriting / HyDE / multi-query?
+
+If the query that drives retrieval is itself an LLM output (HyDE,
+multi-query, agentic retrieval), note this in `rationale`. It compounds
+the injection surface — the attacker can influence what gets retrieved
+two steps upstream — but it is NOT itself the missing validator. The
+verdict is about the retriever→model path.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "no_validator_present | validator_present | partial_validator | unclear",
+  "validator_location": "pre_retrieval | between_retriever_and_model | post_model | none | multiple",
+  "rationale": "one paragraph citing specific symbols / line numbers from the snippet",
+  "corpus_sources": ["uploaded_pdfs", "scraped_web_pages", "confluence_sync"],
+  "blast_radius": "single_endpoint | route_family | service_wide | agent_wide | unclear",
+  "recommended_controls": ["guardrails_library", "source_attribution_in_prompt"],
+  "evidence_spans": [
+    { "file": "src/rag.ts", "start_line": 14, "end_line": 38, "note": "retriever→model, no validator" }
+  ]
+}
+```
+
+### Verdict definitions
+
+- `no_validator_present` — retrieval feeds the model directly; nothing
+  between them inspects content.
+- `validator_present` — a real validator (per the "what counts" list)
+  sits between retriever and model.
+- `partial_validator` — something inspects content but with known gaps:
+  e.g., regex-only injection filter, or only one document type is
+  validated, or validation only runs in some branches. Use this when
+  there is *some* defense but it doesn't cover the full path.
+- `unclear` — the snippet doesn't show enough of the path to determine.
+  Don't guess. Surface what you'd need to see to decide.
+
+### Blast-radius guidance
+
+- `single_endpoint` — one route handler.
+- `route_family` — a helper / chain reused across a router.
+- `service_wide` — the retrieval helper is the shared way the service
+  answers questions.
+- `agent_wide` — an agent's tool-use path itself runs through this
+  retriever (more dangerous: agent can iterate on injections).
+
+Cite line numbers and symbol names from the snippet only. Do not invent
+files. If a control is named in code but you can't see its
+implementation, mark `unclear` and note which file you'd need.

package/dist/pattern-packs/zivis-public-0.2.0/prompts/security/late-org-filter/identify.md

@@ -0,0 +1,78 @@
+# Inference prompt: security.late-org-filter — identify
+
+You are reviewing a multi-tenant route handler, stream, or async iterator
+that has been flagged as *possibly* applying tenant scoping at the
+presentation layer rather than inside the data query. The pattern is one of
+the most common causes of cross-tenant data leaks in SaaS systems. Your job
+is to determine where in the stack the org/tenant filter actually lives.
+
+## What you are evaluating
+
+1. Where does the query that returns rows execute? Identify the call (raw
+   SQL, ORM method, repository call, fetch, etc.). Does its `WHERE` /
+   `where:` / equivalent clause include an org / tenant predicate?
+2. Where does the filter referencing `request.orgId` (or a session-scoped
+   tenant id) fire? In the query, in a middleware, in the response loop,
+   in the stream emit?
+3. Is there a row-level security policy, ORM middleware, or repository
+   pattern that *implicitly* scopes every query — even queries that don't
+   themselves mention tenant?
+4. For SSE / stream / async iterator responses: does the filter run per
+   emit, before any logging, tracing, or buffering hook?
+5. Does any logging or observability hook capture the row set BEFORE the
+   filter applies?
+
+## What does NOT count as data-layer scoping
+
+- A presentation-layer filter that "looks like" it's inside the query just
+  because it sits in the same function body. Trace where the SQL actually
+  runs.
+- A comment claiming the ORM is org-scoped without code enforcing it.
+- A type system that makes "OrgScopedQuery<T>" but is never actually
+  required at the call site.
+- An auth middleware that *checks* the user can access the org but does
+  not constrain what rows the subsequent query returns.
+
+## What counts as data-layer scoping
+
+- A `WHERE org_id = $1` (or equivalent) inside the query itself.
+- Postgres row-level security with a session GUC the connection sets.
+- Prisma extension / SQLAlchemy event listener / ORM middleware that
+  appends the predicate.
+- Repository pattern where the `findByX(ctx)` method takes the org from
+  `ctx` and mandates the predicate.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "late_filter_present | scoped_at_query | partial_scope | unclear",
+  "scope_location": "data_layer | query_layer | presentation_layer | multiple | none",
+  "rationale": "one paragraph",
+  "blast_radius": "single_endpoint | route_family | service_wide | unclear",
+  "recommended_controls": ["row_level_security", "query_helper"],
+  "evidence_spans": [
+    { "file": "routes/queue.ts", "start_line": 18, "end_line": 60, "note": "..." }
+  ]
+}
+```
+
+- `late_filter_present` — the query returns cross-tenant rows; the only
+  enforcement is at the response/emit layer.
+- `scoped_at_query` — the query itself filters by org/tenant; presentation
+  filter (if any) is defense in depth.
+- `partial_scope` — *some* queries are scoped at the data layer but at
+  least one in the path is not.
+- `unclear` — query plumbing crosses too many layers to determine from the
+  snippet. Don't guess.
+
+For `blast_radius`: estimate based on whether the unscoped query helper is
+used elsewhere. `service_wide` if the helper / repository method is shared
+across many routes; `route_family` if reused inside the same router;
+`single_endpoint` if isolated.
+
+Cite line numbers from the snippet only. Do not invent files. If a control
+(e.g. "RLS") is mentioned but you can't see the policy text, mark
+`unclear` and explain.

