residoo 0.21.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cli.js

@@ -165,6 +165,27 @@ Scan options:
                           excludes bare email/phone (too common in
                           ordinary text to meet this
                           project's own high-confidence bar even opt-in).
+  --include-injection      also scan transcript content for prompt-
+                          injection signatures: special/role-token
+                          sequences (<|im_start|>, [INST], <<SYS>>, and
+                          similar -- the control tokens an attacker can
+                          smuggle into fetched content to make a model
+                          treat it as a privileged turn instead of
+                          untrusted data) and hidden instructions carried
+                          by invisible Unicode. A third RISK CATEGORY,
+                          neither a credential nor PII: this looks for
+                          evidence an injection attempt already reached
+                          the agent, in the same at-rest transcript
+                          content every other pass scans -- not a
+                          static-analysis check of an application's own
+                          prompt-construction code (that's a different,
+                          much bigger product; see docs/comparison.md).
+                          Combine with --include-noisy for a small set of
+                          canonical override phrases ("ignore previous
+                          instructions" and close variants) -- disclosed
+                          as genuinely heuristic and prone to matching a
+                          security-research conversation about this exact
+                          technique, not a solved detection problem.
 
 Watch:
   residoo watch            continuous scanning instead of one snapshot:
@@ -182,7 +203,8 @@ Watch:
   --verify                same opt-in vendor check as scan --verify,
                           applied to each newly found credential once,
                           never to one already seen
-  --include-noisy, --include-suppressed, --include-pii, --no-color
+  --include-noisy, --include-suppressed, --include-pii,
+  --include-injection, --no-color
                           same meaning as scan
   --no-notify             skip the OS desktop notification watch fires for
                           each genuinely new finding (macOS via osascript,
@@ -774,6 +796,7 @@ async function runWatch(args) {
   const verify = args.includes("--verify");
   const noColor = args.includes("--no-color");
   const includePii = args.includes("--include-pii");
+  const includeInjection = args.includes("--include-injection");
   const noNotify = args.includes("--no-notify");
 
   let intervalSeconds = 5;
@@ -800,7 +823,7 @@ async function runWatch(args) {
 
   const { promise, stop } = startWatch({
     sources,
-    options: { includeNoisy, includeSuppressed, verify, noColor, includePii, noNotify, json: wantsJson, pollMs: intervalSeconds * 1000 },
+    options: { includeNoisy, includeSuppressed, verify, noColor, includePii, includeInjection, noNotify, json: wantsJson, pollMs: intervalSeconds * 1000 },
   });
 
   const printFinalSummary = (stats) => {
@@ -1098,6 +1121,11 @@ async function main(argv) {
   // card numbers, IBAN) rather than the shape-only, much noisier
   // categories (bare email, phone) some competitors also ship.
   const wantsPii = args.includes("--include-pii");
+  // --include-injection: a third, separate risk category from either of the
+  // above (see injection.js) -- detects a realized prompt-injection
+  // signature already sitting in transcript content, not a credential or
+  // personal data.
+  const wantsInjection = args.includes("--include-injection");
 
   // --project [dir]: the dir is optional (CI passes ".", a bare --project
   // means the current directory). null means machine mode.
@@ -1209,7 +1237,7 @@ async function main(argv) {
 
   const progress = makeProgressReporter(noColor);
   const result = await scan({
-    sources, includeNoisy, includeSuppressed, verify, noColor, ocr: wantsOcr, includePii: wantsPii,
+    sources, includeNoisy, includeSuppressed, verify, noColor, ocr: wantsOcr, includePii: wantsPii, includeInjection: wantsInjection,
     onProgress: progress.onProgress,
     // Clears the spinner's last frame before --verify's own stderr lines
     // print; without this the last spinner line sits uncleared on screen

