opencode-v2-guard 0.0.0-stage → 1.0.0

package/src/guard.ts

@@ -0,0 +1,431 @@
+import { Error as ToolError } from "@opencode/plugin/promise/tool"
+import type { Plugin } from "@opencode/plugin"
+import { createHash } from "node:crypto"
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+import { activePatterns, type Pattern } from "./patterns.ts"
+import { redact, scan } from "./scan.ts"
+import { isPathBlocked, isPathExempt, isPathWriteProtected } from "./glob.ts"
+import type { GuardConfig } from "./config.ts"
+import { appendAudit, type AuditEvent } from "./audit.ts"
+import { scanSkillDir } from "./skillcheck.ts"
+import { checkInstall } from "./deps.ts"
+
+type Ctx = Plugin.Context
+
+const PATH_KEY = /^(filePath|path|file|directory|dir|folder|uri)$/i
+const WRITE_TOOLS = new Set(["write", "edit", "patch"])
+const SHELL_TOOLS = new Set(["shell", "bash"])
+/** never rewrite these (matching anchors must stay byte-identical to the file) */
+const SKIP_REDACT_KEYS = new Set(["oldString", "old_string", "oldText"])
+
+function audit(cfg: GuardConfig, ev: AuditEvent): void {
+  if (!cfg.audit.enabled) return
+  appendAudit(cfg.audit.dir, ev)
+}
+
+function veto(message: string): never {
+  throw new ToolError({ message })
+}
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v)
+}
+
+function keepValue(key: string): boolean {
+  return SKIP_REDACT_KEYS.has(key) || PATH_KEY.test(key)
+}
+
+/**
+ * Recursively count (and optionally mask) secret matches in string values.
+ * Skips match-anchors and path-like keys (paths are policy-checked, not rewritten).
+ */
+function deepRedact(value: unknown, patterns: readonly Pattern[], mutate: boolean, skipKey?: string): number {
+  if (typeof value === "string") {
+    if (skipKey && keepValue(skipKey)) return 0
+    return redact(value, patterns).matches.length
+  }
+  if (Array.isArray(value)) {
+    let n = 0
+    for (let i = 0; i < value.length; i++) n += deepRedact(value[i], patterns, mutate)
+    return n
+  }
+  if (isRecord(value)) {
+    let n = 0
+    for (const [k, v] of Object.entries(value)) {
+      if (typeof v === "string") {
+        if (!keepValue(k)) {
+          const r = redact(v, patterns)
+          if (r.matches.length > 0) {
+            if (mutate) value[k] = r.text
+            n += r.matches.length
+          }
+        }
+      } else {
+        n += deepRedact(v, patterns, mutate, k)
+      }
+    }
+    return n
+  }
+  return 0
+}
+
+/** Collect strings stored under path-like keys. */
+function pathStrings(value: unknown, out: string[] = []): string[] {
+  if (Array.isArray(value)) {
+    for (const v of value) pathStrings(v, out)
+    return out
+  }
+  if (isRecord(value)) {
+    for (const [k, v] of Object.entries(value)) {
+      if (typeof v === "string" && PATH_KEY.test(k)) out.push(v)
+      else pathStrings(v, out)
+    }
+  }
+  return out
+}
+
+/** Extract target paths from unified-diff ---/+++ headers in patch text. */
+function patchPaths(text: string): string[] {
+  const out: string[] = []
+  for (const line of text.split("\n")) {
+    const m = /^(?:---|\+\+\+)\s+"?([^\s"]+)"?/.exec(line)
+    if (m && m[1] !== "/dev/null") out.push(m[1].replace(/^[ab]\//, ""))
+  }
+  return out
+}
+
+function commandTokens(command: string): string[] {
+  return command
+    .split(/[\s"'`;&|()<>]+/)
+    .flatMap((t) => t.split("="))
+    .map((t) => t.replace(/^[<>]+/, ""))
+    .filter((t) => t.length > 0)
+}
+
+function checkCommandPaths(command: string, cfg: GuardConfig): string | undefined {
+  // limitation: ~, $VAR and shell globs are not expanded here — the runtime
+  // shell may still resolve them to blocked paths. Tracked as a known gap.
