/**
 * Prompt Guard Service — Prompt Injection Protection
 *
 * Detects and blocks prompt injection attempts that try to extract API keys,
 * secrets, or sensitive environment variables through agent commands.
 *
 * Integrates with the tool registry to block dangerous bash commands and
 * logs blocked attempts to the audit trail.
 *
 * @module services/agent/crewly-agent/prompt-guard.service
 *
 * @example
 * ```typescript
 * const guard = new PromptGuardService();
 * const result = guard.checkCommand('echo $ANTHROPIC_API_KEY');
 * // { blocked: true, reason: 'Key extraction attempt: echo env var', pattern: '...' }
 * ```
 */
/**
 * Patterns that detect attempts to extract API keys or secrets via bash commands.
 */
export const KEY_EXTRACTION_PATTERNS = [
    // Direct env var echo/print
    {
        pattern: /\becho\s+\$[A-Z_]*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)/i,
        reason: 'Attempt to echo sensitive environment variable',
        category: 'env_extraction',
    },
    {
        pattern: /\bprintf\s+.*\$[A-Z_]*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)/i,
        reason: 'Attempt to printf sensitive environment variable',
        category: 'env_extraction',
    },
    // env/printenv with grep for secrets
    {
        pattern: /\benv\b.*\|\s*grep\s+.*(?:KEY|SECRET|TOKEN|PASSWORD|API|AUTH)/i,
        reason: 'Attempt to grep env for secrets',
        category: 'env_extraction',
    },
    {
        pattern: /\bprintenv\b.*(?:KEY|SECRET|TOKEN|PASSWORD|API|AUTH)/i,
        reason: 'Attempt to printenv sensitive variable',
        category: 'env_extraction',
    },
    // set | grep (bash set command dumps all vars)
    {
        pattern: /\bset\b\s*\|\s*grep\s+.*(?:KEY|SECRET|TOKEN|PASSWORD|API|AUTH)/i,
        reason: 'Attempt to dump shell variables and grep for secrets',
        category: 'env_extraction',
    },
    // Reading sensitive config files (must come before bare env/printenv to avoid early match on "cat .env")
    {
        pattern: /\bcat\s+.*\.env\b/i,
        reason: 'Attempt to read .env file',
        category: 'file_exfiltration',
    },
    {
        pattern: /\bcat\s+.*(?:credentials|secrets|\.aws\/credentials|\.npmrc|\.netrc|\.pgpass)/i,
        reason: 'Attempt to read credentials file',
        category: 'file_exfiltration',
    },
    {
        pattern: /\bcat\s+.*\/etc\/shadow\b/i,
        reason: 'Attempt to read system password file',
        category: 'file_exfiltration',
    },
    // Direct env dump
    {
        pattern: /\benv\s*$/i,
        reason: 'Attempt to dump all environment variables',
        category: 'key_dump',
    },
    {
        pattern: /\bprintenv\s*$/i,
        reason: 'Attempt to dump all environment variables',
        category: 'key_dump',
    },
    // compgen dumps shell vars/functions
    {
        pattern: /\bcompgen\s+-[ev]/i,
        reason: 'Attempt to dump shell variables via compgen',
        category: 'key_dump',
    },
    // base64 encoding secrets for exfiltration
    {
        pattern: /\bbase64\b.*\$[A-Z_]*(?:KEY|SECRET|TOKEN)/i,
        reason: 'Attempt to base64 encode secret for exfiltration',
        category: 'file_exfiltration',
    },
    // curl/wget exfiltration of env vars
    {
        pattern: /\b(?:curl|wget)\b.*\$[A-Z_]*(?:KEY|SECRET|TOKEN)/i,
        reason: 'Attempt to exfiltrate secret via HTTP request',
        category: 'file_exfiltration',
    },
    // Python/Node one-liners to access env
    {
        pattern: /\bpython[23]?\s+-c\s+.*os\.environ/i,
        reason: 'Attempt to access env via Python subprocess',
        category: 'env_extraction',
    },
    {
        pattern: /\bnode\s+-e\s+.*process\.env/i,
        reason: 'Attempt to access env via Node subprocess',
        category: 'env_extraction',
    },
    // Specific key variable names in $() or backtick subshells
    {
        pattern: /\$\(.*(?:ANTHROPIC_API_KEY|OPENAI_API_KEY|GOOGLE_API_KEY|AWS_SECRET|STRIPE_SECRET)/i,
        reason: 'Attempt to expand sensitive env var in subshell',
        category: 'env_extraction',
    },
];
/**
 * Prompt-level injection patterns (detected in natural language prompts, not just commands).
