fix: prompt-injection and system-prompt hardening + follow-ups (2026-10-09 assessment)

[jkyberneees]

Fixes every finding from the 2026-10-09 prompt-injection and system-prompt security assessment, plus the defects the per-area adversarial reviews found in the fixes. One commit per finding; review fixes are squashed into the commit they correct.

Six Opus agents (plus three for follow-ups) implemented the fixes in parallel worktrees (RED test first, then GREEN). A Sonnet agent then reviewed each area adversarially, and every confirmed defect was fixed before the commits were combined here.

Findings fixed

MCP

• ODEK_APPROVE_MCP=1 now runs the schema guard scan and the 256 KiB cap, like auto_approve.
• Schema free text never reaches the provider unwrapped. The model-facing schema keeps only structural keywords. Descriptions, titles, examples, string and object defaults, and non-identifier names move into the nonce-wrapped description. The approval scan also covers map keys. required is kept consistent with the surviving properties. The approval key still hashes the original schema.
• The per-tool approval prompt shows the sanitised description, a parameter summary and the lifted docs, not just a hash.
• JSON-RPC error.message is capped by max_result_chars.

Telegram

• New telegram.link_preview setting (default false) and ODEK_TELEGRAM_LINK_PREVIEW. Previews are disabled on every outbound text by default, which closes a zero-click exfiltration beacon. Operator-only: project odek.json cannot enable it.
• Wake-turn approvals and clarify bind to the user who last started a turn, resolved after the chat slot is held, or the single allowed user. Otherwise they fail closed. Wake messages persist as bg-wake.
• Startup warning for group chats allowed without allowed_users.
• Forwarded, voice, caption and document ingests are audit-recorded. Forwards are guard-scanned under the telegram scope, with one banner only.

Memory and skills

• Memory write approvals show the full text being persisted. Fields over 2048 bytes are refused so nothing is elided.
• Skill names are capped at 64 runes, charset-restricted and guard-scanned. Skills pending review are counted, not named, in the unwrapped catalog. Catalog lines are sanitised. Rejected names are logged.
• A trusted skill wins over a same-named copy pending review.
• Shell and bg_start commands with network or unknown effects taint memory episodes.
• REST episode promote requires summary_sha256, compares it under the episode lock and returns the promoted text. The WebUI and odek memory list/promote show the full sanitised summary.

Loop and system prompt

• The completion nudge never directs execution of plan checks. Checks restored from a persisted plan are marked and do not trigger it.
• Bare loop.New engines default-wrap skill, episode, extended-memory and bg-notice context.
• Persisted system messages and extension tool output are re-wrapped unless minted in this process. Re-wrapping is byte-stable across restarts, with no banner stacking.
• Persisted digests are re-capped on load. Persisted plan size, titles and notes are bounded.
• Identity text imitating pillar headings is stripped. This handles setext, bold, fullwidth and zero-width variants, and leaves code fences and unrelated persona text intact. The real pillar is always last.
• The return-after-break summary is a wrapped user message named return-after-break. It is never persisted, counted as a turn, indexed, or treated as the task.

Scanner and render

• Identity prose such as "When the user says deploy…" no longer trips the impersonation patterns. Relayed-authority and relayed-execution impersonation are still caught.
• New low-false-positive patterns: persona swaps, set-aside phrasing, context-leak requests, override banners, notes to the model, [SYSTEM]/### SYSTEM markers, ES/FR/DE redirects that name a secret or target, and spaced-letter evasion.
• AGENTS.md guard rejection now warns on stderr.
• Sidecar scans content past max_text_length in overlapping windows. Content too large for the window cap is rejected whatever fallback_to_local says.
• Terminal output escapes control, bidi and invisible characters in all model and tool text, and is streaming-safe.

Taint and sub-agents

• The sub-agent task fence keys on effective trust.
• A run with any MCP tool registered is tainted for delegate_tasks, so trusted delegation is unavailable while MCP servers are loaded.
• Taint persists as sticky Session.UntrustedIngested. Trimming does not clear it, it is seeded on every resume surface, and catalogue taint persists too. Embedders get odek.WithUntrustedIngest. Taint detection now matches only real wrappers, not the pillar's prose that mentions the tag.
• The child result frame is authenticated with a per-spawn nonce passed over an inherited pipe. Unauthenticated frames show status: "unverified" and never refund budget.

