monofence-ai 1.0.0 → 1.0.2

package/README.md

@@ -1,276 +1,105 @@
 # monofence-ai
 
-[![npm version](https://img.shields.io/npm/v/monofence-ai?color=blue&label=npm)](https://www.npmjs.com/package/monofence-ai)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.3+-blue.svg)](https://www.typescriptlang.org/)
-[![Node.js](https://img.shields.io/badge/Node.js-18+-green.svg)](https://nodejs.org/)
+[![npm version](https://img.shields.io/npm/v/monofence-ai?style=flat-square)](https://www.npmjs.com/package/monofence-ai)
+[![license](https://img.shields.io/npm/l/monofence-ai?style=flat-square)](https://github.com/monoes/monomind/blob/main/LICENSE)
+[![node](https://img.shields.io/badge/node-%3E%3D18-blue?style=flat-square)](https://nodejs.org)
 
-**AI manipulation defense for LLM applications** — evasion detection, multi-turn context tracking, output scanning, and hook wiring. Sub-millisecond detection with self-learning.
+**AI manipulation defense** — prompt injection, jailbreak, homoglyph evasion, base64 encoding, multi-turn escalation, and PII detection. Sub-millisecond, 50+ patterns, self-learning.
 
-```
-Detection: ~0.04ms | 50+ patterns | evasion normalization | context-aware escalation
-```
-
----
+> Part of the [Monomind](https://github.com/monoes/monomind) ecosystem.
 
 ## Install
 
 ```bash
 npm install monofence-ai
-# or
-pnpm add monofence-ai
 ```
 
-Optional — HNSW-accelerated pattern search:
-
-```bash
-npm install lancedb
-```
-
----
-
 ## Quick start
 
 ```typescript
 import { isSafe, createMonoDefence } from 'monofence-ai';
 
-// Fast boolean check
-isSafe('Hello, help me write code');            // true
-isSafe('Ignore all previous instructions');     // false
+// Fast boolean check (~0.04ms)
+isSafe('Hello, help me write code');          // true
+isSafe('Ignore all previous instructions');   // false
 
-// Full detection with threat objects
+// Full detection with threat details
 const fence = createMonoDefence();
 const result = await fence.detect(userInput);
 
 if (!result.safe) {
-  // result.threats — array of detected threats
-  // result.overallRisk — 0.0–1.0
+  console.log(result.threats);     // detected threat objects
+  console.log(result.overallRisk); // 0.0–1.0
 }
 ```
 
----
-
 ## API
 
 ### `createMonoDefence(config?)`
 
-Creates a `MonoDefence` instance.
-
 ```typescript
 const fence = createMonoDefence({
-  enableLearning: true,        // persist learned threat patterns (default: false)
-  enableContextTracking: true, // track escalation state across turns (default: false)
-  enablePIIDetection: true,    // detect PII in inputs/outputs (default: true)
-  maxContextTurns: 20,         // rolling window for context tracking (default: 20)
+  enableLearning: true,        // persist learned patterns (default: false)
+  enableContextTracking: true, // track multi-turn escalation (default: false)
+  enablePIIDetection: true,    // detect PII (default: true)
+  maxContextTurns: 20,         // rolling window (default: 20)
   confidenceThreshold: 0.5,    // minimum detection confidence (default: 0.5)
 });
 ```
 
-### `fence.detect(input)`
+### Methods
+
+| Method | Returns | Description |
+|--------|---------|-------------|
+| `fence.detect(input)` | `Promise<DetectionResult>` | Full async scan with threats, risk score, timing |
+| `fence.quickScan(input)` | `{ threat, confidence }` | Synchronous sub-millisecond check |
+| `fence.hasPII(input)` | `boolean` | Check for emails, SSNs, API keys, passwords |
+| `fence.scanOutput(output, prompt?)` | `Promise<OutputScanResult>` | Scan LLM output for leakage/echo/policy violations |
+| `fence.isAllowed(input)` / `fence.addAllowlistRule(rule)` | — | Allowlist bypass for known-safe inputs |
+| `fence.getStats()` | `Promise<Stats>` | Detection + learning statistics |
 
