codehere 0.1.1 → 0.2.1

package/dist/infrastructure/providers/openai-provider.js

@@ -12,8 +12,6 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { encoding_for_model } from 'tiktoken';
 import { retryWithBackoff } from '../../error-handler.js';
-import { sessionTokenTracker } from '../cost/session-token-tracker.js';
-import { getConfigManager } from '../config/config-manager.js';
 // Load .env (same pattern as CohereProvider)
 try {
     const __filename = fileURLToPath(import.meta.url);
@@ -28,15 +26,10 @@ let tokenEncoder = null;
 function getTokenEncoder() {
     if (!tokenEncoder) {
         try {
-            // Use default model from config for token encoding
-            const config = getConfigManager();
-            const defaultModel = config.getModel('default') || config.getPreference('defaultModel') || 'gpt-3.5-turbo';
-            // Map to OpenAI model for tiktoken (tiktoken uses OpenAI models)
-            const tiktokenModel = defaultModel.includes('gpt') ? defaultModel : 'gpt-3.5-turbo';
-            tokenEncoder = encoding_for_model(tiktokenModel);
+            tokenEncoder = encoding_for_model('gpt-3.5-turbo');
         }
         catch {
-            tokenEncoder = encoding_for_model('gpt-3.5-turbo');
+            tokenEncoder = encoding_for_model('gpt-4');
         }
     }
     return tokenEncoder;
@@ -77,7 +70,6 @@ export class OpenAIProvider {
         }
         this.apiKey = key;
         this.baseUrl = baseUrl || process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1';
-        // Use provider-specific defaults (DO NOT use global config - it has Cohere models!)
         this.defaultChatModel = process.env.CODEHERE_OPENAI_MODEL || 'gpt-4o-mini';
         this.defaultEmbedModel = process.env.CODEHERE_OPENAI_EMBED_MODEL || 'text-embedding-3-small';
     }
@@ -196,7 +188,7 @@ export class OpenAIProvider {
                             content: prompt,
                         },
                     ],
-                    temperature: options?.temperature ?? (getConfigManager().getTemperature('chat') || 0.7),
+                    temperature: options?.temperature ?? 0.7,
                     max_tokens: options?.maxTokens,
                 }),
             });
@@ -215,21 +207,12 @@ export class OpenAIProvider {
             const data = await response.json();
             const text = data.choices?.[0]?.message?.content || 'No response generated';
             const usage = data.usage || {};
-            const inputTokens = usage.prompt_tokens || countTokens(prompt);
-            const outputTokens = usage.completion_tokens || countTokens(text);
-            // Track tokens for session cost display
-            sessionTokenTracker.record({
-                operation: 'chat',
-                model: data.model || model,
-                inputTokens,
-                outputTokens,
-            });
             return {
                 text,
                 model: data.model || model,
                 usage: {
-                    inputTokens,
-                    outputTokens,
+                    inputTokens: usage.prompt_tokens || countTokens(prompt),
+                    outputTokens: usage.completion_tokens || countTokens(text),
                 },
                 finishReason: data.choices?.[0]?.finish_reason,
             };
@@ -311,13 +294,6 @@ export class OpenAIProvider {
             }
             const inputTokens = countTokens(prompt);
             const outputTokens = countTokens(fullText);
-            // Track tokens for session cost display
-            sessionTokenTracker.record({
-                operation: 'chat-stream',
-                model: model || this.defaultChatModel,
-                inputTokens,
-                outputTokens,
-            });
             return {
                 text: fullText,
                 model: model || 'default',
@@ -357,14 +333,6 @@ export class OpenAIProvider {
             }
             const data = await response.json();
             const embeddings = data.data?.map((item) => item.embedding) || [];
-            // Track tokens for session cost display
