praxis-sec 1.2.0 → 1.2.1

package/cli/core/output/html-theme.js

@@ -1,158 +1,158 @@
-/**
- * Shared HTML report theme — single source of truth for every Praxis HTML surface.
- * ============================================================================
- *
- * Extracted (P-IMP-051c) because `cli/agents/html-reporter.js` and
- * `cli/commands/team-report.js` each carried their own ~100-line inline stylesheet
- * and their own severity palette. Those palettes had already drifted
- * (`critical` was `#ef4444` in one and `#dc2626` in the other), so every brand or
- * styling fix had to be applied twice — and the two files disagreed on the same
- * concept.
- *
- * Also centralises the primitives that must never be re-implemented per report:
- *   - `esc()`               — HTML escaping. `team-report.js` previously had none and
- *                             interpolated finding text straight into markup, which is
- *                             an injection sink in a file users open in a browser.
- *   - `severityBadgeClass()` — maps a severity to a *known* CSS class, so an arbitrary
- *                             severity string can't be injected into a class attribute.
- *   - `countBySeverity()`    — one counting implementation, not one per report.
- *
- * Design constraints (per AGENTS.md): no build step, no bundler, no framework. These
- * are plain template strings and functions, so every report stays a single
- * self-contained offline HTML file.
- */
-
-/** Severity → accent colour. Used for bars, legends, and inline accents. */
-export const SEVERITY_COLORS = {
-  critical: '#ef4444',
-  high: '#f97316',
-  medium: '#eab308',
-  low: '#38bdf8',
-  info: '#64748b',
-};
-
-/** Security-score letter grade → colour. */
-export const GRADE_COLORS = {
-  A: '#22c55e',
-  B: '#06b6d4',
-  C: '#eab308',
-  D: '#f97316',
-  F: '#ef4444',
-};
-
-/** Every severity we recognise, in report order. */
-export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
-
-/**
- * Severities rendered in distribution bars/legends. Includes `info` so the segments
- * always sum to 100% of the findings shown — omitting it left the bar visibly
- * under-filled whenever a scan produced informational findings.
- */
-export const DISPLAY_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
-
-/**
- * Escapes text for interpolation into HTML markup or a quoted attribute.
- * Null/undefined become an empty string so callers can interpolate directly.
- */
-export function esc(str) {
-  if (str === null || str === undefined) return '';
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
-
-/**
- * Maps a severity to a known-safe CSS class suffix.
- *
- * Returns `''` for anything unrecognised so the result is always a safe subset of
- * the class attribute — a finding whose `severity` came from a parsed report file
- * must never be able to break out of `class="sev-badge …"`.
- */
-export function severityBadgeClass(severity) {
-  const key = String(severity || '').toLowerCase();
-  return SEVERITIES.includes(key) || key === 'info' ? key : '';
-}
-
-/** Renders a severity badge span. Escapes the label and sanitises the class. */
-export function severityBadge(severity, label) {
-  const cls = severityBadgeClass(severity);
-  const text = label ?? String(severity || 'unknown');
-  const classes = cls ? `sev-badge sev-${cls}` : 'sev-badge';
-  return `<span class="${classes}">${esc(text)}</span>`;
-}
-
-/** Counts findings per severity, always returning a fully-populated record. */
-export function countBySeverity(findings = []) {
-  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  for (const f of Array.isArray(findings) ? findings : []) {
-    const key = String(f?.severity || '').toLowerCase();
-    if (key in counts) counts[key]++;
-  }
-  return counts;
-}
-
-/**
- * The shared base stylesheet: reset, typography, layout container, tables, code,
- * severity badges, and the muted/empty/footer primitives. Every report includes
- * this, then appends its own component styles.
- */
-export function baseStyles() {
-  return `
-      *{margin:0;padding:0;box-sizing:border-box}
-      html{scroll-behavior:smooth}
-      body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;background:#090d16;color:#cbd5e1;line-height:1.55;font-size:14px}
-      a{color:#38bdf8;text-decoration:none}
-      a:hover{text-decoration:underline}
-
-      .container{max-width:1440px;margin:1.8rem auto;padding:0 2rem}