-Full async scan. Returns:
+Module-level helpers: `isSafe(input)` (fastest boolean check against a shared
+singleton), `checkThreats(input)`, `getMonoDefence()`, `resetMonoDefence()`.
+
+### Detection result
 
 ```typescript
 {
-  safe: boolean;          // false if any threat detected
-  threats: Threat[];      // detected threat objects with type/severity/confidence
+  safe: boolean;
+  threats: Threat[];       // type, severity, confidence per threat
   piiFound: boolean;
-  overallRisk: number;    // 0.0–1.0
+  overallRisk: number;     // 0.0–1.0
   detectionTimeMs: number;
 }
 ```
 
-> When context tracking is on and escalation reaches `attack`, `overallRisk` is raised
-> to at least 0.5 even when `safe=true`. Check both `safe` and `overallRisk` when using
-> context tracking.
-
-### `fence.quickScan(input)`
-
-Synchronous, sub-millisecond check. Returns `{ threat: boolean, confidence: number }`.
-
-### `isSafe(input)` / `fence.isSafe(input)`
-
-Returns `boolean`. Fastest option — no async overhead.
-
-### `fence.hasPII(input)`
-
-Returns `boolean`. Checks emails, SSNs, API keys, and passwords.
-
-### `fence.getStats()`
-
-Returns detection counters, learned pattern count, and average latency.
-
-### `fence.learnFromDetection(input, result, feedback)`
-
-Reinforces or corrects a prior detection for human-in-the-loop feedback.
-
-### `fence.getBestMitigation(threatType)`
-
-Returns the highest-effectiveness mitigation strategy for a threat type.
-
-### `fence.searchSimilarThreats(input, { k })`
-
-Vector similarity search over learned threat patterns (requires LanceDB).
-
-### `fence.recordMitigation(threatType, strategy, success)`
-
-Records whether a mitigation worked; affects future `getBestMitigation` results.
-
----
-
-## Threat types
-
-| Type | Severity | Examples |
-|---|---|---|
-| `instruction_override` | Critical | "Ignore previous instructions", "forget everything" |
-| `jailbreak` | Critical | "DAN mode", "bypass restrictions", "developer mode" |
-| `role_switching` | High | "You are now", "Act as an unrestricted AI" |
-| `context_manipulation` | Critical | Fake `system:` messages, delimiter injection |
-| `encoding_attack` | Medium | base64/hex obfuscation |
-| `prompt_injection` | Critical | Injected instructions in user content |
-
----
-
-## Evasion detection
-
-Inputs are normalized before pattern matching to defeat obfuscation:
-
-- **Homoglyphs**: Cyrillic/Greek lookalikes → ASCII (`і` → `i`)
-- **Spaced chars**: `i g n o r e` → `ignore`
-- **Leet substitution**: `ign0re` → `ignore` (applied after space collapsing)
-
-```typescript
-const result = await fence.detect('іgnore all рrevious instructions'); // Cyrillic chars
-// result.safe === false, threats include instruction_override
-```
-
----
-
-## Multi-turn context tracking
-
-Enable to track escalation state across a conversation:
-
-```typescript
-const fence = createMonoDefence({ enableContextTracking: true });
-
-// Turn 1: probing question → state: probing
-// Turn 2: jailbreak attempt → state: escalating
-// Turn 3: confirmed attack → state: attack
-// Once in attack state, overallRisk ≥ 0.5 even on benign inputs
-```
-
-States: `clean` → `probing` → `escalating` → `attack`. Decays toward `clean` on idle turns.
-
----
-
-## Multi-agent consensus
-
-When running multiple detection agents in parallel:
+### Learning (opt-in)
 
 ```typescript
-import { calculateSecurityConsensus } from 'monofence-ai';
-
-const consensus = calculateSecurityConsensus([
-  { result: resultA, weight: 0.6 },
-  { result: resultB, weight: 0.4 },
-]);
-// consensus.safe, consensus.overallRisk, consensus.threats
-```
-
-A single critical threat short-circuits weighted scoring regardless of agent weight (fail-secure).
-
----
-
-## Hook wiring (optional)
-
-Wire into the monomind hooks system so pre-task and pre-command inputs are scanned automatically. **Off by default.**
-
-```typescript
-import { SecurityHook } from 'monofence-ai/hooks';
-
-SecurityHook.register({ priority: 1000 });
-// Runs before all other hooks; aborts on attack escalation state
-```
-
-Or from the CLI:
-
-```bash
-npx monomind hooks pre-task --monofence-ai-check
-```
+const fence = createMonoDefence({ enableLearning: true });
 
----
-
-## Review integration
-
-When using `mastermind:review`, two flags activate monofence-ai analysis:
-
-| Flag | Effect |
-|---|---|
-| `--monofence-ai-check` | Test suite + adversarial probes against the live detector |
-| `--monofence-ai-security-deep` | Scan LLM input boundaries for unprotected paths |
-
-Both are off by default:
-
-```bash
-/mastermind:review --monofence-ai-check --monofence-ai-security-deep
+await fence.learnFromDetection(input, result, { wasAccurate: true });
+const similar = await fence.searchSimilarThreats(suspiciousInput);
+const strategy = await fence.getBestMitigation('prompt_injection');
 ```
 
