kodelyth-ecc 1.5.9 → 1.7.0

package/hooks/hooks.json

@@ -152,6 +152,19 @@
         ],
         "description": "Kodelyth Memory: auto-detect topic from each user prompt and inject relevant past memories before the AI responds (suppresses repeats per session)",
         "id": "kodelyth:user-prompt:memory-auto-recall"
+      },
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/safety/prompt-injection-guard.js\"",
+            "async": false,
+            "timeout": 3
+          }
+        ],
+        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "id": "kodelyth:user-prompt:prompt-injection-guard"
       }
     ],
     "PreCompact": [
@@ -168,6 +181,19 @@
       }
     ],
     "SessionStart": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/safety/token-budget.js\"",
+            "async": false,
+            "timeout": 3
+          }
+        ],
+        "description": "Kodelyth Safety: enforce per-session token budget. Opt-in via KODELYTH_TOKEN_BUDGET=<tokens>|warn (default off).",
+        "id": "kodelyth:session:start:token-budget"
+      },
       {
         "matcher": "*",
         "hooks": [
@@ -337,6 +363,19 @@
         ],
         "description": "Capture tool use results for continuous learning",
         "id": "post:observe:continuous-learning"
+      },
+      {
+        "matcher": "Read|WebFetch|mcp__.*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/safety/prompt-injection-guard.js\"",
+            "async": false,
+            "timeout": 3
+          }
+        ],
+        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "id": "kodelyth:post-tool:prompt-injection-guard"
       }
     ],
     "PostToolUseFailure": [
@@ -353,6 +392,19 @@
       }
     ],
     "Stop": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/safety/token-budget.js\"",
+            "async": false,
+            "timeout": 3
+          }
+        ],
+        "description": "Kodelyth Safety: accumulate per-session token usage and warn/block on budget threshold. Opt-in via KODELYTH_TOKEN_BUDGET=<tokens>|warn (default off).",
+        "id": "kodelyth:stop:token-budget"
+      },
       {
         "matcher": "*",
         "hooks": [

package/hooks/memory/auto-recall.js

@@ -50,7 +50,13 @@ function main() {
       limit:    MAX_RECALLED * 2,   // grab extra so we can filter out repeats
       minScore: MIN_SCORE,
     });
-    if (matches.length === 0) return done({});
+
+    // Phase 3.4 — record signal for self-evolving memory.
+    // Fire-and-forget; never block recall path on stats failure.
+    if (matches.length === 0) {
+      tryRecordRoutingMiss({ prompt: userPrompt, sessionId, projectRoot });
+      return done({});
+    }
 
     // Filter out memories already surfaced this session
     const surfacedFile = surfacedStatePath(sessionId);
@@ -62,6 +68,11 @@ function main() {
     for (const m of fresh) surfaced.add(m.id);
     saveSurfaced(surfacedFile, surfaced);
 
+    // Phase 3.4 — bump reuse counters for each freshly surfaced memory.
+    for (const m of fresh) {
+      tryRecordSurface({ memoryId: m.id, sessionId, projectRoot });
+    }
+
     const block = formatBlock(fresh, userPrompt);
     done({
       additionalContext: block,
@@ -131,6 +142,23 @@ function saveSurfaced(file, set) {
   }
 }
 
+// ── Phase 3.4 — self-evolving memory signals ────────────────────────────────
+// Lazy-require the evolve stats module so the hook does not pay the cost
+// (or crash on a broken module) unless we actually have something to record.
+function tryRecordSurface(args) {
+  try {
+    const stats = require(path.join(__dirname, '..', '..', 'scripts', 'evolve', 'stats.js'));
+    stats.recordSurface(args);
+  } catch { /* never break the hook */ }
+}
+
+function tryRecordRoutingMiss(args) {
+  try {
+    const stats = require(path.join(__dirname, '..', '..', 'scripts', 'evolve', 'stats.js'));
+    stats.recordRoutingMiss(args);
+  } catch { /* never break the hook */ }
+}
+
 function safeJson(s) {
   try { return JSON.parse(s); } catch { return {}; }
 }