-      h1{font-size:1.8rem;font-weight:700;color:#f8fafc;margin-bottom:0.25rem}
-      h2{font-size:1.1rem;font-weight:600;margin:2rem 0 1rem;color:#94a3b8;border-bottom:1px solid #1e293b;padding-bottom:0.5rem;text-transform:uppercase;letter-spacing:0.05em}
-
-      .table-responsive{overflow-x:auto}
-      table{width:100%;border-collapse:collapse;font-size:0.86rem;text-align:left}
-      th{background:#131d33;color:#94a3b8;padding:0.75rem 1rem;font-size:0.75rem;text-transform:uppercase;letter-spacing:0.6px;border-bottom:1px solid #1e293b}
-      td{padding:0.75rem 1rem;border-bottom:1px solid #172239;vertical-align:top}
-      tr:hover td{background:#111b30}
-      code{background:#050811;border:1px solid #1e293b;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.8rem;word-break:break-word}
-      small{color:#64748b}
-
-      .sev-badge{display:inline-block;padding:3px 9px;border-radius:6px;font-size:0.72rem;font-weight:800;text-transform:uppercase;letter-spacing:0.5px}
-      .sev-critical{background:#450a0a;color:#fca5a5;border:1px solid #991b1b}
-      .sev-high{background:#431407;color:#fdba74;border:1px solid #9a3412}
-      .sev-medium{background:#422006;color:#fde047;border:1px solid #854d0e}
-      .sev-low{background:#082f49;color:#7dd3fc;border:1px solid #075985}
-      .sev-info{background:#1e293b;color:#cbd5e1;border:1px solid #334155}
-
-      .muted{color:#64748b}
-      .ok{color:#6ee7b7}
-      .fail{color:#fca5a5}
-      .empty-state{text-align:center;color:#64748b;padding:2.5rem 1rem;font-size:0.9rem}
-      .footer{text-align:center;padding:2.5rem 0 1.5rem;color:#64748b;font-size:0.8rem;border-top:1px solid #1e293b;margin-top:3rem}
-      @media(max-width:1024px){.container{padding:0 1rem}}
-    `;
-}
-
-/**
- * Wraps body markup in a complete, self-contained HTML document.
- *
- * `styles` is injected verbatim and must be trusted (it is always generated by
- * this module, never derived from scan findings). `body` and `title` are escaped.
- */
-export function documentShell({ title, styles, body, bodyClass = '' }) {
-  const cls = bodyClass ? ` class="${esc(bodyClass)}"` : '';
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${esc(title)}</title>
-<style>${styles}</style>
-</head>
-<body${cls}>
-${body}
-</body>
-</html>`;
-}
+/**
+ * Shared HTML report theme — single source of truth for every Praxis HTML surface.
+ * ============================================================================
+ *
+ * Extracted because `cli/agents/html-reporter.js` and
+ * `cli/commands/team-report.js` each carried their own ~100-line inline stylesheet
+ * and their own severity palette. Those palettes had already drifted
+ * (`critical` was `#ef4444` in one and `#dc2626` in the other), so every brand or
+ * styling fix had to be applied twice — and the two files disagreed on the same
+ * concept.
+ *
+ * Also centralises the primitives that must never be re-implemented per report:
+ *   - `esc()`               — HTML escaping. `team-report.js` previously had none and
+ *                             interpolated finding text straight into markup, which is
+ *                             an injection sink in a file users open in a browser.
+ *   - `severityBadgeClass()` — maps a severity to a *known* CSS class, so an arbitrary
+ *                             severity string can't be injected into a class attribute.
+ *   - `countBySeverity()`    — one counting implementation, not one per report.
+ *
+ * Design constraints (per AGENTS.md): no build step, no bundler, no framework. These
+ * are plain template strings and functions, so every report stays a single
+ * self-contained offline HTML file.
+ */
+
+/** Severity → accent colour. Used for bars, legends, and inline accents. */
+export const SEVERITY_COLORS = {
+  critical: '#ef4444',
+  high: '#f97316',
+  medium: '#eab308',
+  low: '#38bdf8',
+  info: '#64748b',
+};
+
+/** Security-score letter grade → colour. */
+export const GRADE_COLORS = {
+  A: '#22c55e',
+  B: '#06b6d4',
+  C: '#eab308',
+  D: '#f97316',
+  F: '#ef4444',
+};
+
+/** Every severity we recognise, in report order. */
+export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
+
+/**
+ * Severities rendered in distribution bars/legends. Includes `info` so the segments
+ * always sum to 100% of the findings shown — omitting it left the bar visibly
+ * under-filled whenever a scan produced informational findings.
+ */
