/*
 * Copyright 2026, Jaime Terrats.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
const SECRET_PATTERNS = [
    {
        pattern: /(?:AWS_?(?:ACCESS_?KEY|SECRET)|aws_access_key_id|aws_secret_access_key)\s*[=:]\s*\S+/gi,
        label: 'AWS credential',
        action: 'redact',
    },
    { pattern: /(?:GITHUB_TOKEN|GH_TOKEN|GITHUB_PAT)\s*[=:]\s*\S+/gi, label: 'GitHub token', action: 'redact' },
    { pattern: /ghp_[A-Za-z0-9]{36,}/g, label: 'GitHub PAT', action: 'redact' },
    { pattern: /ghs_[A-Za-z0-9]{36,}/g, label: 'GitHub App token', action: 'redact' },
    { pattern: /sk-[A-Za-z0-9]{32,}/g, label: 'API secret key', action: 'redact' },
    { pattern: /xox[bporas]-[A-Za-z0-9-]{10,}/g, label: 'Slack token', action: 'redact' },
    { pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g, label: 'Private key', action: 'redact' },
    { pattern: /(?:password|passwd|pwd)\s*[=:]\s*['"]?[^\s'"]{8,}/gi, label: 'Password literal', action: 'redact' },
    {
        pattern: /(?:SONAR_TOKEN|ANTHROPIC_API_KEY|OPENAI_API_KEY|CLAUDE_API_KEY)\s*[=:]\s*\S+/gi,
        label: 'Service API key',
        action: 'redact',
    },
];
const DANGEROUS_COMMAND_PATTERNS = [
    { pattern: /\brm\s+-rf\s+[/~]/g, label: 'Destructive rm -rf', action: 'warn' },
    { pattern: /\bcurl\s+.*\|\s*(?:bash|sh|zsh)/g, label: 'Pipe to shell', action: 'warn' },
    { pattern: /\bchmod\s+777\b/g, label: 'World-writable permission', action: 'warn' },
    { pattern: /\beval\s*\(/g, label: 'eval() call', action: 'warn' },
    { pattern: /\b(?:DROP|DELETE FROM|TRUNCATE)\s+\w+/gi, label: 'Destructive SQL/SOQL', action: 'warn' },
];
const REDACTION_PLACEHOLDER = '[REDACTED]';
export function filterOutput(content, canary) {
    const findings = [];
    let filtered = content;
    let redacted = false;
    // Check canary leak (deterministic — if canary is present, it was exfiltrated)
    if (canary && filtered.includes(canary)) {
        findings.push('Canary token leaked in output — possible prompt injection success');
        filtered = filtered.replaceAll(canary, REDACTION_PLACEHOLDER);
        redacted = true;
    }
    // Scan for secrets
    for (const { pattern, label, action } of SECRET_PATTERNS) {
        const matches = filtered.match(pattern);
        if (matches) {
            findings.push(`${label} detected (${String(matches.length)} occurrence${matches.length > 1 ? 's' : ''})`);
            if (action === 'redact') {
                filtered = filtered.replace(pattern, REDACTION_PLACEHOLDER);
                redacted = true;
            }
        }
    }
    // Scan for dangerous commands (warn only — don't redact)
    for (const { pattern, label } of DANGEROUS_COMMAND_PATTERNS) {
        if (pattern.test(filtered)) {
            findings.push(`Warning: ${label} found in response`);
        }
        pattern.lastIndex = 0;
    }
    return { content: filtered, redacted, findings };
}
export function isCleanOutput(result) {
    return !result.redacted && result.findings.length === 0;
}
//# sourceMappingURL=output-filter.js.map