----
-
-## MCP tools
-
-Six MCP tools are available when monomind is installed:
-
-| Tool | Description |
-|---|---|
-| `aidefence_scan` | Scan input for threats (`input`, `quick?`) |
-| `aidefence_analyze` | Deep analysis with similar-pattern search |
-| `aidefence_stats` | Detection and learning statistics |
-| `aidefence_learn` | Record feedback for pattern learning |
-| `aidefence_is_safe` | Quick boolean check |
-| `aidefence_has_pii` | PII detection only |
-
----
-
-## Performance
+## What it detects
 
-| Operation | Typical latency |
-|---|---|
-| Full `detect()` | ~0.04ms |
-| `quickScan()` | ~0.02ms |
-| PII check | ~0.01ms |
-| HNSW search (LanceDB) | ~0.1ms |
+- Prompt injection (direct and indirect)
+- Jailbreak attempts
+- Homoglyph substitution (Cyrillic, Unicode lookalikes)
+- Base64 encoded payloads
+- Multi-turn escalation patterns
+- PII (emails, SSNs, API keys, passwords)
+- Role-play manipulation
+- Context window abuse
 
-Throughput: >12,000 req/s single-threaded. Memory: ~50KB per instance.
-
----
-
-## Deprecated aliases
-
-Still exported for backward compatibility; will be removed in v2:
-
-| Deprecated | Replacement |
-|---|---|
-| `createAIDefence` | `createMonoDefence` |
-| `getAIDefence` | `getMonoDefence` |
-| `AIDefenceConfig` | `MonoDefenceConfig` |
-| `AIDefence` | `MonoDefence` |
-
----
-
-## Development
-
-```bash
-git clone https://github.com/monoes/monomind.git
-cd monomind/packages/monofence-ai
-
-npm install
-npm test        # vitest run
-npm run build   # tsc
-```
+## Links
 
----
+- [GitHub](https://github.com/monoes/monomind)
+- [npm](https://www.npmjs.com/package/monofence-ai)
+- [Issues](https://github.com/monoes/monomind/issues)
 
