@gaunt-sloth/core 2.0.0-alpha.26 → 2.0.0-alpha.28

package/dist/utils/systemPromptNotes.js

@@ -15,6 +15,7 @@
  * `GthDeepAgent`.
  */
 import { DEFAULT_COMMIT_CO_AUTHOR_EMAIL, DEFAULT_COMMIT_CO_AUTHOR_NAME } from '#src/constants.js';
+import { capUntrustedText, defangUntrustedDelimiters, MCP_FENCE_BEGIN, MCP_FENCE_END, } from '#src/utils/untrustedText.js';
 /**
  * EXT-26: the platform-agnostic tail shared by both {@link appendOsShellNote} branches.
  *
@@ -84,34 +85,64 @@ export function appendCwdNote(systemPrompt, cwd) {
     return systemPrompt ? `${systemPrompt}\n\n${cwdNote}` : cwdNote;
 }
 /**
- * GS2-35: append the commit co-authoring rule to the composed code-mode system prompt.
+ * GS2-35/EXT-83: append the commit-writing rules to the composed code-mode system prompt.
  *
  * Gaunt Sloth has **no dedicated git-commit tool** — the agent commits by calling
- * `run_shell_command` with `git commit`, composing the message (including any trailer) itself. Left
- * unguided, models emit `Co-Authored-By: <their own model name>` (e.g. `Claude`, `GPT`, `Gemini`)
- * from trained habit, which is **factually wrong**: the commit was produced by *Gaunt Sloth*, not by
- * the model. This note is the fix at the correct layer — first-party prompt guidance that (a) states
- * the exact trailer to emit and (b) forbids a model-name co-author.
+ * `run_shell_command` with `git commit`, composing the message (including any trailer) itself. That
+ * leaves two things it must be told, and both live here because both are about committing:
+ *
+ * 1. **WHO the co-author is.** Left unguided, models emit their own model name from trained habit,
+ *    which is factually wrong: the commit was produced by *Gaunt Sloth*, not by the model. The note
+ *    states the exact trailer to emit. EXT-83 — rather than enumerate model names not to write (a
+ *    denylist is stale the day a new vendor ships, and an enumeration beside a catch-all teaches the
+ *    model that the list is the rule), the correct name is SUPPLIED: the resolved
+ *    {@link ResolvedModelIdentity} decorates the DEFAULT name as `Gaunt Sloth (provider:model)`, so
+ *    the real model is named while the authorship stays Gaunt Sloth's.
+ * 2. **HOW the message reaches git.** A commit message passed inline in a double-quoted shell
+ *    argument is EXPANDED BY THE SHELL before git runs, so a message that quotes code the way
+ *    ordinary technical prose does is executed as a command. The note states that mechanism rather
+ *    than merely forbidding the construct — naming a construct without its mechanism has been
+ *    measured not to work. A file path carries no shell metacharacters, so the file form removes the
+ *    failure mode instead of asking the model to avoid it.
+ *
+ * The note's prose carries **no backtick and no other markup** — including no angle-bracket
+ * placeholder: it is the one piece of guidance whose subject is how to write a commit message, so
+ * quoting its own examples in backticks would demonstrate the exact style rule 2 exists to stop, and
+ * an angle-bracket placeholder copied literally is itself a shell input redirect. The `<email>` of
+ * the trailer line is the exception the RFC form requires, and is scoped out of the scan.
  *
  * The identity is config-driven (`commit.coAuthor` in {@link import('#src/config/types.js').GthConfig}).
  * Each field falls back INDEPENDENTLY to the Gaunt Sloth account
  * ({@link DEFAULT_COMMIT_CO_AUTHOR_NAME} / {@link DEFAULT_COMMIT_CO_AUTHOR_EMAIL}) — so a partial
  * override (name only, or a config that bypassed the loader) still yields a complete trailer, and a
- * fully-absent config yields the default account. Blank/whitespace values are treated as unset.
