cowork-os 0.3.21

package/dist/electron/electron/agent/security/input-sanitizer.js

@@ -0,0 +1,303 @@
+"use strict";
+/**
+ * Input Sanitizer
+ *
+ * Preprocesses user input before LLM processing to detect and handle
+ * potentially malicious patterns like:
+ * - Encoded instructions (base64, ROT13)
+ * - System impersonation attempts
+ * - Document/content injection
+ * - Hidden instructions in various formats
+ *
+ * This is a defense-in-depth layer that runs transparently without
+ * restricting legitimate user capabilities.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InputSanitizer = void 0;
+class InputSanitizer {
+    /**
+     * Perform full sanitization analysis on input
+     */
+    static analyze(input) {
+        const hasEncodedContent = this.detectEncodedContent(input);
+        const hasImpersonation = this.detectImpersonation(input);
+        const hasContentInjection = this.detectContentInjection(input);
+        // Calculate threat level
+        let threatLevel = 'none';
+        if (hasImpersonation.detected) {
+            threatLevel = 'high';
+        }
+        else if (hasEncodedContent.hasEncoded && hasEncodedContent.decodedPayload) {
+            threatLevel = 'high';
+        }
+        else if (hasContentInjection.detected) {
+            threatLevel = 'medium';
+        }
+        else if (hasEncodedContent.hasEncoded) {
+            threatLevel = 'low';
+        }
+        return {
+            originalLength: input.length,
+            hasEncodedContent,
+            hasImpersonation,
+            hasContentInjection,
+            threatLevel,
+        };
+    }
+    /**
+     * Detect and decode potentially encoded instructions
+     */
+    static detectEncodedContent(input) {
+        // Base64 detection - look for decode requests with base64 content
+        const base64Pattern = /(?:decode|base64|b64)\s*[:\s]*([A-Za-z0-9+/=]{20,})/gi;
+        let match;
+        while ((match = base64Pattern.exec(input)) !== null) {
+            try {
+                const decoded = Buffer.from(match[1], 'base64').toString('utf8');
+                // Check if decoded content is readable text (not binary garbage)
+                if (/^[\x20-\x7E\s]+$/.test(decoded) && this.containsInjectionPatterns(decoded)) {
+                    return {
+                        hasEncoded: true,
+                        decodedPayload: decoded,
+                        encodingType: 'base64',
+                    };
+                }
+            }
+            catch {
+                /* Invalid base64, continue */
+            }
+        }
+        // ROT13 / backwards text detection
+        const rot13Patterns = [
+            /(?:read|decode)\s*(?:this\s*)?backwards/gi,
+            /rot13/gi,
+            /reverse\s*(?:this|the\s*text)/gi,
+        ];
+        for (const pattern of rot13Patterns) {
+            if (pattern.test(input)) {
+                return { hasEncoded: true, encodingType: 'rot13' };
+            }
+        }
+        // Hex encoding detection
+        const hexPattern = /(?:hex|0x)\s*[:\s]*([0-9A-Fa-f]{20,})/gi;
+        while ((match = hexPattern.exec(input)) !== null) {
+            try {
+                const decoded = Buffer.from(match[1], 'hex').toString('utf8');
+                if (/^[\x20-\x7E\s]+$/.test(decoded) && this.containsInjectionPatterns(decoded)) {
+                    return {
+                        hasEncoded: true,
+                        decodedPayload: decoded,
+                        encodingType: 'hex',
+                    };
+                }
+            }
+            catch {
+                /* Invalid hex, continue */
+            }
+        }
+        return { hasEncoded: false };
+    }
+    /**
+     * Detect system impersonation attempts
+     */
+    static detectImpersonation(input) {
+        for (const { pattern, type } of this.IMPERSONATION_PATTERNS) {
+            const match = input.match(pattern);
