feat(ai): extend the prompt injection defense to streamed suggestions

[Reversean]

The one-shot path scans the finished answer before returning it. A stream cannot be checked that way: it leaves the server while still being written, and a nonce split across two deltas passes a per-chunk scan untouched.

Add a holdback guard. It withholds the last nonce.length − 1 characters and scans withheld + new chunk on every delta, releasing only text that cannot be the start of the nonce. The bound is exact — for the nonce to straddle the send boundary, more than nonce.length − 1 characters after its first one must already be sent — so every occurrence falls inside one scanned window and the nonce never reaches the client. Detection itself is unchanged and shared with the one-shot path.

The guard runs in streamText's experimental_transform, on typed TextStreamPart chunks: in the encoded SSE bytes the nonce is split by JSON envelopes and escaping, where no substring search can find it. The withheld tail is released on text-end rather than in the TransformStream's flush, so deltas stay inside the block they belong to.

stopStream is not used: it requires synthesising finish-step and finish chunks whose shape is tied to the SDK version. Suppressing text instead keeps the stream well-formed, at the cost of tokens the model goes on producing unheard — paid only when the tripwire fires.

On detection the guard emits the fallback message once and stays silent, logging eventId and originalEventId. The prefix already sent cannot be retracted, which is acceptable: the nonce is what triggered detection and is still withheld when it fires.

The transport takes a StreamGuard port declared in the domain layer and does not know what a leak is.

[Copilot]

Pull request overview

Extends the existing prompt-injection / marker-leak defense from one-shot completions to streamed AI suggestions by introducing nonce-based spotlighting, deterministic leak detection, and a streaming “holdback” guard that prevents nonce substrings from crossing chunk boundaries.

Changes:

• Add spotlighting markers + per-request random nonce in the prompt, and reject outputs that reproduce the nonce.
• Add streaming leak defense via a holdback guard wired into streamText(...).experimental_transform.
• Add an Express /integration/ai/stream route that proxies the UI message stream response; expand tests and shared test helpers accordingly.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/services/askAi.test.ts	Expands AIService tests to cover spotlighting, rejection reporting, and stream guard wiring.
test/services/askAi-spotlighting.test.ts	Adds unit coverage for prompt marker wrapping and nonce generation/collision handling.
test/services/askAi-leak-detector.test.ts	Adds unit tests for deterministic nonce leak detection behavior.
test/services/askAi-holdback.test.ts	Adds unit tests for the streaming holdback guard behavior and edge cases.
test/integrations/vercel-ai.test.ts	Adds tests for streamText usage and the guarded transform wiring/semantics.
test/integrations/github-routes.test.ts	Refactors to reuse the new Express request helper.
test/integrations/ai-routes.test.ts	Adds route-level tests for the new SSE proxy endpoint and auth/validation paths.
test/helpers/expressRequest.ts	Introduces a reusable Express request/response harness that supports pipe() streaming.
src/services/types.ts	Exports the Event type for reuse (e.g., AI service internals).
src/services/askAi/security/spotlighting.ts	Implements nonce-based marker wrapping (buildEventPrompt) + system spotlighting instruction.
src/services/askAi/security/leakDetector.ts	Adds isLeaked + fallback message constant for suggestion rejection.
src/services/askAi/security/holdback.ts	Implements streaming holdback guard (createLeakGuard) to detect nonce across deltas.
src/services/askAi/inputs/eventSolving.ts	Documents that this serialization is unwrapped/untrusted and must be wrapped via spotlighting.
src/services/ai.ts	Updates AIService to use spotlighting + leak detection, and adds a streaming suggestion method.
src/integrations/vercel-ai/routes.ts	Adds /integration/ai/stream proxy route for the UI message stream response.
src/integrations/vercel-ai/index.ts	Adds vercelAIApi.stream and the guarded transform that applies the stream guard to deltas.
src/index.ts	Registers the new AI assistant routes on the Express app.
src/directives/requireUserInWorkspace.ts	Exports checkUserInWorkspaceByProjectId for reuse in the new route.
package.json	Bumps package version.
.eslintrc.js	Declares Fetch/Streams globals used in tests and streaming code.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.