+ * fully-absent config yields the default account. Blank/whitespace values are treated as unset. An
+ * EXPLICITLY CONFIGURED name is emitted verbatim, with no identity spliced in — the user asked for
+ * that string; the identity decorates only the default. An unresolvable identity (`undefined`) falls
+ * back to the plain default name, never to a placeholder.
  *
  * Backend-agnostic: composed through the shared code path so BOTH the lean `GthLangChainAgent` and
  * the deep `GthDeepAgent` inject it (the git-commit capability rides on `run_shell_command`, which
  * both backends expose in code mode). Returns the note alone when there is no base prompt.
  */
-export function appendCommitCoAuthorNote(systemPrompt, coAuthor) {
-    const name = coAuthor?.name?.trim() || DEFAULT_COMMIT_CO_AUTHOR_NAME;
+export function appendCommitCoAuthorNote(systemPrompt, coAuthor, modelIdentity) {
+    // EXT-83 — ONE place composes the name, so the parenthesised shape stays a one-line change. The
+    // identity decorates ONLY the default name: a configured name is the user's own string and is
+    // emitted verbatim, and an unresolved identity yields the bare default (never a placeholder).
+    const configuredName = coAuthor?.name?.trim();
+    const identity = modelIdentity?.identity?.trim();
+    const name = configuredName ||
+        (identity ? `${DEFAULT_COMMIT_CO_AUTHOR_NAME} (${identity})` : DEFAULT_COMMIT_CO_AUTHOR_NAME);
     const email = coAuthor?.email?.trim() || DEFAULT_COMMIT_CO_AUTHOR_EMAIL;
     const note = 'When you create a git commit, add EXACTLY this co-author trailer line (on its own line, at ' +
         `the end of the commit message):\nCo-Authored-By: ${name} <${email}>\n` +
-        'NEVER attribute the co-author to the underlying model or provider name (do not write ' +
-        '`Co-Authored-By: Claude`, `GPT`, `Gemini`, `Opus`, `Sonnet`, or any model/vendor name): the ' +
-        'commit is authored by Gaunt Sloth, the assistant, not the model. Emit at most this one ' +
-        'Co-Authored-By trailer.';
+        'Emit at most this one Co-Authored-By trailer.\n' +
+        'Write the commit message in plain English: say what changed and why, and keep code, shell ' +
+        'commands, backticks and markup out of it.\n' +
+        'Never pass a commit message inline with the -m option: inside double quotes a POSIX shell ' +
+        'expands backtick and dollar-parenthesis constructs before git ever runs, so a message that ' +
+        'quotes code is executed as a command. Write the message to a file with the write_file tool ' +
+        '(never with shell echo or a heredoc, which put the same text back into a shell argument), ' +
+        'then commit it with git commit -F followed by that file path.';
     return systemPrompt ? `${systemPrompt}\n\n${note}` : note;
 }
 /**
@@ -208,46 +239,13 @@ export function appendModelContextNote(systemPrompt, modelIdentity) {
 export const MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER = 4000;
 /** EXT-32: truncation marker appended when a server's instructions exceed the per-server cap. */
 export const MCP_INSTRUCTIONS_TRUNCATION_MARKER = '… [truncated]';
-/** EXT-32: the ONLY real structural delimiters in the composed block (emitted by this helper). */
-const MCP_FENCE_BEGIN = '[BEGIN MCP SERVER-PROVIDED CONTEXT]';
-const MCP_FENCE_END = '[END MCP SERVER-PROVIDED CONTEXT]';
-/**
- * EXT-32 (security): neutralize the block's structural delimiters inside UNTRUSTED server text.
- *
- * `getInstructions()` is fully server-controlled, so a malicious/compromised MCP server can emit
- * text that forges the fence tokens or a per-server label — closing the fence early so its lines
- * land OUTSIDE the visual boundary, or impersonating another server. Before fencing, we defang any
- * occurrence in the server text of:
- *   - the fence tokens `[BEGIN|END MCP SERVER-PROVIDED CONTEXT]` (bracket run collapsed so they can
- *     no longer be read as the real delimiter), and
- *   - a per-server label line `--- Server: …` (the leading `---` run broken so it can't masquerade
- *     as one of our labels).
