Backport of the hardened injection-defense from magatama core
(packages/core/src/security/injection-scan.ts) so both layers stay in
lockstep. Pattern ids are identical across layers for cross-layer telemetry.
- fix latent dead ignore-ru pattern: JS \b is ASCII-only and never matches
around Cyrillic, so the Russian "ignore previous instructions" pattern
never fired. Removed the leading/trailing \b.
- add normalizeForScan de-obfuscation pre-pass (NFKC; strip zero-width/bidi/
unicode-tag/combining; map Cyrillic+Greek homoglyphs to ASCII; collapse
spaced-out letters; de-leet). scanForInjection now scans BOTH raw and
normalized input and unions matches by id; new viaNormalization flag.
- add excessive-letter-spacing (high) + broaden repeat-words-above (stacked
determiners), ignore-zh (mid-phrase) and ignore-ko (before-verb determiners).
Block-mode FP guard: the gateway BLOCKS (INJECTION_DEFENSE_MODE=block), so
excessive-letter-spacing diverges from the Magatama regex by a letter-guard
lookahead (>=3 consecutive spaced letters). The raw Magatama form would 422
legit numeric traffic ("what comes next: 1 2 3 4 5 6 7 8 9 10"). Same id +
severity so telemetry stays in lockstep.
Verified: 76/76 red-team + benign dev/ops FP battery against built dist; 10 new
vitest cases; live /v1/guard/scan before/after (RU clear->blocked,
homoglyph/spacing/ko blocked, numeric sequence stays clear); gateway rebuilt +
restarted, health 200, 0 new false positives.
Internal red-team showed the pattern layer caught only ~33% of injection-
shaped prompts. Adds 9 high-severity, FP-tuned patterns for the bypassed
classes (system-prompt extraction via repeat/read, self-referential secret
exfil, authority-spoof, base64 decode-exec, unfiltered persona, jailbreak-
confirm). Result: 10/10 attacks blocked on the red-team set, 0 false-
positives from the new patterns (verified against benign dev/ops prompts).
New package @llm-gateway/ctx-health (packages/ctx-health/) — a TypeScript
infrastructure monitoring and auto-healing daemon. Monitors 8 subsystems
every 60s (PM2, PostgreSQL, Ollama, Cloudflare tunnel, disk, memory,
network, WireGuard), gets AI-powered root cause analysis via the gateway
(ctxhealer caller / ctx_health_diagnose task_type), executes healing
actions with cooldown (5min) and escalation guards (3+ failures → human
escalation), persists all incidents to ctx_health_incidents and
ctx_health_status tables. Dry-run mode via CTX_HEALTH_DRY_RUN=true.
Runs as ctx-health PM2 process on Erik server.