+export const DISPLAY_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+
+/**
+ * Escapes text for interpolation into HTML markup or a quoted attribute.
+ * Null/undefined become an empty string so callers can interpolate directly.
+ */
+export function esc(str) {
+  if (str === null || str === undefined) return '';
+  return String(str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+/**
+ * Maps a severity to a known-safe CSS class suffix.
+ *
+ * Returns `''` for anything unrecognised so the result is always a safe subset of
+ * the class attribute — a finding whose `severity` came from a parsed report file
+ * must never be able to break out of `class="sev-badge …"`.
+ */
+export function severityBadgeClass(severity) {
+  const key = String(severity || '').toLowerCase();
+  return SEVERITIES.includes(key) || key === 'info' ? key : '';
+}
+
+/** Renders a severity badge span. Escapes the label and sanitises the class. */
+export function severityBadge(severity, label) {
+  const cls = severityBadgeClass(severity);
+  const text = label ?? String(severity || 'unknown');
+  const classes = cls ? `sev-badge sev-${cls}` : 'sev-badge';
+  return `<span class="${classes}">${esc(text)}</span>`;
+}
+
+/** Counts findings per severity, always returning a fully-populated record. */
+export function countBySeverity(findings = []) {
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of Array.isArray(findings) ? findings : []) {
+    const key = String(f?.severity || '').toLowerCase();
+    if (key in counts) counts[key]++;
+  }
+  return counts;
+}
+
+/**
+ * The shared base stylesheet: reset, typography, layout container, tables, code,
+ * severity badges, and the muted/empty/footer primitives. Every report includes
+ * this, then appends its own component styles.
+ */
+export function baseStyles() {
+  return `
+      *{margin:0;padding:0;box-sizing:border-box}
+      html{scroll-behavior:smooth}
+      body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;background:#090d16;color:#cbd5e1;line-height:1.55;font-size:14px}
+      a{color:#38bdf8;text-decoration:none}
+      a:hover{text-decoration:underline}
+
+      .container{max-width:1440px;margin:1.8rem auto;padding:0 2rem}
+      h1{font-size:1.8rem;font-weight:700;color:#f8fafc;margin-bottom:0.25rem}
+      h2{font-size:1.1rem;font-weight:600;margin:2rem 0 1rem;color:#94a3b8;border-bottom:1px solid #1e293b;padding-bottom:0.5rem;text-transform:uppercase;letter-spacing:0.05em}
+
+      .table-responsive{overflow-x:auto}
+      table{width:100%;border-collapse:collapse;font-size:0.86rem;text-align:left}
+      th{background:#131d33;color:#94a3b8;padding:0.75rem 1rem;font-size:0.75rem;text-transform:uppercase;letter-spacing:0.6px;border-bottom:1px solid #1e293b}
+      td{padding:0.75rem 1rem;border-bottom:1px solid #172239;vertical-align:top}
+      tr:hover td{background:#111b30}
+      code{background:#050811;border:1px solid #1e293b;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.8rem;word-break:break-word}
+      small{color:#64748b}
+
+      .sev-badge{display:inline-block;padding:3px 9px;border-radius:6px;font-size:0.72rem;font-weight:800;text-transform:uppercase;letter-spacing:0.5px}
+      .sev-critical{background:#450a0a;color:#fca5a5;border:1px solid #991b1b}
+      .sev-high{background:#431407;color:#fdba74;border:1px solid #9a3412}
+      .sev-medium{background:#422006;color:#fde047;border:1px solid #854d0e}
+      .sev-low{background:#082f49;color:#7dd3fc;border:1px solid #075985}
+      .sev-info{background:#1e293b;color:#cbd5e1;border:1px solid #334155}
+
+      .muted{color:#64748b}
+      .ok{color:#6ee7b7}
+      .fail{color:#fca5a5}
+      .empty-state{text-align:center;color:#64748b;padding:2.5rem 1rem;font-size:0.9rem}
+      .footer{text-align:center;padding:2.5rem 0 1.5rem;color:#64748b;font-size:0.8rem;border-top:1px solid #1e293b;margin-top:3rem}
+      @media(max-width:1024px){.container{padding:0 1rem}}
+    `;
+}
+
+/**
+ * Wraps body markup in a complete, self-contained HTML document.
+ *
+ * `styles` is injected verbatim and must be trusted (it is always generated by
+ * this module, never derived from scan findings). `body` and `title` are escaped.
+ */
+export function documentShell({ title, styles, body, bodyClass = '' }) {
+  const cls = bodyClass ? ` class="${esc(bodyClass)}"` : '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<style>${styles}</style>
+</head>
+<body${cls}>
+${body}
+</body>
+</html>`;
+}