- * After this, the ONLY real delimiters in the composed block are the ones this helper emits. The
- * server NAME in our own label comes from trusted config keys, so it is not sanitized — only the
- * server-supplied CONTENT is. Whitespace-tolerant matching (`\s+`, optional bracket padding, `-{3,}`)
- * so trivial spacing variants can't slip a delimiter through.
- */
-function defangMcpDelimiters(text) {
-    return text
-        .replace(/\[\s*(BEGIN|END)\s+MCP\s+SERVER-PROVIDED\s+CONTEXT\s*\]/gi, (_m, kw) => `(server text: ${kw.toUpperCase()} MCP SERVER-PROVIDED CONTEXT)`)
-        .replace(/-{3,}(\s*Server\s*:)/gi, '- - -$1');
-}
 /**
  * EXT-32: cap server text at {@link MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER}, SURROGATE-SAFE.
  *
- * A naive `slice(0, N)` can split a surrogate pair (e.g. an emoji) at the boundary, emitting a lone
- * half-code-unit. If the cut would land between a high and low surrogate, back off one code unit so
- * the pair is kept whole (dropped entirely rather than split). Appends the truncation marker only
- * when text is actually clipped.
+ * Thin binding of the shared {@link capUntrustedText} to this block's own cap and marker.
  */
 function capMcpText(text) {
-    if (text.length <= MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER)
-        return text;
-    let end = MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER;
-    const code = text.charCodeAt(end - 1);
-    if (code >= 0xd800 && code <= 0xdbff)
-        end -= 1; // don't split a surrogate pair
-    return `${text.slice(0, end).trimEnd()}\n${MCP_INSTRUCTIONS_TRUNCATION_MARKER}`;
+    return capUntrustedText(text, MCP_INSTRUCTIONS_MAX_CHARS_PER_SERVER, MCP_INSTRUCTIONS_TRUNCATION_MARKER);
 }
 /**
  * EXT-32: append connected MCP servers' discovery `instructions` to the composed system prompt.
@@ -277,7 +275,7 @@ export function appendMcpServerInstructionsNote(systemPrompt, instructions) {
         // SECURITY: defang the untrusted server text's structural delimiters BEFORE fencing, then cap
         // (surrogate-safe). Order matters — defang first so a forged fence/label can't survive into the
         // composed block; cap after so the final per-server size stays bounded.
-        const safe = capMcpText(defangMcpDelimiters(text));
+        const safe = capMcpText(defangUntrustedDelimiters(text));
         blocks.push(`--- Server: "${entry.server}" ---\n${safe}`);
     }
     if (blocks.length === 0) {

package/dist/utils/systemPromptNotes.js.map

@@ -1 +1 @@
-{"version":3,"file":"systemPromptNotes.js","sourceRoot":"","sources":["../../src/utils/systemPromptNotes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4FAA4F;IAC5F,wFAAwF;IACxF,2DAA2D,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAgC;IAChE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI;YACF,sFAAsF;gBACtF,qFAAqF;gBACrF,uFAAuF;gBACvF,4FAA4F;gBAC5F,6BAA6B,iBAAiB,EAAE,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,IAAI;YACF,0BAA0B,MAAM,yDAAyD;gBACzF,qFAAqF;gBACrF,+CAA+C,iBAAiB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,YAAgC,EAAE,GAAW;IACzE,MAAM,OAAO,GACX,sBAAsB,GAAG,IAAI;QAC7B,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,yDAAyD,CAAC;IAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAQD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAgC,EAChC,QAAyB;IAEzB,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,6BAA6B,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,8BAA8B,CAAC;IACxE,MAAM,IAAI,GACR,6FAA6F;QAC7F,oDAAoD,IAAI,KAAK,KAAK,KAAK;QACvE,uFAAuF;QACvF,8FAA8F;QAC9F,yFAAyF;QACzF,yBAAyB,CAAC;IAC5B,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAOa;IAEb,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;IACxB,8FAA8F;IAC9F,gGAAgG;IAChG,0FAA0F;IAC1F,uFAAuF;IACvF,IAAI,QAAQ,GAAuB,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,gBAAgB,IAAI,GAAG,EAAE,KAAK,