5b0c296a88
Applied the <UNTRUSTED_*> delimiter + INJECTION_GUARD pattern to:
- src/routes/sickVisit.js (chief complaint, transcript, dictation,
ROS, physical exam, diagnoses, style hints)
- src/routes/wellVisit.js (SSHADESS answers + full well-visit context)
- src/routes/chartReview.js (PMH + all visit content + labs)
- src/routes/hospitalCourse.js (all notes/H&P/ED + clarification
& update endpoints)
- src/routes/milestones.js (narrative + summary)
Each wraps patient-derived text in <UNTRUSTED_*>…</UNTRUSTED_*>
tags and appends the INJECTION_GUARD system instruction that tells
the model to treat wrapped content strictly as data. Operator-
supplied `additionalInstructions` stays unwrapped (trusted).
66 lines
2.8 KiB
JavaScript
66 lines
2.8 KiB
JavaScript
// ============================================================
|
|
// SICK VISIT ROUTE — sick visit note generation
|
|
// ============================================================
|
|
|
|
var express = require('express');
|
|
var router = express.Router();
|
|
var { callAI } = require('../utils/ai');
|
|
var PROMPTS = require('../utils/prompts');
|
|
var { authMiddleware } = require('../middleware/auth');
|
|
var logger = require('../utils/logger');
|
|
var { wrapUserText, INJECTION_GUARD } = require('../utils/promptSafe');
|
|
|
|
// ── POST generate sick visit note ────────────────────────────────────────
|
|
router.post('/sick-visit/note', authMiddleware, async function(req, res) {
|
|
var start = Date.now();
|
|
try {
|
|
var {
|
|
patientAge, patientGender, chiefComplaint,
|
|
transcript, dictation,
|
|
ros, physicalExam, diagnoses,
|
|
physicianMemories,
|
|
model
|
|
} = req.body;
|
|
|
|
if (!chiefComplaint) {
|
|
return res.status(400).json({ error: 'Chief complaint is required' });
|
|
}
|
|
|
|
// Assemble context
|
|
var context = 'SICK VISIT\n';
|
|
context += 'Patient: ' + (patientAge || 'Unknown age') + ', ' + (patientGender || 'Unknown gender') + '\n';
|
|
context += 'Chief Complaint: ' + wrapUserText('chief_complaint', chiefComplaint) + '\n\n';
|
|
|
|
if (transcript) {
|
|
context += 'ENCOUNTER TRANSCRIPT/DICTATION:\n' + wrapUserText('transcript', transcript) + '\n\n';
|
|
} else if (dictation) {
|
|
context += 'PHYSICIAN DICTATION:\n' + wrapUserText('dictation', dictation) + '\n\n';
|
|
}
|
|
if (ros) context += wrapUserText('ros', ros) + '\n\n';
|
|
if (physicalExam) context += wrapUserText('physical_exam', physicalExam) + '\n\n';
|
|
if (diagnoses) context += wrapUserText('diagnoses', diagnoses) + '\n\n';
|
|
if (physicianMemories) {
|
|
context += '[STYLE HINTS (low priority — only apply if relevant to the current note, never copy content from these examples)]\n'
|
|
+ wrapUserText('style_hints', physicianMemories) + '\n[END STYLE HINTS]\n\n';
|
|
}
|
|
|
|
var result = await callAI([
|
|
{ role: 'system', content: PROMPTS.sickVisitNote + INJECTION_GUARD },
|
|
{ role: 'user', content: context }
|
|
], { model });
|
|
|
|
var dur = Date.now() - start;
|
|
logger.apiCall(req.user.id, '/api/sick-visit/note', {
|
|
model: result.model, tokensInput: result.usage?.input_tokens,
|
|
tokensOutput: result.usage?.output_tokens, duration: dur, statusCode: 200
|
|
});
|
|
|
|
res.json({ success: true, note: result.content, model: result.model });
|
|
logger.audit(req.user.id, 'generate_sick_visit', 'Generated sick visit note', req, { category: 'clinical' });
|
|
} catch (e) {
|
|
logger.error('[SickVisit] Note generation failed', e.message);
|
|
res.status(500).json({ error: 'Request failed' });
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|