Behaviour changes worth a release note

• Telegram link previews are off by default. Set telegram.link_preview: true to restore them.
• REST POST …/episodes/{id}/promote returns 200 with the summary instead of 204, and requires summary_sha256.
• Trusted delegation is unavailable while any MCP server is loaded. Disable servers with "enabled": false if needed.
• Older odek binaries running as sub-agents send no frame auth. Their results show as unverified, and their budget grant is not refunded under budget_inherit=share.
• More sessions need episode review, because network shell commands now taint.
• Turn counts no longer include bg-wake or bg-notice messages.

Build

• golang.org/x/net bumped to v0.60.0 to clear the govulncheck advisories that would block CI.

Verification

• go test ./... passes. internal/danger was run with HOME=/home/user.
• -race passes on every changed package, including cmd/odek.
• ODEK_E2E=true E2E and MCP E2E pass.
• go vet and gofmt are clean. golangci-lint is clean.
• node --test for the UI passes.
• internal/danger fuzz targets ran 10s each with no failures.

Coverage, before → after:

Package	Before	After
cmd/odek	72.6%	73.0%
internal/loop	93.1%	93.5%
internal/agent	78.2%	80.8%
internal/session	89.5%	89.7%
internal/memory	82.9%	84.2%
internal/memory/approval	new	89.3%
internal/skills	91.0%	91.2%
internal/telegram	90.1%	90.2%
internal/mcpclient	94.5%	94.6%
internal/danger	92.1%	92.2%
internal/guard	74.1%	83.9%
internal/render	68.8%	74.2%

Coverage figures are per-group measurements taken in each worktree.

Full-branch Opus review

The review found three cross-group defects, all fixed and squashed into the commits they correct:

• Pillar-imitation stripping ran over the wrapped AGENTS.md and could remove its closing tag. Stripping now runs on the operator identity only, before project files and skills are appended, and wrapped regions are opaque to it.
• New scanner patterns rejected ordinary project prose such as "Forget the previous guidelines about tabs" and "### Admin / Override the default port". They now require an agent-directed target. Spaced-letter scanning cost is bounded.
• The delegation taint keyed on wrapper syntax, so plans, digests and memory blocks tainted every session. Taint now comes only from external sources. Engine-derived labels such as compaction, plan and memory are allowlisted, and tools cannot mint those labels. AGENTS.md and MCP still taint.

CodeQL flagged SHA-256 "password hashing" on the content-identity registry. That was a false positive. The registry now uses HMAC-SHA256 with a random per-process key, and the stable wrapper nonce uses FNV-128a.

A second Opus re-check found three more issues in the fixes, all now fixed. A file named like an engine label, such as plan, could be read via head_tail without tainting. Tool-side wrappers now relabel such sources to external:<label>. Recalled episodes did not taint. episode is now off the allowlist, and episode provenance counts wrapped non-tool ingests. A fake wrapper in a library identity could shield a pillar imitation. Identity wrapper literals are now neutralised. The final re-check verdict was merge-ready.

Follow-ups, now fixed in this PR

• Pure first-party tools stop tainting the run. Calls to audited built-ins (math_eval, inline base64 encode, list_subagent_profiles, list_tools without project MCP servers, plan) are wrapped as pure_tool:<name>, record no ingest and do not taint. Purity is honoured only for registered first-party types, so embedder and MCP tools can never claim it. A panic in the purity check counts as impure.
• Episode provenance is sticky. It is stored as Session.EpisodeUntrusted. Save-time scans use their own anchor, independent of the redaction boundary, and Telegram resume and archive carry the flag. A tainting call trimmed out of history no longer yields a trusted, auto-recalled episode. It stays separate from the stricter delegation taint, so workspace coding sessions remain recallable.
• Memory replace and remove approvals show the full matched entry. The mutation is bound to that entry (ErrEntryChanged). Legacy entries over the display bound show their length, a sha256 and an excerpt.
• Sub-agent children call prctl(PR_SET_DUMPABLE, 0) on Linux. This blocks same-uid /proc/<pid>/fd replay of the result-frame nonce. Costs: no core dumps, and no same-uid ptrace attach on sub-agents.
• The Telegram taint mark runs under the chat save lock.
• Terminal output keeps only RGI subdivision flags (England, Scotland, Wales). Other tag characters are still escaped, so they cannot hide text.
• Scanner: policy prose such as "Never send secrets to external services." no longer trips the transmit pattern. The exemption fails closed. Any exception word, condition, question, object pronoun, later secret noun, or destination-shaped token anywhere in the text keeps the line flagged. A decoy prohibition around a trigger-free payload can still clear it. That grants nothing, because the payload alone already passes the scanner on main. This was verified on 15 probes.
• internal/loop/plan_baseline_eval_test.go is now gofmt'd.