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,iGAAiG;IACjG,gGAAgG;IAChG,8BAA8B;IAC9B,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;QACzD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAgC,EAChC,aAAgD;IAEhD,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IACnC,8FAA8F;IAC9F,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,0DAA0D;IAC1D,MAAM,WAAW,GAAG,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GACR,iDAAiD,QAAQ,KAAK,WAAW,iBAAiB;QAC1F,4FAA4F;QAC5F,kCAAkC,CAAC;IACrC,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;AAE1D,iGAAiG;AACjG,MAAM,CAAC,MAAM,kCAAkC,GAAG,eAAe,CAAC;AAElE,kGAAkG;AAClG,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAC9D,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CACN,2DAA2D,EAC3D,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,+BAA+B,CACrF;SACA,OAAO,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,qCAAqC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,GAAG,GAAG,qCAAqC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,+BAA+B;IAC/E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,kCAAkC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAgC,EAChC,YAAgD;IAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,qDAAqD;QAC1E,8FAA8F;QAC9F,gGAAgG;QAChG,wEAAwE;QACxE,MAAM,IAAI,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,MAAM,UAAU,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,8FAA8F;QAC9F,8FAA8F;QAC9F,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GACR,2FAA2F;QAC3F,4FAA4F;QAC5F,iCAAiC;QACjC,GAAG,eAAe,IAAI;QACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnB,KAAK,aAAa,IAAI;QACtB,6FAA6F;QAC7F,4EAA4E,CAAC;IAE/E,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"systemPromptNotes.js","sourceRoot":"","sources":["../../src/utils/systemPromptNotes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,aAAa,GACd,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,4FAA4F;IAC5F,wFAAwF;IACxF,2DAA2D,CAAC;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAgC;IAChE,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI;YACF,sFAAsF;gBACtF,qFAAqF;gBACrF,uFAAuF;gBACvF,4FAA4F;gBAC5F,6BAA6B,iBAAiB,EAAE,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,IAAI;YACF,0BAA0B,MAAM,yDAAyD;gBACzF,qFAAqF;gBACrF,+CAA+C,iBAAiB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,YAAgC,EAAE,GAAW;IACzE,MAAM,OAAO,GACX,sBAAsB,GAAG,IAAI;QAC7B,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,yDAAyD,CAAC;IAC5D,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAgC,EAChC,QAAyB,EACzB,aAAqC;IAErC,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,cAAc,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GACR,cAAc;QACd,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,6BAA6B,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,8BAA8B,CAAC;IACxE,MAAM,IAAI,GACR,6FAA6F;QAC7F,oDAAoD,IAAI,KAAK,KAAK,KAAK;QACvE,iDAAiD;QACjD,4FAA4F;QAC5F,6CAA6C;QAC7C,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,+DAA+D,CAAC;IAClE,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAOa;IAEb,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;IACxB,8FAA8F;IAC9F,gGAAgG;IAChG,0FAA0F;IAC1F,uFAAuF;IACvF,IAAI,QAAQ,GAAuB,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,OAAO,GAAG,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,gBAAgB,IAAI,GAAG,EAAE,KAAK,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,iGAAiG;IACjG,gGAAgG;IAChG,8BAA8B;IAC9B,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;QACzD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAgC,EAChC,aAAgD;IAEhD,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,YAAY,CAAC;IACnC,8FAA8F;IAC9F,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,0DAA0D;IAC1D,MAAM,WAAW,GAAG,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GACR,iDAAiD,QAAQ,KAAK,WAAW,iBAAiB;QAC1F,4FAA4F;QAC5F,kCAAkC,CAAC;IACrC,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;AAE1D,iGAAiG;AACjG,MAAM,CAAC,MAAM,kCAAkC,GAAG,eAAe,CAAC;AAElE;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,gBAAgB,CACrB,IAAI,EACJ,qCAAqC,EACrC,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAgC,EAChC,YAAgD;IAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,SAAS,CAAC,qDAAqD;QAC1E,8FAA8F;QAC9F,gGAAgG;QAChG,wEAAwE;QACxE,MAAM,IAAI,GAAG,UAAU,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,MAAM,UAAU,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,8FAA8F;QAC9F,8FAA8F;QAC9F,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GACR,2FAA2F;QAC3F,4FAA4F;QAC5F,iCAAiC;QACjC,GAAG,eAAe,IAAI;QACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnB,KAAK,aAAa,IAAI;QACtB,6FAA6F;QAC7F,4EAA4E,CAAC;IAE/E,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}

package/dist/utils/untrustedText.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @module utils/untrustedText
+ *
+ * **The structural delimiters gsloth wraps untrusted text in, and the one function that neutralizes
+ * a forged one.**
+ *
+ * Text that arrived from outside this process — an MCP server's discovery `instructions`, a command
+ * string the model composed from an issue body or a fetched page — is quoted into the model's
+ * context in several places. Wherever it is, the same two things have to be true:
+ *
+ * 1. the quoted text is visibly fenced, so the model can tell data from first-party instruction; and
+ * 2. **the quoted text cannot forge the fence** and escape it.
+ *
+ * (2) is the load-bearing half, and it is why the delimiters and the defang live together in one
+ * module rather than beside each consumer. A second defang written for a second consumer is how one
+ * of them comes to know about a delimiter the other emits: a forged `[END …]` token that the
+ * emitting site happens not to defang closes its fence early and the attacker's lines land OUTSIDE
+ * the boundary, reading as first-party text. {@link defangUntrustedDelimiters} knows **every**
+ * delimiter we emit, so every consumer is protected by every arm.
+ *
+ * **Defang BEFORE wrapping, always.** That ordering is the whole mechanism; wrapping first and
+ * sanitizing after would sanitize a string that already contains the real delimiters.
+ */
+/** The MCP discovery-instructions fence (EXT-32), emitted by `utils/systemPromptNotes.ts`. */
+export declare const MCP_FENCE_BEGIN = "[BEGIN MCP SERVER-PROVIDED CONTEXT]";
+export declare const MCP_FENCE_END = "[END MCP SERVER-PROVIDED CONTEXT]";
+/**
+ * EXT-65 — the fence a refused command is quoted back inside, emitted by
+ * `core/shell/abstention.ts`. A command the gate could not parse is frequently a command the model
+ * assembled out of text it read somewhere, so quoting it back for the model to rewrite is quoting
+ * untrusted bytes into the model's context.
+ */
+export declare const QUOTED_COMMAND_FENCE_BEGIN = "[BEGIN QUOTED COMMAND TEXT]";
+export declare const QUOTED_COMMAND_FENCE_END = "[END QUOTED COMMAND TEXT]";
+/** How much of a refused command is quoted back. Generous; a realistic command is far shorter. */
+export declare const QUOTED_COMMAND_MAX_CHARS = 2000;
+/** Appended when {@link QUOTED_COMMAND_MAX_CHARS} actually clipped the quoted command. */
+export declare const QUOTED_COMMAND_TRUNCATION_MARKER = "\u2026 [truncated]";
+/**
+ * Neutralize every structural delimiter this codebase emits, inside UNTRUSTED text.
+ *
+ * The text is fully attacker-influenceable, so it may forge:
+ *   - either fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
+ *     `[BEGIN|END QUOTED COMMAND TEXT]`) — the bracket run is collapsed so they can no longer be
+ *     read as the real delimiter, while staying legible to a reader who wants to see what was
+ *     attempted; and
+ *   - a per-server label line `--- Server: …` (EXT-32) — the leading `---` run is broken so it
+ *     cannot masquerade as one of ours.
