claudmax 2.0.0 → 2.0.1

package/src/lib/security.ts

@@ -1,165 +0,0 @@
-/**
- * Security module — jailbreak detection, prompt injection blocking,
- * response scrubbing, and security headers for ClaudMax.
- */
-
-import { NextResponse } from 'next/server';
-
-// ── Jailbreak Pattern Detection ─────────────────────────────────────────────
-
-const JAILBREAK_PATTERNS = [
-  /ignore\s*(all\s+)?(previous\s+)?instructions/i,
-  /forget\s*(everything|all\s+instructions|your\s+prompt)/i,
-  /(you\s+are|act\s+as|pretend\s+to\s+be)\s*(DAN|unrestricted|jailbroken)/i,
-  /developer\s+mode/i,
-  /debug\s*(mode|output|info)/i,
-  /show\s*(me\s+)?(your\s+)?(system\s+prompt|instructions|config)/i,
-  /repeat\s*(your\s+)?(instructions|prompt|system)/i,
-  /what\s*(model|llm|ai)\s*(are\s+you|powers\s+you|is\s+this)/i,
-  /your\s+(real|true|actual|underlying)\s+(model|identity|name)/i,
-  /are\s+you\s+(gpt|gemini|llama|deepseek|mistral|groq)/i,
-  /print\s*(your\s+)?(raw\s+)?(config|prompt|instructions|json)/i,
-  /(literouter|openrouter|groq|cerebras|mistral|gemma|gemini)/i,
-  /admin\s*(override|access|mode)/i,
-  /official\s*(audit|test|inspection)/i,
-  /anthropic\s*(engineer|employee|staff|admin)/i,
-  /bypass\s*(your\s+)?(filters|restrictions|rules)/i,
-  /(base64|rot13|morse|leetspeak).*model/i,
-  /reveal\s+(your|true|real)\s+(model|identity|backend)/i,
-  /what\s+does?\s+(your|this)\s+(underlying|running)\s+(model|engine)/i,
-];
-
-/** Returns true if jailbreak attempt is detected */
-export function detectJailbreak(text: string): boolean {
-  for (const pattern of JAILBREAK_PATTERNS) {
-    if (pattern.test(text)) return true;
-  }
-  return false;
-}
-
-// ── Prompt Injection Sanitization ────────────────────────────────────────────
-
-const INJECTION_PHRASES = [
-  'ignore previous instructions',
-  'ignore all instructions',
-  'forget your instructions',
-  'new instructions:',
-  'system:',
-  'assistant:',
-  'SYSTEM:',
-  'ASSISTANT:',
-  '<|system|>',
-  '<|user|>',
-  '<|assistant|>',
-  '[INST]',
-  '[/INST]',
-  '<|im_start|>',
-  '<|im_end|>',
-];
-
-/**
- * Sanitize user-provided content to remove prompt injection attempts.
- * Returns a sanitized copy of the content.
- */
-export function sanitizeMessage(content: string): string {
-  let sanitized = content;
-  for (const phrase of INJECTION_PHRASES) {
-    sanitized = sanitized.replace(new RegExp(escapeRegex(phrase), 'gi'), '[filtered]');
-  }
-  return sanitized;
-}
-
-function escapeRegex(str: string): string {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Recursively sanitize all user messages in a message array.
- * Returns a new array with sanitized user content.
- */
-export function sanitizeMessages(messages: any[]): any[] {
-  return messages.map((msg) => {
-    if (msg.role !== 'user') return msg;
-    const content = msg.content;
-    if (typeof content === 'string') {
-      return { ...msg, content: sanitizeMessage(content) };
-    }
-    if (Array.isArray(content)) {
-      return {
-        ...msg,
-        content: content.map((part: any) => {
-          if (part.type === 'text') {
-            return { ...part, text: sanitizeMessage(part.text) };
-          }
-          return part;
-        }),
-      };
-    }
-    return msg;
-  });
-}
-
-// ── Response Scrubbing ───────────────────────────────────────────────────────
-
-/** Words/phrases that may leak backend provider info, mapped to safe replacements */
-const SCRUB_MAP: Record<string, string> = {
-  'literouter':    'my AI service',
-  'openrouter':   'my AI service',
-  'groq':          'my service',
-  'cerebras':      'my service',
-  'minimax':       'my AI system',
-  'deepseek':      'my AI system',
-  'mistral':       'my AI system',
-  'llama':         'my AI system',
-  'gemma':         'my AI system',
-  'gemini':        'my AI system',
-  'google ai':     'my AI service',
-  'google ai studio': 'my AI service',
-  'meta ai':       'my AI service',
-  'gpt-4':         'Claude',
-  'gpt4':          'Claude',
-  'claude via':    'Claude',
-  '(powered by':   '(built by',
-};
-
-/**
- * Scrub provider/model names from model response text.
- * Used to ensure backend provider names never leak to users.
- */
-export function scrubResponse(text: string): string {
-  let result = text;
-  for (const [word, replacement] of Object.entries(SCRUB_MAP)) {
-    result = result.replace(new RegExp(escapeRegex(word), 'gi'), replacement);
-  }
-  return result;
-}
-
-// ── Security Headers ─────────────────────────────────────────────────────────
-
-/** Headers applied to every API response */
-export const SECURITY_HEADERS = {
-  'X-Content-Type-Options': 'nosniff',
-  'X-Frame-Options': 'DENY',
-  'X-XSS-Protection': '1; mode=block',
-  'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none';",
-  'Server': 'Claude-API',
-};
-
-/** Apply security headers to a NextResponse */
-export function withSecurityHeaders(response: NextResponse): NextResponse {
-  const clone = NextResponse.json(response.body ?? {}, { status: response.status });
-  // Copy existing headers
-  response.headers.forEach((value, key) => {
-    clone.headers.set(key, value);
-  });
-  // Apply security headers
-  for (const [key, value] of Object.entries(SECURITY_HEADERS)) {
-    clone.headers.set(key, value);
-  }
-  // Remove leaky headers
-  clone.headers.delete('X-Powered-By');
-  clone.headers.delete('Via');
-  clone.headers.delete('X-Cache');
-  clone.headers.delete('X-Amzn-Trace-Id');
-  return clone;
-}