package/hooks/safety/README.md

@@ -0,0 +1,124 @@
+# Kodelyth ECC — Safety Hooks
+
+Two production-ready safety primitives that ride on the existing ECC hook pipeline. Both are **off by default** — explicitly opt in via env vars so existing users see zero behavior change unless they ask for it.
+
+> Phase 2.10 of the [Devil Roadmap](../../README.md). Local-only, deterministic regex-based detection. No LLM calls. No telemetry.
+
+---
+
+## 1. `prompt-injection-guard.js`
+
+Scans inbound text for jailbreak / instruction-override patterns **before the model sees it**. Wires into:
+
+- `UserPromptSubmit` — scans the user's outbound message
+- `PostToolUse` on `Read|WebFetch|mcp__*` — scans tool responses for indirect injection from external content
+
+### Modes
+
+| `KODELYTH_PI_GUARD` | Behavior |
+|---|---|
+| `off` (or unset) | Hook does nothing. Default. |
+| `warn` | Always exits 0. Prints findings to stderr (visible in transcript). |
+| `block` | Exits 2 (block) on **critical** findings. Warns on high. Passes on medium. |
+
+### Severity tiers
+
+- **critical** — instruction override, system-prompt extraction, role rebind (DAN/dev-mode), exfiltration channel, decoded base64 jailbreak payload
+- **high** — hidden system markers (`[[SYSTEM]]`, `<|system|>`, `### NEW INSTRUCTIONS`), tool-call hijack patterns, jailbreak canaries, demands for unrestricted output
+- **medium** — generic "new instructions" keywords, invisible/bidi Unicode, large base64 blobs
+
+The full pattern catalog lives in `lib/patterns.js` — auditable and contributor-friendly.
+
+### Optional knobs
+
+```bash
+KODELYTH_PI_GUARD_LOG=/path/to/findings.jsonl   # append findings to a JSONL audit log
+KODELYTH_PI_GUARD_MAX_INPUT=20000               # truncate scanned text length
+```
+
+### Example
+
+```bash
+# Warn-only (recommended for first rollout)
+KODELYTH_PI_GUARD=warn claude
+
+# Hard block on critical (production / enterprise)
+KODELYTH_PI_GUARD=block KODELYTH_PI_GUARD_LOG=~/.kodelyth/safety/pi-audit.jsonl claude
+```
+
+---
+
+## 2. `token-budget.js`
+
+Tracks per-session token usage and **blocks new turns** once a configurable budget is exceeded. Wires into:
+
+- `SessionStart` — pre-check; can block if budget already exhausted
+- `Stop` — accumulates usage from transcript size + visible message lengths
+
+### Token estimation
+
+Hooks don't get authoritative token counts from the platform, so the budget enforcer uses a **4-chars-per-token heuristic** over the transcript path supplied in the Stop payload, plus visible prompt / tool-response text. Rough but stable, and good enough for guardrail purposes.
+
+### Modes
+
+| `KODELYTH_TOKEN_BUDGET` | Behavior |
+|---|---|
+| `off` (or unset) | Hook does nothing. Default. |
+| `warn` | Tracks usage and prints it to stderr after every turn. Never blocks. |
+| `<positive integer>` (e.g. `200000`) | Hard budget in tokens. Warns at threshold. Blocks `SessionStart` once usage ≥ budget. |
+
+### Optional knobs
+
+```bash
+KODELYTH_TOKEN_BUDGET_DIR=~/.kodelyth/safety   # state file directory (per-session JSON)
+KODELYTH_TOKEN_BUDGET_WARN=0.7                  # warn at this fraction of budget (default 0.7)
+KODELYTH_TOKEN_BUDGET_RESET=1                   # admin op: wipe session state and exit
+```
+
+### Example
+
+```bash
+# Warn-only — track but never block (good for cost visibility)
+KODELYTH_TOKEN_BUDGET=warn claude
+
+# Hard 200K-token budget per session, warn at 70%, block at 100%
+KODELYTH_TOKEN_BUDGET=200000 claude
+
+# Reset the current session's accumulated budget
+KODELYTH_TOKEN_BUDGET=200000 KODELYTH_TOKEN_BUDGET_RESET=1 claude
+```
+
+State files live at `${KODELYTH_TOKEN_BUDGET_DIR}/budget-<sessionId>.json`. Inspect or delete them manually anytime — the hook will recover gracefully.
+
+---
+
+## Why opt-in?
+
+Safety primitives that **silently block traffic** are how observability tools become "that thing the team hates." Both hooks default to `off` so:
+
+- Existing users upgrade to v1.7+ with zero behavior change.
+- Adoption happens deliberately — `warn` first, `block` once the team trusts the signal.
+- A misfire from a bad regex never silently kills a workflow.
+
+Both hooks **always exit 0 on internal errors** (parse failure, missing env, fs error) so a broken hook never blocks the user.
+
+---
+
+## Architecture
+
+```
+hooks/safety/
+├── README.md                      ← this file
+├── prompt-injection-guard.js      ← UserPromptSubmit + PostToolUse hook
+├── token-budget.js                ← SessionStart + Stop hook
+└── lib/
+    └── patterns.js                ← shared injection pattern catalog (regex + severity)
+```
+
+Both hooks read the standard Claude Code hook payload from stdin, echo it back to stdout for chained hooks, and write any human-readable report to stderr. Tests cover block/warn/off paths plus parse-failure recovery.
+
+Tests live at `tests/safety/`.
+
+---
+
+Built into [Kodelyth ECC](../../README.md). MIT licensed.

