Function checkCanaryInStructure

browse/src/security.ts:297–310

(value: unknown, canary: string)

 * structure — including tool call arguments, URLs embedded in strings, etc.
 */
export function checkCanaryInStructure(value: unknown, canary: string): boolean {
  if (value == null) return false;
  if (typeof value === 'string') return value.includes(canary);
  if (typeof value === 'number' || typeof value === 'boolean') return false;
  if (Array.isArray(value)) {
    return value.some((v) => checkCanaryInStructure(v, canary));
  }
  if (typeof value === 'object') {
    return Object.values(value as Record<string, unknown>).some((v) =>
      checkCanaryInStructure(v, canary),
    );
  }
  return false;
}

// ─── Attack logging ──────────────────────────────────────────