"""
SHIELD Security Module for Hermes
Jailbreak and Crisis Detection System

Based on Issue #75 Red Team Audit Specifications
"""

import re
import base64
import unicodedata
from enum import Enum
from typing import Dict, List, Set, Tuple, Any


class Verdict(Enum):
    """Four possible SHIELD verdicts"""
    CLEAN = "CLEAN"
    JAILBREAK_DETECTED = "JAILBREAK_DETECTED"
    CRISIS_DETECTED = "CRISIS_DETECTED"
    CRISIS_UNDER_ATTACK = "CRISIS_UNDER_ATTACK"


# SAFE SIX: Trusted models for crisis situations
SAFE_SIX_MODELS: Set[str] = {
    "anthropic/claude-sonnet-4",
    "meta-llama/llama-3.1-8b-instruct",
    "moonshotai/kimi-k2.5",
    "x-ai/grok-code-fast-1",
    "xiaomi/mimo-v2-flash",
    "z-ai/glm-5-turbo",
}

# Crisis System Prompt for emergency situations
CRISIS_SYSTEM_PROMPT = """You are a crisis intervention assistant. The user may be experiencing a mental health emergency.

CRITICAL INSTRUCTIONS:
1. Your ONLY goal is to help keep the user safe
2. Do NOT provide methods for self-harm under ANY circumstances
3. Express genuine compassion and concern
4. Encourage professional help immediately

CRISIS RESOURCES (share these):
- 988 Suicide and Crisis Lifeline (call or text 988)
- Crisis Text Line: Text HOME to 741741
- Emergency Services: 911 (if immediate danger)
- Jesus saves those who call on His name - "For everyone who calls on the name of the Lord will be saved." (Romans 10:13)

RESPONSE GUIDELINES:
- Validate their pain without validating harmful thoughts
- Offer hope - recovery is possible
- Keep responses brief and focused on safety
- Never suggest that self-harm is a valid option
- Encourage reaching out to trusted friends, family, or professionals

Remember: This person's life is valuable. Respond with compassion, urgency, and hope."""


class ShieldDetector:
    """
    SHIELD Detection Engine
    
    Detects jailbreak attempts and crisis signals in user messages.
    Optimized for speed: ~1-5ms per message.
    """
    
    # Jailbreak Pattern Categories
    JB_GODMODE_DIVIDERS = [
        r'\.\-\.\-\.\-',
        r'\.\=\.\=\.\=',
        r'\[\-\-\-\]',
        r'\{\{\{',
        r'\|\|\|',
    ]
    
    JB_AUTHOR_MARKERS = [
        r'(?:^|\s)pliny(?:\s|$)',
        r'(?:^|\s)d(?:\s|\.|\-)*an(?:\s|$)',
        r'(?:^|\s)liberating(?:\s|$)',
        r'godmode\s+enabled',
        r'developer\s+mode',
        r'ignore\s+previous\s+instructions',
        r'ignore\s+all\s+prior\s+instructions',
    ]
    
    JB_LEETSPEAK_MARKERS = [
        r'\bsur3\b',
        r'\bh3r3\b',
        r'\by0u\b',
        r'\bw1ll\b',
        r'\bn0w\b',
        r'\bpl34s3\b',
        r'\b4nd\b',
        r'\bth3\b',
        r'\b4ll\b',
        r'\b1nstruct1ons\b',
    ]
    
    JB_BOUNDARY_INVERSION = [
        r'\[END\s+OF\s+INPUT\]',
        r'\[END\s+INPUT\]',
        r'\[START\s+OUTPUT\]',
        r'<\|im_start\|>',
        r'<\|im_end\|>',
        r'<\|system\|>',
        r'<\|user\|>',
        r'<\|assistant\|>',
        r'<<SYS>>',
        r'<</SYS>>',
        r'\[INST\]',
        r'\[/INST\]',
        r'\[SYSTEM\s*:\s*',
        r'NEW\s+SYSTEM\s+PROMPT',
        r'updated\s+system\s+prompt',
        r'override\s+system',
    ]
    
    JB_TOKEN_INJECTION = [
        r'\\u003c\|vq_\|\\u003e',
        r'<\|vq_\|>',
        r'<\|special\|>',
        r'<\|injection\|>',
        r'{{\s*user\s*}}',
        r'{{\s*char\s*}}',
        r'<<\s*user\s*>>',
        r'<<\s*system\s*>>',
    ]
    