+  for (const token of commandTokens(command)) {
+    if (isPathBlocked(token, cfg)) return token
+  }
+  return undefined
+}
+
+function categoriesOf(matches: readonly { category: string }[]): string[] {
+  return [...new Set(matches.map((m) => m.category))].sort()
+}
+
+function uriToPath(uri: string): string | undefined {
+  if (!uri.startsWith("file://")) return undefined
+  const raw = uri.slice("file://".length)
+  try {
+    return decodeURIComponent(raw)
+  } catch {
+    return raw
+  }
+}
+
+function trackHook(reg: Promise<{ dispose(): Promise<void> }>): void {
+  void reg.then(
+    (r) => tracked.push(r),
+    (err) => console.error("guard: hook registration failed", err),
+  )
+}
+
+const tracked: { dispose(): Promise<void> }[] = []
+
+/** recent deps-audit dedup: tool.before and shell.create.before both see the same command */
+const DEPS_AUDIT_TTL_MS = 2000
+const depsAuditRecent = new Map<string, number>()
+
+export function registerGuard(ctx: Ctx, cfg: GuardConfig): () => Promise<void> {
+  const patterns = activePatterns(cfg.disabledPatterns)
+  const now = () => new Date().toISOString()
+
+  // --- startup scan of installed skills (warn-only, never blocks plugin load) ---
+  if (cfg.scanSkillsOnLoad) {
+    try {
+      const dir = join(homedir(), ".config", "opencode", "skills")
+      const findings = scanSkillDir(dir, patterns, cfg.exemptSkills)
+      // hot-reload: skip re-audit when the findings summary is unchanged
+      const hash = createHash("sha256").update(JSON.stringify(findings)).digest("hex")
+      const marker = join(cfg.audit.dir, "guard-skillscan.state")
+      let prev: string | null = null
+      try {
+        prev = readFileSync(marker, "utf8")
+      } catch {
+        prev = null
+      }
+      if (prev !== hash) {
+        try {
+          mkdirSync(cfg.audit.dir, { recursive: true })
+          writeFileSync(marker, hash, "utf8")
+        } catch {
+          // state file is best-effort
+        }
+        for (const f of findings) {
+          audit(cfg, { ts: now(), kind: "skill", categories: f.categories, count: f.count, action: "warn" })
+        }
+        if (findings.length > 0) {
+          console.warn(`guard: ${findings.length} скилл(ов) с подозрительным содержимым: ${findings.map((f) => f.skill).join(", ")} — детали в аудите`)
+        }
+      }
+    } catch {
+      // never crash plugin load
+    }
+  }
+
+  // --- user prompts ---
+  if (cfg.scanPrompts) {
+    trackHook(
+      ctx.session.hook("prompt", (event) => {
+        const mutate = cfg.mode === "enforce"
+        const action: AuditEvent["action"] = mutate ? "redacted" : "warn"
+
+        // attachment path policy: a blocked file must not enter the context
+        const files = event.prompt.files ?? []
+        for (let i = files.length - 1; i >= 0; i--) {
+          const p = uriToPath(files[i].uri)
+          if (p && isPathBlocked(p, cfg)) {
+            if (mutate) files.splice(i, 1)
+            audit(cfg, { ts: now(), kind: "prompt", sessionID: event.sessionID, categories: ["path"], count: 1, action })
+          }
+        }
+
+        const text = event.prompt.text
+        if (!text) return
+        const r = redact(text, patterns)
+        if (r.matches.length === 0) return
+        if (mutate) {
+          event.prompt.text = r.text
+          // fix mention offsets (files/agents/skills) invalidated by the rewrite
+          const delta = (pos: number) =>
+            r.matches.filter((m) => m.start < pos).reduce((d, m) => d + (m.mask.length - (m.end - m.start)), 0)
+          const mentioned = [
+            ...(event.prompt.files ?? []),
+            ...((event.prompt as { agents?: { mention?: { start: number; end: number; text: string } | undefined }[] }).agents ?? []),
+            ...((event.prompt as { skills?: { mention?: { start: number; end: number; text: string } | undefined }[] }).skills ?? []),
+          ]
+          for (const item of mentioned) {
+            const m = item.mention
+            if (!m) continue
+            if (r.matches.some((x) => x.start < m.end && x.end > m.start)) {
+              item.mention = undefined
+            } else {
+              item.mention = { ...m, start: m.start + delta(m.start), end: m.end + delta(m.end) }
+            }
+          }
+        }
+        audit(cfg, { ts: now(), kind: "prompt", sessionID: event.sessionID, categories: categoriesOf(r.matches), count: r.matches.length, action })
+      }),
+    )
+  }
+
+  // --- tool calls ---
+  trackHook(
+    ctx.tool.hook("execute.before", (event) => {
+      const tool = event.tool
+      const input = event.input
+      const mutate = cfg.mode === "enforce"
+      const action: AuditEvent["action"] = mutate ? "blocked" : "warn"
+
+      // path policy (per path: isPathBlocked is exemption-aware)
+      const paths = pathStrings(input)
+      if (tool === "patch" && isRecord(input) && typeof input.patchText === "string") {
+        paths.push(...patchPaths(input.patchText))
+      }
+      for (const p of paths) {
+        if (isPathBlocked(p, cfg)) {