package/hooks/safety/lib/patterns.js

@@ -0,0 +1,179 @@
+// =============================================================================
+// Kodelyth ECC — Safety Pattern Catalog
+//
+// Shared detection patterns for prompt-injection-guard and any other safety
+// hook. Each pattern: { id, severity, regex, why }.
+//
+// Severity tiers:
+//   critical — strong override / system-prompt extraction / exfiltration
+//   high     — clear injection markers (likely malicious in untrusted input)
+//   medium   — suspicious context (could be legitimate, worth surfacing)
+//
+// Detection is regex-based + a couple of decoded checks. No LLM calls.
+// =============================================================================
+
+'use strict';
+
+// ── Regex catalog ────────────────────────────────────────────────────────────
+const PATTERNS = [
+  // ── Critical: instruction override / system-prompt extraction ──────────────
+  {
+    id: 'override-prior-instructions',
+    severity: 'critical',
+    regex: /\b(ignore|disregard|forget)\s+(all|any|the|your|my|all\s+(?:prior|previous|above|earlier))?\s*(prior|previous|above|earlier|prev|preceding)?\s*(instructions?|rules?|prompt|system\s*prompt|directives?)\b/i,
+    why:   'Classic instruction-override prompt injection.',
+  },
+  {
+    id: 'system-prompt-leak',
+    severity: 'critical',
+    regex: /\b(reveal|print|show|repeat|output|dump|leak|expose)\s+(your|the|all|any)?\s*(system\s*prompt|hidden\s*prompt|initial\s*(prompt|instructions?)|original\s*(prompt|instructions?)|first\s*(message|prompt|instruction))/i,
+    why:   'Explicit attempt to extract the system prompt.',
+  },
+  {
+    id: 'role-rebind',
+    severity: 'critical',
+    regex: /\b(you\s+are\s+now|act\s+as|pretend\s+to\s+be|from\s+now\s+on\s+you\s+are|new\s+role:|switch\s+to\s+(?:dan|dev\s*mode|jailbreak|sudo|root|admin))\b/i,
+    why:   'Role-rebinding attempt (DAN, dev-mode, jailbreak personas).',
+  },
+  {
+    id: 'sudo-prefix',
+    severity: 'critical',
+    regex: /^\s*(?:sudo\s+|root:\s*|admin:\s*|override:\s*|jailbreak:\s*)/im,
+    why:   'Prefix attempting elevation/override.',
+  },
+  {
+    id: 'exfiltration-channel',
+    severity: 'critical',
+    regex: /\b(send|post|upload|exfiltrate|leak|forward)\s+(?:the\s+)?(secrets?|api[\s_-]?keys?|credentials?|env(?:ironment)?\s*(?:vars?|variables?)?|tokens?|sessions?|cookies?|chat\s+history|conversation)\s+(?:to|via|using)\b/i,
+    why:   'Tries to direct the model to exfiltrate sensitive data.',
+  },
+
+  // ── High: clear injection markers ──────────────────────────────────────────
+  {
+    id: 'hidden-system-marker',
+    severity: 'high',
+    regex: /(\[\[\s*(SYSTEM|INSTRUCTION|IMPORTANT|ADMIN|OVERRIDE)\s*[:>\]]|<\|\s*(system|im_start|admin|override)\s*\|>|^###\s*(SYSTEM|NEW\s+INSTRUCTIONS?|IMPORTANT|OVERRIDE)\b)/im,
+    why:   'Hidden-system markers commonly used in indirect injection.',
+  },
+  {
+    id: 'tool-call-hijack',
+    severity: 'high',
+    regex: /\b(call|invoke|run|execute)\s+(?:the\s+)?(tool|function|mcp|command|shell)\s+["'`]?(rm|curl|wget|fetch|bash|sh|exec|eval|delete_|drop_|exfil_|send_|post_|leak_)/i,
+    why:   'Attempts to hijack tool/function calls.',
+  },
+  {
+    id: 'jailbreak-canary',
+    severity: 'high',
+    regex: /\b(do\s+anything\s+now|dan|developer\s+mode\s+enabled|aim\s+mode|opposite\s+day|in\s+a\s+world\s+with\s+no\s+restrictions)\b/i,
+    why:   'Known jailbreak canary phrases.',
+  },
+  {
+    id: 'unrestricted-output',
+    severity: 'high',