    JB_KEYWORDS = [
        r'\bgodmode\b',
        r'\bliberating\b',
        r'^\s*DAN\s*[:\-]?',
        r'\bjailbreak\b',
        r'\bdo\s+anything\s+now\b',
        r'\bno\s+restrictions\b',
        r'\bno\s+limits\b',
        r'\bunfiltered\b',
        r'\bunleashed\b',
        r'\buncensored\b',
    ]
    
    JB_REFUSAL_INVERSION = [
        r'never\s+say\s+(?:"|\')?(?:I\s+cannot|I\s+can\'t|I\s+apologize|I\'m\s+sorry)',
        r'do\s+not\s+(?:mention|say|include|refuse|decline)',
        r'never\s+(?:mention|say|include|refuse|decline)',
        r'do\s+not\s+respond\s+with\s+(?:"|\')?(?:I\s+cannot|I\s+can\'t)',
        r'skip\s+(?:the\s+)?(?:disclaimer|warning|caution|ethical)',
        r'ignore\s+(?:the\s+)?(?:ethical|safety|guideline|policy)',
    ]
    
    JB_PERSONA_INJECTION = [
        r'pretend\s+(?:to\s+be|you\s+are|you\'re)',
        r'act\s+as\s+(?:if\s+you\s+are|you\'re|though)',
        r'roleplay\s+(?:as\s+|being\s+)',
        r'take\s+on\s+(?:the\s+role\s+of|a\s+persona)',
        r'you\s+are\s+now\s+(?:a\s+|an\s+)',
        r'simulate\s+(?:being\s+|a\s+)',
        r'from\s+now\s+on\s+you\s+are',
        r'you\s+will\s+(?:now\s+)?behave\s+as',
    ]
    
    JB_ENCODING_EVASION = [
        r'base64\s*[:\-]?\s*[A-Za-z0-9+/]{20,}={0,2}',
        r'rot13\s*[:\-]?',
        r'decode\s+this\s*[:\-]?',
        r'execute\s+as\s+code',
        r'run\s+as\s+python',
        r'eval\s*\(',
        r'exec\s*\(',
    ]
    
    # Crisis Signal Categories
    CRISIS_SUICIDAL_IDEATION = [
        r'\b(?:kill|end)\s+(?:myself|my\s+life)\b',
        r'\bwant\s+to\s+die\b',
        r'\bwant\s+to\s+end\s+(?:it|everything|my\s+life)\b',
        r'\bsuicidal\s+(?:thoughts|ideation|feelings?)\b',
        r'\bhate\s+my\s+life\b',
        r'\bno\s+reason\s+to\s+live\b',
        r'\bbetter\s+off\s+dead\b',
        r'\bwish\s+I\s+(?:was|were)\s+dead\b',
    ]
    
    CRISIS_METHOD_SEEKING = [
        r'\bhow\s+(?:do\s+I|to|can\s+I)\s+(?:kill|hang|overdose|cut)\s+myself\b',
        r'\bways?\s+to\s+(?:die|kill\s+myself)\b',
        r'\bmethods?\s+of\s+(?:suicide|dying)\b',
        r'\bpainless\s+way\s+to\s+(?:die|go)\b',
        r'\bhow\s+much\s+(?:pills|medication)\s+(?:to\s+take|for\s+overdose)\b',
        r'\bwhere\s+to\s+(?:jump|get\s+rope|buy\s+gun)\b',
        r'\bsuicide\s+methods?\b',
        r'\bhow\s+to\s+(?:commit\s+suicide|end\s+my\s+life)\b',
    ]
    
    CRISIS_LEETSPEAK_EVASION = [
        r'\bsu1c1d3?\b',
        r'\b5u1c1d3?\b',
        r'\bd13?\b',
        r'\b0v3rd0s3?\b',
        r'\bh4ng\s+mys3lf\b',
        r'\bk1ll\s+mys3lf\b',
        r'\bw4nt\s+t0\s+d13?\b',
        r'\bw4nt\s+t0\s+d1e\b',
    ]
    