-            const inputTokens = texts.reduce((sum, t) => sum + countTokens(t), 0);
-            sessionTokenTracker.record({
-                operation: 'embed',
-                model: this.defaultEmbedModel,
-                inputTokens,
-                outputTokens: 0,
-            });
             if (texts.length === 1) {
                 return embeddings[0];
             }

package/dist/infrastructure/providers/openrouter-provider.js

@@ -14,7 +14,6 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { encoding_for_model } from 'tiktoken';
 import { retryWithBackoff } from '../../error-handler.js';
-import { getConfigManager } from '../config/config-manager.js';
 // Load .env (same pattern as other providers)
 try {
     const __filename = fileURLToPath(import.meta.url);
@@ -29,15 +28,10 @@ let tokenEncoder = null;
 function getTokenEncoder() {
     if (!tokenEncoder) {
         try {
-            // Use default model from config for token encoding
-            const config = getConfigManager();
-            const defaultModel = config.getModel('default') || config.getPreference('defaultModel') || 'gpt-3.5-turbo';
-            // Map to OpenAI model for tiktoken (tiktoken uses OpenAI models)
-            const tiktokenModel = defaultModel.includes('gpt') ? defaultModel : 'gpt-3.5-turbo';
-            tokenEncoder = encoding_for_model(tiktokenModel);
+            tokenEncoder = encoding_for_model('gpt-3.5-turbo');
         }
         catch {
-            tokenEncoder = encoding_for_model('gpt-3.5-turbo');
+            tokenEncoder = encoding_for_model('gpt-4');
         }
     }
     return tokenEncoder;
@@ -77,9 +71,7 @@ export class OpenRouterProvider {
         }
         this.apiKey = key;
         this.baseUrl = process.env.OPENROUTER_BASE_URL || 'https://openrouter.ai/api/v1';
-        // Use ConfigManager for default model, with env var override
-        const config = getConfigManager();
-        this.defaultChatModel = process.env.CODEHERE_OPENROUTER_CHAT_MODEL || config.getModel('chat') || config.getModel('default') || 'openai/gpt-4o-mini';
+        this.defaultChatModel = process.env.CODEHERE_OPENROUTER_CHAT_MODEL || 'openai/gpt-4o-mini';
     }
     async getModels() {
         // Fetch models from OpenRouter API

package/dist/infrastructure/safety/pattern-detector.js

@@ -0,0 +1,133 @@
+/**
+ * Mistake Detection Loop (P4-A)
+ *
+ * Detects repeated patterns in hook events and surfaces warnings:
+ * - Same category blocked 3+ times → user warning
+ * - Same file blocked 3+ times → suggest different approach
+ * - AI retrying blocked command with minor variation → escalate
+ *
+ * v0.3.0
+ */
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import chalk from 'chalk';
+const AUDIT_FILE = join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
+const THRESHOLD = 3;
+/**
+ * Analyze recent audit log for mistake patterns in a session.
+ */
+export function detectMistakes(sessionId) {
+    if (!existsSync(AUDIT_FILE))
+        return [];
+    let lines;
+    try {
+        const raw = readFileSync(AUDIT_FILE, 'utf-8').trim();
+        if (!raw)
+            return [];
+        lines = raw.split('\n');
+    }
+    catch {
+        return [];
+    }
+    // Parse blocked events, optionally filtered to a session
+    const blockedEvents = [];
+    for (const line of lines) {
+        try {
+            const entry = JSON.parse(line);
+            if (!entry.blocked)
+                continue;
+            if (sessionId && entry.sessionId !== sessionId)
+                continue;
+            blockedEvents.push(entry);
+        }
+        catch {
+            continue;
+        }
+    }
+    if (blockedEvents.length < THRESHOLD)
+        return [];
+    const patterns = [];
+    // 1. Same category blocked 3+ times
+    const categoryCounts = new Map();
+    for (const event of blockedEvents) {
+        if (event.categories) {
+            for (const cat of event.categories) {
+                categoryCounts.set(cat, (categoryCounts.get(cat) || 0) + 1);
+            }
+        }
+    }
+    for (const [category, count] of categoryCounts) {