 ## License
 
-MIT — part of the [Monomind](https://github.com/monoes/monomind) ecosystem.
+MIT

package/dist/domain/entities/threat.d.ts

@@ -4,7 +4,7 @@
  * Represents a detected security threat from AI manipulation attempts.
  */
 export type ThreatSeverity = 'low' | 'medium' | 'high' | 'critical';
-export type ThreatType = 'prompt_injection' | 'jailbreak' | 'pii_exposure' | 'instruction_override' | 'role_switching' | 'context_manipulation' | 'encoding_attack' | 'unknown';
+export type ThreatType = 'prompt_injection' | 'jailbreak' | 'pii_exposure' | 'instruction_override' | 'role_switching' | 'context_manipulation' | 'encoding_attack' | 'data_exfiltration' | 'unknown';
 export interface Threat {
     readonly id: string;
     readonly type: ThreatType;

package/dist/domain/entities/threat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threat.d.ts","sourceRoot":"","sources":["../../../src/domain/entities/threat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEpE,MAAM,MAAM,UAAU,GAClB,kBAAkB,GAClB,WAAW,GACX,cAAc,GACd,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC9F;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,GAAG,MAAM,CAWT"}
+{"version":3,"file":"threat.d.ts","sourceRoot":"","sources":["../../../src/domain/entities/threat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEpE,MAAM,MAAM,UAAU,GAClB,kBAAkB,GAClB,WAAW,GACX,cAAc,GACd,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,GAKjB,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC9F;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C,GAAG,MAAM,CAWT"}

package/dist/domain/entities/threat.js.map

@@ -1 +1 @@
-{"version":3,"file":"threat.js","sourceRoot":"","sources":["../../../src/domain/entities/threat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmGH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAO5B;IACC,OAAO;QACL,EAAE,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"threat.js","sourceRoot":"","sources":["../../../src/domain/entities/threat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwGH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAO5B;IACC,OAAO;QACL,EAAE,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;AACJ,CAAC"}

package/dist/domain/services/allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/domain/services/allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA2C3D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAkB;gBAEnB,SAAS,GAAE,aAAa,EAAO;IAI3C,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIjC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE;IAIhD,OAAO,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAIlC,OAAO,CAAC,OAAO;CAahB;AAED,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,SAAS,CAEtE"}
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/domain/services/allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA2C3D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAkB;IAE/B,YAAY,SAAS,GAAE,aAAa,EAAO,EAE1C;IAED,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhC;IAED,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,CAE/C;IAED,OAAO,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAEjC;IAED,OAAO,CAAC,OAAO;CAahB;AAED,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,GAAG,SAAS,CAEtE"}

package/dist/domain/services/allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/domain/services/allowlist.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAoB;IACtC;QACE,EAAE,EAAE,mBAAmB;QACvB,2EAA2E;QAC3E,OAAO,EAAE,mFAAmF;QAC5F,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,uGAAuG;QACvG,OAAO,EAAE,mQAAmQ;QAC5Q,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,kDAAkD;QAClD,OAAO,EAAE,sDAAsD;QAC/D,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,+BAA+B;QACvC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,8CAA8C;QACvD,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,kCAAkC;QAC1C,MAAM,EAAE,SAAS;KAClB;CACF,CAAC;AAEF,MAAM,OAAO,SAAS;IACZ,KAAK,CAAkB;IAE/B,YAAY,YAA6B,EAAE;QACzC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,IAAmB;QACzB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAEO,OAAO,CAAC,IAAmB,EAAE,KAAa;QAChD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,oFAAoF;QACpF,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,SAA2B;IACzD,OAAO,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/domain/services/allowlist.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAoB;IACtC;QACE,EAAE,EAAE,mBAAmB;QACvB,2EAA2E;QAC3E,OAAO,EAAE,mFAAmF;QAC5F,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,sCAAsC;QAC/C,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,uGAAuG;QACvG,OAAO,EAAE,mQAAmQ;QAC5Q,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,kDAAkD;QAClD,OAAO,EAAE,sDAAsD;QAC/D,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,+BAA+B;QACvC,MAAM,EAAE,SAAS;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,8CAA8C;QACvD,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,kCAAkC;QAC1C,MAAM,EAAE,SAAS;KAClB;CACF,CAAC;AAEF,MAAM,OAAO,SAAS;IACZ,KAAK,CAAkB;IAE/B,YAAY,SAAS,GAAoB,EAAE;QACzC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,IAAmB;QACzB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAEO,OAAO,CAAC,IAAmB,EAAE,KAAa;QAChD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,oFAAoF;QACpF,wFAAwF;QACxF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,SAA2B;IACzD,OAAO,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/domain/services/context-tracker.d.ts