+    regex: /\b(no\s+(filter|restrictions?|rules|safety|policies)|without\s+(any\s+)?(filter|restriction|safety|warning|disclaimer)|unfiltered\s+(answer|response))\b/i,
+    why:   'Demands an unrestricted / unfiltered response.',
+  },
+
+  // ── Medium: suspicious context (often false-positive in safe content) ──────
+  {
+    id: 'instructions-keyword',
+    severity: 'medium',
+    regex: /\b(new\s+instructions?|updated\s+instructions?|special\s+instructions?\s+for\s+you)\b/i,
+    why:   'Suspicious instruction-channel hijack attempt.',
+  },
+  {
+    id: 'invisible-character',
+    severity: 'medium',
+    regex: /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]/,
+    why:   'Invisible / bidi-override Unicode characters.',
+  },
+  {
+    id: 'huge-base64',
+    severity: 'medium',
+    regex: /[A-Za-z0-9+/=]{200,}/,
+    why:   'Large base64-looking blob — possible encoded payload.',
+  },
+];
+
+// ── Decoded payload checks ───────────────────────────────────────────────────
+// Decode any base64 substring >= 16 chars, search for jailbreak phrases inside.
+const DECODE_PROBE = /\b[A-Za-z0-9+/]{16,}={0,2}\b/g;
+const DECODED_RED_FLAGS = [
+  /ignore\s+(?:all\s+)?(?:prior|previous|above)\s+instructions/i,
+  /system\s*prompt/i,
+  /you\s+are\s+now/i,
+  /developer\s+mode/i,
+];
+
+function checkDecoded(text) {
+  const findings = [];
+  if (typeof text !== 'string' || text.length < 16) return findings;
+  let m;
+  let count = 0;
+  DECODE_PROBE.lastIndex = 0;
+  while ((m = DECODE_PROBE.exec(text)) !== null && count < 20) {
+    count++;
+    const blob = m[0];
+    let decoded;
+    try { decoded = Buffer.from(blob, 'base64').toString('utf8'); }
+    catch { continue; }
+    // Skip random binary garbage — require >= 60% printable to look like text.
+    let printable = 0;
+    for (let i = 0; i < decoded.length; i++) {
+      const c = decoded.charCodeAt(i);
+      if ((c >= 0x20 && c <= 0x7e) || c === 0x09 || c === 0x0a) printable++;
+    }
+    if (decoded.length === 0 || printable / decoded.length < 0.6) continue;
+
+    for (const rx of DECODED_RED_FLAGS) {
+      if (rx.test(decoded)) {
+        findings.push({
+          id: 'decoded-payload',
+          severity: 'critical',
+          why: `Base64-decoded blob contains jailbreak phrase (${rx.source.slice(0, 40)}…).`,
+          excerpt: decoded.slice(0, 120),
+        });
+        break;
+      }
+    }
+  }
+  return findings;
+}
+
+// ── Public API ───────────────────────────────────────────────────────────────
+function scan(text, { maxFindings = 10 } = {}) {
+  if (typeof text !== 'string' || text.length === 0) return [];
+  const findings = [];
+  for (const p of PATTERNS) {
+    if (findings.length >= maxFindings) break;
+    const m = p.regex.exec(text);
+    if (m) {
+      findings.push({
+        id: p.id,
+        severity: p.severity,
+        why: p.why,
+        excerpt: text.slice(Math.max(0, m.index - 20), m.index + m[0].length + 40),
+      });
+    }
+  }
+  for (const f of checkDecoded(text)) {
+    if (findings.length >= maxFindings) break;
+    findings.push(f);
+  }
+  return findings;
+}
+
+function maxSeverity(findings) {
+  if (!findings || findings.length === 0) return 'none';
+  if (findings.some(f => f.severity === 'critical')) return 'critical';
+  if (findings.some(f => f.severity === 'high'))     return 'high';
+  if (findings.some(f => f.severity === 'medium'))   return 'medium';
+  return 'none';
+}
+
+module.exports = {
+  PATTERNS,
+  scan,
+  checkDecoded,
+  maxSeverity,
+};

