Repository navigation

fix: prompt-injection and system-prompt hardening + follow-ups (2026-10-09 assessment) - #314

Merged

jkyberneees merged 40 commits into

mainfrom

fix/prompt-injection-2026-10-09

Oct 10, 2026

Merged

fix: prompt-injection and system-prompt hardening + follow-ups (2026-10-09 assessment)#314
jkyberneees merged 40 commits into
mainfrom
fix/prompt-injection-2026-10-09

Commits on Oct 9, 2026
- fix(mcp): run schema scan and size cap under ODEK_APPROVE_MCP
  
  jkyberneees
  and
  claude
  committed
  9dd3eb6
- fix(mcpclient): cap JSON-RPC error messages at max_result_chars
  
  jkyberneees
  and
  claude
  committed
  033356d
- fix(mcp): keep schema free text out of the provider tool definition
  
  jkyberneees
  and
  claude
  committed
  65d4b99
- fix(mcp): show the tool contract text on MCP tool (re-)approval
  
  jkyberneees
  and
  claude
  committed
  0fd4aca
- docs(agents): note MCP schema stripping and env-path scans
  
  jkyberneees
  and
  claude
  committed
  c1f9495
- fix(telegram): disable link previews on every outbound message by default
  
  jkyberneees
  and
  claude
  committed
  de579c1
- fix(telegram): bind wake-turn approvals to a real user and mark wake messages
  
  jkyberneees
  and
  claude
  committed
  416d897
- fix(telegram): warn when a group chat is allowed without allowed_users
  
  jkyberneees
  and
  claude
  committed
  e66a12b
- fix(telegram): record forwarded/voice/caption ingests and guard-scan forwards
  
  jkyberneees
  and
  claude
  committed
  c9f9fc4
- fix(memory): show persisted text in memory write approvals
  
  jkyberneees
  and
  claude
  committed
  bb51120
- fix(skills): bound, scan and sanitise skill names in the catalog
  
  jkyberneees
  and
  claude
  committed
  2622cc2
- fix(skills): trusted skill wins over a same-named copy pending review
  
  jkyberneees
  and
  claude
  committed
  c77aa46
- fix(memory): taint episodes from network shell commands
  
  jkyberneees
  and
  claude
  committed
  584964d
Commits on Oct 10, 2026
- fix(serve): show the full episode summary before REST promote
  
  jkyberneees
  and
  claude
  committed
  77e4e4e
- test(skills): cover catalog withholding and collision edge cases
  
  jkyberneees
  and
  claude
  committed
  d4b0254
- fix(loop): completion nudge never directs execution of plan checks
  
  jkyberneees
  and
  claude
  committed
  e85647b
- fix(loop): bare engines wrap skill, episode, memory and bg-notice context
  
  jkyberneees
  and
  claude
  committed
  b46566a
- fix(loop): re-wrap persisted and tool-supplied wrappers not minted in-process
  
  jkyberneees
  and
  claude
  committed
  6cb5d1f
- fix(loop): re-cap persisted digest and bound persisted plan fields on load
  
  jkyberneees
  and
  claude
  committed
  a9450d4
- fix(agent): strip identity sections imitating the security pillar
  
  jkyberneees
  and
  claude
  committed
  6a3587a
- fix(proactive): inject return-after-break summary as a named user message
  
  jkyberneees
  and
  claude
  committed
  bf0016b
- fix(danger): stop flagging identity prose as impersonation
  
  jkyberneees
  and
  claude
  committed
  554a980
- fix(guard): judge content past max_text_length with the sidecar
  
  jkyberneees
  and
  claude
  committed
  b241438
- fix(render): escape terminal controls in model and tool text
  
  jkyberneees
  and
  claude
  committed
  e4eef01
- fix(danger): catch common injection paraphrases with low false positives
  
  jkyberneees
  and
  claude
  committed
  795082a
- fix(subagent): fence the task text whenever effective trust is untrusted
  
  jkyberneees
  and
  claude
  committed
  ba8b139
- fix(loop): treat a run with MCP tools registered as tainted for delegation
  
  jkyberneees
  and
  claude
  committed
  0b99ea3
- fix(session): persist the untrusted-ingest taint as sticky session state
  
  jkyberneees
  and
  claude
  committed
  8770b83
- fix(subagent): authenticate the child result frame with a per-spawn nonce
  
  jkyberneees
  and
  claude
  committed
  d9d5cb8
- build(deps): bump golang.org/x/net to v0.60.0
  
  jkyberneees
  and
  claude
  committed
  dad977e
- fix(taint): pure first-party tool calls no longer taint the run
  
  jkyberneees
  and
  claude
  committed
  714b558
- fix(memory): keep episode taint sticky across history trimming
  
  jkyberneees
  and
  claude
  committed
  fc0b198
- fix(telegram): mark session taint under the chat save lock
  
  jkyberneees
  and
  claude
  committed
  82ddee0
- fix(render): print subdivision flags instead of escaping their tag characters
  
  jkyberneees
  and
  claude
  committed
  273d5ff
- docs(memory): long legacy facts are targeted by a unique old_text substring
  
  jkyberneees
  and
  claude
  committed
  d7fb518
- style(loop): gofmt plan_baseline_eval_test.go
  
  jkyberneees
  and
  claude
  committed
  827d6be
- fix(danger): do not flag policy prose that forbids sending secrets
  
  jkyberneees
  and
  claude
  committed
  9b8f6bc
- fix(memory): show the entry a replace/remove modifies in its approval
  
  jkyberneees
  and
  claude
  committed
  f0077f0
- fix(subagent): make the sub-agent child non-dumpable on Linux
  
  jkyberneees
  and
  claude
  committed
  5231543
- test(session): pin the revision settle window in the own-write test
  
  jkyberneees
  and
  claude
  committed
  ea5552b

Commits

Commits on Oct 9, 2026

Commits on Oct 10, 2026