fix(ENG-12594): remove per-tool sanitization rules

[hiskudin]

Summary

• Removes the ToolSanitizationRule system entirely — per-tool rules were redundant with the existing DEFAULT_RISKY_FIELDS.toolOverrides which already handles per-tool field selection
• All tools now treated uniformly with defaultRiskLevel: "medium" and risk escalation driven by Tier 1 patterns + encoding detection
• Net deletion of 286 lines of dead/redundant code

Why

What tool rules provided	What already exists
skipFields (skip id, url, etc.)	DEFAULT_RISKY_FIELDS allowlist already excludes non-risky fields
maxFieldLengths	Dead code — getMaxFieldLength() was never called
riskyFields override	Dead code — never used in implementation
sanitizationLevel (e.g. email → high)	defaultRiskLevel: "medium" for all; encoding escalation handles encoded payloads dynamically
cumulativeRiskThresholds per tool	Global defaults are sufficient (medium: 3, high: 1, patterns: 3)

What was removed

• ToolSanitizationRule interface and public type export
• DEFAULT_TOOL_RULES constant (6 per-tool rule objects)
• getToolRule(), shouldSkipField(), getMaxFieldLength() utilities
• useDefaultToolRules option from PromptDefenseOptions
• toolRule parameter threaded through all recursive sanitization methods
• toolRules from PromptDefenseConfig and ToolResultSanitizerConfig
• 5 tool-rule-specific integration/unit tests

What stays (covers the same functionality)

• DEFAULT_RISKY_FIELDS.toolOverrides — per-tool field selection (e.g. gmail_* → [subject, body, snippet])
• DEFAULT_TRAVERSAL_CONFIG — maxDepth: 10, maxSize: 10MB
• defaultRiskLevel: "medium" — uniform base risk for all tools
• Global cumulative risk thresholds

Test plan

• npm test — 181/181 passing (down from 186; 5 removed tests were tool-rule-specific)
• npm run lint — clean
• npm run build — clean
• All existing Tier 1, Tier 2, sanitizer, and integration tests pass unchanged

🤖 Generated with Claude Code

---

Summary by cubic

Removed per‑tool sanitization rules (ENG-12594) and unified all tools under a medium base risk. Escalation now comes only from Tier 1 patterns, encoding checks, and Tier 2 scoring; per‑tool field scanning stays via DEFAULT_RISKY_FIELDS.toolOverrides.

• Refactors

  • Deleted the ToolSanitizationRule system and all related code (DEFAULT_TOOL_RULES, config toolRules, useDefaultToolRules, and utils like getToolRule/shouldSkipField); removed its public type export.
  • Simplified sanitizer internals to drop rule threading and tool‑specific thresholds; cumulative risk tracker now explicitly uses global thresholds (comment updated).
  • Kept DEFAULT_RISKY_FIELDS.toolOverrides for per‑tool scanned fields.
  • Updated README to remove tool rules references, add “Risky Field Detection,” and clarify riskLevel starts at medium and only escalates via detections.
  • Removed 6 tool‑rule tests.

• Migration

  • Remove all imports/usages of ToolSanitizationRule.
  • Delete PromptDefenseOptions.useDefaultToolRules and any config toolRules references.
  • Construct PromptDefense without tool rules; rely on defaultRiskLevel: 'medium' and detection‑based escalation.
  • Email tools no longer default to high base risk; blocking depends on detections and global thresholds.

^{Written for commit 38d52f1. Summary will update on new commits.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: This refactor removes a core configuration system and changes default risk behaviors for specific tools, which impacts security logic and requires human review.}

[OMauriStkOne]

LGTM

[cubic-dev-ai]

1 issue found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="specs/integration.spec.ts">

<violation number="1" location="specs/integration.spec.ts:289">
P2: The new test does not assert the intended default `medium` risk level; it only excludes `high`/`critical`, so a regression to `low` would go undetected.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

_{Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.}

[Copilot]

Pull request overview

Removes the dedicated per-tool sanitization rule system and simplifies sanitization so all tools share a uniform default risk level, relying on risky-field selection via DEFAULT_RISKY_FIELDS.toolOverrides plus Tier 1 detections for escalation.

Changes:

• Deleted ToolSanitizationRule types/utilities and default per-tool rule config (DEFAULT_TOOL_RULES)
• Simplified ToolResultSanitizer to remove tool-rule threading and apply uniform defaults
• Updated/removed tests that asserted tool-rule behavior

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/utils/field-detection.ts	Removes tool-rule helper APIs (getToolRule, shouldSkipField, getMaxFieldLength) leaving risky-field detection + wildcard matching.
src/types.ts	Removes ToolSanitizationRule and toolRules from public configuration types.
src/index.ts	Stops exporting ToolSanitizationRule from the package entrypoint.
src/core/tool-result-sanitizer.ts	Removes tool-specific rules, sets uniform base risk, and uses only global cumulative-risk thresholds.
src/core/prompt-defense.ts	Drops useDefaultToolRules option and stops passing tool rules into the sanitizer.
src/config.ts	Removes DEFAULT_TOOL_RULES and eliminates toolRules from default config creation.
specs/utils.spec.ts	Removes getToolRule tests and related imports.
specs/integration.spec.ts	Removes integration coverage for useDefaultToolRules/custom tool rules and adds a uniform-default-risk assertion.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

_{Requires human review: This PR is a major refactor of core security logic, changing how tool risk is calculated and removing parts of the public API. It requires human review to ensure no security regression.}