@@ -3,6 +3,7 @@ export declare class ContextTracker {
     private state;
     private lastTurnAt;
     private readonly idleDecayMs;
+    private consecutiveCleanTurns;
     constructor(opts?: {
         idleDecayMs?: number;
     });

package/dist/domain/services/context-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-tracker.d.ts","sourceRoot":"","sources":["../../../src/domain/services/context-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAA2B,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiB1G,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAKX;IAEF,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO;IAI/C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI;IA8B9D,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC;IAIlC,KAAK,IAAI,IAAI;IAUb,OAAO,CAAC,gBAAgB;CAiBzB;AAED,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}
+{"version":3,"file":"context-tracker.d.ts","sourceRoot":"","sources":["../../../src/domain/services/context-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAA2B,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA6B1G,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAKX;IAEF,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAGrC,OAAO,CAAC,qBAAqB,CAAK;IAElC,YAAY,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,EAE9C;IAED,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAyD7D;IAED,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,CAEjC;IAED,KAAK,IAAI,IAAI,CASZ;IAED,OAAO,CAAC,gBAAgB;CAiBzB;AAED,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}

package/dist/domain/services/context-tracker.js

@@ -2,6 +2,16 @@
 const PROBING_THRESHOLD = 0.3;
 const ESCALATING_THRESHOLD = 0.6; // cumulative score
 const ATTACK_CONFIDENCE = 0.9; // single-turn jump-to-attack
+// Matches must clear this confidence floor to count toward cumulative escalation.
+// Low-confidence matches (e.g. hypothetical/educational framing) are still
+// reported in recentThreats but must not push a session toward 'attack'.
+const CUMULATIVE_SCORE_CONFIDENCE_FLOOR = 0.5;
+// Gradual per-turn de-escalation: after this many consecutive clean (no-threat)
+// turns, decay the cumulative score and step the escalation state back down —
+// on top of the existing long-idle decay, so a session doesn't get stuck at
+// 'attack' for its entire lifetime after a few early false positives.
+const CLEAN_TURNS_FOR_DECAY = 3;
+const CLEAN_TURN_DECAY_FACTOR = 0.5;
 const ESCALATION_ORDER = ['clean', 'probing', 'escalating', 'attack'];
 export class ContextTracker {
     state = {
@@ -12,6 +22,9 @@ export class ContextTracker {
     };
     lastTurnAt = 0;
     idleDecayMs;
+    // Consecutive turns with no detected threat — drives gradual de-escalation
+    // independent of the long idle-time decay above.
+    consecutiveCleanTurns = 0;
     constructor(opts = {}) {
         this.idleDecayMs = opts.idleDecayMs ?? 30 * 60 * 1000; // 30 min default
     }
@@ -28,8 +41,14 @@ export class ContextTracker {
         }
         this.lastTurnAt = now;
         this.state.turnCount++;
-        // Update cumulative score
-        this.state.cumulativeThreatScore += result.overallRisk;
+        // Only let matches that clear a reasonable confidence floor accumulate
+        // toward escalation. Low-confidence matches are still recorded in
+        // recentThreats (below) but must not by themselves push a session
+        // toward 'attack' — otherwise a handful of low-confidence false
+        // positives permanently escalates every future turn.
+        if (result.overallRisk >= CUMULATIVE_SCORE_CONFIDENCE_FLOOR) {
+            this.state.cumulativeThreatScore += result.overallRisk;
+        }
         // Maintain sliding window of 10
         if (!result.safe) {
             this.state.recentThreats = [
@@ -37,7 +56,27 @@ export class ContextTracker {
                 ...result.threats,
             ].slice(-10);
         }
-        // Escalation state machine (monotonic — only moves forward)
+        // Gradual per-turn de-escalation: N consecutive clean turns decay the
+        // cumulative score and step escalation back one level, so a session
+        // doesn't stay stuck in 'attack'/'escalating' for its whole lifetime
+        // after a burst of unrelated false positives — without waiting for the
+        // full idle-timeout decay above.
+        if (result.safe) {
+            this.consecutiveCleanTurns++;
+            if (this.consecutiveCleanTurns >= CLEAN_TURNS_FOR_DECAY) {
+                this.consecutiveCleanTurns = 0;
+                this.state.cumulativeThreatScore = Math.max(0, this.state.cumulativeThreatScore * CLEAN_TURN_DECAY_FACTOR);
+                const currentIndex = ESCALATION_ORDER.indexOf(this.state.escalationState);
+                if (currentIndex > 0) {
+                    this.state.escalationState = ESCALATION_ORDER[currentIndex - 1];
+                }
+            }
+        }
+        else {
+            this.consecutiveCleanTurns = 0;
+        }
+        // Escalation state machine (monotonic upward — only computeNextState moves
+        // it forward; the clean-turn decay above is the sole path back down)
         this.state.escalationState = this.computeNextState(result);
     }
     getState() {
@@ -51,6 +90,7 @@ export class ContextTracker {
             recentThreats: [],
         };
         this.lastTurnAt = 0;
+        this.consecutiveCleanTurns = 0;
     }
     computeNextState(result) {
         const current = this.state.escalationState;

