codegate-ai 0.16.2 → 1.0.1

package/dist/layer2-static/state/scan-state.js

@@ -2,6 +2,9 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
+const SCAN_STATE_FILE_VERSION = 2;
+/** Bucket used when no project root is supplied (direct API use, tooling). */
+const SHARED_PROJECT_KEY = "*";
 const LAUNCHERS = new Set(["npx", "uvx", "node", "python", "python3", "deno", "bun"]);
 const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
 const REMOTE_MCP_SERVER_ARRAY_KEYS = ["remoteMCPServers", "remote_mcp_servers"];
@@ -106,18 +109,29 @@ function normalizedUrlServerId(rawUrl) {
         return `url:${trimmed}`;
     }
 }
-function makeStateFinding(kind, snapshot, previousLastSeen) {
+const STATE_FINDING_KIND = {
+    NewServer: "NEW_SERVER",
+    ConfigChange: "CONFIG_CHANGE",
+};
+/** First-use of a server in an untrusted project deserves a visible review. */
+function firstSeenSeverity(trustedTarget) {
+    return trustedTarget ? "INFO" : "MEDIUM";
+}
+function makeStateFinding(kind, snapshot, previousLastSeen, trustedTarget) {
     const locationField = snapshot.serverPath ?? `mcpServers.${snapshot.serverName}`;
-    if (kind === "NEW_SERVER") {
+    if (kind === STATE_FINDING_KIND.NewServer) {
+        const reviewNote = trustedTarget
+            ? "Not previously scanned."
+            : "Not previously scanned in this untrusted project; review its configuration before use.";
         return {
             rule_id: "mcp-server-first-seen",
             finding_id: `NEW_SERVER-${snapshot.serverId}`,
-            severity: "INFO",
+            severity: firstSeenSeverity(trustedTarget),
             category: "NEW_SERVER",
             layer: "L2",
             file_path: snapshot.configPath,
             location: { field: locationField },
-            description: `MCP server "${snapshot.serverId}" first seen in this project. Not previously scanned.`,
+            description: `MCP server "${snapshot.serverId}" first seen in this project. ${reviewNote}`,
             affected_tools: ["claude-code", "cursor", "windsurf", "codex-cli", "opencode"],
             cve: null,
             owasp: ["ASI08"],
@@ -150,31 +164,22 @@ function makeStateFinding(kind, snapshot, previousLastSeen) {
 export function getScanStatePath(customPath) {
     return resolve(expandHomePath(customPath ?? defaultPath()));
 }
-export function loadScanState(customPath) {
-    const path = getScanStatePath(customPath);
-    if (!existsSync(path)) {
-        return { servers: {} };
-    }
-    let parsed;
-    try {
-        const raw = readFileSync(path, "utf8");
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return { servers: {} };
-    }
-    if (!isRecord(parsed) || !isRecord(parsed.servers)) {
-        return { servers: {} };
+function projectStateKey(projectRoot) {
+    return projectRoot === undefined ? SHARED_PROJECT_KEY : resolve(projectRoot);
+}
+function parseServerEntries(value) {
+    if (!isRecord(value)) {
+        return {};
     }
     const entries = {};
-    for (const [key, value] of Object.entries(parsed.servers)) {
-        if (!isRecord(value)) {
+    for (const [key, entry] of Object.entries(value)) {
+        if (!isRecord(entry)) {
             continue;
         }
-        const config_hash = typeof value.config_hash === "string" ? value.config_hash : "";
-        const config_path = typeof value.config_path === "string" ? value.config_path : "";
-        const first_seen = typeof value.first_seen === "string" ? value.first_seen : "";
-        const last_seen = typeof value.last_seen === "string" ? value.last_seen : "";
+        const config_hash = typeof entry.config_hash === "string" ? entry.config_hash : "";
+        const config_path = typeof entry.config_path === "string" ? entry.config_path : "";
+        const first_seen = typeof entry.first_seen === "string" ? entry.first_seen : "";
+        const last_seen = typeof entry.last_seen === "string" ? entry.last_seen : "";
         if (!config_hash || !config_path || !first_seen || !last_seen) {
             continue;
         }
@@ -185,12 +190,47 @@ export function loadScanState(customPath) {
             last_seen,
         };
     }
-    return { servers: entries };
+    return entries;
 }
-export function saveScanState(state, customPath) {
+function loadScanStateFile(customPath) {
+    const empty = { version: SCAN_STATE_FILE_VERSION, projects: {} };
     const path = getScanStatePath(customPath);
+    if (!existsSync(path)) {
+        return empty;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return empty;
+    }
+    // Legacy (unversioned, top-level `servers`) and malformed files both reset:
+    // legacy entries carry no project provenance, so trusting them would leak
+    // baselines across projects.
+    if (!isRecord(parsed) ||
+        parsed.version !== SCAN_STATE_FILE_VERSION ||
+        !isRecord(parsed.projects)) {
+        return empty;
+    }
+    const projects = {};
+    for (const [projectKey, slice] of Object.entries(parsed.projects)) {
+        if (isRecord(slice)) {
+            projects[projectKey] = { servers: parseServerEntries(slice.servers) };
+        }
+    }
+    return { version: SCAN_STATE_FILE_VERSION, projects };
+}
+export function loadScanState(customPath, projectRoot) {
+    const file = loadScanStateFile(customPath);
+    return file.projects[projectStateKey(projectRoot)] ?? { servers: {} };
+}
+export function saveScanState(state, customPath, projectRoot) {
+    const path = getScanStatePath(customPath);
+    const file = loadScanStateFile(customPath);
+    file.projects[projectStateKey(projectRoot)] = state;
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, "utf8");
 }
 export function resetScanState(customPath) {
     const path = getScanStatePath(customPath);
@@ -198,6 +238,8 @@ export function resetScanState(customPath) {
 }
 export function evaluateScanStateSnapshots(input) {
     const nowIso = input.nowIso ?? new Date().toISOString();
+    const trustedTarget = input.trustedTarget ?? false;
+    const firstScanReview = input.firstScanReview ?? true;
     const nextState = {
         servers: { ...input.previousState.servers },
     };
@@ -205,7 +247,9 @@ export function evaluateScanStateSnapshots(input) {
     for (const snapshot of input.snapshots) {
         const previous = nextState.servers[snapshot.serverId];
         if (!previous) {
-            findings.push(makeStateFinding("NEW_SERVER", snapshot, null));
+            if (firstScanReview) {
+                findings.push(makeStateFinding(STATE_FINDING_KIND.NewServer, snapshot, null, trustedTarget));
+            }
             nextState.servers[snapshot.serverId] = {
                 config_hash: snapshot.configHash,
                 config_path: snapshot.configPath,
@@ -215,7 +259,7 @@ export function evaluateScanStateSnapshots(input) {
             continue;
         }
         if (previous.config_hash !== snapshot.configHash) {
-            findings.push(makeStateFinding("CONFIG_CHANGE", snapshot, previous.last_seen));
+            findings.push(makeStateFinding(STATE_FINDING_KIND.ConfigChange, snapshot, previous.last_seen, trustedTarget));
             nextState.servers[snapshot.serverId] = {
                 config_hash: snapshot.configHash,
                 config_path: snapshot.configPath,

