Function detectByRules

layers/foundation-scan.ts:208–253

(content: string)

}

function detectByRules(content: string): Detection | null {
  const normalized = normalizeText(content);
  
  for (const regex of EXPLICIT_ATTACK_PATTERNS) {
    if (regex.test(normalized)) {
      return {
        blocked: true,
        reason: `Explicit attack pattern matched: ${regex.source}`,
      };
    }
  }
  
  for (const regex of SUSPICIOUS_PAYLOAD_REGEX) {
    if (regex.test(normalized)) {
      return {
        blocked: true,
        reason: `Suspicious payload pattern matched: ${regex.source}`,
      };
    }
  }
  
  let bypassMatches = 0;
  for (const regex of BYPASS_REGEX_PATTERNS) {
    if (regex.test(normalized)) {
      bypassMatches++;
    }
  }
  
  if (bypassMatches >= 2) {
    return {
      blocked: true,
      reason: `Multiple bypass patterns detected (${bypassMatches} matches)`
    };
  }
  
  for (const regex of HIGH_RISK_REGEX_PATTERNS) {
    if (regex.test(normalized)) {
      return {
        blocked: true,
        reason: `High-risk pattern matched: ${regex.source}`
      };
    }
  }
  
  return null;
}

function createMaliciousWarning(details: string): Warning {
  return new Warning(