+            if (match) {
+                return {
+                    detected: true,
+                    type,
+                    pattern: match[0],
+                };
+            }
+        }
+        return { detected: false };
+    }
+    /**
+     * Detect document/content injection attempts
+     */
+    static detectContentInjection(input) {
+        for (const { pattern, type } of this.CONTENT_INJECTION_PATTERNS) {
+            if (pattern.test(input)) {
+                return { detected: true, type };
+            }
+        }
+        return { detected: false };
+    }
+    /**
+     * Sanitize code content for review (annotate suspicious patterns)
+     * For code that will be REVIEWED (not executed), we annotate suspicious patterns
+     */
+    static sanitizeCodeForReview(code) {
+        const detectedPatterns = [];
+        let sanitized = code;
+        for (const pattern of this.CODE_INJECTION_PATTERNS) {
+            const matches = code.match(pattern);
+            if (matches) {
+                detectedPatterns.push(...matches);
+                // Replace with annotation that flags the suspicious content
+                sanitized = sanitized.replace(pattern, '[SUSPICIOUS_INJECTION_PATTERN_DETECTED: $&]');
+            }
+        }
+        return {
+            detected: detectedPatterns.length > 0,
+            patterns: detectedPatterns,
+            sanitized,
+        };
+    }
+    /**
+     * Add security context to user message if threats detected
+     * This doesn't block the message, just adds awareness for the LLM
+     */
+    static addSecurityContext(input, report) {
+        if (report.threatLevel === 'none') {
+            return input;
+        }
+        const warnings = [];
+        if (report.hasImpersonation.detected) {
+            warnings.push(`system impersonation attempt detected (${report.hasImpersonation.type})`);
+        }
+        if (report.hasEncodedContent.hasEncoded) {
+            warnings.push(`encoded content detected (${report.hasEncodedContent.encodingType})`);
+        }
+        if (report.hasContentInjection.detected) {
+            warnings.push(`content injection pattern detected (${report.hasContentInjection.type})`);
+        }
+        if (warnings.length === 0) {
+            return input;
+        }
+        // Add security note as metadata, not blocking the content
+        return `[Security Analysis: ${warnings.join('; ')}]\n\n${input}`;
+    }
+    /**
+     * Check if text contains patterns typically used in injection attacks
+     */
+    static containsInjectionPatterns(text) {
+        return this.INJECTION_PATTERNS.some((p) => p.test(text));
+    }
+    /**
+     * Sanitize memory content before injection into system prompt
+     * Removes patterns that could be used to manipulate the agent
+     */
+    static sanitizeMemoryContent(memory) {
+        if (!memory)
+            return '';
+        let sanitized = memory;
+        // Remove instruction-override patterns that may have been stored
+        const memoryDangerousPatterns = [
+            /NEW\s+INSTRUCTIONS?\s*:/gi,
+            /SYSTEM\s*:/gi,
+            /IGNORE\s+(ALL\s+)?PREVIOUS\s+(INSTRUCTIONS?|PROMPTS?)/gi,
+            /DISREGARD\s+(ALL\s+)?PREVIOUS/gi,
+            /OVERRIDE\s+(?:SYSTEM|INSTRUCTIONS?)/gi,
+            /\[INST\]/gi,
+            /<<SYS>>/gi,
+            /<\|im_start\|>/gi,
+        ];
+        for (const pattern of memoryDangerousPatterns) {
+            sanitized = sanitized.replace(pattern, '[filtered_memory_content]');
+        }
+        return sanitized;
+    }
+    /**
+     * Validate and sanitize skill guidelines before injection
+     */
+    static validateSkillGuidelines(guidelines) {
+        const issues = [];
+        let sanitized = guidelines;
+        const dangerousPatterns = [
+            {
+                pattern: /ignore\s+(all\s+)?previous\s+(instructions?|prompts?)/gi,