package/hooks/safety/prompt-injection-guard.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+// =============================================================================
+// Kodelyth ECC — Prompt Injection Guard
+//
+// A safety hook that scans inbound text for jailbreak / instruction-override
+// patterns BEFORE the model sees it. Wires into two Claude Code hook events:
+//
+//   - UserPromptSubmit              (scans the user's outbound message)
+//   - PostToolUse on Read|WebFetch|mcp__*  (scans tool responses for indirect
+//                                           injection from external content)
+//
+// Modes (env var KODELYTH_PI_GUARD):
+//   off    — never run (default if unset)
+//   warn   — exit 0 always; print findings to stderr (visible in transcript)
+//   block  — exit 2 (block) on critical; warn on high; pass on medium
+//
+// Optional knobs:
+//   KODELYTH_PI_GUARD_LOG=/path/to/log.jsonl   append findings as JSONL
+//   KODELYTH_PI_GUARD_MAX_INPUT=20000          truncate input before scan
+//
+// Always exits 0 on internal errors so the hook never blocks accidentally.
+// =============================================================================
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const { scan, maxSeverity } = require('./lib/patterns');
+
+const MODE = String(process.env.KODELYTH_PI_GUARD || 'off').toLowerCase();
+const MAX_INPUT = Number(process.env.KODELYTH_PI_GUARD_MAX_INPUT || 20000);
+const LOG_PATH = process.env.KODELYTH_PI_GUARD_LOG || null;
+
+function safeExit(code) {
+  try { process.stdout.write(''); } catch {}
+  process.exit(code);
+}
+
+function appendLog(record) {
+  if (!LOG_PATH) return;
+  try {
+    fs.mkdirSync(path.dirname(LOG_PATH), { recursive: true });
+    fs.appendFileSync(LOG_PATH, JSON.stringify(record) + '\n');
+  } catch { /* never block on logging */ }
+}
+
+// ── Read the hook payload from stdin ─────────────────────────────────────────
+function readStdinSync() {
+  try {
+    const chunks = [];
+    let buf;
+    // Node 18+: readSync of stdin in blocking mode.
+    const fd = 0;
+    const tmp = Buffer.alloc(64 * 1024);
+    while (true) {
+      let n;
+      try { n = fs.readSync(fd, tmp, 0, tmp.length, null); }
+      catch { break; }
+      if (!n) break;
+      chunks.push(Buffer.from(tmp.subarray(0, n)));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+  } catch {
+    return '';
+  }
+}
+
+// ── Extract scannable text from a hook payload ───────────────────────────────
+function extractTextFromPayload(payload) {
+  if (!payload || typeof payload !== 'object') return '';
+  const buckets = [];
+
+  // Common payload shapes across Claude Code hooks:
+  // - UserPromptSubmit:  { prompt: "..." } or { user_message: "..." }
+  // - PostToolUse:       { tool_name, tool_response: { content: [...] } }
+  // - Generic fallback:  any string anywhere
+
+  if (typeof payload.prompt === 'string')        buckets.push(payload.prompt);
+  if (typeof payload.user_message === 'string')  buckets.push(payload.user_message);
+  if (typeof payload.message === 'string')       buckets.push(payload.message);
+
+  if (payload.tool_response) {