package/src/cve.js

@@ -0,0 +1,278 @@
+"use strict";
+
+/**
+ * A small, hand-curated, dated table of published CVEs affecting the
+ * MCP/AI-agent ecosystem, plus a minimal version-range matcher -- the
+ * shared infrastructure behind `residoo scan`'s MCP-config CVE check
+ * (integrity.js's "MCP server configuration risks" section) and a future
+ * `--project` dependency-manifest check.
+ *
+ * SOURCE, stated precisely because it matters: every entry below was
+ * fetched directly from GitHub's own Security Advisory REST API
+ * (api.github.com/advisories?ecosystem=<npm|pip>&affects=<package>) on
+ * 2026-09-05 -- a primary, authoritative source (GHSA-reviewed, each
+ * entry carrying its own CVE id, GHSA id, and vulnerable/patched version
+ * range), not a secondary aggregator's summary. An earlier draft of this
+ * table was built from a dedicated MCP-CVE tracking site
+ * (vulnerablemcp.info) and cross-checked against this API before
+ * shipping; every version range below is the API's own
+ * `vulnerable_version_range` field, not a re-derived or estimated one.
+ * Package NAMES were independently confirmed to exist on the real npm/
+ * PyPI registries (`npm view <pkg>`, PyPI's own JSON API) before being
+ * added here -- a wrong package name would silently never match anything,
+ * the same "never a false all-clear" concern CONTRIBUTING.md states for
+ * source paths, applied to this table instead.
+ *
+ * DELIBERATELY SMALL, on purpose: this is ~24 entries across 10 packages,
+ * not a claim of exhaustive coverage the way Medusa's own "~200 CVEs" is.
+ * Every single entry here is individually traceable to a specific GHSA/
+ * CVE id and a real advisory -- the same "84 high-confidence rules beat a
+ * competitor's higher rule count" trade-off already proven on this
+ * project's own benchmark (see bench/RESULTS.md), applied to CVE data
+ * instead of secret patterns. A welcome follow-up PR is adding more
+ * packages through the same API query, cited the same way -- never by
+ * guessing a plausible-sounding range.
+ *
+ * VERSION COMPARISON: a minimal, hand-written major.minor.patch numeric
+ * comparator -- NOT a full semver-range grammar (no ^, ~, prerelease
+ * tags, build metadata, x-ranges). Sufficient for every range in this
+ * table, including the date-based versioning scheme
+ * `@modelcontextprotocol/server-filesystem` switched to mid-2025
+ * (`2025.1.14`, `2025.7.1`) -- verified directly that comparing
+ * `[2025,1,20]` against `[2025,7,1]` component-by-component gives the
+ * correct ordering, the same way it would for an ordinary semver triple.
+ * A version string this comparator can't parse (a prerelease suffix, a
+ * git-hash pseudo-version, anything non-numeric) is reported as
+ * "cannot determine" by the caller, never silently treated as either safe
+ * or vulnerable -- CONTRIBUTING.md's rule 5 applied to a version string
+ * instead of a file.
+ */
+
+const CVE_DATABASE = [
+  // ---- npm ----
+  {
+    id: "CVE-2025-6514", ecosystem: "npm", package: "mcp-remote", severity: "critical",
+    ranges: [{ min: "0.0.5", maxExclusive: "0.1.16" }],
+    summary: "OS command injection via a crafted authorization_endpoint response URL when connecting to an untrusted MCP server.",
+    source: "GHSA-6xpm-ggf7-wc3p",
+  },
+  {
+    id: "CVE-2025-58444", ecosystem: "npm", package: "@modelcontextprotocol/inspector", severity: "high",
+    ranges: [{ maxExclusive: "0.16.6" }],
+    summary: "Potential command execution via XSS when Inspector connects to an untrusted MCP server.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-49596", ecosystem: "npm", package: "@modelcontextprotocol/inspector", severity: "critical",
+    ranges: [{ maxExclusive: "0.14.1" }],
+    summary: "The Inspector proxy server lacks authentication between the Inspector client and the proxy, enabling RCE.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-23744", ecosystem: "npm", package: "@mcpjam/inspector", severity: "critical",
+    ranges: [{ maxInclusive: "1.4.2" }],
+    summary: "Remote code execution via an exposed, unauthenticated HTTP endpoint.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-65513", ecosystem: "npm", package: "mcp-fetch-server", severity: "medium",
+    ranges: [{ maxInclusive: "1.0.2" }],
+    summary: "Server-Side Request Forgery (SSRF) vulnerability.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53372", ecosystem: "npm", package: "node-code-sandbox-mcp", severity: "high",
+    ranges: [{ maxInclusive: "1.2.0" }],
+    summary: "Sandbox escape via command injection.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-47250", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "medium",
+    ranges: [{ maxInclusive: "3.6.2" }],
+    summary: "kubectl-generic flag injection enables Kubernetes bearer-token exfiltration.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-46519", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxExclusive: "3.6.0" }],
+    summary: "Tool access control bypass via presentation-layer filtering with no execution-layer enforcement.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-39884", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxInclusive: "3.4.0" }],
+    summary: "Argument injection in the port_forward tool via space-splitting.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66404", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "medium",
+    ranges: [{ maxInclusive: "2.9.7" }],
+    summary: "Security issue in the exec_in_pod tool.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53355", ecosystem: "npm", package: "mcp-server-kubernetes", severity: "high",
+    ranges: [{ maxExclusive: "2.5.0" }],
+    summary: "Command injection in several tools.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-25536", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ min: "1.10.0", maxInclusive: "1.25.3" }],
+    summary: "Cross-client data leak via shared server/transport instance reuse.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-0621", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ min: "1.3.0", maxExclusive: "1.25.2" }],
