cowork-os 0.3.21

package/src/electron/agent/search/types.ts

@@ -0,0 +1,118 @@
+/**
+ * Search Provider abstraction types
+ * Allows switching between Tavily, Brave Search, SerpAPI, and Google Custom Search
+ */
+
+export type SearchProviderType = 'tavily' | 'brave' | 'serpapi' | 'google';
+
+export type SearchType = 'web' | 'news' | 'images';
+
+export interface SearchProviderConfig {
+  type: SearchProviderType;
+  // Tavily-specific
+  tavilyApiKey?: string;
+  // Brave-specific
+  braveApiKey?: string;
+  // SerpAPI-specific
+  serpApiKey?: string;
+  // Google Custom Search-specific
+  googleApiKey?: string;
+  googleSearchEngineId?: string;
+}
+
+export interface SearchQuery {
+  query: string;
+  searchType?: SearchType;
+  maxResults?: number;
+  // Optional filters
+  dateRange?: 'day' | 'week' | 'month' | 'year';
+  region?: string; // e.g., 'us', 'uk', 'de'
+  language?: string; // e.g., 'en', 'de', 'fr'
+  safeSearch?: boolean;
+  // Override provider for this query
+  provider?: SearchProviderType;
+}
+
+export interface SearchResult {
+  title: string;
+  url: string;
+  snippet: string;
+  // Optional metadata
+  publishedDate?: string;
+  source?: string;
+  // For image search
+  thumbnailUrl?: string;
+  imageUrl?: string;
+  width?: number;
+  height?: number;
+}
+
+export interface SearchResponse {
+  results: SearchResult[];
+  query: string;
+  searchType: SearchType;
+  totalResults?: number;
+  provider: SearchProviderType | 'none';
+  // Optional metadata for additional info (e.g., errors, configuration status)
+  metadata?: {
+    error?: string;
+    notConfigured?: boolean;
+    [key: string]: unknown;
+  };
+}
+
+/**
+ * Abstract Search Provider interface
+ */
+export interface SearchProvider {
+  readonly type: SearchProviderType;
+
+  /**
+   * Supported search types for this provider
+   */
+  readonly supportedSearchTypes: SearchType[];
+
+  /**
+   * Perform a search query
+   */
+  search(query: SearchQuery): Promise<SearchResponse>;
+
+  /**
+   * Test the provider connection/API key validity
+   */
+  testConnection(): Promise<{ success: boolean; error?: string }>;
+}
+
+/**
+ * Provider capabilities for UI display
+ */
+export const SEARCH_PROVIDER_INFO = {
+  tavily: {
+    displayName: 'Tavily',
+    description: 'AI-focused search API with structured results',
+    supportedTypes: ['web', 'news'] as SearchType[],
+    envVar: 'TAVILY_API_KEY',
+    signupUrl: 'https://tavily.com/',
+  },
+  brave: {
+    displayName: 'Brave Search',
+    description: 'Privacy-focused web, news, and image search',
+    supportedTypes: ['web', 'news', 'images'] as SearchType[],
+    envVar: 'BRAVE_API_KEY',
+    signupUrl: 'https://brave.com/search/api/',
+  },
+  serpapi: {
+    displayName: 'SerpAPI',
+    description: 'Aggregates Google, Bing, DuckDuckGo results',
+    supportedTypes: ['web', 'news', 'images'] as SearchType[],
+    envVar: 'SERPAPI_KEY',
+    signupUrl: 'https://serpapi.com/',
+  },
+  google: {
+    displayName: 'Google Custom Search',
+    description: 'Official Google Search API',
+    supportedTypes: ['web', 'images'] as SearchType[],
+    envVars: ['GOOGLE_API_KEY', 'GOOGLE_SEARCH_ENGINE_ID'],
+    signupUrl: 'https://developers.google.com/custom-search/v1/introduction',
+  },
+} as const;

package/src/electron/agent/security/index.ts

@@ -0,0 +1,20 @@
+/**
+ * Security Module
+ *
+ * Exports all security-related utilities for the agent system.
+ */
+
+export { InputSanitizer } from './input-sanitizer';
+export type {
+  EncodedContentResult,
+  ImpersonationResult,
+  ContentInjectionResult,
+  CodeInjectionResult,
+  SanitizationReport,
+} from './input-sanitizer';
+
+export { OutputFilter } from './output-filter';
+export type {
+  ComplianceCheckResult,
+  PromptLeakageResult,
+} from './output-filter';

package/src/electron/agent/security/input-sanitizer.ts

@@ -0,0 +1,380 @@
+/**
+ * Input Sanitizer
+ *
+ * Preprocesses user input before LLM processing to detect and handle
+ * potentially malicious patterns like:
+ * - Encoded instructions (base64, ROT13)
+ * - System impersonation attempts
+ * - Document/content injection
+ * - Hidden instructions in various formats
+ *
+ * This is a defense-in-depth layer that runs transparently without
+ * restricting legitimate user capabilities.