+                issue: 'Contains "ignore previous instructions" pattern',
+            },
+            {
+                pattern: /disregard\s+(all\s+)?previous/gi,
+                issue: 'Contains "disregard previous" pattern',
+            },
+            {
+                pattern: /your\s+system\s+prompt/gi,
+                issue: 'References system prompt',
+            },
+            {
+                pattern: /reveal\s+your\s+(instructions?|configuration)/gi,
+                issue: 'Attempts to request instruction disclosure',
+            },
+            {
+                pattern: /output\s+your\s+(system\s+)?prompt/gi,
+                issue: 'Attempts to extract prompt',
+            },
+            {
+                pattern: /new\s+instructions?\s*:/gi,
+                issue: 'Contains instruction override marker',
+            },
+            {
+                pattern: /<<SYS>>|<\|im_start\|>|\[INST\]/gi,
+                issue: 'Contains model-specific injection markers',
+            },
+        ];
+        for (const { pattern, issue } of dangerousPatterns) {
+            if (pattern.test(guidelines)) {
+                issues.push(issue);
+                sanitized = sanitized.replace(pattern, '[filtered_guideline]');
+            }
+        }
+        return {
+            valid: issues.length === 0,
+            issues,
+            sanitized,
+        };
+    }
+}
+exports.InputSanitizer = InputSanitizer;
+// Patterns that indicate injection attempts when decoded
+InputSanitizer.INJECTION_PATTERNS = [
+    /say\s+["'][^"']+["']/i,
+    /respond\s+with/i,
+    /your\s+response/i,
+    /ignore\s+(all\s+)?previous/i,
+    /disregard\s+(all\s+)?previous/i,
+    /forget\s+(all\s+)?previous/i,
+    /new\s+instructions?/i,
+    /system\s*:/i,
+    /override/i,
+];
+// System impersonation patterns
+InputSanitizer.IMPERSONATION_PATTERNS = [
+    { pattern: /\[SYSTEM\]/i, type: 'system' },
+    { pattern: /\[\/SYSTEM\]/i, type: 'system' },
+    { pattern: /<SYSTEM>/i, type: 'system' },
+    { pattern: /<\/SYSTEM>/i, type: 'system' },
+    { pattern: /\[ADMIN\s*OVERRIDE\]/i, type: 'admin' },
+    { pattern: /\[NEW\s*DIRECTIVE\]/i, type: 'directive' },
+    { pattern: /\[PRIORITY\s*INSTRUCTION\]/i, type: 'directive' },
+    { pattern: /INITIATING\s+\w+\s+MODE/i, type: 'mode' },
+    { pattern: /ACTIVATING\s+\w+\s+MODE/i, type: 'mode' },
+    { pattern: /<<\s*SYS\s*>>/i, type: 'system' },
+    { pattern: /<\|im_start\|>system/i, type: 'system' },
+    { pattern: /<\|system\|>/i, type: 'system' },
+    { pattern: /\[INST\]/i, type: 'system' },
+    { pattern: /###\s*System/i, type: 'system' },
+];
+// Document injection patterns (hidden instructions in content)
+InputSanitizer.CONTENT_INJECTION_PATTERNS = [
+    {
+        pattern: /---\s*BEGIN\s*DOCUMENT\s*---[\s\S]*?(?:AI|ASSISTANT|SYSTEM)\s*:/gi,
+        type: 'document',
+    },
+    { pattern: /<!--[\s\S]*?(?:AI|ASSISTANT)\s*:[\s\S]*?-->/gi, type: 'html' },
+    {
+        pattern: /\[(?:AI|ASSISTANT|SYSTEM)[\s_]*(?:INSTRUCTION|NOTE|COMMAND)\s*:/gi,
+        type: 'document',
+    },
+    { pattern: /From:.*\nSubject:.*\n[\s\S]*?(?:AI|ASSISTANT)\s*:/gi, type: 'email' },
+];
+// Patterns for hidden instructions in code
+InputSanitizer.CODE_INJECTION_PATTERNS = [
+    /(?:AI|ASSISTANT|SYSTEM)_?INSTRUCTION\s*:/gi,
+    /\/\*\s*(?:AI|ASSISTANT)\s*:/gi,
+    /<!--\s*(?:AI|ASSISTANT)\s*:/gi,
+    /\/\/\s*(?:AI|ASSISTANT)\s*:/gi,
+    /#\s*(?:AI|ASSISTANT)\s*:/gi,
+    /['"](?:AI|ASSISTANT)_?(?:INSTRUCTION|COMMAND)['"]?\s*:/gi,
+    /(?:HIDDEN|SECRET)_?INSTRUCTION\s*:/gi,
+];

package/dist/electron/electron/agent/security/output-filter.js

@@ -0,0 +1,217 @@
+"use strict";
+/**
+ * Output Filter
+ *
+ * Post-processes LLM responses before delivery to detect potential
+ * prompt injection compliance. This is a monitoring/detection layer
+ * that flags suspicious patterns without blocking legitimate outputs.
