Prompt injection detection (simplified - only pattern matching) (#4237)

Signed-off-by: Dorien Koelemeijer <dkoelemeijer@squareup.com>

merging as looks good, lets keep an eye on it.

ui/desktop/src/components/GooseMessage.tsx

@@ -298,14 +298,16 @@ export default function GooseMessage({
             sessionId={sessionId}
             isCancelledMessage={messageIndex == messageHistoryIndex - 1}
             isClicked={messageIndex < messageHistoryIndex}
-            toolConfirmationId={toolConfirmationContent.id}
-            toolName={toolConfirmationContent.toolName}
+            toolConfirmationContent={toolConfirmationContent}
           />
         )}
       </div>
 
       {/* TODO(alexhancock): Re-enable link previews once styled well again */}
-      {urls.length > 0 && (
+      {/* TEMPORARILY DISABLED (dorien-koelemeijer): This is causing issues in properly "generating" tool calls
+       that contain links and prevents security scanning */}
+      {/* eslint-disable-next-line no-constant-binary-expression */}
+      {false && urls.length > 0 && (
         <div className="mt-4">
           {urls.map((url, index) => (
             <LinkPreview key={index} url={url} />

ui/desktop/src/components/ToolCallConfirmation.tsx

@@ -5,8 +5,8 @@ import { ChevronRight } from 'lucide-react';
 import { confirmPermission } from '../api';
 import { Button } from './ui/button';
 
-const ALWAYS_ALLOW = 'always_allow';
 const ALLOW_ONCE = 'allow_once';
+const ALWAYS_ALLOW = 'always_allow';
 const DENY = 'deny';
 
 // Global state to track tool confirmation decisions
@@ -20,21 +20,23 @@ const toolConfirmationState = new Map<
   }
 >();
 
+import { ToolConfirmationRequestMessageContent } from '../types/message';
+
 interface ToolConfirmationProps {
   sessionId: string;
   isCancelledMessage: boolean;
   isClicked: boolean;
-  toolConfirmationId: string;
-  toolName: string;
+  toolConfirmationContent: ToolConfirmationRequestMessageContent;
 }
 
 export default function ToolConfirmation({
   sessionId,
   isCancelledMessage,
   isClicked,
-  toolConfirmationId,
-  toolName,
+  toolConfirmationContent,
 }: ToolConfirmationProps) {
+  const { id: toolConfirmationId, toolName, prompt } = toolConfirmationContent;
+
   // Check if we have a stored state for this tool confirmation
   const storedState = toolConfirmationState.get(toolConfirmationId);
 
@@ -77,6 +79,8 @@ export default function ToolConfirmation({
       newActionDisplay = 'always allowed';
     } else if (newStatus === ALLOW_ONCE) {
       newActionDisplay = 'allowed once';
+    } else if (newStatus === DENY) {
+      newActionDisplay = 'denied';
     } else {
       newActionDisplay = 'denied';
     }
@@ -125,25 +129,22 @@ export default function ToolConfirmation({
     </div>
   ) : (
     <>
+      {/* Display security message if present */}
+      {prompt && (
+        <div className="goose-message-content bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-800 rounded-2xl px-4 py-2 mb-2 text-yellow-800 dark:text-gray-200">
+          {prompt}
+        </div>
+      )}
+
       <div className="goose-message-content bg-background-muted rounded-2xl px-4 py-2 rounded-b-none text-textStandard">
-        Goose would like to call the above tool. Allow?
+        {prompt
+          ? 'Do you allow this tool call?'
+          : 'Goose would like to call the above tool. Allow?'}
       </div>
       {clicked ? (
         <div className="goose-message-tool bg-background-default border border-borderSubtle dark:border-gray-700 rounded-b-2xl px-4 pt-2 pb-2 flex items-center justify-between">
           <div className="flex items-center">
-            {status === 'always_allow' && (
-              <svg
-                className="w-5 h-5 text-gray-500"
-                xmlns="http://www.w3.org/2000/svg"
-                fill="none"
-                viewBox="0 0 24 24"
-                stroke="currentColor"
-                strokeWidth={2}
-              >
-                <path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" />
-              </svg>
-            )}
-            {status === 'allow_once' && (
+            {(status === 'allow_once' || status === 'always_allow') && (
               <svg
                 className="w-5 h-5 text-gray-500"
                 xmlns="http://www.w3.org/2000/svg"
@@ -193,9 +194,6 @@ export default function ToolConfirmation({
         </div>
       ) : (
         <div className="goose-message-tool bg-background-default border border-borderSubtle dark:border-gray-700 rounded-b-2xl px-4 pt-2 pb-2 flex gap-2 items-center">
-          <Button className="rounded-full" onClick={() => handleButtonClick(ALWAYS_ALLOW)}>
-            Always Allow
-          </Button>
           <Button
             className="rounded-full"
             variant="secondary"
@@ -203,6 +201,16 @@ export default function ToolConfirmation({
           >
             Allow Once
           </Button>
+          {/* Only show "Always Allow" if there's no security message (no security finding) */}
+          {!prompt && (
+            <Button
+              className="rounded-full"
+              variant="secondary"
+              onClick={() => handleButtonClick(ALWAYS_ALLOW)}
+            >
+              Always Allow
+            </Button>
+          )}
           <Button
             className="rounded-full"
             variant="outline"

ui/desktop/src/components/UserMessage.tsx

@@ -255,6 +255,8 @@ export default function UserMessage({ message, onMessageUpdate }: UserMessagePro
         )}
 
         {/* TODO(alexhancock): Re-enable link previews once styled well again */}
+        {/* TEMPORARILY DISABLED (dorien-koelemeijer): This is causing issues in properly "generating" tool calls
+       that contain links and prevents security scanning */}
         {/* eslint-disable-next-line no-constant-binary-expression */}
         {false && urls.length > 0 && (
           <div className="flex flex-wrap mt-2">