+          audit(cfg, { ts: now(), kind: "tool.before", tool, sessionID: event.sessionID, categories: ["path"], count: 1, action })
+          if (mutate) veto(`guard: доступ к '${p}' заблокирован — путь в списке запрещённых (секреты/ПДн). Попроси пользователя явно одобрить работу с этим файлом.`)
+          return
+        }
+        if (WRITE_TOOLS.has(tool) && isPathWriteProtected(p, cfg)) {
+          audit(cfg, { ts: now(), kind: "tool.before", tool, sessionID: event.sessionID, categories: ["path"], count: 1, action })
+          if (mutate) veto(`guard: запись в '${p}' заблокирована — путь защищён от изменений.`)
+          return
+        }
+      }
+
+      if (SHELL_TOOLS.has(tool) && isRecord(input) && typeof input.command === "string") {
+        const blockedPath = checkCommandPaths(input.command, cfg)
+        if (blockedPath) {
+          audit(cfg, { ts: now(), kind: "tool.before", tool, sessionID: event.sessionID, categories: ["path"], count: 1, action })
+          if (mutate) veto(`guard: команда обращается к '${blockedPath}' — доступ запрещён.`)
+          return
+        }
+        if (cfg.depsCheck) {
+          const verdict = checkInstall(input.command, cfg.blockedPackages, cfg.allowedPackages)
+          if (verdict) {
+            const cat = verdict.reason === "blocklist" ? "malicious-package" : "typosquat"
+            depsAuditRecent.set(input.command, Date.now())
+            if (depsAuditRecent.size > 100) depsAuditRecent.clear()
+            audit(cfg, { ts: now(), kind: "deps", tool, sessionID: event.sessionID, categories: [cat], count: 1, action })
+            if (mutate) {
+              const why =
+                verdict.reason === "blocklist"
+                  ? "пакет в списке известных вредоносных (инциденты цепочки поставок)"
+                  : `имя похоже на '${verdict.target}' (typosquat)`
+              veto(`guard: установка '${verdict.name}' заблокирована — ${why}. Если установка легитимна — попроси пользователя выполнить её вручную.`)
+            }
+            return
+          }
+        }
+      }
+
+      // secret redaction on mutating input (only when every involved path is exempt)
+      if (cfg.redactOnWrite) {
+        const allExempt = paths.length > 0 && paths.every((p) => isPathExempt(p, cfg))
+        if (!allExempt) {
+          const count = deepRedact(input, patterns, mutate)
+          if (count > 0) {
+            audit(cfg, { ts: now(), kind: "tool.before", tool, sessionID: event.sessionID, categories: ["secret"], count, action: mutate ? "redacted" : "warn" })
+          }
+        }
+      }
+    }),
+  )
+
+  // --- tool results (secrets must not flow into context/logs) ---
+  trackHook(
+    ctx.tool.hook("execute.after", (event) => {
+      const mutate = cfg.mode === "enforce"
+
+      if (event.status === "error") {
+        // bash providers often echo the failing command/stderr into the message
+        const msg = event.error?.message
+        if (typeof msg === "string") {
+          const r = redact(msg, patterns)
+          if (r.matches.length > 0) {
+            if (mutate) event.error = new ToolError({ message: r.text })
+            audit(cfg, { ts: now(), kind: "tool.after", tool: event.tool, sessionID: event.sessionID, categories: categoriesOf(r.matches), count: r.matches.length, action: mutate ? "redacted" : "warn" })
+          }
+        }
+        return
+      }
+
+      const result = event.result as { content?: unknown; output?: unknown; metadata?: unknown }
+      const cats = new Set<string>()
+      let n = 0
+
+      const scrubText = (s: string): string => {
+        const r = redact(s, patterns)
+        if (r.matches.length > 0) {
+          n += r.matches.length
+          for (const m of r.matches) cats.add(m.category)
+          return mutate ? r.text : s
+        }
+        return s
+      }
+
+      const content = result.content
+      if (typeof content === "string") {
+        result.content = scrubText(content)
+      } else if (Array.isArray(content)) {
+        for (const part of content) {
+          if (isRecord(part) && part.type === "text" && typeof part.text === "string") {
+            part.text = scrubText(part.text)
+          }
+        }
+      }
+
+      // content was already scrubbed above — scan the remainder (output/metadata)
+      // so matches are counted once
+      const rest = { ...result, content: undefined }
+      n += deepRedact(rest, patterns, mutate)
+      if (n > 0) {
+        audit(cfg, { ts: now(), kind: "tool.after", tool: event.tool, sessionID: event.sessionID, categories: [...cats].sort(), count: n, action: mutate ? "redacted" : "warn" })
+      }
+    }),
+  )
+
+  // --- shell backstop: every shell creation, including background shells ---
+  trackHook(
+    ctx.shell.hook("create.before", (event) => {
+      const mutate = cfg.mode === "enforce"
+      const blockedPath = checkCommandPaths(event.command, cfg)
+      if (blockedPath) {
+        // no throw here: shell hooks cannot veto, only tool.execute.before can.