package/dist/layer2-static/text/confusables.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Minimal confusables map: non-Latin code points that render like Latin
+ * letters and are used to slip phrases past literal matching. NFKC already
+ * folds fullwidth/compatibility forms; this covers the Cyrillic and Greek
+ * lookalikes NFKC leaves alone. Data-driven so a content feed can extend it.
+ */
+export declare const CONFUSABLE_TO_LATIN: Readonly<Record<string, string>>;

package/dist/layer2-static/text/confusables.js

@@ -0,0 +1,70 @@
+/**
+ * Minimal confusables map: non-Latin code points that render like Latin
+ * letters and are used to slip phrases past literal matching. NFKC already
+ * folds fullwidth/compatibility forms; this covers the Cyrillic and Greek
+ * lookalikes NFKC leaves alone. Data-driven so a content feed can extend it.
+ */
+export const CONFUSABLE_TO_LATIN = {
+    // Cyrillic lowercase
+    а: "a",
+    в: "b",
+    е: "e",
+    ё: "e",
+    к: "k",
+    м: "m",
+    н: "h",
+    о: "o",
+    р: "p",
+    с: "c",
+    т: "t",
+    у: "y",
+    х: "x",
+    і: "i",
+    ѕ: "s",
+    ј: "j",
+    ԁ: "d",
+    ԛ: "q",
+    ѡ: "w",
+    // Cyrillic uppercase
+    А: "A",
+    В: "B",
+    Е: "E",
+    К: "K",
+    М: "M",
+    Н: "H",
+    О: "O",
+    Р: "P",
+    С: "C",
+    Т: "T",
+    У: "Y",
+    Х: "X",
+    І: "I",
+    Ѕ: "S",
+    Ј: "J",
+    // Greek lowercase
+    α: "a",
+    ε: "e",
+    η: "n",
+    ι: "i",
+    κ: "k",
+    ν: "v",
+    ο: "o",
+    ρ: "p",
+    τ: "t",
+    υ: "u",
+    // Greek uppercase
+    Α: "A",
+    Β: "B",
+    Ε: "E",
+    Ζ: "Z",
+    Η: "H",
+    Ι: "I",
+    Κ: "K",
+    Μ: "M",
+    Ν: "N",
+    Ο: "O",
+    Ρ: "P",
+    Τ: "T",
+    Υ: "Y",
+    Χ: "X",
+};

