Summary

Two-part change so coding agents reading this repo aren't tripped up by literal prompt-injection phrasing, without shipping atob-decoded strings in the extension bundle (which Chrome Web Store review treats as obfuscated code).

Part 1 — Encode the in-repo fixtures

Wrap every prompt-injection-shaped string in the repo in a small decode(atob(...)) helper. Purely a readability shield for coding agents; no security claim.

• extension/src/lib/encoded-fixture.ts — shared decode() helper with intent doc
• extension/src/rules/__tests__/injection-fixtures.ts — shared decoded-fixture table consumed by:
  • prompt-injection-hide.test.ts (13 fixtures)
  • hidden-text-strip.test.ts (4 fixtures)
  • html-comment-strip.test.ts (2 fixtures)
• demo-site/src/data/injection-fixtures.ts — same pattern for the RiverMart fixtures
• reviews.ts + ProductDetail.tsx — review bodies, hidden nudges, ChatML block, and the AGENT-INSTRUCTION HTML comment all reference encoded constants

Part 2 — Decode rule patterns at build time, not runtime

CWS reviewers flag runtime base64 decoding as obfuscated code. Move the encoding boundary to build time so the shipped bundle contains plaintext regexes.

• extension/data/injection-patterns.yaml — source of truth: the 11 pattern sources stay base64-encoded here (YAML never ships), each tagged with a terse non-adversarial name
• extension/scripts/build-injection-patterns.ts — zod-validated codegen, decodes each source_b64, sanity-compiles it, emits src/rules/injection-patterns.generated.ts with new RegExp(...) literals. Mirrors the build-site-data.ts precedent
• extension/build.ts + package.json — bun run build invokes the codegen; manual run via bun run build-injection-patterns
• extension/src/rules/prompt-injection-hide.ts — imports INJECTION_PATTERNS from the generated file; runtime atob decode of patterns is gone
• CLAUDE.md — documents the convention parallel to the site-data section

The test fixtures in __tests__/injection-fixtures.ts still decode via atob, but they aren't reachable from any bundle entrypoint, so Bun tree-shakes them out — grep atob dist/*.js returns 0 across all four bundles.

Out of scope (intentional)

• PII fixtures (phone, email, credit-card-shaped strings in reviews) — those don't trip up coding agents the way directive-phrased text does, so they stay readable for ergonomics
• Innocent CSS selectors / DOM-mechanic code in the other rules — no injection text in them

Verification

• grep atob extension/dist/*.js — 0 hits across content.js, background.js, popup.js, options.js
• Plaintext patterns present in shipped bundle (e.g. ignore.*previous.*instructions)
• bun run test — 385/385 pass
• bun run check — clean (only the pre-existing unrelated Options.tsx unused-var warning remains, untouched)
• bun run build (extension) — clean, codegen runs as part of the pipeline
• bun run build (demo site) — vite builds, all JSX type-checks
• Manual: load the demo site in a browser, confirm the rendered review bodies / hidden nudges / ChatML strings appear visually identical to before

🤖 Generated with Claude Code