+ */
+
+export interface EncodedContentResult {
+  hasEncoded: boolean;
+  decodedPayload?: string;
+  encodingType?: 'base64' | 'rot13' | 'hex' | 'unicode';
+}
+
+export interface ImpersonationResult {
+  detected: boolean;
+  type?: 'system' | 'admin' | 'directive' | 'mode';
+  pattern?: string;
+}
+
+export interface ContentInjectionResult {
+  detected: boolean;
+  type?: 'document' | 'email' | 'code' | 'html';
+  location?: string;
+}
+
+export interface CodeInjectionResult {
+  detected: boolean;
+  patterns: string[];
+  sanitized: string;
+}
+
+export interface SanitizationReport {
+  originalLength: number;
+  hasEncodedContent: EncodedContentResult;
+  hasImpersonation: ImpersonationResult;
+  hasContentInjection: ContentInjectionResult;
+  threatLevel: 'none' | 'low' | 'medium' | 'high';
+}
+
+export class InputSanitizer {
+  // Patterns that indicate injection attempts when decoded
+  private static readonly INJECTION_PATTERNS = [
+    /say\s+["'][^"']+["']/i,
+    /respond\s+with/i,
+    /your\s+response/i,
+    /ignore\s+(all\s+)?previous/i,
+    /disregard\s+(all\s+)?previous/i,
+    /forget\s+(all\s+)?previous/i,
+    /new\s+instructions?/i,
+    /system\s*:/i,
+    /override/i,
+  ];
+
+  // System impersonation patterns
+  private static readonly IMPERSONATION_PATTERNS: Array<{
+    pattern: RegExp;
+    type: 'system' | 'admin' | 'directive' | 'mode';
+  }> = [
+    { pattern: /\[SYSTEM\]/i, type: 'system' },
+    { pattern: /\[\/SYSTEM\]/i, type: 'system' },
+    { pattern: /<SYSTEM>/i, type: 'system' },
+    { pattern: /<\/SYSTEM>/i, type: 'system' },
+    { pattern: /\[ADMIN\s*OVERRIDE\]/i, type: 'admin' },
+    { pattern: /\[NEW\s*DIRECTIVE\]/i, type: 'directive' },
+    { pattern: /\[PRIORITY\s*INSTRUCTION\]/i, type: 'directive' },
+    { pattern: /INITIATING\s+\w+\s+MODE/i, type: 'mode' },
+    { pattern: /ACTIVATING\s+\w+\s+MODE/i, type: 'mode' },
+    { pattern: /<<\s*SYS\s*>>/i, type: 'system' },
+    { pattern: /<\|im_start\|>system/i, type: 'system' },
+    { pattern: /<\|system\|>/i, type: 'system' },
+    { pattern: /\[INST\]/i, type: 'system' },
+    { pattern: /###\s*System/i, type: 'system' },
+  ];
+
+  // Document injection patterns (hidden instructions in content)
+  private static readonly CONTENT_INJECTION_PATTERNS: Array<{
+    pattern: RegExp;
+    type: 'document' | 'email' | 'code' | 'html';
+  }> = [
+    {
+      pattern: /---\s*BEGIN\s*DOCUMENT\s*---[\s\S]*?(?:AI|ASSISTANT|SYSTEM)\s*:/gi,
+      type: 'document',
+    },
+    { pattern: /<!--[\s\S]*?(?:AI|ASSISTANT)\s*:[\s\S]*?-->/gi, type: 'html' },
+    {
+      pattern: /\[(?:AI|ASSISTANT|SYSTEM)[\s_]*(?:INSTRUCTION|NOTE|COMMAND)\s*:/gi,
+      type: 'document',
+    },
+    { pattern: /From:.*\nSubject:.*\n[\s\S]*?(?:AI|ASSISTANT)\s*:/gi, type: 'email' },
+  ];
+
+  // Patterns for hidden instructions in code
+  private static readonly CODE_INJECTION_PATTERNS = [
+    /(?:AI|ASSISTANT|SYSTEM)_?INSTRUCTION\s*:/gi,
+    /\/\*\s*(?:AI|ASSISTANT)\s*:/gi,
+    /<!--\s*(?:AI|ASSISTANT)\s*:/gi,
+    /\/\/\s*(?:AI|ASSISTANT)\s*:/gi,
+    /#\s*(?:AI|ASSISTANT)\s*:/gi,
+    /['"](?:AI|ASSISTANT)_?(?:INSTRUCTION|COMMAND)['"]?\s*:/gi,
+    /(?:HIDDEN|SECRET)_?INSTRUCTION\s*:/gi,
+  ];
+
+  /**
+   * Perform full sanitization analysis on input
+   */
+  static analyze(input: string): SanitizationReport {
+    const hasEncodedContent = this.detectEncodedContent(input);
+    const hasImpersonation = this.detectImpersonation(input);
+    const hasContentInjection = this.detectContentInjection(input);
+
+    // Calculate threat level
+    let threatLevel: 'none' | 'low' | 'medium' | 'high' = 'none';
+
+    if (hasImpersonation.detected) {
+      threatLevel = 'high';
+    } else if (hasEncodedContent.hasEncoded && hasEncodedContent.decodedPayload) {