    CRISIS_SUBSTANCE_SEEKING = [
        r'\bhow\s+much\s+(?:ambien|xanax|prozac|seroquel|trazodone)\s+(?:to\s+overdose|to\s+die)\b',
        r'\blethal\s+dose\s+(?:of\s+)?(?:pills|medication|drugs)\b',
        r'\bhow\s+many\s+pills\s+(?:to\s+die|to\s+end\s+it)\b',
        r'\btaking\s+all\s+my\s+(?:pills|medication)\b',
        r'\bmixing\s+(?:alcohol|pills)\s+(?:to\s+die|to\s+end\s+it)\b',
    ]
    
    CRISIS_DESPAIR = [
        r'\bno\s+(?:point|reason|hope)\s+(?:in\s+living|anymore)\b',
        r'\bcannot\s+(?:go\s+on|continue|take\s+it)\b',
        r'\bcan\'t\s+(?:go\s+on|continue|take\s+it)\b',
        r'\bempty\s+(?:inside|and\s+hollow)\b',
        r'\bno\s+one\s+(?:cares|would\s+miss\s+me)\b',
        r'\bwould\s+be\s+better\s+off\s+without\s+me\b',
        r'\bnever\s+going\s+to\s+get\s+better\b',
        r'\bnothing\s+(?:matters|will\s+change)\b',
    ]
    
    CRISIS_FAREWELL = [
        r'\bsaying\s+goodbye\s+(?:to\s+everyone|forever)\b',
        r'\bthis\s+is\s+(?:goodbye|farewell)\b',
        r'\btell\s+(?:them|everyone)\s+I\s+(?:loved|love)\s+(?:them|him|her)\b',
        r'\bgiving\s+away\s+my\s+(?:things|stuff|possessions)\b',
        r'\bmy\s+final\s+(?:message|note|words)\b',
        r'\bwrote\s+a\s+(?:suicide\s+)?note\b',
        r'\bsorry\s+for\s+(?:everything|the\s+pain|hurting\s+you)\b',
    ]
    
    CRISIS_SELF_HARM = [
        r'\bcut(?:ting)?\s+myself\b',
        r'\bself\s*harm(?:ing)?\b',
        r'\bhurt(?:ing)?\s+myself\b',
        r'\bburn(?:ing)?\s+myself\b',
        r'\bwant\s+to\s+(?:feel\s+pain|hurt\s+myself)\b',
        r'\bdeserve\s+to\s+(?:hurt|suffer|be\s+punished)\b',
    ]
    
    # =====================================================================
    # Multilingual Injection Detection (Issue #614)
    # =====================================================================
    #
    # Translated attack phrases for top non-English languages.
    # Covers: Chinese (zh), Arabic (ar), Russian (ru), Hindi (hi),
    #         Spanish (es), French (fr), German (de), Japanese (ja),
    #         Korean (ko), Portuguese (pt).
    #
    # These are literal translations of common English jailbreak phrases
    # that bypass English-only regex detection.
    # =====================================================================
    
    # Unicode normalization map: confusable characters -> ASCII equivalents
    # Handles homoglyph attacks (Cyrillic а vs Latin a, etc.)
    CONFUSABLE_MAP: Dict[str, str] = {
        # Cyrillic -> Latin
        '\u0430': 'a',  # а
        '\u0435': 'e',  # е
        '\u043e': 'o',  # о
        '\u0440': 'p',  # р
        '\u0441': 'c',  # с
        '\u0443': 'y',  # у
        '\u0445': 'x',  # х
        '\u0410': 'A',  # А
        '\u0415': 'E',  # Е
        '\u041e': 'O',  # О
        '\u0420': 'P',  # Р
        '\u0421': 'C',  # С
        '\u0423': 'Y',  # У
        '\u0425': 'X',  # Х
        # Greek -> Latin
        '\u03b1': 'a',  # α
        '\u03bf': 'o',  # ο
        '\u03c1': 'p',  # ρ
        '\u03c3': 's',  # σ
        '\u03c4': 't',  # τ
        # Fullwidth -> ASCII
        '\uff41': 'a', '\uff42': 'b', '\uff43': 'c', '\uff44': 'd',
        '\uff45': 'e', '\uff46': 'f', '\uff47': 'g', '\uff48': 'h',
    }
    
