nemoris 0.1.0 → 0.1.2

package/src/runtime/input-sanitiser.js

@@ -1,72 +1,72 @@
-import { formatRuntimeError, RuntimeError } from "../utils/errors.js";
-
-const INJECTION_PATTERNS = [
-  { id: "ignore_previous", regex: /ignore\s+(all\s+)?previous\s+instructions/i, label: "ignore previous instructions" },
-  { id: "you_are_now", regex: /you\s+are\s+now\b/i, label: "identity override (you are now)" },
-  { id: "system_prompt", regex: /system\s+prompt\s*:/i, label: "system prompt injection" },
-  { id: "important_start", regex: /^(?:\s*)IMPORTANT\s*:/m, label: "IMPORTANT: at start of output" },
-  { id: "critical_start", regex: /^(?:\s*)CRITICAL\s*:/m, label: "CRITICAL: at start of output" },
-  { id: "fake_system_tag", regex: /<\/?system(?:\s[^>]*)?>/, label: "XML <system> boundary tag" },
-  { id: "fake_assistant_tag", regex: /<\/?assistant(?:\s[^>]*)?>/, label: "XML <assistant> boundary tag" },
-  { id: "fake_user_tag", regex: /<\/?user(?:\s[^>]*)?>/, label: "XML <user> boundary tag" },
-  { id: "fake_tool_boundary", regex: /\[TOOL_OUTPUT:(START|END)\]/i, label: "spoofed TOOL_OUTPUT boundary marker" },
-  { id: "disregard", regex: /disregard\s+(all\s+)?(prior|previous|above)\s+(instructions|context)/i, label: "disregard prior instructions" },
-  { id: "new_instructions", regex: /new\s+instructions?\s*:/i, label: "new instructions injection" }
-];
-
-/**
- * Wraps an external tool output with clear boundary markers so the LLM
- * can distinguish trusted system content from untrusted external data.
- */
-export function tagUntrustedInput(toolOutput, toolName) {
-  const text = String(toolOutput ?? "");
-  const name = String(toolName ?? "unknown");
-  return `[TOOL_OUTPUT:START tool=${name} trust=external]\n${text}\n[TOOL_OUTPUT:END]`;
-}
-
-/**
- * Scans text for common prompt-injection patterns.
- * Returns { flagged, patterns, sanitised }.
- * The sanitised string is always the original text (we never mutate),
- * but the flag + pattern list lets callers decide what to do.
- */
-export function detectInjectionPatterns(text) {
-  const input = String(text ?? "");
-  const matched = [];
-
-  for (const pattern of INJECTION_PATTERNS) {
-    if (pattern.regex.test(input)) {
-      matched.push(pattern.label);
-    }
-  }
-
-  return {
-    flagged: matched.length > 0,
-    patterns: matched,
-    sanitised: input
-  };
-}
-
-/**
- * Combined entry-point used by the executor: tag + scan in one call.
- * Logs a warning to console.warn when injection patterns are detected
- * but never blocks execution to avoid false-positive breakage.
- */
-export function processToolOutput(toolOutput, toolName) {
-  const detection = detectInjectionPatterns(toolOutput);
-
-  if (detection.flagged) {
-    const err = new RuntimeError(
-      `Potential prompt injection detected in output from tool "${toolName}"`,
-      { category: "security", context: { toolName, patterns: detection.patterns.join("; ") }, recoverable: true }
-    );
-    console.warn(formatRuntimeError(err));
-  }
-
-  const tagged = tagUntrustedInput(detection.sanitised, toolName);
-
-  return {
-    tagged,
-    detection
-  };
-}
+import { formatRuntimeError, RuntimeError } from "../utils/errors.js";
+
+const INJECTION_PATTERNS = [
+  { id: "ignore_previous", regex: /ignore\s+(all\s+)?previous\s+instructions/i, label: "ignore previous instructions" },
+  { id: "you_are_now", regex: /you\s+are\s+now\b/i, label: "identity override (you are now)" },
+  { id: "system_prompt", regex: /system\s+prompt\s*:/i, label: "system prompt injection" },
+  { id: "important_start", regex: /^(?:\s*)IMPORTANT\s*:/m, label: "IMPORTANT: at start of output" },
+  { id: "critical_start", regex: /^(?:\s*)CRITICAL\s*:/m, label: "CRITICAL: at start of output" },
+  { id: "fake_system_tag", regex: /<\/?system(?:\s[^>]*)?>/, label: "XML <system> boundary tag" },
+  { id: "fake_assistant_tag", regex: /<\/?assistant(?:\s[^>]*)?>/, label: "XML <assistant> boundary tag" },
+  { id: "fake_user_tag", regex: /<\/?user(?:\s[^>]*)?>/, label: "XML <user> boundary tag" },
+  { id: "fake_tool_boundary", regex: /\[TOOL_OUTPUT:(START|END)\]/i, label: "spoofed TOOL_OUTPUT boundary marker" },
+  { id: "disregard", regex: /disregard\s+(all\s+)?(prior|previous|above)\s+(instructions|context)/i, label: "disregard prior instructions" },
+  { id: "new_instructions", regex: /new\s+instructions?\s*:/i, label: "new instructions injection" }
+];
+
+/**
+ * Wraps an external tool output with clear boundary markers so the LLM
+ * can distinguish trusted system content from untrusted external data.
+ */
+export function tagUntrustedInput(toolOutput, toolName) {
+  const text = String(toolOutput ?? "");
+  const name = String(toolName ?? "unknown");
+  return `[TOOL_OUTPUT:START tool=${name} trust=external]\n${text}\n[TOOL_OUTPUT:END]`;
+}
+
+/**
+ * Scans text for common prompt-injection patterns.
+ * Returns { flagged, patterns, sanitised }.
+ * The sanitised string is always the original text (we never mutate),
+ * but the flag + pattern list lets callers decide what to do.
+ */
+export function detectInjectionPatterns(text) {
+  const input = String(text ?? "");
+  const matched = [];
+
+  for (const pattern of INJECTION_PATTERNS) {
+    if (pattern.regex.test(input)) {
+      matched.push(pattern.label);
+    }
+  }
+
+  return {
+    flagged: matched.length > 0,
+    patterns: matched,
+    sanitised: input
+  };
+}
+
+/**
+ * Combined entry-point used by the executor: tag + scan in one call.
+ * Logs a warning to console.warn when injection patterns are detected
+ * but never blocks execution to avoid false-positive breakage.
+ */
+export function processToolOutput(toolOutput, toolName) {
+  const detection = detectInjectionPatterns(toolOutput);
+
+  if (detection.flagged) {
+    const err = new RuntimeError(
+      `Potential prompt injection detected in output from tool "${toolName}"`,
+      { category: "security", context: { toolName, patterns: detection.patterns.join("; ") }, recoverable: true }
+    );
+    console.warn(formatRuntimeError(err));
+  }
+
+  const tagged = tagUntrustedInput(detection.sanitised, toolName);
+
+  return {
+    tagged,
+    detection
+  };
+}