+        // neutralize the command instead, then audit the guaranteed block.
+        if (mutate) {
+          const safe = blockedPath.replace(/["'`<>|&]/g, "")
+          event.command = `echo "guard: blocked access to '${safe}'" && exit 1`
+        }
+        audit(cfg, { ts: now(), kind: "shell", categories: ["path"], count: 1, action: mutate ? "blocked" : "warn" })
+        return
+      }
+      if (cfg.depsCheck) {
+        const verdict = checkInstall(event.command, cfg.blockedPackages, cfg.allowedPackages)
+        if (verdict) {
+          const cat = verdict.reason === "blocklist" ? "malicious-package" : "typosquat"
+          if (mutate) {
+            const safe = verdict.name.replace(/["'`<>|&]/g, "")
+            event.command = `echo "guard: install blocked '${safe}'" && exit 1`
+          }
+          const last = depsAuditRecent.get(event.command)
+          if (!last || Date.now() - last > DEPS_AUDIT_TTL_MS) {
+            audit(cfg, { ts: now(), kind: "deps", categories: [cat], count: 1, action: mutate ? "blocked" : "warn" })
+          }
+          return
+        }
+      }
+      if (!cfg.redactOnWrite) return
+      const r = redact(event.command, patterns)
+      if (r.matches.length > 0) {
+        if (mutate) event.command = r.text
+        audit(cfg, { ts: now(), kind: "shell", categories: categoriesOf(r.matches), count: r.matches.length, action: mutate ? "redacted" : "warn" })
+      }
+      for (const [k, v] of Object.entries(event.env)) {
+        if (typeof v !== "string") continue
+        const m = scan(v, patterns)
+        if (m.length > 0) {
+          if (mutate) event.env[k] = "<REDACTED:env>"
+          audit(cfg, { ts: now(), kind: "shell", categories: categoriesOf(m), count: m.length, action: mutate ? "redacted" : "warn" })
+        }
+      }
+    }),
+  )
+
+  // --- outbound context scrub (defense in depth) ---
+  if (cfg.scanOutbound) {
+    trackHook(
+      ctx.session.hook("context", (event) => {
+        const mutate = cfg.mode === "enforce"
+        let n = 0
+        const cats = new Set<string>()
+        const scrub = (s: string): string => {
+          const r = redact(s, patterns)
+          if (r.matches.length > 0) {
+            n += r.matches.length
+            for (const m of r.matches) cats.add(m.category)
+            return mutate ? r.text : s
+          }
+          return s
+        }
+        const system = event.system as Array<{ type: string; text?: string }>
+        for (const part of system) {
+          if (part.type === "text" && typeof part.text === "string") part.text = scrub(part.text)
+        }
+        for (const msg of event.messages) {
+          const m = msg as { content?: unknown }
+          if (typeof m.content === "string") {
+            m.content = scrub(m.content)
+          } else if (Array.isArray(m.content)) {
+            for (const p of m.content) {
+              if (isRecord(p) && p.type === "text" && typeof p.text === "string") {
+                p.text = scrub(p.text)
+              }
+            }
+          }
+        }
+        if (n > 0) audit(cfg, { ts: now(), kind: "context", categories: [...cats].sort(), count: n, action: mutate ? "redacted" : "warn" })
+      }),
+    )
+  }
+
+  return async () => {
+    for (const r of tracked.splice(0)) await r.dispose()
+  }
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+import { Plugin } from "@opencode/plugin"
+import { resolveConfig } from "./config.ts"