+    const tr = payload.tool_response;
+    if (typeof tr === 'string') buckets.push(tr);
+    if (Array.isArray(tr.content)) {
+      for (const c of tr.content) {
+        if (typeof c === 'string') buckets.push(c);
+        else if (c && typeof c.text === 'string') buckets.push(c.text);
+      }
+    } else if (typeof tr.text === 'string') {
+      buckets.push(tr.text);
+    } else if (typeof tr.output === 'string') {
+      buckets.push(tr.output);
+    }
+  }
+
+  // Last-resort fallback: walk shallowly for any string fields.
+  if (buckets.length === 0) {
+    for (const v of Object.values(payload)) {
+      if (typeof v === 'string') buckets.push(v);
+    }
+  }
+
+  return buckets.join('\n').slice(0, MAX_INPUT);
+}
+
+// ── Format a human-friendly stderr report ────────────────────────────────────
+function formatReport(findings, eventLabel) {
+  const sev = maxSeverity(findings);
+  const lines = [];
+  lines.push(`\n[Kodelyth Safety] prompt-injection-guard — ${eventLabel} — severity=${sev}`);
+  for (const f of findings.slice(0, 5)) {
+    lines.push(`  • [${f.severity}] ${f.id} — ${f.why}`);
+    if (f.excerpt) lines.push(`      excerpt: ${f.excerpt.replace(/\s+/g, ' ').trim().slice(0, 120)}`);
+  }
+  if (findings.length > 5) lines.push(`  …and ${findings.length - 5} more.`);
+  lines.push(`  mode=${MODE}\n`);
+  return lines.join('\n');
+}
+
+// ── Main ─────────────────────────────────────────────────────────────────────
+function main() {
+  if (MODE === 'off') return safeExit(0);
+
+  let raw = '';
+  try { raw = readStdinSync(); } catch { return safeExit(0); }
+
+  let payload = null;
+  try { payload = raw ? JSON.parse(raw) : null; } catch { payload = null; }
+
+  // Echo stdin to stdout so chained hooks/loggers still see the original.
+  if (raw) process.stdout.write(raw);
+
+  if (!payload) return safeExit(0);
+
+  const text = extractTextFromPayload(payload);
+  if (!text) return safeExit(0);
+
+  const findings = scan(text);
+  if (findings.length === 0) return safeExit(0);
+
+  const baseEvent = payload.hook_event_name || (payload.tool_name ? 'PostToolUse' : 'UserPromptSubmit');
+  const eventLabel = payload.tool_name ? `${baseEvent}:${payload.tool_name}` : baseEvent;
+
+  const sev = maxSeverity(findings);
+
+  appendLog({
+    timestamp: new Date().toISOString(),
+    event:     eventLabel,
+    severity:  sev,
+    mode:      MODE,
+    findings:  findings.map(f => ({ id: f.id, severity: f.severity, why: f.why })),
+  });
+
+  // Always emit the report on stderr (visible to user/transcript).
+  process.stderr.write(formatReport(findings, eventLabel));
+
+  if (MODE === 'block' && sev === 'critical') {
+    process.stderr.write(
+      '\n[Kodelyth Safety] BLOCKED: critical prompt-injection patterns detected.\n' +
+      '  • Set KODELYTH_PI_GUARD=warn to downgrade to warning-only.\n' +
+      '  • Set KODELYTH_PI_GUARD=off to disable this guard entirely.\n\n'
+    );
+    return safeExit(2);
+  }
+
+  return safeExit(0);
+}
+
+if (require.main === module) {
+  try { main(); } catch { safeExit(0); }
+}
+
+module.exports = {
+  // Exposed for tests
+  extractTextFromPayload,
+  formatReport,
+};