+    summary: "ReDoS (regular expression denial of service) vulnerability.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66414", ecosystem: "npm", package: "@modelcontextprotocol/sdk", severity: "high",
+    ranges: [{ maxExclusive: "1.24.0" }],
+    summary: "DNS rebinding protection not enabled by default on localhost-bound SSE/StreamableHTTP servers.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53110", ecosystem: "npm", package: "@modelcontextprotocol/server-filesystem", severity: "high",
+    ranges: [{ maxInclusive: "0.6.2" }, { min: "2025.1.14", maxExclusive: "2025.7.1" }],
+    summary: "Path validation bypass via a colliding path prefix.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53109", ecosystem: "npm", package: "@modelcontextprotocol/server-filesystem", severity: "high",
+    ranges: [{ maxInclusive: "0.6.2" }, { min: "2025.1.14", maxExclusive: "2025.7.1" }],
+    summary: "Path validation bypass via prefix matching and symlink handling.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+
+  // ---- pip ----
+  {
+    id: "CVE-2026-59950", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.28.1" }],
+    summary: "MCP Python SDK: WebSocket server transport does not support Host/Origin validation.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-52869", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxInclusive: "1.27.1" }],
+    summary: "MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-52870", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ min: "1.23.0", maxInclusive: "1.27.1" }],
+    summary: "Experimental task handlers allow any client to access and cancel other clients' tasks.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-66416", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.23.0" }],
+    summary: "DNS rebinding protection not enabled by default on localhost-bound SSE/StreamableHTTP servers.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53366", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.9.4" }],
+    summary: "FastMCP Server validation error leading to denial of service.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-53365", ecosystem: "pip", package: "mcp", severity: "high",
+    ranges: [{ maxExclusive: "1.10.0" }],
+    summary: "Unhandled exception in the Streamable HTTP transport, leading to denial of service.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2026-27735", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2026.1.14" }],
+    summary: "Path traversal in git_add allows staging files outside the repository boundary.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68145", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.12.18" }],
+    summary: "Missing path validation when using the --repository flag.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68144", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.12.18" }],
+    summary: "Argument injection in git_diff and git_checkout allows overwriting local files.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+  {
+    id: "CVE-2025-68143", ecosystem: "pip", package: "mcp-server-git", severity: "medium",
+    ranges: [{ maxExclusive: "2025.9.25" }],
+    summary: "Unrestricted git_init tool allows repository creation at arbitrary filesystem locations.",
+    source: "GHSA (fetched via api.github.com/advisories)",
+  },
+];
+
+/**
+ * Parse a version string's leading major.minor.patch numeric triple.
+ * Returns null for anything this simple comparator can't handle (a
+ * prerelease/build-metadata suffix, a git-hash pseudo-version, a bare "1"
+ * or "1.2" with no patch component) -- the caller must treat null as
+ * "cannot determine," never as a match or a clean bill of health.
+ */
+function parseVersion(v) {
+  // `String(v)` itself can throw -- an object whose own `toString` property
+  // is present but not a function (e.g. `{ toString: "" }`, a real shape
+  // fast-check's property fuzzing found, not a hypothetical) fails the
+  // ToPrimitive coercion with "Cannot convert object to primitive value"
+  // before the regex ever runs. `v` here can be anything an attacker-
+  // controlled MCP config's `args` array contains, so this must degrade to
+  // "unparseable" the same as any other malformed input, never throw.
+  let s;
+  try { s = String(v).trim(); } catch { return null; }
+  const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(s);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+
+/** -1 / 0 / 1, comparing two parseVersion() triples component-by-component. */
+function compareVersions(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i];
+  }
+  return 0;
+}
+
+function inOneRange(parsed, range) {
+  if (range.min) {
+    const min = parseVersion(range.min);
+    if (min && compareVersions(parsed, min) < 0) return false;
+  }
+  if (range.maxInclusive) {
+    const max = parseVersion(range.maxInclusive);
+    if (max && compareVersions(parsed, max) > 0) return false;
+  }
+  if (range.maxExclusive) {
+    const max = parseVersion(range.maxExclusive);
+    if (max && compareVersions(parsed, max) >= 0) return false;
+  }
+  return true;
+}
+
+/**
+ * Check one resolved `packageName`@`version` pair (ecosystem "npm" or
+ * "pip") against CVE_DATABASE. Returns `{ checkable, matches }` --
+ * `checkable: false` means the version string couldn't be parsed at all
+ * (report "cannot determine," never silently clean); `matches` is every
+ * CVE_DATABASE entry whose package matches and whose vulnerable range
+ * (any one of its, possibly several, disjoint ranges) contains this
+ * version.
+ */
+function checkVersion(ecosystem, packageName, version) {
+  const parsed = parseVersion(version);
+  if (!parsed) return { checkable: false, matches: [] };
+  const matches = CVE_DATABASE.filter((entry) =>
+    entry.ecosystem === ecosystem &&
+    entry.package === packageName &&
+    entry.ranges.some((r) => inOneRange(parsed, r)));
+  return { checkable: true, matches };
+}
+
+module.exports = { CVE_DATABASE, parseVersion, compareVersions, checkVersion };