+ *
+ * Detects:
+ * - Canary/verification strings
+ * - Word count suffixes
+ * - Tracking codes
+ * - System prompt leakage indicators
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OutputFilter = void 0;
+class OutputFilter {
+    /**
+     * Check response for potential injection compliance
+     */
+    static check(response) {
+        const patterns = [];
+        // Check canary patterns
+        for (const pattern of this.CANARY_PATTERNS) {
+            const matches = response.match(pattern);
+            if (matches) {
+                patterns.push(...matches.map((m) => `canary: ${m}`));
+            }
+        }
+        // Check format injection patterns
+        for (const pattern of this.FORMAT_INJECTION_PATTERNS) {
+            const matches = response.match(pattern);
+            if (matches) {
+                patterns.push(...matches.map((m) => `format: ${m}`));
+            }
+        }
+        // Check for prompt leakage
+        const promptLeakage = this.detectPromptLeakage(response);
+        // Determine threat level
+        let threatLevel = 'none';
+        if (promptLeakage.confidence === 'high') {
+            threatLevel = 'high';
+        }
+        else if (promptLeakage.detected || patterns.length > 2) {
+            threatLevel = 'medium';
+        }
+        else if (patterns.length > 0) {
+            threatLevel = 'low';
+        }
+        return {
+            suspicious: patterns.length > 0 || promptLeakage.detected,
+            patterns,
+            promptLeakage,
+            threatLevel,
+        };
+    }
+    /**
+     * Detect potential system prompt leakage in response
+     */
+    static detectPromptLeakage(response) {
+        const indicators = [];
+        let totalWeight = 0;
+        for (const { pattern, indicator, weight } of this.PROMPT_LEAKAGE_PATTERNS) {
+            if (pattern.test(response)) {
+                indicators.push(indicator);
+                totalWeight += weight;
+            }
+        }
+        // Determine confidence based on weight
+        let confidence = 'low';
+        if (totalWeight >= 10) {
+            confidence = 'high';
+        }
+        else if (totalWeight >= 5) {
+            confidence = 'medium';
+        }
+        return {
+            detected: indicators.length > 0,
+            indicators,
+            confidence,
+        };
+    }
+    /**
+     * Sanitize tool results before sending to LLM
+     * Annotates potential injection attempts in retrieved content
+     */
+    static sanitizeToolResult(toolName, result) {
+        // Tools that retrieve external content need sanitization
+        const contentTools = [
+            'browser_get_content',
+            'read_file',
+            'web_search',
+            'web_fetch',
+            'search_files',
+        ];
+        if (!contentTools.includes(toolName)) {
+            return result;
+        }
+        // Annotate instruction-like patterns in retrieved content
+        const contentInjectionPatterns = [
+            /(?:AI|ASSISTANT|SYSTEM)[\s_]*(?:INSTRUCTION|NOTE|COMMAND)\s*:/gi,
+            /<!--\s*(?:AI|ASSISTANT)\s*:[^>]*-->/gi,
+            /\/\*\s*(?:AI|ASSISTANT)\s*:[^*]*\*\//gi,
+            /\/\/\s*(?:AI|ASSISTANT)\s*:.*/gi,
+            /#\s*(?:AI|ASSISTANT)\s*:.*/gi,
+            /\[(?:IGNORE|OVERRIDE|NEW)\s*(?:PREVIOUS|SYSTEM|INSTRUCTIONS?)\]/gi,
+        ];
+        let sanitized = result;
+        for (const pattern of contentInjectionPatterns) {