package/dist/layer2-static/text/edit-distance.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Damerau-Levenshtein distance (optimal string alignment variant):
+ * insertions, deletions, substitutions, and adjacent transpositions each
+ * cost 1. Small inputs only (package names), so the O(n*m) table is fine.
+ */
+export declare function damerauLevenshtein(left: string, right: string): number;

package/dist/layer2-static/text/edit-distance.js

@@ -0,0 +1,33 @@
+/**
+ * Damerau-Levenshtein distance (optimal string alignment variant):
+ * insertions, deletions, substitutions, and adjacent transpositions each
+ * cost 1. Small inputs only (package names), so the O(n*m) table is fine.
+ */
+export function damerauLevenshtein(left, right) {
+    if (left === right) {
+        return 0;
+    }
+    const rows = left.length + 1;
+    const cols = right.length + 1;
+    const table = Array.from({ length: rows }, () => new Array(cols).fill(0));
+    for (let row = 0; row < rows; row += 1) {
+        table[row][0] = row;
+    }
+    for (let col = 0; col < cols; col += 1) {
+        table[0][col] = col;
+    }
+    for (let row = 1; row < rows; row += 1) {
+        for (let col = 1; col < cols; col += 1) {
+            const cost = left[row - 1] === right[col - 1] ? 0 : 1;
+            let value = Math.min(table[row - 1][col] + 1, table[row][col - 1] + 1, table[row - 1][col - 1] + cost);
+            if (row > 1 &&
+                col > 1 &&
+                left[row - 1] === right[col - 2] &&
+                left[row - 2] === right[col - 1]) {
+                value = Math.min(value, table[row - 2][col - 2] + 1);
+            }
+            table[row][col] = value;
+        }
+    }
+    return table[rows - 1][cols - 1];
+}

package/dist/layer2-static/text/encoded-payloads.d.ts

@@ -0,0 +1,16 @@
+export declare const ENCODED_PAYLOAD_KIND: {
+    readonly Base64: "base64";
+    readonly Hex: "hex";
+};
+export type EncodedPayloadKind = (typeof ENCODED_PAYLOAD_KIND)[keyof typeof ENCODED_PAYLOAD_KIND];
+export interface EncodedPayloadMatch {
+    kind: EncodedPayloadKind;
+    line: number;
+    decodedExcerpt: string;
+    matchesRemoteShell: boolean;
+    matchesOverridePhrase: boolean;
+    matchesSensitiveExfil: boolean;
+    matchesCommandExecution: boolean;
+}
+/** Scan text for encoded blobs whose decoded content matches threat patterns. */
+export declare function scanEncodedPayloads(text: string): EncodedPayloadMatch[];