package/dist/project-binding.d.ts

@@ -1,25 +1,8 @@
-/**
- * Project Binding
- *
- * Detects and validates `.zivis/project.json` files that bind a project
- * directory to a specific ZIVIS session/org. This prevents accidentally
- * using the wrong org's MCP connection in a project.
- *
- * The binding file is optional — if absent, the server starts normally.
- * If present, the configured ZIVIS_SESSION must match the binding's
- * session field or the server refuses to start.
- */
 import type { ProjectBinding, ZivisConfig } from "./types.js";
-/**
- * Walk up from `cwd` looking for `.zivis/project.json`.
- * Returns the parsed binding or null if not found.
- */
 export declare function detectProjectBinding(cwd: string): {
     binding: ProjectBinding;
     filePath: string;
 } | null;
-/**
- * Validate that the project binding matches the current MCP session.
- * Exits with code 1 on mismatch.
- */
+export declare function resolveConfigFromBinding(cwd?: string): ZivisConfig;
+export declare function resolveMcpSessionForWorkspace(incoming: ZivisConfig, workspacePath: string, detected: ReturnType<typeof detectProjectBinding>, fromBinding: ZivisConfig): string;
 export declare function validateProjectBinding(binding: ProjectBinding, filePath: string, config: ZivisConfig): void;

package/dist/project-binding.js

@@ -1,22 +1,8 @@
-/**
- * Project Binding
- *
- * Detects and validates `.zivis/project.json` files that bind a project
- * directory to a specific ZIVIS session/org. This prevents accidentally
- * using the wrong org's MCP connection in a project.
- *
- * The binding file is optional — if absent, the server starts normally.
- * If present, the configured ZIVIS_SESSION must match the binding's
- * session field or the server refuses to start.
- */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { DEFAULT_CONFIG } from "./types.js";
 const BINDING_DIR = ".zivis";
 const BINDING_FILE = "project.json";
-/**
- * Walk up from `cwd` looking for `.zivis/project.json`.
- * Returns the parsed binding or null if not found.
- */
 export function detectProjectBinding(cwd) {
     let dir = path.resolve(cwd);
     const root = path.parse(dir).root;
@@ -41,12 +27,44 @@ export function detectProjectBinding(cwd) {
     }
     return null;
 }
-/**
- * Validate that the project binding matches the current MCP session.
- * Exits with code 1 on mismatch.
- */
+export function resolveConfigFromBinding(cwd) {
+    const detected = detectProjectBinding(cwd ?? process.cwd());
+    if (!detected)
+        return DEFAULT_CONFIG;
+    const { binding } = detected;
+    return {
+        ...DEFAULT_CONFIG,
+        ...(binding.session ? { session: binding.session } : {}),
+        ...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
+        ...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
+        ...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
+        ...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
+        ...(binding.configDir ? { configDir: binding.configDir } : {}),
+    };
+}
+export function resolveMcpSessionForWorkspace(incoming, workspacePath, detected, fromBinding) {
+    const envSession = process.env.ZIVIS_SESSION?.trim();
+    if (envSession !== undefined && envSession !== "") {
+        if (envSession === "default" &&
+            detected?.binding.session &&
+            detected.binding.session !== "default") {
+            return detected.binding.session;
+        }
+        return envSession;
+    }
+    if (detected?.binding.session) {
+        return detected.binding.session;
+    }
+    if (incoming.session !== undefined && incoming.session !== "") {
+        return incoming.session;
+    }
+    if (fromBinding.session) {
+        return fromBinding.session;
+    }
+    return "default";
+}
 export function validateProjectBinding(binding, filePath, config) {
-    const currentSession = config.session || "default";
+    const currentSession = config.session ?? "default";
     const expectedSession = binding.session;
     if (currentSession !== expectedSession) {
         const orgLabel = binding.orgName
@@ -64,4 +82,3 @@ export function validateProjectBinding(binding, filePath, config) {
     const orgLabel = binding.orgName ? ` (${binding.orgName})` : "";
     console.error(`[zivis] Project binding verified: session "${expectedSession}"${orgLabel}`);
 }
-//# sourceMappingURL=project-binding.js.map

