feat(sable-h6r): consolidate prompt-injection detector — Node + Python parity, hidden behind --experimental flag

[Rome-1]

Summary

Consolidates the in-flight prompt-injection detector (drafts #60 and #82 — same head commit `6d9b91b`, so #82 is baselined) onto `maylist`. Hidden behind `--experimental` flags; default behavior unchanged for non-opted users.

Detector

Pattern-based, English-only, deliberately zero-dependency. Five categories:

• role_override — "ignore previous instructions", "disregard above", "forget everything", DAN-style mimicry, fake `` tags
• tool_exfil — "send my API keys to ...", "delete all files", remote-pipe-shell patterns
• hidden_unicode — tag chars U+E0000–U+E007F, bidi-override, zero-width inside word characters
• html_comment — imperatives smuggled in HTML/markdown comment blocks
• encoded_payload — base64 chunks ≥ 40 chars decoded and re-scanned (covers RAG/indirect injection)

Defenses against pathological input: 1 MB cap on scan input (truncated before regex), base64 re-scan gated on chunk length, no catastrophic-backtracking regex shapes.

CLI surface (all opt-in)

• `rafter scan injection ` — hidden subcommand, spot-check files
• `rafter hook posttool --experimental-prompt-injection [--prompt-injection-min-severity LEVEL]` — flags markers in tool responses to stderr; does NOT modify the response
• Default behavior: warn-only. Block requires `.rafter.yml` opt-in (per maylist A4 acceptance).

JSON output shape (documented in `shared-docs/CLI_SPEC.md` "Experimental Commands")

```json
{
"findings": [{ "pattern", "category", "severity", "offset", "evidence", "remediation" }],
"score": 0–100,
"verdict": "clean" | "suspicious" | "likely_injection"
}
```

Files

• New: `node/src/commands/scan/injection.ts`, `node/src/scanners/prompt-injection.ts`, `node/src/scanners/prompt-injection-patterns.ts`, `node/tests/prompt-injection.test.ts`
• New: `python/rafter_cli/scanners/prompt_injection.py`, `python/rafter_cli/scanners/prompt_injection_patterns.py`, `python/tests/test_prompt_injection.py`
• New: `docs/research/prompt-injection-detector.md` (threat model + known limitations + bypass corpus)
• Modified: scan/hook command registrars + `shared-docs/CLI_SPEC.md`

No new deps.

Status note re: existing drafts

This PR supersedes drafts #60 and #82 (both point at the same head commit `6d9b91b`; nothing #60-unique to salvage). Once this merges to maylist, close #60 and #82 with a "superseded by sable-h6r / PR #118" note.

PR #82 noted "DRAFT — DO NOT MERGE pending rf-i17". That gate still applies at the maylist → main promotion boundary. This PR is mergeable to maylist (it's hidden behind flags), but rf-i17 should be granted before this work crosses to main.

Target: `maylist`.

Closes sable-h6r (A4 from maylist).

Test plan

• `pnpm exec tsc -p tsconfig.json --noEmit` clean (post-rebase onto current maylist HEAD)
• `python3 -c "import ast; ast.parse(...)"` clean on all five touched/new python files
• No `securable-*` repo names in diff
• `vitest` / `pytest` not run locally — host overloaded (build alone exceeds globalSetup timeout). Tests were carried over from [DRAFT — DO NOT MERGE pending rf-i17] feat(experimental): prompt-injection detector (rf-bmo) #82 (positive corpus, clean-baseline guards, known-bypass FN fixtures).

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com

[Rome-1]

Security review notes (rafter-code-review, CLI category)

Walked CWE-Top-25 cross-language + JS/TS + Python + investigation-playbook input-shape questions. No merge-blocking findings.

Checked:

• CWE-400 ReDoS — grepped `prompt-injection-patterns.{ts,py}` for nested-quantifier shapes (`(.*)+`, `(.+)+`, `(a+)+`); none present. Patterns are linear or bounded.
• CWE-400 memory exhaustion — input capped at 1 MB before regex (`prompt-injection.ts:58`/`prompt_injection.py:58`); base64 re-scan gated on chunk length ≥ 40 chars; truncation happens BEFORE pattern iteration so a 1 GB input doesn't OOM.
• CWE-78/94 injection — no shell, no eval, no Function() construction. Detector is read-only string analysis.
• CWE-502 deserialization — only base64-decode of in-input chunks; result is treated as bytes/string and re-scanned with the same regex engine, not deserialized.
• Input shape — UTF-8 / surrogate / null-byte / very-large fixtures covered by the carried-over test corpus.

Low-severity observation (non-blocking):

• The `evidence` field of each finding includes a `snippet()` of the input around the match (default 40 chars). If a user runs `rafter scan injection` on a file that contains BOTH an injection pattern AND nearby secrets, those secrets could appear in the evidence snippet, then get logged / persisted to audit.jsonl / piped into another tool. Worth a `finding-triage.md` follow-up that redacts on overlap with rafter's existing secret patterns before persisting. Filing as a follow-up bead.

Approved for merge to maylist. The PR #82 "DO NOT MERGE pending rf-i17" gate still applies at the maylist→main promotion boundary — that's the right place to enforce it.