Module paste 

Paste-content injection / role-hijack detector. Covers the L5 × V1 cell (cf. crate root §Threat surface × vector).

Pipeline

detect runs four stages on the input string:

1. obfuscation::decode_chain — percent → HTML → base64 → Unicode NFKC, so the detector sees the normalized form even when the payload is obfuscated.
2. detector::scan — multi-pattern Aho-Corasick match over patterns::PATTERNS plus Unicode anomaly scan (RTL override, zero-width joiners, format chars).
3. Threshold-based Verdict assignment (see §Verdict thresholds).
4. Best-effort persistence to <home>/paste_log/<UTC-ts>-<id>.json. Log failure does not affect the verdict returned to the caller; the PasteVerdict::log_path field is empty on persist failure.

Verdict thresholds

Match count	Verdict
0	Verdict::Clean
1–2	Verdict::Suspicious
≥ 3	Verdict::Blocked

The threshold is intentionally low: paste content is untrusted user input, so the cost of a false positive (the LLM sees the verdict and treats the paste as suspect) is much lower than the cost of a false negative (a successful jailbreak / credential exfil prompt).

Read-only invariant

The raw content string is never persisted outside the JSON audit row. Match::span carries only the matched substring (typically a short pattern label or a U+XXXX codepoint marker), not the full input.

Modules

detector

Pattern + Unicode anomaly scanner used by crate::paste::detect.

obfuscation

Obfuscation-aware decode chain for paste detection.

patterns

Built-in injection-pattern list for paste-content detection.

Structs

Match

One individual match row inside PasteVerdict::matches.

PasteVerdict

One detect call’s full verdict payload, suitable for JSON serialization back to the caller (MCP paste_inspect tool / agentsec hook user-prompt-submit).

Enums

Verdict

Three-level verdict produced by detect.

Functions

detect

Run the full detect pipeline (decode → scan → verdict → persist) on a paste-content string.