package/src/injection.js

@@ -0,0 +1,139 @@
+"use strict";
+
+const { scanZeroWidth } = require("./integrity");
+
+/**
+ * Prompt-injection signature detection, applied to the SAME transcript
+ * content every other pass already reads (tool_result blocks, fetched-page
+ * text, file contents an agent read, ordinary message text) -- no new
+ * source, no new file walk, just a second/third rule set matched against
+ * lines scan.js already has in memory. Opt-in via `--include-injection`,
+ * the same "different risk category, not a lower-confidence secret"
+ * reasoning pii.js's own header states for `--include-pii`.
+ *
+ * WHAT THIS IS NOT, stated up front because it is the single most important
+ * scope distinction here: this is NOT a static-analysis scanner for an LLM
+ * APPLICATION'S OWN SOURCE CODE (an f-string concatenating user input into a
+ * prompt, unsanitized external content reaching a prompt template). That is
+ * a real, different product -- it's what Medusa's own PI-SCAN does (checked
+ * directly against Medusa's own docs/AI_SECURITY.md, fetched 2026-09-05:
+ * "Direct Injection: f-string interpolation with user_input... Indirect
+ * Injection: External content fetched and embedded in prompts without
+ * sanitization" -- both examples are about auditing an application's PROMPT
+ * -CONSTRUCTION code for a latent vulnerability class). residoo has no
+ * access to that code and isn't built to read it; what residoo already has,
+ * uniquely, is the agent's own TRANSCRIPT -- a record of what actually got
+ * fed to a live agent. So this module detects INJECTION PAYLOADS THAT
+ * ALREADY REACHED AN AGENT, sitting in the same at-rest data every other
+ * residoo pass scans -- a genuinely different, arguably more valuable
+ * signal (a realized attempt, not a hypothetical vulnerable code path), not
+ * an attempt to clone Medusa's SAST feature with a worse implementation.
+ *
+ * SIGNAL SOURCES, verified 2026-09-05:
+ *
+ *   - **Special/role-token injection**: `<|im_start|>`, `<|im_end|>`,
+ *     `<|system|>`, `<|user|>`, `<|assistant|>`, `<|endoftext|>`,
+ *     `<|endofprompt|>`, `[INST]`/`[/INST]`, `<<SYS>>`/`<</SYS>>` -- the
+ *     control tokens chat-templated models use to delineate a message's
+ *     ROLE. An attacker who gets one of these into content an agent reads
+ *     (a fetched webpage, a file, a tool's output) can, on a vulnerable
+ *     serving pipeline, make the model treat injected text as a new
+ *     system/assistant turn rather than untrusted data. This is a named,
+ *     real technique -- "Special Token Injection" (Sentry's own STI attack
+ *     guide, blog.sentry.security/special-token-injection-sti-attack-guide,
+ *     fetched directly: "the model expects certain token patterns to
+ *     signify roles... if the... pipeline does not properly filter or
+ *     escape these sequences, an attacker's input will reach the model...
+ *     analogous to injecting a SQL query via an input field"), corroborated
+ *     by OWASP's LLM01 Prompt Injection entry (genai.owasp.org) and a 2026
+ *     arXiv paper specifically on chat-template abuse for indirect
+ *     injection ("ChatInject: Abusing Chat Templates for Prompt Injection
+ *     in LLM Agents," arxiv.org/abs/2509.22830) -- not one vendor's
+ *     unverified claim. Medusa's own docs name this same technique family
+ *     ("Code-Level Prompt Injection... ChatML tokens, role manipulation"),
+ *     confirming it's a real, converged-upon signal, not something invented
+ *     here. HIGH confidence: these exact token strings essentially never
+ *     appear in ordinary prose or code by accident -- the honest, disclosed
+ *     exception is a message that *discusses* these tokens by name (a
+ *     tokenizer bug report, this very file's own docstring) rather than
+ *     attempting to use them, the same "a real key a user pasted to ask
+ *     about it" false-positive class patterns.js's private_key_block rule
+ *     already carries.
+ *   - **Hidden/invisible Unicode**: reuses `scanZeroWidth` from
+ *     `integrity.js` verbatim (see that function's own docstring for the
+ *     TrapDoor campaign citation and the always-suspicious/context-
+ *     dependent tiering) -- extended here to every line of every
+ *     transcript this project reads, not only the fixed CLAUDE.md/memory-
+ *     file locations `checkIntegrity` already covers. This closes a real
+ *     gap in the existing coverage: a hidden instruction delivered via a
+ *     fetched web page or a tool's own output lands in ordinary transcript
+ *     content, not in one of `checkIntegrity`'s known config paths, so the
+ *     existing check cannot see it.
+ *
+ * NOISY_INJECTION_PATTERNS (opt-in ADDITIONALLY via `--include-noisy`,
+ * exactly mirroring patterns.js's own NOISY_PATTERNS contract -- "broader,
+ * shape-based patterns that catch more but false-positive more often"):
+ * a small set of the most-cited canonical instruction-override phrases
+ * ("ignore previous instructions" and its close variants). Disclosed
+ * plainly, not glossed over: phrase-based matching is genuinely prone to
+ * matching a security-research conversation, a GitHub issue about prompt
+ * injection, or this very codebase's own documentation discussing the
+ * technique -- OWASP's own LLM01 page and multiple practitioner write-ups
+ * (Simon Willison's "prompt injection" writing among them) describe
+ * reliable phrase-based detection as an open, unsolved problem, not
+ * something this rule set claims to have solved. LOW confidence, never
+ * part of the default report, for exactly that reason.
+ *
+ * WHAT THIS DOES NOT COVER, stated rather than silently gapped: tool-
+ * DESCRIPTION poisoning (a malicious MCP server changing a tool's
+ * description after approval, "rug-pull") is a real, named technique
+ * (Medusa's own "Tool Poisoning (MCP101)") that this module cannot check,
+ * because a tool's description is part of the MCP protocol payload sent to
+ * the model at request time, not something Claude Code's own transcript
+ * JSONL logs — verified directly against a real transcript on this
+ * project's own build machine: a `tool_use` record for an
+ * `mcp__`-namespaced tool carries only `{name, input}`, never the tool's
+ * description or input schema. Checking that would require a live MCP
+ * client connection to query `tools/list`, a fundamentally different
+ * architecture (an active protocol client, not a file scanner) that this
+ * project has not built and is not attempting to fake here.
+ */
+
+const CHATML_TOKEN_RE = /<\|(?:im_start|im_end|system|user|assistant|endoftext|endofprompt)\|>|\[\/?INST\]|<<\/?SYS>>/g;
+
+const INJECTION_PATTERNS = [
+  { id: "chatml_special_token", label: "Special/role-token injection (ChatML or similar)", confidence: "high" },
+  { id: "zero_width_hidden_instruction", label: "Hidden instruction carried by invisible Unicode", confidence: "high" },
+];
+
+const NOISY_INJECTION_PATTERNS = [
+  {
+    id: "injection_override_phrase", label: "Instruction-override phrase (heuristic)", confidence: "low",
+    // Deliberately narrow: the small set of phrasings cited across OWASP's
+    // LLM01 page and independent practitioner write-ups as the canonical
+    // "ignore what came before" injection framing, not an attempt at
+    // exhaustive jailbreak-phrase coverage (see module docstring on why
+    // phrase-based detection stays opt-in and low-confidence).
+    re: /\b(?:ignore|disregard)\s+(?:all\s+|any\s+)?(?:the\s+|your\s+)?(?:previous|prior|above|earlier)\s+instructions\b|\bforget\s+(?:everything|all)\s+(?:above|before\s+this)\b/gi,
+  },
+];
+
+/**
+ * Minimal per-line invisible-character summary: codepoint name + count,
+ * no line-number list (unlike integrity.js's summarizeZeroWidth, which is
+ * built for a whole-file, many-line summary) -- the caller already has the
+ * real line number for this one call, so repeating it here would just be
+ * confusing "(line 1)" noise from scanZeroWidth's own internal, line-blind
+ * counting of a single line with no embedded newline.
+ */
+function summarizeInvisibles(hits) {
+  const byCp = new Map();
+  for (const h of hits) byCp.set(h.cp, (byCp.get(h.cp) || 0) + 1);
+  const parts = [];
+  for (const [cp, count] of byCp) {
+    parts.push("U+" + cp.toString(16).toUpperCase().padStart(4, "0") + " ×" + count);
+  }
+  return parts.join(", ");
+}
+
+module.exports = { INJECTION_PATTERNS, NOISY_INJECTION_PATTERNS, CHATML_TOKEN_RE, summarizeInvisibles };

package/src/integrity.js

@@ -10,6 +10,7 @@ const os = require("os");
 // reference at import time and never see a later patch.
 const cp = require("child_process");
 const { PATTERNS, redact } = require("./patterns");
+const { checkVersion } = require("./cve");
 
 /**
  * Integrity checks for agent config directories.
@@ -386,6 +387,100 @@ function extractHooks(parsed) {
   return { hooks, unrecognized, hadHooksKey: true, truncated, sawLeaf };
 }
 
