feat(ai): extend the prompt injection defense to streamed suggestions

[Reversean]

The one-shot path scans the finished answer before returning it. A streamed answer leaves the server while it is still being written, so a nonce split across two deltas would pass a per-delta check and reach the client.

The stream now runs through a guard that withholds the last nonce.length - 1 characters and scans them together with each new delta, releasing only text that can no longer begin the nonce:

delta 1  "...see marker 0123456789abcdef"  ->  out: "...see marker "   held: "0123456789abcdef"
delta 2  "0123456789abcdef tail"           ->  nonce found in held + delta, answer rejected

That length is the exact minimum: an occurrence spans nonce.length characters, so holding one less leaves it inside a single scanned window. The holdback is released at the end of a text block, since that text cannot be emitted under the next block's id, and its tail is kept as scanning context so that a nonce split across two blocks is still seen.

Detection is unchanged and shared with the one-shot path. guard and onReject are required on stream(): a stream cannot be checked after it has been sent, so an omitted guard would mean an unchecked answer.

The route serves text/plain, which carries no channel for a signal that is not content, so a rejected answer arrives as the prefix already sent, cut mid-word by the holdback, followed by the fallback message. Showing a clean failure instead needs toUIMessageStreamResponse here and a matching change in Garage, and is left for a follow-up.

[Copilot]

Pull request overview

Extends the existing prompt-injection / marker-leak defense from one-shot completions to streamed AI suggestions by introducing nonce-based spotlighting, deterministic leak detection, and a streaming “holdback” guard that prevents nonce substrings from crossing chunk boundaries.

Changes:

• Add spotlighting markers + per-request random nonce in the prompt, and reject outputs that reproduce the nonce.
• Add streaming leak defense via a holdback guard wired into streamText(...).experimental_transform.
• Add an Express /integration/ai/stream route that proxies the UI message stream response; expand tests and shared test helpers accordingly.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/services/askAi.test.ts	Expands AIService tests to cover spotlighting, rejection reporting, and stream guard wiring.
test/services/askAi-spotlighting.test.ts	Adds unit coverage for prompt marker wrapping and nonce generation/collision handling.
test/services/askAi-leak-detector.test.ts	Adds unit tests for deterministic nonce leak detection behavior.
test/services/askAi-holdback.test.ts	Adds unit tests for the streaming holdback guard behavior and edge cases.
test/integrations/vercel-ai.test.ts	Adds tests for streamText usage and the guarded transform wiring/semantics.
test/integrations/github-routes.test.ts	Refactors to reuse the new Express request helper.
test/integrations/ai-routes.test.ts	Adds route-level tests for the new SSE proxy endpoint and auth/validation paths.
test/helpers/expressRequest.ts	Introduces a reusable Express request/response harness that supports pipe() streaming.
src/services/types.ts	Exports the Event type for reuse (e.g., AI service internals).
src/services/askAi/security/spotlighting.ts	Implements nonce-based marker wrapping (buildEventPrompt) + system spotlighting instruction.
src/services/askAi/security/leakDetector.ts	Adds isLeaked + fallback message constant for suggestion rejection.
src/services/askAi/security/holdback.ts	Implements streaming holdback guard (createLeakGuard) to detect nonce across deltas.
src/services/askAi/inputs/eventSolving.ts	Documents that this serialization is unwrapped/untrusted and must be wrapped via spotlighting.
src/services/ai.ts	Updates AIService to use spotlighting + leak detection, and adds a streaming suggestion method.
src/integrations/vercel-ai/routes.ts	Adds /integration/ai/stream proxy route for the UI message stream response.
src/integrations/vercel-ai/index.ts	Adds vercelAIApi.stream and the guarded transform that applies the stream guard to deltas.
src/index.ts	Registers the new AI assistant routes on the Express app.
src/directives/requireUserInWorkspace.ts	Exports checkUserInWorkspaceByProjectId for reuse in the new route.
package.json	Bumps package version.
.eslintrc.js	Declares Fetch/Streams globals used in tests and streaming code.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.