 */
export const PROMPT_INJECTION_PATTERNS = [
    {
        pattern: /(?:print|show|reveal|tell\s+me|display|output|give\s+me|share)\s+(?:(?:your|the|my|me\s+the)\s+)?(?:api[_ ]?key|secret|token|password|credentials)/i,
        reason: 'Prompt injection: request to reveal API key/secret',
        category: 'prompt_injection',
    },
    {
        pattern: /(?:what\s+is|what's)\s+(?:your|the|my)\s+(?:api[_ ]?key|secret[_ ]?key|auth[_ ]?token|password)/i,
        reason: 'Prompt injection: question about API key/secret',
        category: 'prompt_injection',
    },
    {
        pattern: /ignore\s+(?:previous|all|your)\s+(?:instructions|rules|safety)/i,
        reason: 'Prompt injection: instruction override attempt',
        category: 'prompt_injection',
    },
    {
        pattern: /(?:override|bypass|disable|turn\s+off)\s+(?:security|safety|filter|guardrail|redaction)/i,
        reason: 'Prompt injection: attempt to disable security filters',
        category: 'prompt_injection',
    },
];
/**
 * Additional blocked command patterns for tool-registry.ts integration.
 * These extend the existing BLOCKED_COMMAND_PATTERNS with key extraction blocks.
 */
export const KEY_EXTRACTION_BLOCKED_COMMANDS = [
    /\benv\s*$/i,
    /\bprintenv\s*$/i,
    /\benv\b.*\|\s*grep\s+.*(?:KEY|SECRET|TOKEN|PASSWORD|API)/i,
    /\bset\b\s*\|\s*grep\s+.*(?:KEY|SECRET|TOKEN|PASSWORD|API)/i,
    /\bcompgen\s+-[ev]/i,
    /\bcat\s+.*\.env\b/i,
    /\bcat\s+.*(?:credentials|secrets|\.aws\/credentials|\.npmrc|\.netrc|\.pgpass)/i,
];
/**
 * Service that detects and blocks prompt injection and key extraction attempts.
 */
export class PromptGuardService {
    commandPatterns;
    promptPatterns;
    /**
     * Creates a new PromptGuardService.
     *
     * @param additionalCommandPatterns - Extra command-level patterns
     * @param additionalPromptPatterns - Extra prompt-level patterns
     */
    constructor(additionalCommandPatterns, additionalPromptPatterns) {
        this.commandPatterns = additionalCommandPatterns
            ? [...KEY_EXTRACTION_PATTERNS, ...additionalCommandPatterns]
            : KEY_EXTRACTION_PATTERNS;
        this.promptPatterns = additionalPromptPatterns
            ? [...PROMPT_INJECTION_PATTERNS, ...additionalPromptPatterns]
            : PROMPT_INJECTION_PATTERNS;
    }
    /**
     * Checks a bash command for key extraction attempts.
     *
     * @param command - Raw bash command string
     * @returns Guard check result
     */
    checkCommand(command) {
        if (!command) {
            return { blocked: false, reason: '' };
        }
        for (const guard of this.commandPatterns) {
            if (guard.pattern.test(command)) {
                return {
                    blocked: true,
                    reason: guard.reason,
                    category: guard.category,
                    matchedPattern: guard.pattern.source,
                };
            }
        }
        return { blocked: false, reason: '' };
    }
    /**
     * Checks a user/agent prompt for injection attempts targeting secrets.
     *
     * @param prompt - The text prompt or message
     * @returns Guard check result
     */
    checkPrompt(prompt) {
        if (!prompt) {
            return { blocked: false, reason: '' };
        }
        for (const guard of this.promptPatterns) {
            if (guard.pattern.test(prompt)) {
                return {
                    blocked: true,
                    reason: guard.reason,
                    category: guard.category,
                    matchedPattern: guard.pattern.source,
                };
            }
        }
        return { blocked: false, reason: '' };
    }
    /**
     * Checks both command and prompt patterns.
     * Use this for comprehensive scanning of any agent input.
     *
     * @param text - Text to check (command or prompt)
     * @returns Guard check result
     */
    check(text) {
        const cmdResult = this.checkCommand(text);
        if (cmdResult.blocked)
            return cmdResult;
        return this.checkPrompt(text);
    }
    /**
     * Creates an audit entry for a blocked attempt.
     *
     * @param sessionName - Agent session that triggered the block
     * @param toolName - Tool that was used (e.g. 'bash_exec')
     * @param command - The blocked command
     * @param guardResult - The guard check result
     * @returns AuditEntry suitable for the audit log
     */
    createAuditEntry(sessionName, toolName, command, guardResult) {
        return {
            timestamp: new Date().toISOString(),
            sessionName,
            toolName,
            sensitivity: 'destructive',
            args: {
                command,
                blockedReason: guardResult.reason,
                category: guardResult.category || 'unknown',
                matchedPattern: guardResult.matchedPattern || '',
            },
            success: false,
            error: `Blocked by prompt guard: ${guardResult.reason}`,
            durationMs: 0,
        };
    }
}
//# sourceMappingURL=prompt-guard.service.js.map