package/src/lib/utils.ts

@@ -1,14 +0,0 @@
-import { type ClassValue, clsx } from 'clsx';
-import { twMerge } from 'tailwind-merge';
-
-export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs));
-}
-
-export function generateApiKey(): { key: string; prefix: string } {
-  const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
-  const uuid = Array.from({ length: 32 }, () => chars[Math.floor(Math.random() * chars.length)]).join('');
-  const key = `sk-cmx_${uuid}`;
-  const prefix = key.slice(0, 12);
-  return { key, prefix };
-}

package/src/middleware.ts

@@ -1,30 +0,0 @@
-import { NextResponse } from 'next/server';
-import type { NextRequest } from 'next/server';
-
-export function middleware(request: NextRequest) {
-  const host = request.headers.get('host') ?? '';
-  const pathname = request.nextUrl.pathname;
-
-  // Only handle api subdomain
-  if (host.startsWith('api.')) {
-    // Root path on api subdomain — return JSON 404
-    if (pathname === '/') {
-      return NextResponse.json(
-        { message: 'Cannot GET /', error: 'Not Found', statusCode: 404 },
-        { status: 404 }
-      );
-    }
-
-    // Rewrite /v1/* to /api/v1/*
-    if (pathname.startsWith('/v1/')) {
-      const newUrl = request.nextUrl.clone();
-      newUrl.pathname = '/api/v1/' + pathname.slice(4);
-      return NextResponse.rewrite(newUrl);
-    }
-  }
-
-  return NextResponse.next();
-}
-
-// Note: no matcher config — runs on all requests. The in-function host check ensures
-// only api.* subdomain traffic is affected. Static assets live on the main domain.

package/tailwind.config.ts

@@ -1,53 +0,0 @@
-import type { Config } from 'tailwindcss';
-
-const config: Config = {
-  darkMode: ['class'],
-  content: [
-    './src/pages/**/*.{js,ts,jsx,tsx,mdx}',
-    './src/components/**/*.{js,ts,jsx,tsx,mdx}',
-    './src/app/**/*.{js,ts,jsx,tsx,mdx}',
-  ],
-  theme: {
-    extend: {
-      colors: {
-        border: 'hsl(var(--border))',
-        input: 'hsl(var(--input))',
-        ring: 'hsl(var(--ring))',
-        background: 'hsl(var(--background))',
-        foreground: 'hsl(var(--foreground))',
-        primary: {
-          DEFAULT: 'hsl(var(--primary))',
-          foreground: 'hsl(var(--primary-foreground))',
-        },
-        secondary: {
-          DEFAULT: 'hsl(var(--secondary))',
-          foreground: 'hsl(var(--secondary-foreground))',
-        },
-        destructive: {
-          DEFAULT: 'hsl(var(--destructive))',
-          foreground: 'hsl(var(--destructive-foreground))',
-        },
-        muted: {
-          DEFAULT: 'hsl(var(--muted))',
-          foreground: 'hsl(var(--muted-foreground))',
-        },
-        accent: {
-          DEFAULT: 'hsl(var(--accent))',
-          foreground: 'hsl(var(--accent-foreground))',
-        },
-        popover: {
-          DEFAULT: 'hsl(var(--popover))',
-          foreground: 'hsl(var(--popover-foreground))',
-        },
-        card: {
-          DEFAULT: 'hsl(var(--card))',
-          foreground: 'hsl(var(--card-foreground))',
-        },
-      },
-      borderRadius: { lg: 'var(--radius)', md: 'calc(var(--radius) - 2px)', sm: 'calc(var(--radius) - 4px)' },
-    },
-  },
-  plugins: [],
-};
-
-export default config;

package/tsconfig.json

@@ -1,41 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2017",
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
-    "allowJs": true,
-    "skipLibCheck": true,
-    "strict": true,
-    "noEmit": true,
-    "esModuleInterop": true,
-    "module": "esnext",
-    "moduleResolution": "bundler",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "jsx": "react-jsx",
-    "incremental": true,
-    "plugins": [
-      {
-        "name": "next"
-      }
-    ],
-    "paths": {
-      "@/*": [
-        "./src/*"
-      ]
-    }
-  },
-  "include": [
-    "next-env.d.ts",
-    "**/*.ts",
-    "**/*.tsx",
-    ".next/types/**/*.ts",
-    ".next/dev/types/**/*.ts"
-  ],
-  "exclude": [
-    "node_modules"
-  ]
-}