feat(ai): defend Ask AI suggestions against prompt injection

[Reversean]

Ask AI feeds the model the event payload: headers, user agent, query parameters, POST body.
That text was controlled by whoever triggered the crash, and planting it needs no Hawk
account — a request to the customer's site with an instruction in a header is enough. Nothing
separated it from the model's own instruction.

Three layers:

• the call stays tool-less, so a hijacked model can only produce inert text;
• untrusted data is wrapped in delimiters carrying a per-request 128-bit nonce, and the
  system instruction declares the block to be data (spotlighting, https://arxiv.org/abs/2403.14720);
• the answer is rejected if it reproduces that nonce.

A fixed delimiter would not work: JSON.stringify does not escape <, > or /, so an
attacker writes the closing marker into a header and steps out of the block. The nonce makes
the boundary unforgeable.

The output check matches the nonce and deliberately nothing else. Matching hand-picked
phrases of the system prompt would tie the detector to the prompt's wording — reword the
prompt and detection silently becomes a no-op — and a phrase an attacker guesses can be
planted in a header to force false rejections, killing the feature for that event while every
retry still bills an LLM call. The nonce has neither problem. A model-based judge was not
considered either, those being unreliable and bypassable
(https://arxiv.org/abs/2507.05630).

Static defences do not stop adaptive attacks (https://arxiv.org/abs/2510.03705); the
tool-less call is what caps the damage.

The defence sits in src/services/askAi/, above the transport, so replacing the provider
cannot drop it.

[Copilot]

Pull request overview

Introduces a prompt-injection defense for Ask AI suggestions by spotlighting untrusted event payload data with per-request nonce-delimited markers, and rejecting model outputs that echo the nonce to prevent boundary/marker leakage.

Changes:

• Wrap untrusted event payload in nonce-carrying open/close markers and append a matching spotlighting rule to the system prompt.
• Add a deterministic “leak tripwire” that rejects outputs containing the nonce and returns a fallback message, while reporting only event IDs (not attacker-influenced output) to Hawk/logs.
• Add unit tests covering marker/nonce generation, marker-forgery resistance, and leak detection behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/services/askAi.test.ts	Updates AIService tests to assert spotlighting + adds rejection/reporting coverage.
test/services/askAi-spotlighting.test.ts	New tests for nonce generation, marker wrapping, and collision/forgery handling.
test/services/askAi-leak-detector.test.ts	New tests for case-insensitive nonce leak detection and fallback behavior.
src/services/askAi/security/spotlighting.ts	Adds nonce-marked prompt wrapping and system spotlighting instruction generation.
src/services/askAi/security/leakDetector.ts	Adds leak detection helper and fallback message constant.
src/services/askAi/inputs/eventSolving.ts	Documents that the raw serializer is unsafe to send directly to a model.
src/services/ai.ts	Integrates spotlighting + leak detection, and reports rejections via Hawk/logs.
src/integrations/vercel-ai/index.ts	Documents the “tool-less calls only” security invariant (removes TODO).
package.json	Bumps version to 1.5.11.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[neSpecc]

I'd suggest to use English for system prompts since Cyrillic symbols uses 2x more tokens.