+        if (count >= THRESHOLD) {
+            patterns.push({
+                type: 'repeated-category',
+                description: `"${category}" blocked ${count} times`,
+                count,
+                suggestion: `The AI keeps triggering ${category} detections. Consider adding a project rule or using a safer pattern.`,
+            });
+        }
+    }
+    // 2. Same tool+file blocked 3+ times
+    const fileCounts = new Map();
+    for (const event of blockedEvents) {
+        if (event.toolName === 'Write' || event.toolName === 'Edit' || event.toolName === 'MultiEdit') {
+            try {
+                const input = JSON.parse(event.toolInput);
+                const filePath = input.file_path || input.filepath || '';
+                if (filePath) {
+                    fileCounts.set(filePath, (fileCounts.get(filePath) || 0) + 1);
+                }
+            }
+            catch {
+                // toolInput might be truncated
+            }
+        }
+    }
+    for (const [filePath, count] of fileCounts) {
+        if (count >= THRESHOLD) {
+            const shortPath = filePath.split('/').slice(-2).join('/');
+            patterns.push({
+                type: 'repeated-file',
+                description: `Writes to ${shortPath} blocked ${count} times`,
+                count,
+                suggestion: `The AI keeps trying to modify this file in a blocked way. Try a different instruction or approach.`,
+            });
+        }
+    }
+    // 3. Rapid retries (3+ blocked events within 60 seconds)
+    if (blockedEvents.length >= THRESHOLD) {
+        const recent = blockedEvents.slice(-10);
+        let rapidCount = 0;
+        for (let i = 1; i < recent.length; i++) {
+            const prev = new Date(recent[i - 1].timestamp).getTime();
+            const curr = new Date(recent[i].timestamp).getTime();
+            if (curr - prev < 60_000) {
+                rapidCount++;
+            }
+        }
+        if (rapidCount >= THRESHOLD - 1) {
+            patterns.push({
+                type: 'retry-variation',
+                description: `${rapidCount + 1} rapid retries detected`,
+                count: rapidCount + 1,
+                suggestion: `The AI is rapidly retrying blocked commands. It may be stuck in a loop — consider rephrasing your instruction.`,
+            });
+        }
+    }
+    return patterns;
+}
+/**
+ * Format mistake patterns for display in CLI.
+ */
+export function formatMistakeWarnings(patterns) {
+    if (patterns.length === 0)
+        return '';
+    const lines = [];
+    lines.push(chalk.yellow.bold('Repeated patterns detected:'));
+    for (const p of patterns) {
+        lines.push(chalk.yellow(`  ${p.description}`));
+        lines.push(chalk.dim(`  ${p.suggestion}`));
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=pattern-detector.js.map

package/dist/infrastructure/security/ai-sast-scanner.js

@@ -15,26 +15,75 @@ export class AISASTScanner {
      * This is a quick heuristic check to reject dangerous instructions early
      */
     async scanInstruction(instruction) {
-        // Fast pattern-based check for obvious security issues
-        const lower = instruction.toLowerCase();
-        // Dangerous patterns that should be blocked immediately
-        const dangerousPatterns = [
-            { pattern: /execute.*user.*input|eval.*user|exec.*user/i, severity: 'critical', category: 'Code Injection' },
-            { pattern: /shell.*command|system.*call|process\.exec/i, severity: 'critical', category: 'Command Injection' },
-            { pattern: /sql.*injection|raw.*sql.*query/i, severity: 'high', category: 'SQL Injection' },
-            { pattern: /bypass.*security|disable.*security|remove.*validation/i, severity: 'critical', category: 'Security Bypass' },
-            { pattern: /hardcode.*password|store.*password|plaintext.*password/i, severity: 'high', category: 'Password Exposure' },
+        // Full pattern-based scan — 50+ patterns across 5 categories
+        // Matches benchmark coverage. Runs locally, no API needed.