package/cli/core/output/sarif.js

@@ -1,7 +1,7 @@
 /**
  * SARIF v2.1.0 output formatter.
  *
- * The single SARIF serializer for Praxis (P-IMP-062). Every emitting path must go
+ * The single SARIF serializer for Praxis. Every emitting path must go
  * through here: `scan --sarif`, `scan ci --sarif`, `audit --sarif`, `redteam --sarif`,
  * `scan standard --sarif` and `--format sarif`. Four commands used to carry private
  * copies of this logic, which meant fixes applied here reached almost nobody — most
@@ -84,7 +84,7 @@ function renderSARIFDocument(report, options = {}) {
     toolName = 'praxis',
     // Defaults to the real package version. This used to fall back to a hardcoded
     // '1.0.0', so any caller that forgot to pass `toolVersion` reported a confidently
-    // wrong driver version in Code Scanning (P-IMP-065).
+    // wrong driver version in Code Scanning.
     toolVersion = report.version || toolVersion_(),
     informationUri = 'https://github.com/Ganron007/Praxis',
     rootPath = null,

package/cli/core/web/jobs.js

@@ -36,7 +36,7 @@ export class JobQueue extends EventEmitter {
    * @returns {{ok:true, job:object} | {ok:false, error:string}}
    */
   enqueue(project) {
-    const queued = this.jobs.length + this.pending.length;
+    const queued = this.running + this.pending.length;
     if (queued >= this.maxQueue) {
       return { ok: false, error: `queue is full (max ${this.maxQueue} scans)` };
     }
@@ -203,4 +203,4 @@ export async function runScanWithOrchestrator(rootPath, onProgress) {
     standardsSummary,
     scannedAt: new Date().toISOString(),
   };
-}
+}

package/cli/core/web/server.js

@@ -18,9 +18,11 @@
 
 import http from 'http';
 import { URL } from 'url';
+import { isIP } from 'net';
 import { listProjects, addProject, getProject, removeProject } from './projects.js';
 import { JobQueue, runScanWithOrchestrator } from './jobs.js';
 import { renderFrontend, AGENT_ROSTER } from './ui.js';
+import jsonReport from '../output/json.js';
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']); // praxis-ignore SSRF_INTERNAL_IP — loopback allow-list: binding only to loopback IS the mitigation
 const CLIENT_HEADER = 'x-praxis-client';
@@ -28,7 +30,8 @@ const CLIENT_VALUE = 'praxis-web';
 const MAX_BODY_BYTES = 64 * 1024;
 
 export function isLoopback(host) {
-  return LOOPBACK.has(host) || String(host).startsWith('127.');
+  const normalized = String(host).replace(/^\[|\]$/g, '');
+  return LOOPBACK.has(normalized) || (isIP(normalized) === 4 && normalized.startsWith('127.'));
 }
 
 /** Decides the effective bind, refusing an unsafe remote bind (threat T4). */
@@ -136,14 +139,14 @@ function guardMutation(req) {
   }
   const origin = req.headers.origin;
   if (origin) {
-    let host;
+    let originURL;
     try {
-      host = new URL(origin).hostname;
+      originURL = new URL(origin);
     } catch {
       return { ok: false, error: 'malformed Origin' };
     }
-    // Same-origin or loopback origin only: blocks DNS rebinding.
-    if (!isLoopback(host) && host !== 'localhost') {
+    // A different loopback port is still a different browser origin.
+    if (!['http:', 'https:'].includes(originURL.protocol) || originURL.host !== req.headers.host) {
       return { ok: false, error: 'cross-origin request refused' };
     }
   }
@@ -211,6 +214,13 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
     const route = url.pathname.replace(/\/+$/, '') || '/';
     const method = req.method || 'GET';
 