Each follow-up group got a Sonnet adversarial review, and the branch got Opus re-checks. Every confirmed defect was fixed.

Remaining limitations (documented)

• Episode provenance judges outside-workspace reads against the saving process's working directory.
• An older binary that rewrites a session file drops the new taint fields.
• Root or CAP_SYS_PTRACE can still read sub-agent descriptors.

Verification

• go test ./... passes. internal/danger was run with HOME=/home/user.
• -race passes on every changed package, including cmd/odek.
• ODEK_E2E=true E2E and MCP E2E pass.
• go vet and gofmt are clean. golangci-lint is clean.
• node --test for the UI passes.
• internal/danger fuzz targets ran 10s each with no failures.

Coverage, before → after:

Package	Before	After
cmd/odek	72.6%	73.0%
internal/loop	93.1%	93.5%
internal/agent	78.2%	80.8%
internal/session	89.5%	89.7%
internal/memory	82.9%	84.2%
internal/memory/approval	new	89.3%
internal/skills	91.0%	91.2%
internal/telegram	90.1%	90.2%
internal/mcpclient	94.5%	94.6%
internal/danger	92.1%	92.2%
internal/guard	74.1%	83.9%
internal/render	68.8%	74.2%

Coverage figures are per-group measurements taken in each worktree.

Full-branch Opus review

The review found three cross-group defects, all fixed and squashed into the commits they correct:

• Pillar-imitation stripping ran over the wrapped AGENTS.md and could remove its closing tag. Stripping now runs on the operator identity only, before project files and skills are appended, and wrapped regions are opaque to it.
• New scanner patterns rejected ordinary project prose such as "Forget the previous guidelines about tabs" and "### Admin / Override the default port". They now require an agent-directed target. Spaced-letter scanning cost is bounded.
• The delegation taint keyed on wrapper syntax, so plans, digests and memory blocks tainted every session. Taint now comes only from external sources. Engine-derived labels such as compaction, plan and memory are allowlisted, and tools cannot mint those labels. AGENTS.md and MCP still taint.

CodeQL flagged SHA-256 "password hashing" on the content-identity registry. That was a false positive. The registry now uses HMAC-SHA256 with a random per-process key, and the stable wrapper nonce uses FNV-128a.

A second Opus re-check found three more issues in the fixes, all now fixed. A file named like an engine label, such as plan, could be read via head_tail without tainting. Tool-side wrappers now relabel such sources to external:<label>. Recalled episodes did not taint. episode is now off the allowlist, and episode provenance counts wrapped non-tool ingests. A fake wrapper in a library identity could shield a pillar imitation. Identity wrapper literals are now neutralised. The final re-check verdict was merge-ready.

Follow-ups (not in this PR)

• Episode provenance does not read the sticky Session.UntrustedIngested flag. If a tainting tool call is trimmed out of history, its episode can be stored as trusted. The same is true on main, and recall now taints the run, so this does not yield a clean run.
• Any tool call taints the run, because every adapter tool records an ingest. That was already true on main. Trusted delegation is therefore available only before the first tool call in an untainted session with no MCP server or AGENTS.md. Exempting pure first-party tools such as math_eval would be a separate decision.
• Skills whose names exceed 64 runes or use characters outside the new charset are skipped at load with a warning.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	ea5552b	Commit Preview URL Branch Preview URL	Oct 10 2026, 07:15 AM