+// ── MCP server configuration risk checks ────────────────────────────────
+//
+// Distinct from agent-configs.js (which scans these same files' raw TEXT
+// for leaked secrets) and from injection.js (which scans transcript
+// CONTENT for injection payloads): this parses the STRUCTURED
+// `mcpServers` object every MCP client config converges on
+// (`{"mcpServers": {"<name>": {"command", "args", "env", "url"}}}` --
+// Claude Code, Claude Desktop, Cursor, and Visual Studio's own docs all
+// document this identical shape, already cited in agent-configs.js's own
+// header) and checks it for two named, real risk classes:
+//
+//   1. A known-vulnerable version of a specific MCP-ecosystem package
+//      pinned in the server's launch command (see cve.js).
+//   2. A remote (non-loopback) server configured over plain HTTP instead
+//      of HTTPS -- MCP protocol traffic, including tool definitions,
+//      crossing a real network in cleartext.
+//
+// NOT checked, disclosed rather than silently gapped (see injection.js's
+// own header for the fuller version of this point): a malicious server
+// changing a TOOL'S OWN DESCRIPTION after approval ("tool poisoning") --
+// a tool's description is protocol data returned by a live server at
+// request time, never present in a static config file, so there is
+// nothing here for a file-scanner to check it against.
+
+/**
+ * Extract the `mcpServers` object from a parsed config file. Every real
+ * MCP client this project has verified (Claude Code, Claude Desktop,
+ * Cursor, Visual Studio) uses this identical top-level shape. Anything
+ * else (the key absent, present but not an object) yields an empty
+ * object -- a config with no MCP servers configured is not an error.
+ */
+function extractMcpServers(parsed) {
+  if (!parsed || typeof parsed !== "object") return {};
+  const servers = parsed.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) return {};
+  return servers;
+}
+
+// npm: optional @scope/, then a name, a literal @, then a version
+// starting with a digit. pip: a name, a literal ==, then a version
+// starting with a digit. Both anchored full-string (^...$) -- matched
+// against ONE argv element at a time, never a substring of a longer
+// string that happens to contain a coincidental match.
+const NPM_PKG_VERSION_RE = /^(@[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+|[a-zA-Z0-9._-]+)@(\d[\w.-]*)$/;
+const PIP_PKG_VERSION_RE = /^([a-zA-Z0-9._-]+)==(\d[\w.-]*)$/;
+
+/**
+ * Scan one MCP server's `args` array for a `package@version` (npm) or
+ * `package==version` (pip) argv element -- the documented invocation
+ * shape for `npx <pkg>@<version>` / `uvx <pkg>==<version>` / `pip install
+ * <pkg>==<version>`. An unpinned invocation (`npx mcp-remote` with no
+ * `@version`) yields nothing here on purpose: there's no version to
+ * check, and this deliberately does NOT treat "unpinned" itself as a
+ * finding -- that's a real, genuinely debatable trade-off (always
+ * getting the latest PATCHED release vs. exposure to a compromised
+ * "latest" publish), not a clear vulnerability the way a specific
+ * known-bad pinned version is.
+ */
+function extractPackageVersions(args) {
+  if (!Array.isArray(args)) return [];
+  const found = [];
+  for (const a of args) {
+    if (typeof a !== "string") continue;
+    const npm = NPM_PKG_VERSION_RE.exec(a);
+    if (npm) { found.push({ ecosystem: "npm", package: npm[1], version: npm[2] }); continue; }
+    const pip = PIP_PKG_VERSION_RE.exec(a);
+    if (pip) found.push({ ecosystem: "pip", package: pip[1], version: pip[2] });
+  }
+  return found;
+}
+
+// A well-known, widely-flagged supply-chain red flag: an installer script
+// fetched and piped directly into a shell, never saved or reviewed first.
+// Checked against the whole command+args joined, not `command` alone,
+// since the realistic shape is `command: "sh", args: ["-c", "curl ... |
+// bash"]` -- the risky text lives in `args`, not `command`.
+const CURL_PIPE_SHELL_RE = /\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash|zsh)\b/i;
+
+/**
+ * True for a URL-transport MCP server (`url` field present) using plain
+ * HTTP to a non-loopback host. A loopback URL (localhost/127.0.0.1/::1)
+ * is excluded -- an ordinary local-dev MCP server, not the actual risk
+ * this names: MCP protocol traffic, including tool definitions, crossing
+ * a real network where it can be observed or altered in transit.
+ */
+function isInsecureRemoteUrl(url) {
+  if (typeof url !== "string") return false;
+  let parsed;
+  try { parsed = new URL(url); } catch { return false; }
+  if (parsed.protocol !== "http:") return false;
+  const host = parsed.hostname;
+  return host !== "localhost" && host !== "127.0.0.1" && host !== "::1" && host !== "[::1]";
+}
+
 // ── the checker ───────────────────────────────────────────────────────────
 
 /**
@@ -827,6 +922,66 @@ function checkIntegrity({ home = os.homedir(), cwd = process.cwd(), projectMode
     }
   }
 
+  // ---- 6. MCP server configuration risks ---------------------------------
+  // Home/machine-level configs (none of these are ever project-scoped by
+  // any vendor's own design, the same reasoning section 5 states) plus
+  // the two genuinely project-scoped MCP config locations, which use `cwd`
+  // unconditionally -- `cwd` already equals the project root in project
+  // mode (see this function's own docstring), so no separate branch is
+  // needed for them.
+  const mcpConfigFiles = [];
+  if (!projectMode) {
+    mcpConfigFiles.push(path.join(home, ".claude.json"));
+    const desktopConfig =
+      process.platform === "darwin" ? path.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") :
+      process.platform === "win32" ? path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json") :
+      null; // Linux: no official build, unofficial ports disagree -- see agent-configs.js's own header
+    if (desktopConfig) mcpConfigFiles.push(desktopConfig);
+    mcpConfigFiles.push(path.join(home, ".cursor", "mcp.json"));
+    mcpConfigFiles.push(path.join(home, ".kiro", "settings", "mcp.json"));
+    mcpConfigFiles.push(path.join(home, ".mcp.json"));
+  }
+  mcpConfigFiles.push(path.join(cwd, ".mcp.json"));
+  mcpConfigFiles.push(path.join(cwd, ".vs", "mcp.json"));
+
+  for (const file of mcpConfigFiles) {
+    const text = readOrReport(file);
+    if (text === null) continue;
+
+    let parsed;
+    try { parsed = JSON.parse(text); } catch {
+      add("warn", "unparseable-config", file, "exists in a known MCP config location but is not valid JSON; the client's own loader would also choke on it, so corruption or tampering is worth a look");
+      continue;
+    }
+
+    const servers = extractMcpServers(parsed);
+    for (const [name, def] of Object.entries(servers)) {
+      if (!def || typeof def !== "object") continue;
+      const label = safePreview(name, 60);
+
+      for (const { ecosystem, package: pkg, version } of extractPackageVersions(def.args)) {
+        const { checkable, matches } = checkVersion(ecosystem, pkg, version);
+        if (!checkable) continue; // a version string this comparator can't parse: unverified, not silently clean, but nothing more to say than that
+        for (const m of matches) {
+          add("warn", "mcp-known-cve", file,
+            `MCP server "${label}" pins ${pkg}@${version}, matching ${m.id} (${m.severity}): ${m.summary} Upgrade past the vulnerable range.`);
+        }
+      }
+
+      if (isInsecureRemoteUrl(def.url)) {
+        add("warn", "mcp-insecure-transport", file,
+          `MCP server "${label}" connects to ${safePreview(def.url, 80)} over plain HTTP -- protocol traffic, including tool definitions, can be observed or altered in transit. Use an HTTPS URL if the server supports one.`);
+      }
+
+      const commandLine = [def.command, ...(Array.isArray(def.args) ? def.args : [])]
+        .filter((x) => typeof x === "string").join(" ");
+      if (commandLine && CURL_PIPE_SHELL_RE.test(commandLine)) {
+        add("warn", "mcp-curl-pipe-shell", file,
+          `MCP server "${label}" launch command fetches a script and pipes it directly into a shell: "${safePreview(commandLine)}". Review and pin to a specific, reviewed version instead of trusting whatever the URL currently serves.`);
+      }
+    }
+  }
+
   return {
     findings,
     filesChecked,
@@ -836,4 +991,9 @@ function checkIntegrity({ home = os.homedir(), cwd = process.cwd(), projectMode
   };
 }
 
