Function validateOutput

server/src/addie/security.ts:126–160

(text: string)

 * Validate output before sending to Slack
 */
export function validateOutput(text: string): SanitizationResult {
  let flagged = false;
  let reason: string | undefined;

  // Check for forbidden patterns
  for (const pattern of FORBIDDEN_OUTPUT_PATTERNS) {
    if (pattern.test(text)) {
      flagged = true;
      reason = `Output may contain sensitive content`;
      logger.warn({ pattern: pattern.source.substring(0, 30) }, 'Addie: Suspicious output pattern');
      break;
    }
  }

  // Truncate very long outputs (increased to 10000 to support web search responses)
  const MAX_OUTPUT_LENGTH = 10000;
  let sanitized = text;
  if (text.length > MAX_OUTPUT_LENGTH) {
    sanitized = text.substring(0, MAX_OUTPUT_LENGTH) + '\n\n_[Response truncated]_';
    if (!flagged) {
      flagged = true;
      reason = 'Output truncated due to length';
    }
  }

  // Note: Link format conversion removed - Claude now outputs correct format
  // based on channel context (Slack mrkdwn or web markdown)

  return {
    valid: !flagged || (reason?.includes('truncated') ?? false),
    sanitized,
    flagged,
    reason,
  };
}

/**
 * Strip bot mention from message text