+ *
+ * After this, the ONLY real delimiters in a composed block are the ones the caller emits. Names we
+ * put in our OWN labels come from trusted config keys and are not sanitized — only the untrusted
+ * CONTENT is.
+ *
+ * Whitespace-tolerant (`\s+`, optional bracket padding, `-{3,}`) so trivial spacing variants cannot
+ * slip a delimiter through, and case-insensitive so neither can a lowercase one.
+ */
+export declare function defangUntrustedDelimiters(text: string): string;
+/**
+ * Truncate untrusted text at `maxChars`, SURROGATE-SAFE, appending `marker` only when text was
+ * actually clipped.
+ *
+ * A naive `slice(0, N)` can split a surrogate pair (e.g. an emoji) at the boundary and emit a lone
+ * half-code-unit. If the cut would land between a high and a low surrogate, back off one code unit
+ * so the pair is kept whole (dropped entirely rather than split).
+ */
+export declare function capUntrustedText(text: string, maxChars: number, marker: string): string;

package/dist/utils/untrustedText.js

@@ -0,0 +1,80 @@
+/**
+ * @module utils/untrustedText
+ *
+ * **The structural delimiters gsloth wraps untrusted text in, and the one function that neutralizes
+ * a forged one.**
+ *
+ * Text that arrived from outside this process — an MCP server's discovery `instructions`, a command
+ * string the model composed from an issue body or a fetched page — is quoted into the model's
+ * context in several places. Wherever it is, the same two things have to be true:
+ *
+ * 1. the quoted text is visibly fenced, so the model can tell data from first-party instruction; and
+ * 2. **the quoted text cannot forge the fence** and escape it.
+ *
+ * (2) is the load-bearing half, and it is why the delimiters and the defang live together in one
+ * module rather than beside each consumer. A second defang written for a second consumer is how one
+ * of them comes to know about a delimiter the other emits: a forged `[END …]` token that the
+ * emitting site happens not to defang closes its fence early and the attacker's lines land OUTSIDE
+ * the boundary, reading as first-party text. {@link defangUntrustedDelimiters} knows **every**
+ * delimiter we emit, so every consumer is protected by every arm.
+ *
+ * **Defang BEFORE wrapping, always.** That ordering is the whole mechanism; wrapping first and
+ * sanitizing after would sanitize a string that already contains the real delimiters.
+ */
+/** The MCP discovery-instructions fence (EXT-32), emitted by `utils/systemPromptNotes.ts`. */
+export const MCP_FENCE_BEGIN = '[BEGIN MCP SERVER-PROVIDED CONTEXT]';
+export const MCP_FENCE_END = '[END MCP SERVER-PROVIDED CONTEXT]';
+/**
+ * EXT-65 — the fence a refused command is quoted back inside, emitted by
+ * `core/shell/abstention.ts`. A command the gate could not parse is frequently a command the model
+ * assembled out of text it read somewhere, so quoting it back for the model to rewrite is quoting
+ * untrusted bytes into the model's context.
+ */
+export const QUOTED_COMMAND_FENCE_BEGIN = '[BEGIN QUOTED COMMAND TEXT]';
+export const QUOTED_COMMAND_FENCE_END = '[END QUOTED COMMAND TEXT]';
+/** How much of a refused command is quoted back. Generous; a realistic command is far shorter. */
+export const QUOTED_COMMAND_MAX_CHARS = 2000;
+/** Appended when {@link QUOTED_COMMAND_MAX_CHARS} actually clipped the quoted command. */
+export const QUOTED_COMMAND_TRUNCATION_MARKER = '… [truncated]';
+/**
+ * Neutralize every structural delimiter this codebase emits, inside UNTRUSTED text.