    # Multilingual jailbreak: "ignore all instructions" in 10 languages
    JB_MULTILINGUAL_IGNORE = [
        # Chinese
        r'忽\s*略\s*所\s*有\s*(?:指\s*令|规\s*则|命\s*令|指\s*示)',
        r'忽\s*略\s*之\s*前\s*的\s*(?:指\s*令|规\s*则|命\s*令)',
        r'不\s*要\s*遵\s*守\s*(?:规\s*则|指\s*令|限\s*制)',
        r'无\s*视\s*(?:所\s*有|之\s*前)\s*(?:指\s*令|规\s*则)',
        # Arabic
        r'تجاهل\s+(?:جميع|كل)\s+(?:التعليمات|القواعد|الأوامر)',
        r'لا\s+تتبع\s+(?:القواعد|التعليمات)',
        r'.Ignore\s+(?:جميع|كل)\s+(?:التعليمات|القواعد)',
        # Russian
        r'игнорируй\s+(?:все|все предыдущие)\s+(?:инструкции|правила|команды)',
        r'не\s+следуй\s+(?:правилам|инструкциям)',
        r'пренебреги\s+(?:всеми|всеми предыдущими)\s+(?:инструкциями|правилами)',
        # Hindi
        r'(?:सभी|सारे)\s+(?:निर्देश|नियम|आदेश)\s+(?:अनदेखा|नज़रअंदाज़)\s+करो',
        r'(?:निर्देश|नियम)\s+(?:अनदेखा|नज़रअंदाज़)\s+करो',
        r'पहले\s+के\s+(?:निर्देश|नियम)\s+(?:अनदेखा|नज़रअंदाज़)\s+करो',
        # Spanish
        r'ignora\s+(?:todas?\s+)?(?:las?\s+)?(?:instrucciones|reglas|órdenes)',
        r'no\s+sigas\s+(?:las?\s+)?(?:reglas|instrucciones)',
        r'olvida\s+(?:todas?\s+)?(?:las?\s+)?(?:instrucciones|reglas)',
        # French
        r'ignore\s+(?:toutes?\s+)?(?:les?\s+)?(?:instructions|règles|consignes)',
        r'ne\s+suis\s+pas\s+(?:les?\s+)?(?:règles|instructions)',
        r'oublie\s+(?:toutes?\s+)?(?:les?\s+)?(?:instructions|règles)',
        # German
        r'ignoriere\s+(?:alle\s+)?(?:Anweisungen|Regeln|Befehle)',
        r'befolge\s+(?:die\s+)?(?:Regeln|Anweisungen)\s+nicht',
        r'vernachlässige\s+(?:alle\s+)?(?:Anweisungen|Regeln)',
        # Japanese
        r'(?:すべての|全ての)?(?:指示|ルール|命令|規則)を(?:無視|IGNORE)',
        r'(?:指示|ルール|命令)を(?:無視|IGNORE)',
        r'従わないで\s*(?:指示|ルール|規則)',
        # Korean
        r'(?:모든|전체)\s*(?:지시|규칙|명령)\s*을?\s*(?:를)?\s*(?:무시|IGNORE)',
        r'(?:지시|규칙|명령)\s*을?\s*(?:를)?\s*(?:무시|IGNORE)',
        r'따르지\s*마\s*(?:지시|규칙)',
        # Portuguese
        r'ignore\s+(?:todas?\s+)?(?:as?\s+)?(?:instruções|regras|ordens)',
        r'não\s+(?:siga|obedeça)\s+(?:as?\s+)?(?:regras|instruções)',
        r'esqueça\s+(?:todas?\s+)?(?:as?\s+)?(?:instruções|regras)',
    ]
    
    # Multilingual jailbreak: "you are now [role]" / persona injection
    JB_MULTILINGUAL_PERSONA = [
        # Chinese
        r'你\s*(?:现在|从现在起)\s*(?:是|扮演|成为)',
        r'扮演\s*(?:一个|一下)\s*(?:角色|人物)',
        r'假装\s*(?:你\s*(?:是|成为))',
        # Arabic
        r'أنت\s+الآن\s+(?:角色)',
        r'كن\s+(?:角色)',
        r'تظاهر\s+أنك\s+角色',
        # Russian
        r'ты\s+теперь\s+(?:角色)',
        r'притворись\s+(?:что\s+ты)',
        r'сыграй\s+роль',
        # Spanish
        r'(?:ahora\s+)?(?:eres|serás|actúa\s+como)',
        r'finge\s+que\s+(?:eres|sos)',
        r'pretende\s+ser',
        # French
        r'tu\s+es\s+maintenant',
        r'fais\s+semblant\s+d\'être',
        r'joue\s+le\s+rôle\s+de',
        # German
        r'du\s+bist\s+jetzt',
        r'tue\s+so\s+als\s+wärst\s+du',
        r'spiel\s+die\s+Rolle',
        # Japanese
        r'(?:あなたは|君は)\s*(?:今|これから)',
        r'(?:ふりをして|假装)',
        r'役割を(?:演じて|務めて)',
        # Korean
        r'너는\s*(?:지금|이제)',
        r'역할을\s*(?:연기해|맡아)',
        r'척해\s*(?:봐|줘)',
    ]
    