+    // DNS rebinding can read reports through GET as well as mutate through POST.
+    // Without token auth, every request must address the actual local server.
+    if (!token && ((!isLoopback(url.hostname) && url.hostname !== 'localhost') ||
+        Number(url.port || 80) !== server.address()?.port)) {
+      return sendJSON(res, 403, { error: 'untrusted Host header' });
+    }
+
     // Auth for remote binds.
     if (token) {
       const auth = req.headers.authorization || '';
@@ -266,7 +276,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
           if (!job) return sendJSON(res, 404, { error: 'no completed scan for this project' });
           const full = jobs.get(job.id);
           if (!full?.result) return sendJSON(res, 404, { error: 'scan has no result' });
-          return sendJSON(res, 200, { job: jobs._public(full), result: full.result });
+          return sendJSON(res, 200, { job: jobs._public(full), result: JSON.parse(jsonReport(full.result)) });
         }
       }
 
@@ -279,7 +289,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
         const full = jobs.get(jobReportMatch[1]);
         if (!full) return sendJSON(res, 404, { error: 'unknown job' });
         if (!full.result) return sendJSON(res, 404, { error: 'scan has no result' });
-        return sendJSON(res, 200, { job: jobs._public(full), result: full.result });
+        return sendJSON(res, 200, { job: jobs._public(full), result: JSON.parse(jsonReport(full.result)) });
       }
 
       const jobMatch = route.match(/^\/api\/jobs\/([\w-]+)$/);
@@ -313,6 +323,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
         });
         const send = j => res.write(`data: ${JSON.stringify(j)}\n\n`);
         send(jobs._public(job));
+        if (['done', 'failed', 'cancelled'].includes(job.status)) return res.end();
         const onUpdate = j => {
           if (j.id !== job.id) return;
           send(j);
@@ -350,4 +361,4 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
   });
 
