gsd-read-injection-scanner.js

#!/usr/bin/env node
// gsd-hook-version: {{GSD_VERSION}}
// GSD Read Injection Scanner — PostToolUse hook (#2201)
// Scans file content returned by the Read tool for prompt injection patterns.
// Catches poisoned content at ingestion before it enters conversation context.
//
// Defense-in-depth: long GSD sessions hit context compression, and the
// summariser does not distinguish user instructions from content read from
// external files. Poisoned instructions that survive compression become
// indistinguishable from trusted context. This hook warns at ingestion time.
//
// Triggers on: Read tool PostToolUse events
// Action: Advisory warning (does not block) — logs detection for awareness
// Severity: LOW (1–2 patterns), HIGH (3+ patterns)
//
// False-positive exclusion: .planning/, REVIEW.md, CHECKPOINT, security docs,
// hook source files — these legitimately contain injection-like strings.

const path = require('path');

// Summarisation-specific patterns (novel — not in gsd-prompt-guard.js).
// These target instructions specifically designed to survive context compression.
const SUMMARISATION_PATTERNS = [
…