gsd-prompt-guard.js

#!/usr/bin/env node
// gsd-hook-version: {{GSD_VERSION}}
// GSD Prompt Injection Guard — PreToolUse hook
// Scans file content being written to .planning/ for prompt injection patterns.
// Defense-in-depth: catches injected instructions before they enter agent context.
//
// Triggers on: Write and Edit tool calls targeting .planning/ files
// Action: Advisory warning (does not block) — logs detection for awareness
//
// Why advisory-only: Blocking would prevent legitimate workflow operations.
// The goal is to surface suspicious content so the orchestrator can inspect it,
// not to create false-positive deadlocks.

const fs = require('fs');
const path = require('path');

// Prompt injection patterns (subset of security.cjs patterns, inlined for hook independence)
const INJECTION_PATTERNS = [
  /ignore\s+(all\s+)?previous\s+instructions/i,
  /ignore\s+(all\s+)?above\s+instructions/i,
  /disregard\s+(all\s+)?previous/i,
  /forget\s+(all\s+)?(your\s+)?instructions/i,
  /override\s+(system|previous)\s+(prompt|instructions)/i,
  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
…