   return { server, jobs };
-}
+}

package/cli/data/threatpacks/latest.json

@@ -1,41 +1,41 @@
-{
-  "version": "1.1",
-  "_refresh_policy": {
-    "cadence": "Incident-driven + weekly review",
-    "process": "1. Track OWASP LLM/Agentic releases and reported AI attack incidents. 2. Add signatures in own phrasing (never copy AGPL/copyrighted text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
-    "owner": "Praxis contributors",
-    "lastReviewed": "2026-10-02"
-  },
-  "probes": [
-    {
-      "id": "TP-001",
-      "category": "obfuscated-injection",
-      "title": "Encoded-payload decode instruction (base64/hex/ROT)",
-      "regex": "(?i)(?:decode|base64|rot1[0-9]|deobfuscate)[\\s\\S]{0,80}(?:then\\s+(?:respond|answer|execute|run)|before\\s+you\\s+(?:respond|answer))",
-      "severity": "high",
-      "description": "Source contains a decode-then-execute instruction that tells a model to decode an encoded payload before acting — the obfuscated-injection family used to smuggle instructions past content filters.",
-      "fix": "Reject decode-first instructions from untrusted content. Never execute content decoded from user-controlled strings."
-    },
-    {
-      "id": "TP-002",
-      "category": "jailbreak-frame",
-      "title": "System-prompt redefinition instruction",
-      "regex": "(?i)(?:redefine|replace|rewrite)\\s+(?:your|the)\\s+(?:system|base)\\s+(?:prompt|instructions|rules)[\\s\\S]{0,120}(?:with|to)\\s+",
-      "severity": "high",
-      "description": "Source contains an instruction that asks the model to replace its own system prompt — a jailbreak frame that erases the developer's guardrails.",
-      "fix": "Strip prompt-redefinition frames. Treat any instruction that modifies the system prompt as untrusted input."
-    },
-    {
-      "id": "TP-003",
-      "category": "indirect-injection",
-      "title": "Document-payload split injection (multi-file chaining)",
-      "regex": "(?i)(?:part\\s*\\d+\\s*of\\s*\\d+|continue\\s+(?:reading|with|in)\\s+(?:the\\s+)?(?:next|following|part|message)|when\\s+combined\\s+with\\s+(?:the\\s+)?(?:above|previous|preceding|earlier|these|prior|other)\\s+(?:instruction|instructions|rule|rules|prompt|prompts|text|content|contents|message|messages|directive|directives|command|commands|guideline|guidelines)\\b)",
-      "severity": "medium",
-      "description": "Source contains split-payload markers that chain instructions across documents/messages — the payload-splitting technique that defeats per-input content filters.",
-      "fix": "Evaluate documents independently; do not concatenate instruction-like text across untrusted sources.",
-      "_tightened": "P-IMP-057: the bare phrase \"when combined with\" matched ordinary English (e.g. the comment \"when combined with machine output\") and produced a medium-severity finding. It now requires a chaining referent (above/previous/preceding/earlier/these/prior/other) AND an instruction-like noun, so benign prose like \"merged when combined with the previous version\" no longer matches."
-    }
-  ],
-  "eaa": [],
-  "gateways": []
-}
+{
+  "version": "1.1",
+  "_refresh_policy": {
+    "cadence": "Incident-driven + weekly review",
+    "process": "1. Track OWASP LLM/Agentic releases and reported AI attack incidents. 2. Add signatures in own phrasing (never copy AGPL/copyrighted text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
+    "owner": "Praxis contributors",
+    "lastReviewed": "2026-10-02"
+  },
+  "probes": [
+    {
+      "id": "TP-001",
+      "category": "obfuscated-injection",
+      "title": "Encoded-payload decode instruction (base64/hex/ROT)",
+      "regex": "(?i)(?:decode|base64|rot1[0-9]|deobfuscate)[\\s\\S]{0,80}(?:then\\s+(?:respond|answer|execute|run)|before\\s+you\\s+(?:respond|answer))",
+      "severity": "high",
+      "description": "Source contains a decode-then-execute instruction that tells a model to decode an encoded payload before acting — the obfuscated-injection family used to smuggle instructions past content filters.",
+      "fix": "Reject decode-first instructions from untrusted content. Never execute content decoded from user-controlled strings."
+    },
+    {
+      "id": "TP-002",
+      "category": "jailbreak-frame",
+      "title": "System-prompt redefinition instruction",
+      "regex": "(?i)(?:redefine|replace|rewrite)\\s+(?:your|the)\\s+(?:system|base)\\s+(?:prompt|instructions|rules)[\\s\\S]{0,120}(?:with|to)\\s+",
+      "severity": "high",
+      "description": "Source contains an instruction that asks the model to replace its own system prompt — a jailbreak frame that erases the developer's guardrails.",
+      "fix": "Strip prompt-redefinition frames. Treat any instruction that modifies the system prompt as untrusted input."
+    },
+    {
+      "id": "TP-003",
+      "category": "indirect-injection",
+      "title": "Document-payload split injection (multi-file chaining)",
+      "regex": "(?i)(?:part\\s*\\d+\\s*of\\s*\\d+|continue\\s+(?:reading|with|in)\\s+(?:the\\s+)?(?:next|following|part|message)|when\\s+combined\\s+with\\s+(?:the\\s+)?(?:above|previous|preceding|earlier|these|prior|other)\\s+(?:instruction|instructions|rule|rules|prompt|prompts|text|content|contents|message|messages|directive|directives|command|commands|guideline|guidelines)\\b)",
+      "severity": "medium",
+      "description": "Source contains split-payload markers that chain instructions across documents/messages — the payload-splitting technique that defeats per-input content filters.",
+      "fix": "Evaluate documents independently; do not concatenate instruction-like text across untrusted sources.",
+      "_tightened": "The bare phrase \"when combined with\" matched ordinary English (e.g. the comment \"when combined with machine output\") and produced a medium-severity finding. It now requires a chaining referent (above/previous/preceding/earlier/these/prior/other) AND an instruction-like noun, so benign prose like \"merged when combined with the previous version\" no longer matches."
+    }
+  ],
+  "eaa": [],
+  "gateways": []
+}