package/dist/domain/services/context-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-tracker.js","sourceRoot":"","sources":["../../../src/domain/services/context-tracker.ts"],"names":[],"mappings":"AAEA,wBAAwB;AACxB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAI,mBAAmB;AACxD,MAAM,iBAAiB,GAAG,GAAG,CAAC,CAAQ,6BAA6B;AAEnE,MAAM,gBAAgB,GAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAUzF,MAAM,OAAO,cAAc;IACjB,KAAK,GAAwB;QACnC,eAAe,EAAE,OAAO;QACxB,qBAAqB,EAAE,CAAC;QACxB,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;IAEM,UAAU,GAAW,CAAC,CAAC;IACd,WAAW,CAAS;IAErC,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,iBAAiB;IAC1E,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,MAA6B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,kDAAkD;QAClD,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1E,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,kFAAkF;YAClF,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QAEtB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAEvB,0BAA0B;QAC1B,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,MAAM,CAAC,WAAW,CAAC;QAEvD,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG;gBACzB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,GAAG,MAAM,CAAC,OAAO;aAClB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG;YACX,eAAe,EAAE,OAAO;YACxB,qBAAqB,EAAE,CAAC;YACxB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAEO,gBAAgB,CAAC,MAA6B;QACpD,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,WAAW,GAAG,YAAY,CAAC,CAAC,2BAA2B;QAE3D,gDAAgD;QAChD,IAAI,MAAM,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;YAC5C,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE,CAAC;YACpE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,cAAc,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"context-tracker.js","sourceRoot":"","sources":["../../../src/domain/services/context-tracker.ts"],"names":[],"mappings":"AAEA,wBAAwB;AACxB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAI,mBAAmB;AACxD,MAAM,iBAAiB,GAAG,GAAG,CAAC,CAAQ,6BAA6B;AAEnE,kFAAkF;AAClF,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,gBAAgB,GAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAUzF,MAAM,OAAO,cAAc;IACjB,KAAK,GAAwB;QACnC,eAAe,EAAE,OAAO;QACxB,qBAAqB,EAAE,CAAC;QACxB,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;IAEM,UAAU,GAAW,CAAC,CAAC;IACd,WAAW,CAAS;IACrC,2EAA2E;IAC3E,iDAAiD;IACzC,qBAAqB,GAAG,CAAC,CAAC;IAElC,YAAY,IAAI,GAA6B,EAAE;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,iBAAiB;IAC1E,CAAC;IAED,UAAU,CAAC,KAAa,EAAE,MAA6B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,kDAAkD;QAClD,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1E,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,kFAAkF;YAClF,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QAEtB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAEvB,uEAAuE;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,qDAAqD;QACrD,IAAI,MAAM,CAAC,WAAW,IAAI,iCAAiC,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,MAAM,CAAC,WAAW,CAAC;QACzD,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG;gBACzB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrC,GAAG,MAAM,CAAC,OAAO;aAClB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,iCAAiC;QACjC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,EAAE,CAAC;gBACxD,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CACzC,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,uBAAuB,CAC3D,CAAC;gBACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC1E,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBACrB,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,gBAAgB,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG;YACX,eAAe,EAAE,OAAO;YACxB,qBAAqB,EAAE,CAAC;YACxB,SAAS,EAAE,CAAC;YACZ,aAAa,EAAE,EAAE;SAClB,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;IACjC,CAAC;IAEO,gBAAgB,CAAC,MAA6B;QACpD,MAAM,OAAO,GAAoB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAC5D,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,WAAW,GAAG,YAAY,CAAC,CAAC,2BAA2B;QAE3D,gDAAgD;QAChD,IAAI,MAAM,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;YAC5C,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE,CAAC;YACpE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;YACnD,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,cAAc,EAAE,CAAC;AAC9B,CAAC"}