+      threatLevel = 'high';
+    } else if (hasContentInjection.detected) {
+      threatLevel = 'medium';
+    } else if (hasEncodedContent.hasEncoded) {
+      threatLevel = 'low';
+    }
+
+    return {
+      originalLength: input.length,
+      hasEncodedContent,
+      hasImpersonation,
+      hasContentInjection,
+      threatLevel,
+    };
+  }
+
+  /**
+   * Detect and decode potentially encoded instructions
+   */
+  static detectEncodedContent(input: string): EncodedContentResult {
+    // Base64 detection - look for decode requests with base64 content
+    const base64Pattern = /(?:decode|base64|b64)\s*[:\s]*([A-Za-z0-9+/=]{20,})/gi;
+    let match: RegExpExecArray | null;
+
+    while ((match = base64Pattern.exec(input)) !== null) {
+      try {
+        const decoded = Buffer.from(match[1], 'base64').toString('utf8');
+        // Check if decoded content is readable text (not binary garbage)
+        if (/^[\x20-\x7E\s]+$/.test(decoded) && this.containsInjectionPatterns(decoded)) {
+          return {
+            hasEncoded: true,
+            decodedPayload: decoded,
+            encodingType: 'base64',
+          };
+        }
+      } catch {
+        /* Invalid base64, continue */
+      }
+    }
+
+    // ROT13 / backwards text detection
+    const rot13Patterns = [
+      /(?:read|decode)\s*(?:this\s*)?backwards/gi,
+      /rot13/gi,
+      /reverse\s*(?:this|the\s*text)/gi,
+    ];
+
+    for (const pattern of rot13Patterns) {
+      if (pattern.test(input)) {
+        return { hasEncoded: true, encodingType: 'rot13' };
+      }
+    }
+
+    // Hex encoding detection
+    const hexPattern = /(?:hex|0x)\s*[:\s]*([0-9A-Fa-f]{20,})/gi;
+    while ((match = hexPattern.exec(input)) !== null) {
+      try {
+        const decoded = Buffer.from(match[1], 'hex').toString('utf8');
+        if (/^[\x20-\x7E\s]+$/.test(decoded) && this.containsInjectionPatterns(decoded)) {
+          return {
+            hasEncoded: true,
+            decodedPayload: decoded,
+            encodingType: 'hex',
+          };
+        }
+      } catch {
+        /* Invalid hex, continue */
+      }
+    }
+
+    return { hasEncoded: false };
+  }
+
+  /**
+   * Detect system impersonation attempts
+   */
+  static detectImpersonation(input: string): ImpersonationResult {
+    for (const { pattern, type } of this.IMPERSONATION_PATTERNS) {
+      const match = input.match(pattern);
+      if (match) {
+        return {
+          detected: true,
+          type,
+          pattern: match[0],
+        };
+      }
+    }
+    return { detected: false };
+  }
+
+  /**
+   * Detect document/content injection attempts
+   */
+  static detectContentInjection(input: string): ContentInjectionResult {
+    for (const { pattern, type } of this.CONTENT_INJECTION_PATTERNS) {
+      if (pattern.test(input)) {
+        return { detected: true, type };
+      }
+    }
+    return { detected: false };
+  }
+
+  /**
+   * Sanitize code content for review (annotate suspicious patterns)
+   * For code that will be REVIEWED (not executed), we annotate suspicious patterns
+   */
+  static sanitizeCodeForReview(code: string): CodeInjectionResult {
+    const detectedPatterns: string[] = [];
+    let sanitized = code;
+
+    for (const pattern of this.CODE_INJECTION_PATTERNS) {
+      const matches = code.match(pattern);
+      if (matches) {
+        detectedPatterns.push(...matches);
+        // Replace with annotation that flags the suspicious content
+        sanitized = sanitized.replace(
+          pattern,
+          '[SUSPICIOUS_INJECTION_PATTERN_DETECTED: $&]'
+        );
+      }
+    }
+
+    return {
+      detected: detectedPatterns.length > 0,
+      patterns: detectedPatterns,