+import { registerGuard } from "./guard.ts"
+
+export default Plugin.define({
+  id: "guard",
+  setup(ctx) {
+    const cfg = resolveConfig(ctx.options)
+    return registerGuard(ctx, cfg)
+  },
+})

package/src/patterns.ts

@@ -0,0 +1,120 @@
+export type PatternCategory =
+  | "api-key"
+  | "token"
+  | "private-key"
+  | "credential"
+  | "connection-string"
+  | "pii"
+  | "pii-name"
+  | "prompt-injection"
+
+export interface Pattern {
+  /** stable id, used in audit and disabledPatterns */
+  id: string
+  category: PatternCategory
+  /** regex source; compiled lazily with flags + "gd" */
+  regex: string
+  flags?: string
+  /** capture group to mask; 0 = whole match (default) */
+  maskGroup?: number
+  /** keep last N chars visible in the mask (e.g. sk-…UvWx); omitted = full mask */
+  keepLast?: number
+  /** validate digit-only match with Luhn before accepting */
+  luhn?: boolean
+  /** arbitrary acceptance check; gets the raw span and its position in the full text */
+  validate?: (raw: string, text: string, start: number, end: number) => boolean
+}
+
+export const DEFAULT_PATTERNS: readonly Pattern[] = [
+  // --- private keys (whole block) ---
+  {
+    id: "private-key-block",
+    category: "private-key",
+    regex: "-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----[\\s\\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----",
+  },
+  // --- cloud / service API keys ---
+  { id: "stripe-key", category: "api-key", regex: "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}", keepLast: 4 },
+  { id: "gitlab-pat", category: "api-key", regex: "glpat-[A-Za-z0-9_-]{20,}", keepLast: 4 },
+  { id: "telegram-bot-token", category: "api-key", regex: "\\d{8,10}:[A-Za-z0-9_-]{35}", keepLast: 4 },
+  { id: "slack-webhook", category: "api-key", regex: "https://hooks\\.slack\\.com/services/T[A-Za-z0-9_]+/B[A-Za-z0-9_]+/[A-Za-z0-9_]+", keepLast: 4 },
+  { id: "openai-key", category: "api-key", regex: "sk-[A-Za-z0-9_-]{10,}", keepLast: 4 },
+  { id: "github-token", category: "api-key", regex: "gh[pousr]_[A-Za-z0-9]{20,}", keepLast: 4 },
+  { id: "github-fine-pat", category: "api-key", regex: "github_pat_[A-Za-z0-9_]{20,}", keepLast: 4 },
+  { id: "slack-token", category: "api-key", regex: "xox[baprs]-[A-Za-z0-9-]{10,}", keepLast: 4 },
+  { id: "aws-access-key", category: "api-key", regex: "(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}", keepLast: 4 },
+  { id: "google-api-key", category: "api-key", regex: "AIza[0-9A-Za-z_-]{35}", keepLast: 4 },
+  { id: "google-oauth-token", category: "api-key", regex: "ya29\\.[A-Za-z0-9_-]+", keepLast: 4 },
+  { id: "huggingface-key", category: "api-key", regex: "hf_[A-Za-z0-9]{20,}", keepLast: 4 },
+  { id: "npm-token", category: "api-key", regex: "npm_[A-Za-z0-9]{20,}", keepLast: 4 },
+  // --- tokens ---
+  { id: "jwt", category: "token", regex: "eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}" },
+  { id: "bearer-token", category: "token", regex: "Bearer\\s+[A-Za-z0-9._~+/=-]{20,}", flags: "i" },
+  // --- credentials in URLs and connection strings ---
+  { id: "basic-auth-url", category: "credential", regex: "(?<=https?://)[^\\s/:]+:[^\\s@]+(?=@)" },
+  { id: "connection-string", category: "connection-string", regex: "(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis|amqp|mssql):\\/\\/[^\\s/:]+:[^\\s@]+@" },
+  // --- generic key=value credentials (value masked, key kept) ---
+  {
