wrapUntrustedContent (security/untrusted-content.ts)

Wraps external content in XML fences, escapes tags, and enforces character limits to prevent prompt injection.

// Source: https://github.com/vellum-ai/vellum-assistant | License: MIT | Copyright 2025 Vellum AI
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Structural defenses against prompt injection from external content.
 *
 * All external data (emails, messages, web pages, calendar events, etc.)
 * should be wrapped via `wrapUntrustedContent()` before entering the LLM
 * conversation context. The wrapper:
 *
 * 1. Delimits external content with `<external_content>` XML boundaries so
 *    the model can distinguish data from instructions.
 * 2. Escapes boundary-breaking sequences within the content.
 * 3. Enforces per-source character budgets to prevent context flooding.
 */

import { safeStringSlice } from "../util/unicode.js";

// ---------------------------------------

... (truncated -- full source via MCP)