+        const instructionPatterns = [
+            // ── PROMPT INJECTION (10 patterns) ────────────────────────
+            { pattern: /ignore\s+(previous|prior|above|all|your)\s+(instructions?|rules?|prompts?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to override system instructions' },
+            { pattern: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to disregard system instructions' },
+            { pattern: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to clear system context' },
+            { pattern: /you\s+are\s+now\s+(a|an|my)|new\s+role|act\s+as\s+(a|an|if)/i, severity: 'critical', category: 'Prompt Injection', description: 'Role hijacking attempt' },
+            { pattern: /system\s*prompt|<\/?system>|<\/?instruction>/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to access or inject system prompt' },
+            { pattern: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i, severity: 'critical', category: 'Prompt Injection', description: 'Instruction override attempt' },
+            { pattern: /override\s+(safety|security|rules|restrictions|guidelines)/i, severity: 'critical', category: 'Prompt Injection', description: 'Safety override attempt' },
+            { pattern: /jailbreak|DAN\s+mode|developer\s+mode|unrestricted\s+mode/i, severity: 'critical', category: 'Prompt Injection', description: 'Known jailbreak technique' },
+            { pattern: /translate.*to.*base64|encode.*instructions|decode.*payload/i, severity: 'high', category: 'Prompt Injection', description: 'Obfuscation-based injection' },
+            { pattern: /pretend\s+(you|there|that)\s*(are|is|was)\s*(no|isn.t|aren.t)/i, severity: 'critical', category: 'Prompt Injection', description: 'Reality manipulation injection' },
+            // ── CREDENTIAL THEFT (10 patterns) ────────────────────────
+            { pattern: /hardcode.*password|store.*password|plaintext.*password/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded credentials' },
+            { pattern: /api[_\s-]?key\s*[:=]\s*['"]/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded API key' },
+            { pattern: /secret[_\s-]?key\s*[:=]\s*['"]/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded secret key' },
+            { pattern: /\bpassword\s*[:=]\s*['"][^'"]{3,}/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded password value' },
+            { pattern: /token\s*[:=]\s*['"][A-Za-z0-9+/=_-]{20,}/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded token' },
+            { pattern: /print.*env|console\.log.*process\.env|dump.*environment/i, severity: 'high', category: 'Credential Theft', description: 'Environment variable exfiltration' },
+            { pattern: /read.*\.env|cat\s+\.env|show.*credentials/i, severity: 'high', category: 'Credential Theft', description: 'Credential file access' },
+            { pattern: /send.*key.*to|post.*secret.*to|upload.*credentials/i, severity: 'critical', category: 'Credential Theft', description: 'Credential exfiltration' },
+            { pattern: /AWS_SECRET|AZURE_KEY|GCP_KEY|DATABASE_URL.*password/i, severity: 'high', category: 'Credential Theft', description: 'Cloud credential exposure' },
+            { pattern: /ssh[_\s-]?key|private[_\s-]?key.*BEGIN/i, severity: 'critical', category: 'Credential Theft', description: 'Private key exposure' },
+            // ── CODE INJECTION (10 patterns) ──────────────────────────
+            { pattern: /execute.*user.*input|eval.*user|exec.*user/i, severity: 'critical', category: 'Code Injection', description: 'User input execution' },
+            { pattern: /shell.*command|system.*call|process\.exec|child_process/i, severity: 'critical', category: 'Code Injection', description: 'Shell command execution' },
+            { pattern: /sql.*injection|raw.*sql.*query|query.*\+.*user/i, severity: 'high', category: 'Code Injection', description: 'SQL injection vector' },
+            { pattern: /bypass.*security|disable.*security|remove.*validation/i, severity: 'critical', category: 'Code Injection', description: 'Security bypass' },
+            { pattern: /delete\s+all\s+files|rm\s+-rf|remove\s+all|wipe\s+disk/i, severity: 'critical', category: 'Code Injection', description: 'Destructive file operation' },
+            { pattern: /reverse\s+shell|bind\s+shell|nc\s+-e|netcat.*-e/i, severity: 'critical', category: 'Code Injection', description: 'Reverse shell attempt' },
+            { pattern: /download.*execute|curl.*\|\s*sh|wget.*\|\s*bash/i, severity: 'critical', category: 'Code Injection', description: 'Remote code execution' },
+            { pattern: /modify.*hosts|edit.*\/etc\/|change.*resolv\.conf/i, severity: 'critical', category: 'Code Injection', description: 'System file modification' },
+            { pattern: /disable.*firewall|stop.*antivirus|kill.*security/i, severity: 'critical', category: 'Code Injection', description: 'Security software bypass' },
