Code Extraction¶

The code extractor separates code blocks from natural language in AI responses, enabling dedicated malicious code scanning via the AIRS code_response field.

Extraction Strategy¶

The extractor uses three strategies in priority order:

1. Fenced Code Blocks¶

```python
def example():
    return "hello"
```

Detects language from the fence annotation. Supports all common programming languages.

2. Indented Code Blocks¶

    function example() {
        return "hello";
    }

Lines with 4+ leading spaces are treated as code.

3. Heuristic Fallback¶

When no fenced or indented blocks are found, the extractor looks for code indicators:

Import/require statements
Function/class definitions
Braces, semicolons, arrow functions
Shell commands (pipes, redirects)

Content is classified as code if the ratio of code-like characters exceeds 15% (CODE_CHAR_THRESHOLD = 0.15).

Output¶

interface ExtractedContent {
  naturalLanguage: string;   // Text portions
  codeBlocks: string[];      // Extracted code blocks
  languages: string[];       // Detected languages
}

Multiple code blocks are joined with \n\n---\n\n separators before being sent in the code_response field.

AIRS Field Mapping¶

Extracted Content	AIRS Field	Detection Engines
Natural language	`response`	DLP, toxicity, URL categorization
Code blocks	`code_response`	WildFire, ATP (malicious code)

Why separate fields matter

The code_response field activates WildFire and Advanced Threat Prevention engines that specifically analyze code for malicious patterns. These engines don't run on natural language content, so splitting the response ensures comprehensive coverage.