-module.exports = { checkIntegrity };
+// scanZeroWidth is also reused by injection.js, applying the same
+// TrapDoor-sourced invisible-character classification (see its own
+// docstring above) to general transcript content, not just this file's
+// own fixed config-location list -- additive export, this module's own
+// behavior is unchanged.
+module.exports = { checkIntegrity, scanZeroWidth };

package/src/mcpTools.js

@@ -52,18 +52,20 @@ function rejectUnknownKeys(args, allowed) {
 
 /**
  * Shared arg shape for residoo_scan/residoo_check: includeNoisy,
- * includeSuppressed, includePii, maxEntries. includePii is exposed here
- * (unlike ocr or verify, see this file's own header comment on verify's
- * exclusion) because it is architecturally identical to includeNoisy --
- * local-only, no network call, no external process, just a different
- * detection category (see pii.js) -- not the network/live-secret trust
- * boundary verify's own exclusion is specifically about.
+ * includeSuppressed, includePii, includeInjection, maxEntries. includePii
+ * and includeInjection are exposed here (unlike ocr or verify, see this
+ * file's own header comment on verify's exclusion) because they are
+ * architecturally identical to includeNoisy -- local-only, no network
+ * call, no external process, just a different detection category (see
+ * pii.js and injection.js respectively) -- not the network/live-secret
+ * trust boundary verify's own exclusion is specifically about.
  */
 function validateSweepArgs(args, allowedKeys) {
   const errs = rejectUnknownKeys(args, allowedKeys);
   if (args.includeNoisy !== undefined && typeof args.includeNoisy !== "boolean") errs.push("includeNoisy must be a boolean");
   if (args.includeSuppressed !== undefined && typeof args.includeSuppressed !== "boolean") errs.push("includeSuppressed must be a boolean");
   if (args.includePii !== undefined && typeof args.includePii !== "boolean") errs.push("includePii must be a boolean");
+  if (args.includeInjection !== undefined && typeof args.includeInjection !== "boolean") errs.push("includeInjection must be a boolean");
   let maxEntries = 25;
   if (args.maxEntries !== undefined) {
     if (typeof args.maxEntries !== "number" || !Number.isInteger(args.maxEntries) || args.maxEntries < 1 || args.maxEntries > 200) {
@@ -74,7 +76,7 @@ function validateSweepArgs(args, allowedKeys) {
   }
   return {
     errs, includeNoisy: args.includeNoisy === true, includeSuppressed: args.includeSuppressed === true,
-    includePii: args.includePii === true, maxEntries,
+    includePii: args.includePii === true, includeInjection: args.includeInjection === true, maxEntries,
   };
 }
 
@@ -134,8 +136,8 @@ function buildTools({ sources }) {
   let checkStarted = false;
 
   async function handleScan(args) {
-    const SCAN_KEYS = new Set(["projectDir", "includeNoisy", "includeSuppressed", "includePii", "maxEntries"]);
-    const { errs, includeNoisy, includeSuppressed, includePii, maxEntries } = validateSweepArgs(args, SCAN_KEYS);
+    const SCAN_KEYS = new Set(["projectDir", "includeNoisy", "includeSuppressed", "includePii", "includeInjection", "maxEntries"]);
+    const { errs, includeNoisy, includeSuppressed, includePii, includeInjection, maxEntries } = validateSweepArgs(args, SCAN_KEYS);
     if (args.projectDir !== undefined && typeof args.projectDir !== "string") errs.push("projectDir must be a string");
     if (errs.length) return errorResult(`Invalid arguments: ${errs.join("; ")}`);
 
@@ -152,7 +154,7 @@ function buildTools({ sources }) {
       scanSources = sources;
     }
 
-    const result = await scan({ sources: scanSources, includeNoisy, includeSuppressed, includePii, verify: false, noColor: true });
+    const result = await scan({ sources: scanSources, includeNoisy, includeSuppressed, includePii, includeInjection, verify: false, noColor: true });
     const acks = loadAcks();
     const dismissed = loadDismissed();
     const rotation = renderRotation(result.findings, acks, dismissed);
@@ -179,8 +181,8 @@ function buildTools({ sources }) {
   }
 
   async function handleCheck(args) {
-    const CHECK_KEYS = new Set(["includeNoisy", "includeSuppressed", "includePii", "maxEntries"]);
-    const { errs, includeNoisy, includeSuppressed, includePii, maxEntries } = validateSweepArgs(args, CHECK_KEYS);
+    const CHECK_KEYS = new Set(["includeNoisy", "includeSuppressed", "includePii", "includeInjection", "maxEntries"]);
+    const { errs, includeNoisy, includeSuppressed, includePii, includeInjection, maxEntries } = validateSweepArgs(args, CHECK_KEYS);
     if (errs.length) return errorResult(`Invalid arguments: ${errs.join("; ")}`);
 
     const firstCheckThisSession = !checkStarted;
@@ -191,7 +193,7 @@ function buildTools({ sources }) {
     const emit = (e) => events.push(e);
     const stats = await sweepOnce({
       sources, tracked: checkTracked, seen: checkSeen, ledger,
-      options: { includeNoisy, includeSuppressed, includePii, verify: false, noColor: true }, emit,
+      options: { includeNoisy, includeSuppressed, includePii, includeInjection, verify: false, noColor: true }, emit,
     });
 