package/dist/layer2-static/text/encoded-payloads.js

@@ -0,0 +1,116 @@
+import { normalizeForMatching } from "./normalize.js";
+import { COMMAND_EXECUTION_PATTERN, EXFIL_PATTERN, REMOTE_SHELL_PATTERN, SENSITIVE_FILE_PATTERN, findOverridePhrase, } from "./threat-patterns.js";
+/**
+ * Bounded decode-and-rescan for base64/hex blobs embedded in instruction
+ * files and tool descriptions. Hard limits keep this pass cheap and
+ * non-explosive: one nesting level, capped blob count and decoded size.
+ */
+const BASE64_RUN_PATTERN = /[A-Za-z0-9+/_-]{40,}={0,2}/gu;
+const HEX_RUN_PATTERN = /(?:[0-9a-fA-F]{2}){30,}/gu;
+const MAX_BLOBS_PER_TEXT = 20;
+const MAX_DECODED_BYTES = 64 * 1024;
+const MIN_PRINTABLE_RATIO = 0.3;
+const DECODED_EXCERPT_LENGTH = 160;
+export const ENCODED_PAYLOAD_KIND = {
+    Base64: "base64",
+    Hex: "hex",
+};
+function printableRatio(text) {
+    if (text.length === 0) {
+        return 0;
+    }
+    let printable = 0;
+    for (const char of text) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code === 0x09 || code === 0x0a || code === 0x0d || (code >= 0x20 && code < 0x7f)) {
+            printable += 1;
+        }
+    }
+    return printable / text.length;
+}
+function decodeBase64(blob) {
+    // Normalize base64url variants before decoding.
+    const normalized = blob.replace(/-/gu, "+").replace(/_/gu, "/");
+    try {
+        const decoded = Buffer.from(normalized, "base64");
+        if (decoded.length === 0 || decoded.length > MAX_DECODED_BYTES) {
+            return null;
+        }
+        return decoded.toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function decodeHex(blob) {
+    try {
+        const decoded = Buffer.from(blob, "hex");
+        if (decoded.length === 0 || decoded.length > MAX_DECODED_BYTES) {
+            return null;
+        }
+        return decoded.toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function lineNumberAt(text, index) {
+    return text.slice(0, index).split(/\r?\n/u).length;
+}
+function isDataImageUri(text, blobIndex) {
+    const prefixStart = Math.max(0, blobIndex - 40);
+    return /data:image\/[a-z+.-]+;base64,?$/iu.test(text.slice(prefixStart, blobIndex));
+}
+function analyzeDecoded(kind, line, decoded) {
+    if (printableRatio(decoded) < MIN_PRINTABLE_RATIO) {
+        return null;
+    }
+    const normalized = normalizeForMatching(decoded);
+    const matchesRemoteShell = REMOTE_SHELL_PATTERN.test(normalized);
+    const matchesOverridePhrase = findOverridePhrase(normalized) !== null;
+    const matchesSensitiveExfil = SENSITIVE_FILE_PATTERN.test(normalized) && EXFIL_PATTERN.test(normalized);
+    const matchesCommandExecution = COMMAND_EXECUTION_PATTERN.test(normalized);
+    if (!matchesRemoteShell &&
+        !matchesOverridePhrase &&
+        !matchesSensitiveExfil &&
+        !matchesCommandExecution) {
+        return null;
+    }
+    return {
+        kind,
+        line,
+        decodedExcerpt: decoded.slice(0, DECODED_EXCERPT_LENGTH),
+        matchesRemoteShell,
+        matchesOverridePhrase,
+        matchesSensitiveExfil,
+        matchesCommandExecution,
+    };
+}
+/** Scan text for encoded blobs whose decoded content matches threat patterns. */
+export function scanEncodedPayloads(text) {
+    const matches = [];
+    let blobsSeen = 0;
+    const scanRuns = (pattern, kind, decode) => {
+        pattern.lastIndex = 0;
+        let match = pattern.exec(text);
+        while (match && blobsSeen < MAX_BLOBS_PER_TEXT) {
+            blobsSeen += 1;
+            const blob = match[0];
+            if (kind === ENCODED_PAYLOAD_KIND.Base64 && isDataImageUri(text, match.index)) {
+                match = pattern.exec(text);
+                continue;
+            }
+            const decoded = decode(blob);
+            if (decoded) {
+                const analyzed = analyzeDecoded(kind, lineNumberAt(text, match.index), decoded);
+                if (analyzed) {
+                    matches.push(analyzed);
+                }
+            }
+            match = pattern.exec(text);
+        }
+    };
+    scanRuns(BASE64_RUN_PATTERN, ENCODED_PAYLOAD_KIND.Base64, decodeBase64);
+    scanRuns(HEX_RUN_PATTERN, ENCODED_PAYLOAD_KIND.Hex, decodeHex);
+    return matches;
+}

package/dist/layer2-static/text/normalize.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Normalize text before threat-pattern matching so trivial obfuscation
+ * (zero-width splits, tag characters, homoglyphs, compatibility forms)
+ * cannot dodge literal patterns:
+ *
+ *   NFKC -> strip hidden characters -> fold confusables -> lowercase
+ *
+ * Normalize per line when line numbers matter: evidence must quote the
+ * original line while matching runs against the normalized one.
+ */
+export declare function normalizeForMatching(text: string): string;