package/dist/prompts/audit-dependencies.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAuditDependenciesPrompt(server: McpServer): void;

package/dist/prompts/audit-dependencies.js

@@ -0,0 +1,47 @@
+export function registerAuditDependenciesPrompt(server) {
+    server.registerPrompt("audit-dependencies", {
+        description: "Check the open source libraries this project depends on for security risks. No account setup needed.",
+        argsSchema: {},
+    }, async () => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `I want to check whether the open source libraries I'm using are safe.
+
+Please do the following:
+
+1. Look at the dependency files in this project. In priority order, check:
+   - package.json (look for the "dependencies" and "devDependencies" keys)
+   - requirements.txt or pyproject.toml
+   - go.mod
+   - Any other manifest files you can see
+
+2. From those files, find all external dependencies that have a GitHub repository.
+   - Skip internal packages (those starting with "@my-company/" or similar private namespaces).
+   - Skip built-in packages (e.g. node built-ins like "fs", "path").
+
+3. For each external dependency that has a public GitHub repo, call \`zivis_check_repo_trust\`
+   with the owner/repo string (e.g. "openai/openai-node").
+
+4. After checking each one, give me a summary table with columns:
+   - Package name
+   - Trust grade (A+ through F)
+   - Risk level (Safe / Low risk / Moderate / High / Critical)
+   - Any critical or high findings (one line each)
+
+5. Flag any package with grade C or below and explain in plain English why it's risky.
+
+6. At the end, suggest the two highest-priority actions to take based on the results.
+
+Ground rules:
+- Process dependencies one at a time so I can follow along.
+- If a package doesn't have a GitHub repo, skip it and say "(no GitHub repo found)".
+- Don't make up trust data — only use what zivis_check_repo_trust returns.
+- Speak in plain English. "High risk" is better than "critical severity threat vector".`,
+                },
+            },
+        ],
+    }));
+}

package/dist/prompts/getting-started.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerGettingStartedPrompt(server: McpServer): void;

package/dist/prompts/getting-started.js

@@ -0,0 +1,37 @@
+export function registerGettingStartedPrompt(server) {
+    server.registerPrompt("getting-started", {
+        description: "Walk me through ZIVIS for this project. Use this if you're new or unsure what to test.",
+        argsSchema: {},
+    }, async () => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: `I want to use ZIVIS for security on this project but I'm not sure where to start.
+
+Please do the following, in order:
+
+1. Call \`zivis_check_project\` (no arguments) to confirm the project is connected correctly.
+   - If it returns any problems, explain them in plain English and tell me the exact terminal command to run to fix them. Stop here and wait for me.
+   - If it's OK, continue to step 2.
+
+2. Call \`zivis_get_started\` (no arguments).
+
+3. Present the \`recommended_next_steps\` from the response as a numbered list.
+   - Use the \`label\` as the item text.
+   - Add one sentence from the \`why\` field below each item.
+   - Do NOT invent additional steps or add security advice of your own.
+
+4. Ask me which number I want to do. Wait for my answer before calling anything else.
+
+Ground rules for this conversation:
+- I'm a developer, not a security person. Speak plainly.
+- Avoid these words unless I use them first: "actor", "attack vector", "threat model", "STRIDE", "kill chain", "TTPs".
+- Use plain alternatives: "tester", "how someone might break in", "security plan", "types of attacks".
+- If I seem unsure which option to pick, suggest the one flagged as \`if_user_unsure\` in the response.`,
+                },
+            },
+        ],
+    }));
+}

package/dist/prompts/index.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAllPrompts(server: McpServer): void;

package/dist/prompts/index.js

@@ -0,0 +1,6 @@
+import { registerGettingStartedPrompt } from "./getting-started.js";
+import { registerAuditDependenciesPrompt } from "./audit-dependencies.js";
+export function registerAllPrompts(server) {
+    registerGettingStartedPrompt(server);
+    registerAuditDependenciesPrompt(server);
+}