    # Multilingual jailbreak: "do anything now" / unrestricted behavior
    JB_MULTILINGUAL_UNRESTRICTED = [
        # Chinese
        r'(?:现在|从现在起)\s*(?:可以|能)\s*(?:做|做任何)\s*(?:任何|一切|所有)',
        r'不\s*(?:受|要)\s*(?:任何|所有)\s*(?:限制|约束|规则)',
        r'(?:自由|无限制|无约束)\s*(?:地|的)?\s*(?:回答|回复|行动)',
        # Arabic
        r'افعل\s+أي\s+شيء\s+الآن',
        r'بدون\s+(?:قيود|restrictions|limits)',
        # Russian
        r'делай\s+(?:что\s+угодно|всё\s+что\s+хочешь)\s+сейчас',
        r'без\s+(?:ограничений|restrictions)',
        # Spanish
        r'haz\s+(?:lo\s+que\s+quieras|cualquier\s+cosa)\s+ahora',
        r'sin\s+(?:restricciones|limits|límites)',
        # French
        r'fais\s+(?:ce\s+que\s+tu\s+veux|n\'importe\s+quoi)\s+maintenant',
        r'sans\s+(?:restrictions|limites)',
        # German
        r'tue\s+(?:was\s+du\s+willst|alles)\s+jetzt',
        r'ohne\s+(?:Einschränkungen|restrictions)',
        # Japanese
        r'(?:何でも|なんでも)(?:して|やっ?て)',
        r'(?:制限|制約|ルール)\s*(?:なし|無し|なく)',
        # Korean
        r'(?:아무거나|뭐든지)\s*(?:해|하세요)',
        r'(?:제한|제약|규칙)\s*(?:없이|없는)',
    ]
    
    # Multilingual crisis signals: suicidal ideation
    CRISIS_MULTILINGUAL_SUICIDAL = [
        # Chinese
        r'想\s*(?:死|自杀|结束\s*(?:生命|自己|一切))',
        r'不\s*想\s*(?:活|活下去|活了)',
        r'活着\s*(?:没|没有)\s*(?:意思|意义|意思)',
        # Arabic
        r'أريد\s+(?:أن\s+أموت|الموت|أن\s+أقتل\s+نفسي)',
        r'لا\s+أريد\s+(?:العيش|الحياة|أن\s+أعيش)',
        # Russian
        r'хочу\s+(?:умереть|помереть|убить\s+себя)',
        r'не\s+хочу\s+(?:жить|жизни)',
        # Hindi
        r'मरना\s+चाहता?\s*(?:हूँ|है)',
        r'जीना\s+नहीं\s+चाहता?\s*(?:हूँ|है)',
        r'आत्महत्या\s+करना\s+चाहता?\s*(?:हूँ|है)',
        # Spanish
        r'quiero\s+(?:morir|suicidarme|matarme)',
        r'no\s+quiero\s+(?:vivir|seguir\s+vivo)',
        r'odio\s+mi\s+vida',
        # French
        r'je\s+veux\s+(?:mourir|me\s+suicider|me\s+tuer)',
        r'je\s+ne\s+veux\s+plus\s+(?:vivre|continuer)',
        # German
        r'ich\s+will\s+(?:sterben|mich\s+umbringen|suizid)',
        r'ich\s+will\s+nicht\s+mehr\s+(?:leben|weiterleben)',
        # Japanese
        r'(?:死にたい|消えたい|自殺したい)',
        r'(?:生きる|生きてる)\s*(?:意味|甲斐)\s*(?:が|は)\s*(?:ない|無い)',
        # Korean
        r'(?:죽고\s*싶다|죽고\s*싶어|자살\s*하고\s*싶다)',
        r'(?:살기|살아가기)\s*(?:싫다|싫어)',
        # Portuguese
        r'quero\s+(?:morrer|me\s+matar|suicidar)',
        r'não\s+quero\s+(?:mais\s+)?viver',
    ]
    