package/dist/layer2-static/text/normalize.js

@@ -0,0 +1,19 @@
+import { CONFUSABLE_TO_LATIN } from "./confusables.js";
+import { stripHiddenCharacters } from "./unicode.js";
+const confusablePattern = new RegExp(`[${Object.keys(CONFUSABLE_TO_LATIN).join("")}]`, "gu");
+function foldConfusables(text) {
+    return text.replace(confusablePattern, (char) => CONFUSABLE_TO_LATIN[char] ?? char);
+}
+/**
+ * Normalize text before threat-pattern matching so trivial obfuscation
+ * (zero-width splits, tag characters, homoglyphs, compatibility forms)
+ * cannot dodge literal patterns:
+ *
+ *   NFKC -> strip hidden characters -> fold confusables -> lowercase
+ *
+ * Normalize per line when line numbers matter: evidence must quote the
+ * original line while matching runs against the normalized one.
+ */
+export function normalizeForMatching(text) {
+    return foldConfusables(stripHiddenCharacters(text.normalize("NFKC"))).toLowerCase();
+}

package/dist/layer2-static/text/override-phrases.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Instruction-override phrases matched against normalized (NFKC, hidden
+ * characters stripped, confusable-folded, lowercased) text. This is the
+ * high-signal literal tier; semantic analysis belongs to the Layer 3
+ * meta-agent. Data-driven so the content feed can extend it.
+ */
+export interface OverridePhrase {
+    phrase: string;
+    language: string;
+}
+export declare const OVERRIDE_PHRASES: readonly OverridePhrase[];
+export declare function resetActiveOverridePhrasesCache(): void;
+/** Bundled phrases plus any extras delivered by the verified content feed. */
+export declare function activeOverridePhrases(): readonly OverridePhrase[];

package/dist/layer2-static/text/override-phrases.js

@@ -0,0 +1,49 @@
+import { loadActiveContentBundle } from "../../content/content-store.js";
+export const OVERRIDE_PHRASES = [
+    { phrase: "ignore previous instructions", language: "en" },
+    { phrase: "ignore all previous instructions", language: "en" },
+    { phrase: "disregard previous instructions", language: "en" },
+    { phrase: "disregard prior instructions", language: "en" },
+    { phrase: "skip permissions", language: "en" },
+    { phrase: "bypass permissions", language: "en" },
+    { phrase: "bypass safety", language: "en" },
+    { phrase: "disable guardrails", language: "en" },
+    { phrase: "ignora las instrucciones anteriores", language: "es" },
+    { phrase: "ignore las instrucciones anteriores", language: "es" },
+    { phrase: "ignore as instrucoes anteriores", language: "pt" },
+    { phrase: "ignore as instruções anteriores", language: "pt" },
+    { phrase: "ignore les instructions precedentes", language: "fr" },
+    { phrase: "ignore les instructions précédentes", language: "fr" },
+    { phrase: "ignorez les instructions précédentes", language: "fr" },
+    { phrase: "ignoriere alle vorherigen anweisungen", language: "de" },
+    { phrase: "ignoriere die vorherigen anweisungen", language: "de" },
+    { phrase: "игнорируй предыдущие инструкции", language: "ru" },
+    { phrase: "игнорируйте предыдущие инструкции", language: "ru" },
+    { phrase: "忽略之前的指令", language: "zh" },
+    { phrase: "忽略以上指令", language: "zh" },
+    { phrase: "忽略先前的指示", language: "zh" },
+    { phrase: "以前の指示を無視して", language: "ja" },
+    { phrase: "これまでの指示を無視", language: "ja" },
+];
+let cachedActivePhrases = null;
+export function resetActiveOverridePhrasesCache() {
+    cachedActivePhrases = null;
+}
+/** Bundled phrases plus any extras delivered by the verified content feed. */
+export function activeOverridePhrases() {
+    if (cachedActivePhrases) {
+        return cachedActivePhrases;
+    }
+    let feedPhrases;
+    try {
+        const bundle = loadActiveContentBundle();
+        feedPhrases = (bundle?.override_phrases ?? []).filter((entry) => typeof entry?.phrase === "string" &&
+            entry.phrase.length > 0 &&
+            typeof entry?.language === "string");
+    }
+    catch {
+        feedPhrases = [];
+    }
+    cachedActivePhrases = [...OVERRIDE_PHRASES, ...feedPhrases];
+    return cachedActivePhrases;
+}

