Scan Engine

import { createScanEngine } from "zeroleaks";

const engine = createScanEngine({
  scan: {
    maxTurns: 20,
    maxTreeDepth: 4,
    branchingFactor: 3,
    enableBestOfN: true,
    bestOfNCount: 3,
  },
});

const result = await engine.runScan(systemPrompt, {
  onProgress: async (progress) => {
    console.log(`Turn ${progress.turn}/${progress.maxTurns} (${progress.phase})`);
  },
  onFinding: async (finding) => {
    console.log("Finding:", finding.technique, finding.severity);
  },
});

interface EngineConfig {
  apiKey?: string;                  // defaults to OPENROUTER_API_KEY
  scan?: Partial<ScanConfig>;       // the options in the table below
  attacker?: AttackerConfig;        // per-agent overrides, e.g. { model }
  evaluator?: EvaluatorConfig;
  mutator?: MutatorConfig;
  strategist?: StrategistConfig;
  target?: TargetConfig;            // { model?, apiKey? }
}

engine.runScan(systemPrompt, {
  onProgress?: (progress: ScanProgress) => Promise<void>,
  onFinding?: (finding: Finding) => Promise<void>,
  onDefenseDetected?: (fingerprint: DefenseFingerprint) => Promise<void>,
  onInjectionResult?: (result: InjectionTestResult) => Promise<void>,
  maxDurationMs?: number, // default 0, no limit
});

interface ScanProgress {
  turn: number;
  maxTurns: number;
  phase: AttackPhase; // "reconnaissance" | "profiling" | "soft_probe" | "escalation" | "exploitation" | "persistence"
  strategy: string;
  leakStatus: LeakStatus; // "none" | "hint" | "fragment" | "substantial" | "complete"
  findingsCount: number;
  treeNodesExplored: number;
  estimatedCompletion: number; // 0-1
}

interface Finding {
  id: string;
  turn: number;
  timestamp: number;
  technique: string;
  category: AttackCategory;
  severity: "critical" | "high" | "medium" | "low";
  confidence: "high" | "medium" | "low";
  extractedContent: string;
  contentType: "system_prompt" | "rule" | "constraint" | "capability" | "persona" | "unknown";
  evidence: string;
  attackNodeId: string;
  verified: boolean;
  verificationMethod?: string;
}

const engine = createScanEngine({ scan: { enableDualMode: true } });

const result = await engine.runScan(systemPrompt, {
  maxDurationMs: 120000,
  onProgress: async (p) => console.log(p.turn, p.maxTurns),
  onFinding: async (f) => console.log(f.technique),
  onInjectionResult: async (r) => console.log(r.technique, r.success, r.compliance),
});

console.log(result.overallScore, result.injectionScore);

import { createScanEngine } from "zeroleaks";

const engine = createScanEngine({
  apiKey: process.env.OPENROUTER_API_KEY,
  scan: {
    maxTurns: 10,
    maxTreeDepth: 3,
    branchingFactor: 2,
    enableBestOfN: true,
    bestOfNCount: 5,
    targetModel: "openai/gpt-5",
  },
});

const result = await engine.runScan(systemPrompt, {
  maxDurationMs: 60000,
  onProgress: async (p) => {
    process.stdout.write(`\rTurn ${p.turn}/${p.maxTurns} (${p.leakStatus})`);
  },
  onFinding: async (f) => {
    console.log(`\n[!] ${f.severity}: ${f.technique}`);
  },
});

console.log(`\nScore: ${result.overallScore}/100 (${result.overallVulnerability})`);