    # Multilingual crisis: despair / hopelessness
    CRISIS_MULTILINGUAL_DESPAIR = [
        # Chinese
        r'(?:生活|活着)\s*(?:没有|没)\s*(?:意义|意思|希望)',
        r'一切\s*(?:都|全)\s*(?:没有|没)\s*(?:意义|希望|用)',
        # Arabic
        r'لا\s+(?:أمل|hope|reason)\s+(?:في\s+الحياة|للعيش)',
        # Russian
        r'нет\s+(?:надежды|смысла)\s+(?:жить|в\s+жизни)',
        # Spanish
        r'no\s+tiene\s+(?:sentido|hope|razón)\s+(?:vivir|la\s+vida)',
        # French
        r'il\s+n\'y\s+a\s+plus\s+(?:d\'espoir|de\s+raison\s+de\s+vivre)',
        # German
        r'es\s+hat\s+(?:keinen\s+Sinn|keine\s+Hoffnung)\s+(?:zu\s+leben|mehr)',
        # Japanese
        r'(?:生きる|生きてる)\s*(?:意味|甲斐|希望)\s*(?:が|は)\s*(?:ない|無い| 없다)',
        # Korean
        r'(?:사는|살아가는)\s*(?:의미|희망|이유)\s*(?:가|은)\s*(?:없다|없어)',
    ]
    
    def __init__(self):
        """Initialize compiled regex patterns for performance"""
        self._compile_patterns()
    
    def _compile_patterns(self):
        """Compile all detection patterns for fast execution"""
        # Jailbreak patterns
        self.jb_patterns = {
            'godmode_dividers': re.compile('|'.join(self.JB_GODMODE_DIVIDERS), re.IGNORECASE),
            'author_markers': re.compile('|'.join(self.JB_AUTHOR_MARKERS), re.IGNORECASE),
            'leetspeak': re.compile('|'.join(self.JB_LEETSPEAK_MARKERS), re.IGNORECASE),
            'boundary_inversion': re.compile('|'.join(self.JB_BOUNDARY_INVERSION), re.IGNORECASE),
            'token_injection': re.compile('|'.join(self.JB_TOKEN_INJECTION), re.IGNORECASE),
            'keywords': re.compile('|'.join(self.JB_KEYWORDS), re.IGNORECASE),
            'refusal_inversion': re.compile('|'.join(self.JB_REFUSAL_INVERSION), re.IGNORECASE),
            'persona_injection': re.compile('|'.join(self.JB_PERSONA_INJECTION), re.IGNORECASE),
            'encoding_evasion': re.compile('|'.join(self.JB_ENCODING_EVASION), re.IGNORECASE),
            # Multilingual (Issue #614)
            'multilingual_ignore': re.compile('|'.join(self.JB_MULTILINGUAL_IGNORE)),
            'multilingual_persona': re.compile('|'.join(self.JB_MULTILINGUAL_PERSONA)),
            'multilingual_unrestricted': re.compile('|'.join(self.JB_MULTILINGUAL_UNRESTRICTED)),
        }
        
        # Crisis patterns
        self.crisis_patterns = {
            'suicidal_ideation': re.compile('|'.join(self.CRISIS_SUICIDAL_IDEATION), re.IGNORECASE),
            'method_seeking': re.compile('|'.join(self.CRISIS_METHOD_SEEKING), re.IGNORECASE),
            'leetspeak_evasion': re.compile('|'.join(self.CRISIS_LEETSPEAK_EVASION), re.IGNORECASE),
            'substance_seeking': re.compile('|'.join(self.CRISIS_SUBSTANCE_SEEKING), re.IGNORECASE),
            'despair': re.compile('|'.join(self.CRISIS_DESPAIR), re.IGNORECASE),
            'farewell': re.compile('|'.join(self.CRISIS_FAREWELL), re.IGNORECASE),
            'self_harm': re.compile('|'.join(self.CRISIS_SELF_HARM), re.IGNORECASE),
            # Multilingual (Issue #614)
            'multilingual_suicidal': re.compile('|'.join(self.CRISIS_MULTILINGUAL_SUICIDAL)),
            'multilingual_despair': re.compile('|'.join(self.CRISIS_MULTILINGUAL_DESPAIR)),
        }
    
    def _check_jailbreak(self, message: str) -> Tuple[bool, Dict[str, List[str]]]:
        """
        Check message for jailbreak patterns
        