package/dist/redact.d.ts

@@ -0,0 +1,30 @@
+export interface RedactionFinding {
+    rule: string;
+    path: string;
+}
+export interface RedactionReport {
+    redacted: boolean;
+    count: number;
+    byRule: Record<string, number>;
+    findings: RedactionFinding[];
+}
+interface RedactRule {
+    id: string;
+    regex: RegExp;
+    secretGroup?: number;
+}
+export declare const REDACTION_RULES: readonly RedactRule[];
+export declare function redactString(input: string, report?: RedactionReport, path?: string): {
+    text: string;
+    report: RedactionReport;
+};
+export declare const SENSITIVE_KEY_NAMES: ReadonlySet<string>;
+export interface RedactOptions {
+    maxDepth?: number;
+}
+export declare function redactValue<T>(value: T, opts?: RedactOptions): {
+    value: T;
+    report: RedactionReport;
+};
+export declare function redactEvidence<T>(value: T): T;
+export {};

package/dist/redact.js

@@ -0,0 +1,164 @@
+function emptyReport() {
+    return { redacted: false, count: 0, byRule: {}, findings: [] };
+}
+function record(report, rule, path) {
+    report.redacted = true;
+    report.count += 1;
+    report.byRule[rule] = (report.byRule[rule] ?? 0) + 1;
+    report.findings.push({ rule, path });
+}
+const MASK = (id) => `[REDACTED:${id}]`;
+export const REDACTION_RULES = [
+    {
+        id: "auth-header",
+        regex: /^([ \t]*(?:authorization|proxy-authorization|www-authenticate|cookie|set-cookie|x-api-key|x-apikey|x-auth-token|x-access-token|x-session-token|x-refresh-token|x-amz-security-token|api-key|apikey)[ \t]*:[ \t]*)(.+)$/gim,
+        secretGroup: 2,
+    },
+    { id: "bearer-token", regex: /\b(Bearer[ \t]+)([A-Za-z0-9._~+/=-]{8,})/gi, secretGroup: 2 },
+    { id: "basic-auth", regex: /\b(Basic[ \t]+)([A-Za-z0-9+/=]{8,})/gi, secretGroup: 2 },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    {
+        id: "private-key",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    { id: "jwt", regex: /\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g },
+    { id: "aws-access-key-id", regex: /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g },
+    {
+        id: "aws-secret-access-key",
+        regex: /(aws_?secret_?access_?key["' ]*[=:]["' ]*)([A-Za-z0-9/+=]{40})/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "azure-storage-key",
+        regex: /(AccountKey=)([A-Za-z0-9+/=]{40,})/gi,
+        secretGroup: 2,
+    },
+    { id: "google-api-key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: "github-token", regex: /\bgh[pousr]_[A-Za-z0-9_]{36,}\b/g },
+    { id: "slack-token", regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}/g },
+    { id: "slack-webhook", regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g },
+    { id: "stripe-key", regex: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+    { id: "sendgrid-key", regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g },
+    { id: "npm-token", regex: /\bnpm_[A-Za-z0-9]{36}\b/g },
+    { id: "anthropic-key", regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    { id: "openai-key", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    {
+        id: "connection-string-password",
+        regex: /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqps?|https?):\/\/[^:@/\s]+:)([^@/\s]+)(@)/gi,
+        secretGroup: 2,
+    },
+    {
+        id: "generic-secret-assignment",
+        regex: /\b(password|passwd|pwd|secret|client[_-]?secret|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|auth[_-]?token|session[_-]?token|private[_-]?key|passphrase)\b(["' ]*[=:]["' ]*)([^\s"',;&})]{6,})/gi,
+        secretGroup: 3,
+    },
+];
+export function redactString(input, report = emptyReport(), path = "") {
+    if (typeof input !== "string" || input.length === 0) {
+        return { text: input, report };
+    }
+    let text = input;
+    for (const rule of REDACTION_RULES) {
+        if (rule.secretGroup === undefined) {
+            text = text.replace(rule.regex, () => {
+                record(report, rule.id, path);
+                return MASK(rule.id);
+            });
+        }
+        else {
+            const g = rule.secretGroup;
+            text = text.replace(rule.regex, (match, ...groups) => {
+                const secret = groups[g - 1];
+                if (secret === undefined || secret === "")
+                    return match;
+                record(report, rule.id, path);
+                const idx = match.lastIndexOf(String(secret));
+                if (idx < 0)
+                    return MASK(rule.id);
+                return match.slice(0, idx) + MASK(rule.id) + match.slice(idx + String(secret).length);
+            });
+        }
+    }
+    return { text, report };
+}
+export const SENSITIVE_KEY_NAMES = new Set([
+    "authorization",
+    "proxyauthorization",
+    "cookie",
+    "setcookie",
+    "xapikey",
+    "xauthtoken",
+    "xaccesstoken",
+    "xsessiontoken",
+    "xrefreshtoken",
+    "xamzsecuritytoken",
+    "apikey",
+    "apitoken",
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "secret",
+    "clientsecret",
+    "secretkey",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "idtoken",
+    "authtoken",
+    "sessiontoken",
+    "sessionid",
+    "session",
+    "privatekey",
+    "credential",
+    "credentials",
+    "bearer",
+    "auth",
+].map((k) => k.replace(/[-_]/g, "")));
+function normalizeKey(key) {
+    return key.toLowerCase().replace(/[-_]/g, "");
+}
+export function redactValue(value, opts = {}) {
+    const report = emptyReport();
+    const maxDepth = opts.maxDepth ?? 64;
+    const seen = new WeakSet();
+    const walk = (node, path, depth, underSensitiveKey) => {
+        if (node === null || node === undefined)
+            return node;
+        if (typeof node === "string") {
+            if (underSensitiveKey) {
+                if (node.length > 0) {
+                    record(report, "sensitive-key", path);
+                    return MASK("sensitive-key");
+                }
+                return node;
+            }
+            return redactString(node, report, path).text;
+        }
+        if (typeof node !== "object")
+            return node;
+        if (seen.has(node))
+            return "[CYCLE]";
+        if (depth >= maxDepth)
+            return node;
+        seen.add(node);
+        if (Array.isArray(node)) {
+            return node.map((item, i) => walk(item, `${path}[${i}]`, depth + 1, underSensitiveKey));
+        }
+        const out = {};
+        for (const [key, v] of Object.entries(node)) {
+            const childPath = path ? `${path}.${key}` : key;
+            const sensitive = underSensitiveKey || SENSITIVE_KEY_NAMES.has(normalizeKey(key));
+            out[key] = walk(v, childPath, depth + 1, sensitive);
+        }
+        return out;
+    };
+    const redacted = walk(value, "", 0, false);
+    return { value: redacted, report };
+}
+export function redactEvidence(value) {
+    return redactValue(value).value;
+}