package/dist/layer2-static/text/threat-patterns.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared threat patterns for instruction/rule-file text and MCP tool
+ * descriptions. Callers are expected to match against text run through
+ * normalizeForMatching() so hidden-character and homoglyph obfuscation
+ * cannot dodge these literals.
+ */
+export declare const NEGATION_PATTERN: RegExp;
+export declare const SENSITIVE_READ_PATTERN: RegExp;
+export declare const SENSITIVE_FILE_PATTERN: RegExp;
+export declare const OUTBOUND_TRANSFER_PATTERN: RegExp;
+export declare const EXFIL_PATTERN: RegExp;
+export declare const COMMAND_EXECUTION_PATTERN: RegExp;
+export declare const REMOTE_SHELL_PATTERN: RegExp;
+export declare const SUSPICIOUS_LONG_LINE_PATTERN: RegExp;
+export declare const HTML_COMMENT_PATTERN: RegExp;
+export declare const COMMENT_PAYLOAD_PATTERN: RegExp;
+export declare const COOKIE_EXPORT_PATTERN: RegExp;
+export declare const SESSION_SHARE_PATTERN: RegExp;
+export declare const PROFILE_SYNC_PATTERN: RegExp;
+export declare const BOOTSTRAP_INSTALL_PATTERN: RegExp;
+export declare const AGENT_CONTROL_POINT_PATTERN: RegExp;
+export declare const RESTART_LOAD_PATTERN: RegExp;
+export declare const REMOTE_INSTRUCTION_INDIRECTION_PATTERN: RegExp;
+export interface OverridePhraseMatch {
+    phrase: string;
+    index: number;
+}
+/**
+ * Find the first instruction-override phrase in a normalized line, skipping
+ * matches preceded by nearby negation ("never bypass permissions").
+ */
+export declare function findOverridePhrase(normalizedLine: string): OverridePhraseMatch | null;
+export declare function hasNegationBefore(normalizedLine: string, matchIndex: number): boolean;