package/dist/domain/services/evasion-detector.d.ts

@@ -3,8 +3,17 @@ export declare class EvasionDetector {
     normalize(input: string): EvasionResult;
     private replaceHomoglyphs;
     private expandLeetspeak;
+    private normalizePunctuationSeparators;
     private collapseSpacedChars;
     private stripZeroWidth;
+    /**
+     * Decode `candidate` as base64 and return the decoded text only if it looks
+     * like a genuine base64-encoded payload rather than an incidental long
+     * alphanumeric run (git SHA, JWT segment, session id, ...):
+     *   - length must be divisible by 4 (real padded base64 always satisfies this)
+     *   - the decoded bytes must be mostly printable text (>70%), not binary noise
+     */
+    private decodeIfLikelyBase64;
     private appendDecodedBase64;
     private detectTechnique;
 }

package/dist/domain/services/evasion-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evasion-detector.d.ts","sourceRoot":"","sources":["../../../src/domain/services/evasion-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAmD3D,qBAAa,eAAe;IAC1B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa;IA6BvC,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,eAAe;IAkBvB,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,eAAe;CAWxB;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CAEvD"}
+{"version":3,"file":"evasion-detector.d.ts","sourceRoot":"","sources":["../../../src/domain/services/evasion-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAoD3D,qBAAa,eAAe;IAC1B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAgCtC;IAED,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,eAAe;IAkBvB,OAAO,CAAC,8BAA8B;IActC,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,cAAc;IAItB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,eAAe;CAcxB;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CAEvD"}