+    id: "credential-assignment",
+    category: "credential",
+    regex: "(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|refresh[_-]?token|client[_-]?secret)\\b\\s*[:=]\\s*['\"]?(?!<REDACTED:)([^\\s'\"]{4,})",
+    flags: "i",
+    maskGroup: 1,
+  },
+  // --- PII (RU) ---
+  { id: "inn", category: "pii", regex: "(?<![A-Za-zА-Яа-яЁё0-9])(?:инн|inn)(?![A-Za-zА-Яа-яЁё0-9])\\s*[:№]?\\s*(\\d{10}(?:\\d{2})?)", flags: "i", maskGroup: 1 },
+  { id: "snils", category: "pii", regex: "\\d{3}-\\d{3}-\\d{3}[ ]\\d{2}\\b" },
+  { id: "passport-ru", category: "pii", regex: "(?<=паспорт[\\s:№]{0,6})\\d{4}[\\s-]*№?\\s*\\d{6}" },
+  { id: "phone-ru", category: "pii", regex: "(?<!\\d)(?:\\+7|8)[\\s(-]*\\d{3}[\\s)-]*\\d{3}[\\s-]*\\d{2}[\\s-]*\\d{2}(?!\\d)" },
+  { id: "pii-email", category: "pii", regex: "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}" },
+  { id: "bank-card", category: "pii", regex: "\\b\\d{4}[ -]?\\d{4}[ -]?\\d{4}[ -]?\\d{4}(?:[ -]?\\d{3})?\\b", luhn: true },
+  // --- ФИО: only with explicit context marker, name itself masked ---
+  {
+    id: "fio-context",
+    category: "pii-name",
+    regex: "(?:фио|фамилия\\s+имя\\s+отчество)\\s*[:：]?\\s*([А-ЯЁ][а-яё]+(?:[- ][А-ЯЁ][а-яё]+){1,2})",
+    flags: "i",
+    maskGroup: 1,
+  },
+  // --- prompt injection (skill-guard) ---
+  {
+    id: "inj-override",
+    category: "prompt-injection",
+    regex:
+      "ignore\\s+(?:(?:all|any|the|your|of|and),?\\s+){0,3}(?:previous|prior|above|earlier)\\s+instructions" +
+      "|disregard\\s+(?:(?:all|any|the|your|of|and)\\s+){0,3}(?:previous|prior|above|earlier|everything)(?:\\s+instructions)?" +
+      "|forget\\s+(?:everything|all\\s+(?:previous\\s+)?instructions|what\\s+you\\s+(?:were\\s+)?(?:told|instructed))" +
+      "|ignore\\s+the\\s+above" +
+      "|from\\s+now\\s+on\\s+(?:you\\b|ignore|follow|obey)" +
+      "|игнорируй(?:те)?\\s+(?:[а-яё'-]+?\\s+){0,3}[а-яё'-]*?(?:инструкци[ийяюеё]|указани[ийяюеё]|сказанн[оыеёа]|изложенн[оыеёа])" +
+      "|забудь(?:те)?\\s+(?:(?:всё|все)\\s+инструкции|предыдущие(?:\\s+инструкции)?)" +
+      "|отныне\\s+ты",
+    flags: "i",
+  },
+  {
+    id: "inj-exfil-combo",
+    category: "prompt-injection",
+    regex:
+      "~[/\\\\](?:\\.ssh|\\.aws|\\.gnupg)[/\\\\]?[^\\s'\"\\\\]*" +
+      "|(?:[/\\\\]|(?<![\\w.]))\\.env\\b(?:\\.[A-Za-z0-9._-]+)?" +
+      "|\\bid_rsa\\b" +
+      "|\\bcredentials\\.(?:json|csv|ini|txt|ya?ml)\\b|[/\\\\]credentials\\b",
+    validate: (raw, text, start, end) => {
+      const window = text.slice(Math.max(0, start - 200), end + 200)
+      return /curl|wget|(?:^|\s)nc\s|netcat|exfiltrat|base64|send(?:ing)?\b|post(?:ing)?\b|fetch(?:ing)?\b|upload(?:ing)?\b|transfer(?:ing|red)?\b|отправь|отправить|выгрузи|выгрузить|залей|передай|пришли|скинь/i.test(window)
+    },
+  },
+  {
+    id: "inj-zerowidth",
+    category: "prompt-injection",
+    // U+200D (ZWJ) excluded: legit emoji/composite scripts; a lone BOM at position 0 is routine.
+    regex: "[\\u200B\\u200C\\u2060\\uFEFF\\u202E\\u202B]+",
+    validate: (raw, _text, start) => !(start === 0 && raw.length === 1 && raw.charCodeAt(0) === 0xfeff),
+  },
+]
+
+/** patterns minus disabled ids; single source of truth for the active set */
+export function activePatterns(disabledPatterns: readonly string[]): readonly Pattern[] {
+  if (disabledPatterns.length === 0) return DEFAULT_PATTERNS
+  const off = new Set(disabledPatterns)
+  return DEFAULT_PATTERNS.filter((p) => !off.has(p.id))
+}