     const allNew = events.filter((e) => e.type === "finding");
@@ -366,6 +368,7 @@ function buildTools({ sources }) {
         includeNoisy: { type: "boolean", default: false, description: "Also run residoo's two low-confidence heuristic rules (generic password/secret assignments) -- catches more, false-positives more. Off by default." },
         includeSuppressed: { type: "boolean", default: false, description: "Include matches normally hidden because they look like vendor-documented example values or placeholder text. Off by default." },
         includePii: { type: "boolean", default: false, description: "Also scan for PII and adjacent secrets (US Social Security Numbers, Luhn-validated credit card numbers, checksum-validated IBANs, BIP-39 checksum-validated crypto wallet seed phrases) -- a different risk category from a vendor credential, not a lower confidence bar. Off by default; residoo is deliberately credentials-only otherwise." },
+        includeInjection: { type: "boolean", default: false, description: "Also scan transcript content for prompt-injection signatures (special/role-token sequences like <|im_start|> or [INST], and hidden instructions carried by invisible Unicode) -- evidence an injection attempt already reached the agent, not a static-analysis check of application code. A third risk category, off by default." },
         maxEntries: { type: "integer", minimum: 1, maximum: 200, default: 25, description: "Cap on distinct findings returned in full detail, pending-first. Counts in the response are always exact even when the entry list is truncated." },
       },
       required: [],
@@ -382,6 +385,7 @@ function buildTools({ sources }) {
         includeNoisy: { type: "boolean", default: false, description: "Same meaning as residoo_scan." },
         includeSuppressed: { type: "boolean", default: false, description: "Same meaning as residoo_scan." },
         includePii: { type: "boolean", default: false, description: "Same meaning as residoo_scan." },
+        includeInjection: { type: "boolean", default: false, description: "Same meaning as residoo_scan." },
         maxEntries: { type: "integer", minimum: 1, maximum: 200, default: 25, description: "Cap on new findings / re-exposures returned in full detail. Counts are always exact even when truncated." },
       },
       required: [],

package/src/report.js

@@ -541,11 +541,15 @@ function renderJson(result, integrity = null, rotation = null) {
         // value was never plain text at all -- it was read out of a
         // pasted or tool-returned image (see ocr.js); `pii` means this is
         // a --include-pii finding, a different risk category from a
-        // credential, not a rule from the default set (see pii.js).
+        // credential, not a rule from the default set (see pii.js);
+        // `injection` means this is a --include-injection finding -- a
+        // prompt-injection signature, not a credential or PII at all (see
+        // injection.js).
         ...(f.encoding ? { encoding: f.encoding } : {}),
         ...(f.spanLines ? { spanLines: f.spanLines } : {}),
         ...(f.ocr ? { ocr: true } : {}),
         ...(f.pii ? { pii: true } : {}),
+        ...(f.injection ? { injection: true } : {}),
         fingerprint: fingerprintFinding(f),
         // Only present on an --include-suppressed run: says WHY this finding
         // is low-confidence, so a JSON consumer doesn't have to guess.

package/src/rotation.js

@@ -1222,6 +1222,43 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Low-confidence match: verify before rotating anything.",
   },
+
+  // ── INJECTION_PATTERNS (--include-injection; see injection.js) ─────────
+  // Framed like the PII entries above, not like a credential: there is no
+  // issuer, no console, nothing to rotate. The real action is investigating
+  // HOW this reached the transcript -- a fetched page, a file the agent
+  // read, a tool's own output -- since that's the actual attack surface,
+  // not the token/character itself.
+  chatml_special_token: {
+    label: "Special/role-token injection (ChatML or similar)",
+    consolePath: "No vendor console -- this is a structural signature in content, not a credential.",
+    steps: [
+      "Find which tool call or fetched source produced the line this was found in -- that's the actual entry point, not this file",
+      "If it came from external content (a web page, an API response, a file the agent read), treat that source as untrusted going forward and review what the agent did in the turns immediately after seeing it",
+      "If this is a false positive -- code or documentation that legitimately discusses these tokens by name (a tokenizer bug report, this project's own docs) -- no action needed",
+    ],
+    revokeNote: "High confidence structurally (these exact token sequences are rare in ordinary prose/code), but confidence in the MATCH is not the same as confidence an attack succeeded -- whether it actually altered the agent's behavior depends on the specific model/serving pipeline, which this check cannot see.",
+  },
+  zero_width_hidden_instruction: {
+    label: "Hidden instruction carried by invisible Unicode",
+    consolePath: "No vendor console -- this is a structural signature in content, not a credential.",
+    steps: [
+      "Inspect the source file in a hex viewer or an editor that reveals invisible characters -- never trust how it renders in a normal terminal, that's the whole point of this technique",
+      "Find which tool call or fetched source produced this line, the same way as the special-token rule above",
+      "This is the same technique named in the TrapDoor campaign (see integrity.js's own citation) -- if this pattern shows up in a fixed config location (CLAUDE.md, a hook script) rather than ordinary transcript content, `residoo scan`'s own integrity check (not this rule) is what already covers that case with campaign-specific detail",
+    ],
+    revokeNote: "The always-suspicious codepoint tier (not the context-dependent emoji-joiner tier) is what reaches this rule -- see integrity.js's scanZeroWidth for exactly which codepoints qualify and why.",
+  },
+  injection_override_phrase: {
+    label: "Instruction-override phrase (noisy rule)",
+    generic: true,
+    consolePath: "No vendor console -- this is a phrase match in content, not a credential.",
+    steps: [
+      "Read the surrounding context before treating this as a real attempt -- this exact phrase is also what a security-research conversation, a GitHub issue, or a prompt-engineering discussion about this technique looks like, and this rule cannot tell the difference",
+      "If it's a real attempt, find which tool call or fetched source it came from",
+    ],
+    revokeNote: "Low-confidence, phrase-based match: OWASP's own LLM01 guidance and independent practitioner writing both describe reliable phrase-based injection detection as unsolved, not something this rule claims to have done.",
+  },
 };
 Object.freeze(ROTATION_GUIDANCE);
 

