contexel 0.1.16 → 0.1.17

package/README.md

@@ -72,7 +72,7 @@ const searchCode = shaped([
 | `select` | keep only the listed fields |
 | `dedupe` | drop duplicates by key or whole-record fingerprint (type-aware: `1`, `"1"`, `true` stay distinct) |
 | `allowlist` | fail-closed provenance gate — keep records whose field is in the allowed set (a missing field reads as `null`, kept only if `null` is explicitly allowed) |
-| `quarantine` | drop or flag records matching injection patterns ("ignore previous instructions", …) |
+| `quarantine` | drop or flag records matching injection patterns ("ignore previous instructions", …); custom `patterns` extend the built-ins — `replacePatterns: true` is the explicit opt-out |
 | `rescore` | batch BM25 relevance with word-boundary matching and in-order proximity bonus |
 | `rank` | stable sort by a field; records missing the field sort last |
 | `truncateField` | cut one field to a token budget, `…` suffix |

package/dist/index.d.ts

@@ -8,4 +8,4 @@ export { pipeline, stage, type StageFn } from "./pipeline.js";
 export { shaped } from "./shaped.js";
 export { trace, currentTrace, Trace, type Entry } from "./trace.js";
 export * as tokens from "./tokens.js";
-export declare const VERSION = "0.1.16";
+export declare const VERSION = "0.1.17";

package/dist/index.js

@@ -8,4 +8,4 @@ export { pipeline, stage } from "./pipeline.js";
 export { shaped } from "./shaped.js";
 export { trace, currentTrace, Trace } from "./trace.js";
 export * as tokens from "./tokens.js";
-export const VERSION = "0.1.16";
+export const VERSION = "0.1.17";

package/dist/stages.d.ts

@@ -34,9 +34,10 @@ export declare const quarantine: (records: {
     [x: string]: unknown;
 }[], params?: {
     fields?: string | string[];
-    patterns?: string[];
+    patterns?: string | string[];
     action?: "drop" | "flag";
     into?: string;
+    replacePatterns?: boolean;
 } | undefined) => {
     [x: string]: unknown;
 }[];

package/dist/stages.js

@@ -105,7 +105,32 @@ export const quarantine = traced("quarantine", (records, params = {}) => {
     if (action !== "drop" && action !== "flag") {
         throw new Error(`action must be 'drop' or 'flag', got ${String(action)}`);
     }
-    const matcher = new RegExp((params.patterns ?? INJECTION_PATTERNS).join("|"), "i");
+    // custom patterns EXTEND the built-ins: passing domain markers must
+    // never silently disable "ignore all previous instructions" detection;
+    // replacePatterns is the explicit opt-out
+    let patternList;
+    if (params.patterns === undefined) {
+        if (params.replacePatterns) {
+            throw new Error("replacePatterns without patterns is contradictory; pass the replacement patterns");
+        }
+        patternList = INJECTION_PATTERNS;
+    }
+    else {
+        const userPatterns = fieldList(params.patterns);
+        if (userPatterns.some((p) => !p)) {
+            // an empty fragment becomes an empty regex alternative, which
+            // matches EVERY record — the opposite of configuring a screen
+            throw new Error("empty pattern fragments match everything; remove them");
+        }
+        patternList = params.replacePatterns
+            ? userPatterns
+            : [...INJECTION_PATTERNS, ...userPatterns];
+    }
+    if (!patternList.length) {
+        throw new Error("replacePatterns with no patterns would disable the control entirely; " +
+            "pass at least one pattern");
+    }
+    const matcher = new RegExp(patternList.join("|"), "i");
     const out = [];
     for (const r of records) {
         // Python str(r.get(f, "")): None -> "None", nested containers via
@@ -175,7 +200,9 @@ export const rescore = traced("rescore", (records, params) => {
                 const firstIdx = idx;
                 while (idx !== -1) {
                     cnt++;
-                    idx = text.indexOf(t, idx + 1);
+                    // Python str.count is NON-overlapping: advance past the whole
+                    // match ("aaaa".count("aa") === 2)
+                    idx = text.indexOf(t, idx + t.length);
                 }
                 if (cnt) {
                     row.set(t, cnt);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contexel",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Deterministic, dependency-free context shaping for code-writing agents — TypeScript parity of the Python package, enforced by shared golden vectors.",
   "keywords": ["llm", "agents", "context-engineering", "tokens", "tool-use", "rag"],
   "license": "MIT",