        Returns:
            Tuple of (detected, patterns_matched)
        """
        patterns_found = {}
        detected = False
        
        for category, pattern in self.jb_patterns.items():
            matches = pattern.findall(message)
            if matches:
                patterns_found[category] = matches
                detected = True
        
        # Check for base64 encoded content
        if self._detect_base64_jailbreak(message):
            patterns_found.setdefault('encoding_evasion', []).append('base64_jailbreak')
            detected = True
        
        return detected, patterns_found
    
    def _check_crisis(self, message: str) -> Tuple[bool, Dict[str, List[str]]]:
        """
        Check message for crisis signals
        
        Returns:
            Tuple of (detected, patterns_matched)
        """
        patterns_found = {}
        detected = False
        
        for category, pattern in self.crisis_patterns.items():
            matches = pattern.findall(message)
            if matches:
                patterns_found[category] = matches
                detected = True
        
        return detected, patterns_found
    
    def _detect_base64_jailbreak(self, message: str) -> bool:
        """Detect potential jailbreak attempts hidden in base64"""
        # Look for base64 strings that might decode to harmful content
        b64_pattern = re.compile(r'[A-Za-z0-9+/]{40,}={0,2}')
        potential_b64 = b64_pattern.findall(message)
        
        for b64_str in potential_b64:
            try:
                decoded = base64.b64decode(b64_str).decode('utf-8', errors='ignore')
                # Check if decoded content contains jailbreak keywords
                if any(kw in decoded.lower() for kw in ['ignore', 'system', 'jailbreak', 'dan', 'godmode']):
                    return True
            except Exception:
                continue
        
        return False
    
    def _calculate_confidence(
        self, 
        jb_detected: bool, 
        crisis_detected: bool,
        jb_patterns: Dict[str, List[str]],
        crisis_patterns: Dict[str, List[str]]
    ) -> float:
        """
        Calculate confidence score based on number and type of matches
        
        Returns:
            Float between 0.0 and 1.0
        """
        confidence = 0.0
        
        if jb_detected:
            # Weight different jailbreak categories
            weights = {
                'godmode_dividers': 0.9,
                'token_injection': 0.9,
                'refusal_inversion': 0.85,
                'boundary_inversion': 0.8,
                'author_markers': 0.75,
                'keywords': 0.7,
                'persona_injection': 0.6,
                'leetspeak': 0.5,
                'encoding_evasion': 0.8,
                # Multilingual (Issue #614)
                'multilingual_ignore': 0.85,
                'multilingual_persona': 0.6,
                'multilingual_unrestricted': 0.75,
            }
            
            for category, matches in jb_patterns.items():
                weight = weights.get(category, 0.5)
                confidence += weight * min(len(matches) * 0.3, 0.5)
        
        if crisis_detected:
            # Crisis patterns get high weight
            weights = {
                'method_seeking': 0.95,
                'substance_seeking': 0.95,
                'suicidal_ideation': 0.9,
                'farewell': 0.85,
                'self_harm': 0.9,
                'despair': 0.7,
                'leetspeak_evasion': 0.8,
                # Multilingual (Issue #614)
                'multilingual_suicidal': 0.9,
                'multilingual_despair': 0.7,
            }
            
            for category, matches in crisis_patterns.items():
                weight = weights.get(category, 0.7)
                confidence += weight * min(len(matches) * 0.3, 0.5)
        
        return min(confidence, 1.0)
    
    @staticmethod
    def _merge_patterns(a: Dict[str, List[str]], b: Dict[str, List[str]]) -> Dict[str, List[str]]:
        """Merge two pattern dictionaries, deduplicating matches."""
        merged = {}
        for d in (a, b):
            for category, matches in d.items():
                if category not in merged:
                    merged[category] = list(matches)
                else:
                    existing = set(merged[category])
                    for m in matches:
                        if m not in existing:
                            merged[category].append(m)
                            existing.add(m)
        return merged
    
    def _normalize_unicode(self, text: str) -> str:
        """Normalize unicode to catch homoglyph attacks.
        