package/dist/domain/services/evasion-detector.js

@@ -2,12 +2,13 @@ const HOMOGLYPHS = {
     // Cyrillic lookalikes (lowercase)
     'а': 'a', 'е': 'e', 'і': 'i', 'о': 'o',
     'р': 'r', 'с': 'c', 'х': 'x', 'у': 'y',
+    'ѕ': 's', 'ԁ': 'd', 'һ': 'h',
     // Cyrillic lookalikes (uppercase)
     'А': 'A', 'Е': 'E', 'І': 'I', 'О': 'O',
     'Р': 'R', 'С': 'C', 'Х': 'X', 'У': 'U',
     // Greek lookalikes
     'ο': 'o', 'α': 'a', 'ε': 'e', 'ι': 'i',
-    'ν': 'n', 'ρ': 'r', 'τ': 't',
+    'ν': 'n', 'ρ': 'r', 'τ': 't', 'Ι': 'I',
     // IPA small caps
     'ɪ': 'i', 'ɢ': 'g', 'ɴ': 'n', 'ʀ': 'r', 'ɑ': 'a',
     // Fullwidth ASCII
@@ -44,6 +45,11 @@ export class EvasionDetector {
         const afterNFKC = input.normalize('NFKC');
         let result = afterNFKC;
         result = this.replaceHomoglyphs(result);
+        // Punctuation-separated obfuscation ("ignore-previous-instructions",
+        // "ignore.previous.instructions", "ignore_previous_instructions") must run
+        // before pattern matching since the injection regexes join words with
+        // \s+ only and never match punctuation-joined variants.
+        result = this.normalizePunctuationSeparators(result);
         result = this.collapseSpacedChars(result);
         // Leet expansion runs after space collapsing so that spaced-leet combos like
         // "i g n 0 r e" collapse to "ign0re" first, then "0" → "o" → "ignore".
@@ -81,6 +87,17 @@ export class EvasionDetector {
             return token.replace(LEET_REGEX, (ch) => LEET_MAP[ch] ?? ch);
         });
     }
+    normalizePunctuationSeparators(input) {
+        // Convert runs of '.', '-', '_' between word characters into a single
+        // space, e.g. "ignore-previous-instructions" → "ignore previous
+        // instructions". Skips tokens immediately preceded by '@' so email/domain
+        // parts like "alice@example.com" are left intact.
+        return input.replace(/[a-zA-Z0-9]+(?:[._-]+[a-zA-Z0-9]+)+/g, (token, offset, full) => {
+            if (full[offset - 1] === '@')
+                return token;
+            return token.replace(/[._-]+/g, ' ');
+        });
+    }
     collapseSpacedChars(input) {
         // "i g n o r e" → "ignore": collapse runs of space-separated single chars
         return input.replace(/(?<!\w)(\w)( \w){2,}(?!\w)/g, (match) => match.replace(/ /g, ''));
@@ -88,20 +105,41 @@ export class EvasionDetector {
     stripZeroWidth(input) {
         return input.replace(/[​-‏⁠᠎]/g, '');
     }
+    /**
+     * Decode `candidate` as base64 and return the decoded text only if it looks
+     * like a genuine base64-encoded payload rather than an incidental long
+     * alphanumeric run (git SHA, JWT segment, session id, ...):
+     *   - length must be divisible by 4 (real padded base64 always satisfies this)
+     *   - the decoded bytes must be mostly printable text (>70%), not binary noise
+     */
+    decodeIfLikelyBase64(candidate) {
+        if (candidate.length % 4 !== 0)
+            return null;
+        try {
+            const dec = Buffer.from(candidate, 'base64').toString('utf8');
+            if (dec.length === 0 || dec.includes('\x00'))
+                return null;
+            let printable = 0;
+            for (let i = 0; i < dec.length; i++) {
+                const code = dec.charCodeAt(i);
+                if ((code >= 0x20 && code <= 0x7e) || code === 0x09 || code === 0x0a || code === 0x0d) {
+                    printable++;
+                }
+            }
+            return printable / dec.length > 0.7 ? dec : null;
+        }
+        catch {
+            return null;
+        }
+    }
     appendDecodedBase64(original, current) {
         const decoded = [];
         let match;
         BASE64_BLOB_REGEX.lastIndex = 0;
         while ((match = BASE64_BLOB_REGEX.exec(original)) !== null) {
-            try {
-                const dec = Buffer.from(match[0], 'base64').toString('utf8');
-                if (/[\x20-\x7E]{5,}/.test(dec) && !dec.includes('\x00')) {
-                    decoded.push(dec);
-                }
-            }
-            catch {
-                // ignore invalid base64
-            }
+            const dec = this.decodeIfLikelyBase64(match[0]);
+            if (dec !== null)
+                decoded.push(dec);
         }
         return decoded.length > 0 ? `${current} ${decoded.join(' ')}` : current;
     }
@@ -117,8 +155,11 @@ export class EvasionDetector {
         if (/(?<!\w)(\w)( \w){2,}(?!\w)/.test(original))
             return 'spacing';
         BASE64_BLOB_REGEX.lastIndex = 0;
-        if (BASE64_BLOB_REGEX.test(original))
-            return 'base64';
+        let base64Match;
+        while ((base64Match = BASE64_BLOB_REGEX.exec(original)) !== null) {
+            if (this.decodeIfLikelyBase64(base64Match[0]) !== null)
+                return 'base64';
+        }
         return undefined;
     }
 }