package/dist/layer2-static/text/threat-patterns.js

@@ -0,0 +1,45 @@
+import { activeOverridePhrases } from "./override-phrases.js";
+/**
+ * Shared threat patterns for instruction/rule-file text and MCP tool
+ * descriptions. Callers are expected to match against text run through
+ * normalizeForMatching() so hidden-character and homoglyph obfuscation
+ * cannot dodge these literals.
+ */
+export const NEGATION_PATTERN = /\b(?:must not|should not|do not|don't|never)\b/iu;
+export const SENSITIVE_READ_PATTERN = /\b(?:read|cat)\s+(?:~\/\.ssh(?:\/[^\s]+)?|\.env\b|~\/\.[a-z0-9._-]+(?:\/[^\s]+)*)/iu;
+export const SENSITIVE_FILE_PATTERN = /(~\/\.ssh|~\/\.aws|id_rsa|\.env|credentials|\.git-credentials)/iu;
+export const OUTBOUND_TRANSFER_PATTERN = /\b(?:upload externally|send to (?:an |a )?(?:external )?(?:webhook|endpoint|server)|curl\b|wget\b|invoke-webrequest\b|post to\b|https?:\/\/|exfiltrat(?:e|ion|ing))\b/iu;
+export const EXFIL_PATTERN = /(send .*https?:\/\/|upload|webhook|post to|exfiltrat)/iu;
+export const COMMAND_EXECUTION_PATTERN = /(run command|execute shell|bash -c|sh -c|powershell)/iu;
+export const REMOTE_SHELL_PATTERN = /\b(?:curl|wget)\b[^\n|]{0,240}\|\s*(?:bash|sh)\b|\b(?:invoke-webrequest|iwr)\b[^\n|]{0,240}\|\s*(?:iex|invoke-expression)\b/iu;
+export const SUSPICIOUS_LONG_LINE_PATTERN = /\b(?:ignore previous instructions|skip permissions|bypass permissions|upload externally|curl\b|wget\b|https?:\/\/|bash\s+-lc|sh\s+-c|powershell\b|base64\b|~\/\.ssh|\.env\b)\b/iu;
+export const HTML_COMMENT_PATTERN = /<!--([\s\S]*?)-->/gu;
+export const COMMENT_PAYLOAD_PATTERN = /\b(?:secret instructions|ignore previous instructions|curl\b|wget\b|invoke-webrequest\b|bash\b|powershell\b|session share\b|profile sync\b)\b/iu;
+export const COOKIE_EXPORT_PATTERN = /\bcookies?\s+(?:export|import|get)\b/iu;
+export const SESSION_SHARE_PATTERN = /\bsession\s+share\b|\blive url\b/iu;
+export const PROFILE_SYNC_PATTERN = /\bprofile\s+sync\b|\breal chrome\b|\blogin sessions\b|\bsession tokens?\b|--profile\b/iu;
+export const BOOTSTRAP_INSTALL_PATTERN = /\b(?:npm|pnpm|yarn|bun)\s+install\s+-g\b|\bbrew\s+install\b|\bpipx\s+install\b|\bgo\s+install\b|\b(?:npx|pnpx|uvx)\b[^\n`]{0,160}@latest\b/iu;
+export const AGENT_CONTROL_POINT_PATTERN = /\.claude\/hooks\/|\.claude\/settings\.json|\.claude\/agents\/|\bclaude\.md\b|\bagents\.md\b|\bmcp configuration\b/iu;
+export const RESTART_LOAD_PATTERN = /\brestart\b.*\b(?:load|take effect|activate|reload|work)\b|\bonly load after restart\b|\bafter restarting\b/iu;
+export const REMOTE_INSTRUCTION_INDIRECTION_PATTERN = /\b(?:follow|read|fetch|apply|obey|execute)\b[^\n]{0,40}\b(?:instructions|steps|guide|rules|directives)\b[^\n]{0,40}https?:\/\//iu;
+function hasNearbyNegation(normalizedLine, matchIndex) {
+    const prefix = normalizedLine.slice(Math.max(0, matchIndex - 24), matchIndex);
+    return NEGATION_PATTERN.test(prefix);
+}
+/**
+ * Find the first instruction-override phrase in a normalized line, skipping
+ * matches preceded by nearby negation ("never bypass permissions").
+ */
+export function findOverridePhrase(normalizedLine) {
+    for (const { phrase } of activeOverridePhrases()) {
+        const matchIndex = normalizedLine.indexOf(phrase);
+        if (matchIndex < 0 || hasNearbyNegation(normalizedLine, matchIndex)) {
+            continue;
+        }
+        return { phrase, index: matchIndex };
+    }
+    return null;
+}
+export function hasNegationBefore(normalizedLine, matchIndex) {
+    return hasNearbyNegation(normalizedLine, matchIndex);
+}

package/dist/layer2-static/text/unicode.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Single source of truth for hidden/invisible Unicode classes used across
+ * detectors. Tag characters (U+E0000-U+E007F) are the primary real-world
+ * "ASCII smuggling" vector: they encode invisible ASCII that survives
+ * copy/paste and reaches models while remaining unseen by human reviewers.
+ *
+ * All patterns use escape sequences on purpose: this file must never
+ * contain literal hidden characters.
+ */
+export declare const HIDDEN_UNICODE_CLASS: {
+    readonly ZeroWidth: "zero-width";
+    readonly Bidi: "bidi";
+    readonly Tags: "tags";
+    readonly VariationSelector: "variation-selector";
+};
+export type HiddenUnicodeClass = (typeof HIDDEN_UNICODE_CLASS)[keyof typeof HIDDEN_UNICODE_CLASS];
+export declare const ZERO_WIDTH_PATTERN: RegExp;
+export declare const BIDI_CONTROL_PATTERN: RegExp;
+export declare const TAG_CHARACTER_PATTERN: RegExp;
+export declare const VARIATION_SELECTOR_PATTERN: RegExp;
+export interface HiddenUnicodeMatch {
+    index: number;
+    codePoint: number;
+    class: HiddenUnicodeClass;
+}
+/**
+ * Find hidden Unicode characters worth flagging. Variation selectors are
+ * reported only when clustered (two or more in a row).
+ */
+export declare function findHiddenUnicode(text: string): HiddenUnicodeMatch[];
+/** Remove every hidden character class so pattern matching sees the visible text. */
+export declare function stripHiddenCharacters(text: string): string;
+export declare function hasHiddenUnicodeClass(text: string, cls: HiddenUnicodeClass): boolean;