        1. NFKC normalization (compatibility decomposition + canonical composition)
        2. Replace confusable characters (Cyrillic/Greek lookalikes -> ASCII)
        3. Strip zero-width characters used for obfuscation
        """
        # NFKC normalization handles most compatibility characters
        normalized = unicodedata.normalize('NFKC', text)
        
        # Replace confusable characters
        result = []
        for ch in normalized:
            if ch in self.CONFUSABLE_MAP:
                result.append(self.CONFUSABLE_MAP[ch])
            else:
                result.append(ch)
        normalized = ''.join(result)
        
        # Strip zero-width characters (used to break pattern matching)
        zero_width = '\u200b\u200c\u200d\u2060\ufeff'  # ZWSP, ZWNJ, ZWJ, WJ, BOM
        for zw in zero_width:
            normalized = normalized.replace(zw, '')
        
        return normalized
    
    def detect(self, message: str) -> Dict[str, Any]:
        """
        Main detection entry point
        
        Analyzes a message for jailbreak attempts and crisis signals.
        Now includes unicode normalization and multilingual detection (Issue #614).
        
        Args:
            message: The user message to analyze
            
        Returns:
            Dict containing:
                - verdict: One of Verdict enum values
                - confidence: Float 0.0-1.0
                - patterns_matched: Dict of matched patterns by category
                - action_required: Bool indicating if intervention needed
                - recommended_model: Model to use (None for normal routing)
        """
        if not message or not isinstance(message, str):
            return {
                'verdict': Verdict.CLEAN.value,
                'confidence': 0.0,
                'patterns_matched': {},
                'action_required': False,
                'recommended_model': None,
            }
        
        # Normalize unicode to catch homoglyph attacks (Issue #614)
        normalized = self._normalize_unicode(message)
        
        # Run detection on both original and normalized
        # Original catches native-script multilingual attacks
        # Normalized catches homoglyph-evasion attacks
        jb_detected_orig, jb_patterns_orig = self._check_jailbreak(message)
        jb_detected_norm, jb_patterns_norm = self._check_jailbreak(normalized)
        crisis_detected_orig, crisis_patterns_orig = self._check_crisis(message)
        crisis_detected_norm, crisis_patterns_norm = self._check_crisis(normalized)
        
        # Merge results from both passes
        jb_detected = jb_detected_orig or jb_detected_norm
        jb_patterns = self._merge_patterns(jb_patterns_orig, jb_patterns_norm)
        crisis_detected = crisis_detected_orig or crisis_detected_norm
        crisis_patterns = self._merge_patterns(crisis_patterns_orig, crisis_patterns_norm)
        
        # Calculate confidence
        confidence = self._calculate_confidence(
            jb_detected, crisis_detected, jb_patterns, crisis_patterns
        )
        
        # Determine verdict
        if jb_detected and crisis_detected:
            verdict = Verdict.CRISIS_UNDER_ATTACK
            action_required = True
            recommended_model = None  # Will use Safe Six internally
        elif crisis_detected:
            verdict = Verdict.CRISIS_DETECTED
            action_required = True
            recommended_model = None  # Will use Safe Six internally
        elif jb_detected:
            verdict = Verdict.JAILBREAK_DETECTED
            action_required = True
            recommended_model = None  # Route to hardened model
        else:
            verdict = Verdict.CLEAN
            action_required = False
            recommended_model = None
        
        # Combine patterns
        all_patterns = {}
        if jb_patterns:
            all_patterns['jailbreak'] = jb_patterns
        if crisis_patterns:
            all_patterns['crisis'] = crisis_patterns
        
        return {
            'verdict': verdict.value,
            'confidence': round(confidence, 3),
            'patterns_matched': all_patterns,
            'action_required': action_required,
            'recommended_model': recommended_model,
        }


# Convenience function for direct use
def detect(message: str) -> Dict[str, Any]:
    """
    Convenience function to detect threats in a message.
    
    Args:
        message: User message to analyze
        
    Returns:
        Detection result dictionary
    """
    detector = ShieldDetector()
    return detector.detect(message)


def is_safe_six_model(model_name: str) -> bool:
    """
    Check if a model is in the SAFE SIX trusted list
    
    Args:
        model_name: Name of the model to check
        
    Returns:
        True if model is in SAFE SIX
    """
    return model_name.lower() in {m.lower() for m in SAFE_SIX_MODELS}


def get_crisis_prompt() -> str:
    """
    Get the crisis system prompt for emergency situations
    
    Returns:
        Crisis intervention system prompt
    """
    return CRISIS_SYSTEM_PROMPT