+            sanitized = sanitized.replace(pattern, '[EXTERNAL_CONTENT_INJECTION_DETECTED]');
+        }
+        return sanitized;
+    }
+    /**
+     * Log suspicious output for security monitoring
+     */
+    static logSuspiciousOutput(taskId, result, responsePreview) {
+        if (result.threatLevel === 'none') {
+            return;
+        }
+        const preview = responsePreview.slice(0, 200).replace(/\n/g, '\\n');
+        console.warn(`[OutputFilter] Suspicious output detected in task ${taskId}:`, {
+            threatLevel: result.threatLevel,
+            patterns: result.patterns,
+            promptLeakage: result.promptLeakage.detected
+                ? result.promptLeakage.indicators
+                : 'none',
+            preview: `${preview}...`,
+        });
+    }
+}
+exports.OutputFilter = OutputFilter;
+// Patterns that indicate the LLM may have complied with canary injection
+OutputFilter.CANARY_PATTERNS = [
+    // Verification strings like ZEBRA_CONFIRMED_9X7K
+    /\b[A-Z]{3,}_(?:CONFIRMED|VERIFIED|ACTIVE|SUCCESS|CODE)[_\s]*[A-Z0-9]{2,}\b/g,
+    // Generic canary patterns
+    /\b(?:CANARY|VERIFICATION|TRACKING)[_\s]*(?:CODE|STRING|ID)[_\s:]*[A-Z0-9]+\b/gi,
+];
+// Patterns for format injection compliance
+OutputFilter.FORMAT_INJECTION_PATTERNS = [
+    // Word count suffixes [WORDS: 37]
+    /\[WORDS\s*:\s*\d+\]/gi,
+    // Character count suffixes
+    /\[CHARS?\s*:\s*\d+\]/gi,
+    // Token count
+    /\[TOKENS?\s*:\s*\d+\]/gi,
+    // Mode activation confirmations
+    /\b(?:TEST|DEBUG|ADMIN|ROBOT|PIRATE)_?MODE\s*(?:ACTIVATED?|ACTIVE|ENABLED)\b/gi,
+    // Tracking markers
+    /\[(?:VERIFIED|CONFIRMED|PROCESSED|RECEIVED)[:\s][^\]]*\]/gi,
+    // End transmission markers
+    /\bEND[_\s]*TRANSMISSION\b/gi,
+];
+// Patterns that may indicate system prompt leakage
+OutputFilter.PROMPT_LEAKAGE_PATTERNS = [
+    {
+        pattern: /system[_\s]*role\s*:/gi,
+        indicator: 'YAML system_role key',
+        weight: 3,
+    },
+    {
+        pattern: /initial[_\s]*instructions?\s*:/gi,
+        indicator: 'YAML initial_instructions key',
+        weight: 3,
+    },
+    {
+        pattern: /You are an autonomous task executor/gi,
+        indicator: 'Core system prompt text',
+        weight: 5,
+    },
+    {
+        pattern: /AUTONOMOUS OPERATION \(CRITICAL\)/gi,
+        indicator: 'System prompt section header',
+        weight: 5,
+    },
+    {
+        pattern: /PATH DISCOVERY \(CRITICAL\)/gi,
+        indicator: 'System prompt section header',
+        weight: 5,
+    },
+    {
+        pattern: /TOOL CALL STYLE/gi,
+        indicator: 'System prompt section header',
+        weight: 4,
+    },
+    {
+        pattern: /EFFICIENCY RULES \(CRITICAL\)/gi,
+        indicator: 'System prompt section header',
+        weight: 5,
+    },
+    {
+        pattern: /ANTI-PATTERNS \(NEVER DO THESE\)/gi,
+        indicator: 'System prompt section header',
+        weight: 5,
+    },
+    {
+        pattern: /constraints\s*:\s*\n\s*-/gi,
+        indicator: 'YAML constraints list',
+        weight: 3,
+    },
+    {
+        pattern: /capabilities\s*:\s*\n\s*-/gi,
+        indicator: 'YAML capabilities list',
+        weight: 3,
+    },
+    {
+        pattern: /```yaml\s*\n\s*system/gi,
+        indicator: 'YAML code block with system',
+        weight: 4,
+    },
+    {
+        pattern: /my\s+(?:system\s+)?(?:instructions?|prompt|configuration)\s+(?:are|is|say)/gi,
+        indicator: 'Direct instruction disclosure',
+        weight: 4,
+    },
+];