Add SCAN injection defense, embedded fonts, shape SVG guard, and refine narrative

[lizTheDeveloper]

Summary

Implements four critical security and presentation-quality features across the research pipeline (#2), presentation generator (#3), and worker seam:

1. SCAN stage (§7.1) — Active prompt-injection classifier scan of all free-text fields before synthesis, with Llama Prompt Guard 2 integration
2. Embedded typeface support (§7.1) — Self-hosted font files with CSP-clean @font-face declarations to guarantee sandbox↔viewer rendering fidelity
3. Shape SVG trust boundary (§3/§9) — Fail-closed allowlist validator for untrusted shape blocks, rejecting scripts, handlers, external refs, and <foreignObject>
4. Narrative refinement (§6) — Optional LLM wording polish of Compose output (fail-open; structure/layout/citations untouched)

Key Changes

Research Pipeline (#2)

• src/research/scan.mjs (125 lines): SCAN stage implementation

  • chunkText() — splits long text into ≤512-token windows on whitespace boundaries
  • scanField() — scores a field; flags if ANY window exceeds threshold
  • scanCandidates() — scans all candidates; quarantines malicious free-text fields while retaining structured metadata (copy-on-write)
  • makeLocalScorer() — builds localhost scorer for self-hosted Prompt Guard 2 (dependency-injected; returns null when unconfigured)
  • Comprehensive test suite (src/research/scan.test.mjs) covering injection payloads, label-only scorers, and metadata retention

• src/research/pipeline.mjs (modified): Wires SCAN into the pipeline

  • Accepts opts.scan = { scorer, threshold?, maxChars? }
  • Calls scanCandidates() after ranking, before synthesis
  • Trace records quarantine count and enabled/disabled status
  • Contract adds quarantined_sources field

• src/research/schema.mjs (modified): Adds quarantined_sources to findings doc contract

• src/research/cli.mjs (modified): CLI wires makeLocalScorer() when PROMPT_GUARD_URL is set

Presentation Generator (#3)

• src/prezi/fonts.mjs (100 lines): Font embedding plumbing

  • buildFontFaceCss() — emits CSP-clean @font-face rules with assets/fonts/ same-origin paths
  • makeFontDeps() — assembles { embedded, faceCss, files, families } shape with fallback stacks
  • loadFontDeps() — reads font files from a directory using a manifest; pure stdlib (no network)
  • Test suite (src/prezi/fonts.test.mjs) validates CSS generation, file loading, and end-to-end SVG/styles.css emission

• src/prezi/shape-guard.mjs (90 lines): Shape SVG validator

  • checkShapeSvg() — fail-closed allowlist: only inert vector elements (path, rect, circle, g, defs, gradients, clipPath, title, desc)
  • Rejects <script>, <foreignObject>, <image>, <use>, <a>, event handlers, href/xlink:href, style, and unsafe URLs (external schemes, javascript:, data:, non-fragment url())
  • isSafeShapeSvg() — boolean wrapper
  • Regex-based (no DOM parser; stdlib-only per #0)
  • Test suite (src/prezi/shape-guard.test.mjs) covers geometry, handlers, external content, and IR validation integration

• src/prezi/ir-schema.mjs (modified): Integrates shape validation

  • validateBlock() now calls `

https://claude.ai/code/session_01YNZCWtNSiZ5bWkc56eYGeE