Prompt Injection Sanitiser

Overview

A heuristic TypeScript filter for untrusted text on its way into an LLM prompt. It scores text against 35 rules covering instruction-override phrasing, chat-template token smuggling, fence escapes, invisible Unicode, Markdown/HTML exfiltration beacons, tool-call mimicry and encoded payloads, then conservatively rewrites the mechanical parts and fences the result with a random nonce. Ships a zero-dependency CLI (`prompt-injection-sanitiser scan <file|->`) with JSON output and a configurable failing exit code, so the same rules can run in CI. It is defence-in-depth, not a security boundary: it is heuristic, it has not been audited, and it does not prevent prompt injection. Zero runtime dependencies, ships ESM + CJS + type declarations.

  // Pick a nonce that does not occur in the body. With a random nonce this
  // essentially never loops; the loop exists so the invariant is guaranteed
  // rather than merely likely.
  let nonce = providedNonce ?? randomNonce(nonceLength);
  if (providedNonce === undefined) {
    for (let attempt = 0; attempt < 8 && body.includes(nonce); attempt += 1) {
      nonce = randomNonce(nonceLength + attempt + 1);
    }
  }

  // Final, unconditional enforcement: strip any occurrence of the nonce or of
  // either marker from the body. After this the closing marker cannot appear
  // inside the block by construction.
  const { openTag, closeTag } = buildTags(label, nonce);
  if (body.includes(nonce) || body.includes(openTag) || body.includes(closeTag)) {
    body = body.split(closeTag).join('').split(openTag).join('').split(nonce).join('');
    modified = true;
  }