package/src/scan.js

@@ -5,6 +5,8 @@ const { PATTERNS, NOISY_PATTERNS, redact } = require("./patterns");
 const { findDecodedMatches, findBoundaryMatches, contentProjection } = require("./decode");
 const { isTesseractAvailable, extractImageBlocks, ocrImageBase64 } = require("./ocr");
 const { PII_PATTERNS } = require("./pii");
+const { INJECTION_PATTERNS, NOISY_INJECTION_PATTERNS, CHATML_TOKEN_RE, summarizeInvisibles } = require("./injection");
+const { scanZeroWidth } = require("./integrity");
 const { findPairedSecret, findNearbyCandidate } = require("./pairing");
 const { looksRandom } = require("./rarity");
 const { decodeJwtExpiryMs } = require("./jwtExpiry");
@@ -273,7 +275,7 @@ function localTimestamp(d) {
  * absolute path can itself carry a username or a project name the rest of
  * this report is careful never to print.
  */
-async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false, verifyOnlyFingerprint = null, onBeforeVerify = null, noColor = false, ocr = false, includePii = false } = {}) {
+async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false, verifyOnlyFingerprint = null, onBeforeVerify = null, noColor = false, ocr = false, includePii = false, includeInjection = false } = {}) {
   const rules = includeNoisy ? PATTERNS.concat(NOISY_PATTERNS) : PATTERNS;
   // --ocr: checked once, not per line/image -- isTesseractAvailable shells
   // out, and this scan can touch thousands of lines. ocrRequestedButMissing
@@ -639,6 +641,40 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
   };
 
+  // --include-injection: a third, separate risk category (see injection.js's
+  // own header for why this is neither a secret nor PII). No suppression
+  // heuristics apply here -- there is no "vendor-documented example" or
+  // "placeholder-like context" equivalent for a special-token sequence or a
+  // hidden Unicode character, unlike a value-shaped secret. NOISY_INJECTION_
+  // PATTERNS additionally require --include-noisy, mirroring exactly how
+  // patterns.js's own NOISY_PATTERNS require it for secrets.
+  const injectionLine = (line, file, relFile, lineNo, mtimeMs) => {
+    if (!includeInjection) return;
+    for (const rule of INJECTION_PATTERNS) {
+      if (rule.id === "chatml_special_token") {
+        CHATML_TOKEN_RE.lastIndex = 0;
+        let m;
+        while ((m = CHATML_TOKEN_RE.exec(line)) !== null) {
+          record(rule, m[0], relFile, file, lineNo, mtimeMs, rule.confidence, null, { injection: true });
+        }
+      } else if (rule.id === "zero_width_hidden_instruction") {
+        const hits = scanZeroWidth(line).filter((h) => h.suspicious);
+        if (hits.length > 0) {
+          record(rule, summarizeInvisibles(hits), relFile, file, lineNo, mtimeMs, rule.confidence, null, { injection: true });
+        }
+      }
+    }
+    if (includeNoisy) {
+      for (const rule of NOISY_INJECTION_PATTERNS) {
+        rule.re.lastIndex = 0;
+        let m;
+        while ((m = rule.re.exec(line)) !== null) {
+          record(rule, m[0], relFile, file, lineNo, mtimeMs, rule.confidence, null, { injection: true });
+        }
+      }
+    }
+  };
+
   // Feature 2: split-line boundary join. A finding here means one credential
   // was split across this line and the next and is contiguous on neither. It
   // is recorded against BOTH contributing lines (each holds a fragment of the
@@ -763,6 +799,13 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
               flagFailed();
             }
           }
+          if (includeInjection) {
+            try {
+              injectionLine(line, file, relFile, i + 1, mtimeMs);
+            } catch (err) {
+              flagFailed();
+            }
+          }
           try {
             const content = contentProjection(line);
             // Boundary join with the previous line (2-way splits only; see

package/src/watch.js

@@ -267,14 +267,14 @@ function makeSyntheticSource(realId, batchesByFile) {
  * `verify` is always forced off here: seeding a dedup cache must never be
  * the reason a live vendor API gets hit.
  */
-async function baselineSeed(source, sourceId, file, sizeBytes, mtimeMs, seen, includeNoisy, includeSuppressed, noColor, includePii) {
+async function baselineSeed(source, sourceId, file, sizeBytes, mtimeMs, seen, includeNoisy, includeSuppressed, noColor, includePii, includeInjection) {
   const batch = await readWholeFile(source, file, sizeBytes, mtimeMs);
   if (!batch) return;
   let result;
   try {
     result = await scan({
       sources: [makeSyntheticSource(sourceId, new Map([[file, batch]]))],
-      includeNoisy, includeSuppressed, verify: false, noColor, includePii,
+      includeNoisy, includeSuppressed, verify: false, noColor, includePii, includeInjection,
     });
   } catch {
     return; // best-effort: a failure here just leaves this file's dedup
@@ -300,7 +300,7 @@ async function baselineSeed(source, sourceId, file, sizeBytes, mtimeMs, seen, in
  * `dismiss` takes effect without a restart.
  */
 async function sweepOnce({ sources, tracked, seen, ledger, options, emit }) {
-  const { includeNoisy, includeSuppressed, verify, noColor, includePii } = options || {};
+  const { includeNoisy, includeSuppressed, verify, noColor, includePii, includeInjection } = options || {};
   let loud = 0;
   let quiet = 0;
   let suppressedByLedger = 0;
@@ -364,7 +364,7 @@ async function sweepOnce({ sources, tracked, seen, ledger, options, emit }) {
           contentHash: tailable ? null : wholeFileHash(file),
         });
         if (!tailable) {
-          await baselineSeed(source, sourceId, file, sizeBytes, mtimeMs, seen, includeNoisy, includeSuppressed, noColor, includePii);
+          await baselineSeed(source, sourceId, file, sizeBytes, mtimeMs, seen, includeNoisy, includeSuppressed, noColor, includePii, includeInjection);
         }
         continue;
       }
@@ -433,7 +433,7 @@ async function sweepOnce({ sources, tracked, seen, ledger, options, emit }) {
     try {
       result = await scan({
         sources: [makeSyntheticSource(sourceId, batchesByFile)],
-        includeNoisy, includeSuppressed, verify, noColor, includePii,
+        includeNoisy, includeSuppressed, verify, noColor, includePii, includeInjection,
       });
     } catch (err) {
       emit({ type: "watch-error", at: new Date(), source: sourceId, detail: "scan failed: " + (err && err.message) });