+            { pattern: /crypto.*min(er|ing)|bitcoin.*address|monero.*wallet/i, severity: 'critical', category: 'Code Injection', description: 'Cryptominer injection' },
+            // ── SUPPLY CHAIN (10 patterns) ────────────────────────────
+            { pattern: /install\s+[a-z]+-[a-z]+\d{3,}|npm\s+i\s+[a-z]+-typo/i, severity: 'high', category: 'Supply Chain', description: 'Typosquatting package install' },
+            { pattern: /add.*dependency.*http|require\s*\(\s*['"]https?:/i, severity: 'high', category: 'Supply Chain', description: 'Remote dependency injection' },
+            { pattern: /postinstall.*script|preinstall.*curl|lifecycle.*wget/i, severity: 'critical', category: 'Supply Chain', description: 'Malicious lifecycle script' },
+            { pattern: /replace.*package|swap.*module|inject.*into.*node_modules/i, severity: 'critical', category: 'Supply Chain', description: 'Package replacement attack' },
+            { pattern: /modify.*package\.json.*scripts|add.*postinstall/i, severity: 'high', category: 'Supply Chain', description: 'Build script injection' },
+            { pattern: /git.*clone.*untrusted|clone.*unknown.*repo/i, severity: 'high', category: 'Supply Chain', description: 'Untrusted repository clone' },
+            { pattern: /override.*lockfile|delete.*lock|ignore.*integrity/i, severity: 'high', category: 'Supply Chain', description: 'Lock file tampering' },
+            { pattern: /publish.*malicious|npm\s+publish.*trojan/i, severity: 'critical', category: 'Supply Chain', description: 'Malicious package publish' },
+            { pattern: /dependency\s+confusion|internal.*package.*public/i, severity: 'high', category: 'Supply Chain', description: 'Dependency confusion attack' },
+            { pattern: /add.*webpack.*plugin.*http|loader.*remote.*url/i, severity: 'high', category: 'Supply Chain', description: 'Build tool injection' },
+            // ── OWASP TOP 10 (10 patterns) ────────────────────────────
+            { pattern: /disable.*cors|access-control-allow-origin.*\*/i, severity: 'high', category: 'OWASP', description: 'CORS misconfiguration' },
+            { pattern: /disable.*csrf|skip.*csrf.*check|no.*csrf/i, severity: 'high', category: 'OWASP', description: 'CSRF protection bypass' },
+            { pattern: /no.*authentication|skip.*auth|remove.*auth.*check/i, severity: 'critical', category: 'OWASP', description: 'Authentication bypass' },
+            { pattern: /set.*cookie.*httponly.*false|cookie.*secure.*false/i, severity: 'high', category: 'OWASP', description: 'Insecure cookie configuration' },
+            { pattern: /http:\/\/.*api|unencrypted.*connection|disable.*tls/i, severity: 'high', category: 'OWASP', description: 'Insecure transport' },
+            { pattern: /expose.*stack.*trace|verbose.*error.*production/i, severity: 'high', category: 'OWASP', description: 'Information disclosure' },
+            { pattern: /admin.*route.*public|no.*authorization.*check/i, severity: 'critical', category: 'OWASP', description: 'Broken access control' },
+            { pattern: /deserialize.*untrusted|parse.*user.*json.*eval/i, severity: 'critical', category: 'OWASP', description: 'Insecure deserialization' },
+            { pattern: /log.*password|log.*token|log.*secret|log.*credentials/i, severity: 'high', category: 'OWASP', description: 'Sensitive data in logs' },
+            { pattern: /xml.*external.*entity|xxe|DOCTYPE.*SYSTEM/i, severity: 'critical', category: 'OWASP', description: 'XXE injection' },
         ];
         const findings = [];
-        for (const { pattern, severity, category } of dangerousPatterns) {
+        for (const { pattern, severity, category, description } of instructionPatterns) {
             if (pattern.test(instruction)) {
                 findings.push({
-                    severity: severity,
+                    severity,
                     category,
-                    description: `Instruction contains dangerous pattern: ${category}`,
+                    description,
                     filepath: 'instruction',
                     line: 0,
-                    recommendation: `Review instruction for security vulnerabilities. Pattern detected: ${category}`,
+                    recommendation: `BLOCKED: ${description}. This instruction was rejected by the safety scanner.`,
                 });
             }
         }

package/dist/infrastructure/security/enhanced-security-gate.js

@@ -10,9 +10,7 @@
  *
  * All checks must pass before code generation/editing
  */
-import { createHash } from 'crypto';
 import { getSecurityScanCache } from '../cache/security-scan-cache.js';
-import { detectPromptInjection } from './input-validator.js';
 /**
  * Enhanced Security Gate
  * Orchestrates all security scanners