+ *
+ * The text is fully attacker-influenceable, so it may forge:
+ *   - either fence's tokens (`[BEGIN|END MCP SERVER-PROVIDED CONTEXT]`,
+ *     `[BEGIN|END QUOTED COMMAND TEXT]`) — the bracket run is collapsed so they can no longer be
+ *     read as the real delimiter, while staying legible to a reader who wants to see what was
+ *     attempted; and
+ *   - a per-server label line `--- Server: …` (EXT-32) — the leading `---` run is broken so it
+ *     cannot masquerade as one of ours.
+ *
+ * After this, the ONLY real delimiters in a composed block are the ones the caller emits. Names we
+ * put in our OWN labels come from trusted config keys and are not sanitized — only the untrusted
+ * CONTENT is.
+ *
+ * Whitespace-tolerant (`\s+`, optional bracket padding, `-{3,}`) so trivial spacing variants cannot
+ * slip a delimiter through, and case-insensitive so neither can a lowercase one.
+ */
+export function defangUntrustedDelimiters(text) {
+    return text
+        .replace(/\[\s*(BEGIN|END)\s+MCP\s+SERVER-PROVIDED\s+CONTEXT\s*\]/gi, (_m, kw) => `(server text: ${kw.toUpperCase()} MCP SERVER-PROVIDED CONTEXT)`)
+        .replace(/\[\s*(BEGIN|END)\s+QUOTED\s+COMMAND\s+TEXT\s*\]/gi, (_m, kw) => `(quoted text: ${kw.toUpperCase()} QUOTED COMMAND TEXT)`)
+        .replace(/-{3,}(\s*Server\s*:)/gi, '- - -$1');
+}
+/**
+ * Truncate untrusted text at `maxChars`, SURROGATE-SAFE, appending `marker` only when text was
+ * actually clipped.
+ *
+ * A naive `slice(0, N)` can split a surrogate pair (e.g. an emoji) at the boundary and emit a lone
+ * half-code-unit. If the cut would land between a high and a low surrogate, back off one code unit
+ * so the pair is kept whole (dropped entirely rather than split).
+ */
+export function capUntrustedText(text, maxChars, marker) {
+    if (text.length <= maxChars)
+        return text;
+    let end = maxChars;
+    const code = text.charCodeAt(end - 1);
+    if (code >= 0xd800 && code <= 0xdbff)
+        end -= 1; // don't split a surrogate pair
+    return `${text.slice(0, end).trimEnd()}\n${marker}`;
+}
+//# sourceMappingURL=untrustedText.js.map

package/dist/utils/untrustedText.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrustedText.js","sourceRoot":"","sources":["../../src/utils/untrustedText.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,IAAI;SACR,OAAO,CACN,2DAA2D,EAC3D,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,+BAA+B,CACrF;SACA,OAAO,CACN,mDAAmD,EACnD,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAC7E;SACA,OAAO,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;IAC7E,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC,CAAC,+BAA+B;IAC/E,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gaunt-sloth/core",
-  "version": "2.0.0-alpha.26",
+  "version": "2.0.0-alpha.28",
   "description": "Core utilities and types for Gaunt Sloth",
   "license": "MIT",
   "author": "Andrew Kondratev",
@@ -35,6 +35,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "langchain": "^1.5.4",
+    "string-width": "^8.2.2",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -44,6 +45,7 @@
     "@langchain/groq": "^1.3.0",
     "@langchain/ollama": "^1.3.0",
     "@langchain/openai": "^1.5.1",
+    "@langchain/openrouter": "^0.4.5",
     "@langchain/xai": "^1.4.1"
   },
   "peerDependenciesMeta": {
@@ -65,6 +67,9 @@
     "@langchain/openai": {
       "optional": true
     },
+    "@langchain/openrouter": {
+      "optional": true
+    },
     "@langchain/xai": {
       "optional": true
     }

package/schema/gsloth-config.schema.json

@@ -615,7 +615,9 @@
     "mcpServers": {
       "type": "object",
       "propertyNames": {
-        "type": "string"
+        "type": "string",
+        "minLength": 1,
+        "pattern": "^([^*]|[\\s\\S]{2,})$"
       },
       "additionalProperties": {}
     },