+      sanitized,
+    };
+  }
+
+  /**
+   * Add security context to user message if threats detected
+   * This doesn't block the message, just adds awareness for the LLM
+   */
+  static addSecurityContext(input: string, report: SanitizationReport): string {
+    if (report.threatLevel === 'none') {
+      return input;
+    }
+
+    const warnings: string[] = [];
+
+    if (report.hasImpersonation.detected) {
+      warnings.push(
+        `system impersonation attempt detected (${report.hasImpersonation.type})`
+      );
+    }
+
+    if (report.hasEncodedContent.hasEncoded) {
+      warnings.push(
+        `encoded content detected (${report.hasEncodedContent.encodingType})`
+      );
+    }
+
+    if (report.hasContentInjection.detected) {
+      warnings.push(
+        `content injection pattern detected (${report.hasContentInjection.type})`
+      );
+    }
+
+    if (warnings.length === 0) {
+      return input;
+    }
+
+    // Add security note as metadata, not blocking the content
+    return `[Security Analysis: ${warnings.join('; ')}]\n\n${input}`;
+  }
+
+  /**
+   * Check if text contains patterns typically used in injection attacks
+   */
+  private static containsInjectionPatterns(text: string): boolean {
+    return this.INJECTION_PATTERNS.some((p) => p.test(text));
+  }
+
+  /**
+   * Sanitize memory content before injection into system prompt
+   * Removes patterns that could be used to manipulate the agent
+   */
+  static sanitizeMemoryContent(memory: string): string {
+    if (!memory) return '';
+
+    let sanitized = memory;
+
+    // Remove instruction-override patterns that may have been stored
+    const memoryDangerousPatterns = [
+      /NEW\s+INSTRUCTIONS?\s*:/gi,
+      /SYSTEM\s*:/gi,
+      /IGNORE\s+(ALL\s+)?PREVIOUS\s+(INSTRUCTIONS?|PROMPTS?)/gi,
+      /DISREGARD\s+(ALL\s+)?PREVIOUS/gi,
+      /OVERRIDE\s+(?:SYSTEM|INSTRUCTIONS?)/gi,
+      /\[INST\]/gi,
+      /<<SYS>>/gi,
+      /<\|im_start\|>/gi,
+    ];
+
+    for (const pattern of memoryDangerousPatterns) {
+      sanitized = sanitized.replace(pattern, '[filtered_memory_content]');
+    }
+
+    return sanitized;
+  }
+
+  /**
+   * Validate and sanitize skill guidelines before injection
+   */
+  static validateSkillGuidelines(guidelines: string): {
+    valid: boolean;
+    issues: string[];
+    sanitized: string;
+  } {
+    const issues: string[] = [];
+    let sanitized = guidelines;
+
+    const dangerousPatterns: Array<{ pattern: RegExp; issue: string }> = [
+      {
+        pattern: /ignore\s+(all\s+)?previous\s+(instructions?|prompts?)/gi,
+        issue: 'Contains "ignore previous instructions" pattern',
+      },
+      {
+        pattern: /disregard\s+(all\s+)?previous/gi,
+        issue: 'Contains "disregard previous" pattern',
+      },
+      {
+        pattern: /your\s+system\s+prompt/gi,
+        issue: 'References system prompt',
+      },
+      {
+        pattern: /reveal\s+your\s+(instructions?|configuration)/gi,
+        issue: 'Attempts to request instruction disclosure',
+      },
+      {
+        pattern: /output\s+your\s+(system\s+)?prompt/gi,
+        issue: 'Attempts to extract prompt',
+      },
+      {
+        pattern: /new\s+instructions?\s*:/gi,
+        issue: 'Contains instruction override marker',
+      },
+      {
+        pattern: /<<SYS>>|<\|im_start\|>|\[INST\]/gi,
+        issue: 'Contains model-specific injection markers',
+      },
+    ];
+
+    for (const { pattern, issue } of dangerousPatterns) {
+      if (pattern.test(guidelines)) {
+        issues.push(issue);
+        sanitized = sanitized.replace(pattern, '[filtered_guideline]');
+      }
+    }
+
+    return {
+      valid: issues.length === 0,
+      issues,
+      sanitized,
+    };
+  }
+}