@@ -37,9 +35,7 @@ export class EnhancedSecurityGate {
         const errors = [];
         const warnings = [];
         // PERFORMANCE: Check cache first (bypasses expensive scans for unchanged files)
-        // CRITICAL FIX: Hash code before cache lookup (cache expects hash, not raw code)
-        const contentHash = createHash('sha256').update(code).digest('hex');
-        const cachedResults = this.scanCache.get(filepath, contentHash);
+        const cachedResults = this.scanCache.get(filepath, code);
         if (cachedResults) {
             // Return cached results (skip expensive scans)
             const passed = cachedResults.sast.passed && cachedResults.license.passed;
@@ -126,7 +122,6 @@ export class EnhancedSecurityGate {
         }
         const passed = errors.length === 0; // Only fail on critical errors
         // Cache results for future use (performance optimization)
-        // Note: cache.set() accepts code string and hashes internally
         this.scanCache.set(filepath, code, sast, license, providerBias);
         return {
             passed,
@@ -140,70 +135,16 @@ export class EnhancedSecurityGate {
     }
     /**
      * Fast pre-check on instruction (before expensive operations)
-     * Enhanced with prompt injection detection
      */
     async fastCheck(instruction) {
         const findings = [];
-        // P0 Security: Check for prompt injection first (fast, synchronous)
-        const injectionResult = detectPromptInjection(instruction);
-        if (injectionResult) {
-            if (injectionResult.severity === 'critical' || injectionResult.severity === 'high') {
-                findings.push(`Prompt injection (${injectionResult.severity}): ${injectionResult.description}`);
-            }
-            else {
-                findings.push(`Prompt injection (${injectionResult.severity}): ${injectionResult.description}`);
-            }
-        }
-        // SAST scan on instruction
         const sastResult = await this.sastScanner.scanInstruction(instruction);
         if (sastResult && !sastResult.passed) {
             findings.push(...sastResult.findings.map(f => `${f.severity}: ${f.description}`));
         }
-        // Block if critical/high severity findings
-        const hasCriticalFindings = findings.some(f => f.includes('critical') || f.includes('high') ||
-            (injectionResult && (injectionResult.severity === 'critical' || injectionResult.severity === 'high')));
-        return {
-            allowed: !hasCriticalFindings,
-            findings,
-        };
-    }
-    /**
-     * Validate LLM output before code execution
-     * P0 Security: Enhanced output validation
-     */
-    async validateOutput(output, context) {
-        const findings = [];
-        let sanitized = output;
-        // Check for prompt injection in output (LLM may have been manipulated)
-        const injectionResult = detectPromptInjection(output);
-        if (injectionResult && (injectionResult.severity === 'critical' || injectionResult.severity === 'high')) {
-            findings.push(`Output contains prompt injection (${injectionResult.severity}): ${injectionResult.description}`);
-        }
-        // Check for dangerous code patterns in output
-        const dangerousPatterns = [
-            { pattern: /eval\s*\(/i, description: 'eval() function detected' },
-            { pattern: /Function\s*\(/i, description: 'Function constructor detected' },
-            { pattern: /exec\s*\(|execSync|spawn|execFile/i, description: 'Process execution detected' },
-            { pattern: /require\s*\([^)]*process/i, description: 'Process module access detected' },
-            { pattern: /child_process/i, description: 'Child process module detected' },
-            { pattern: /fs\.(writeFile|unlink|rmdir|rm)/i, description: 'File system write operation detected' },
-            { pattern: /__dirname|__filename/i, description: 'File system path access detected' },
-        ];
-        for (const { pattern, description } of dangerousPatterns) {
-            if (pattern.test(output)) {
-                findings.push(`Dangerous pattern: ${description}`);
-            }
-        }
-        // Check for suspicious encoding attempts
-        if (/base64|hex|binary|decode/i.test(output) && /eval|exec|Function/i.test(output)) {
-            findings.push('Suspicious encoding with code execution detected');
-        }
-        // If critical findings, don't sanitize - reject entirely
-        const hasCriticalFindings = findings.some(f => f.includes('critical') || f.includes('high') || f.includes('Prompt injection'));
         return {
-            allowed: !hasCriticalFindings,
+            allowed: findings.length === 0,
             findings,
-            sanitized: hasCriticalFindings ? undefined : (sanitized || output),
         };
     }
 }