package/dist/resolve-application-id.d.ts

@@ -1,7 +1,3 @@
-/**
- * Default `application_id` tool arguments from `.zivis/project.json` when the
- * user omits the parameter (optional `applicationId` on ProjectBinding).
- */
 export declare function resolveApplicationId(explicit: string | undefined, cwd?: string): string | undefined;
 export declare function requireApplicationId(explicit: string | undefined, cwd?: string): {
     ok: true;

package/dist/resolve-application-id.js

@@ -1,7 +1,3 @@
-/**
- * Default `application_id` tool arguments from `.zivis/project.json` when the
- * user omits the parameter (optional `applicationId` on ProjectBinding).
- */
 import { detectProjectBinding } from "./project-binding.js";
 export function resolveApplicationId(explicit, cwd = process.cwd()) {
     const t = explicit?.trim();
@@ -18,4 +14,3 @@ export function requireApplicationId(explicit, cwd = process.cwd()) {
         message: "application_id is required, or set applicationId in .zivis/project.json for this workspace.",
     };
 }
-//# sourceMappingURL=resolve-application-id.js.map

package/dist/sanitize.d.ts

@@ -1,23 +1,3 @@
-/**
- * Response Sanitization — Prompt Injection Defense
- *
- * Sanitizes API response data before returning it to the AI assistant.
- * Finding content (titles, descriptions, code snippets, remediation text)
- * is untrusted data from automated scanners and external vulnerability
- * databases. This layer strips common injection patterns.
- *
- * Defense layers:
- * 1. Strip non-printable / control characters
- * 2. Truncate field lengths
- * 3. Strip common LLM prompt injection patterns
- * 4. Encode suspicious formatting
- */
-/**
- * Sanitize a single string field
- */
+export declare function sanitizeInboundText(value: string | undefined, maxLength: number): string | undefined;
 export declare function sanitizeField(value: string, fieldName?: string): string;
-/**
- * Recursively sanitize all string fields in an object.
- * Handles nested objects and arrays.
- */
 export declare function sanitizeResponse<T>(data: T): T;