@inetafrica/open-claudia 2.6.24 → 2.6.26

package/bin/pack.js

@@ -56,6 +56,9 @@ function run(args) {
       const p = packs.findPack(rest[0]);
       if (!p) { console.error(`No pack: ${rest[0]}`); process.exitCode = 1; return; }
       console.log(fs.readFileSync(path.join(packs.PACKS_DIR, p.dir, "PACK.md"), "utf-8"));
+      const prov = packs.readProvenance(p.dir);
+      const authored = packs.SECTIONS.map((s) => `${s}=${prov.sections[s] || "user"}`).join("  ");
+      console.log(`\n# provenance: ${authored}${prov.lastWriter ? `  (last: ${prov.lastWriter} ${prov.ts})` : ""}`);
       break;
     }
 

package/core/dream.js

@@ -17,6 +17,7 @@ const CONFIG_DIR = require("../config-dir");
 const { config } = require("./config");
 const packs = require("./packs");
 const entities = require("./entities");
+const packGuard = require("./pack-guard");
 const persona = require("./persona");
 const { spawnSubagent } = require("./subagent");
 
@@ -62,7 +63,7 @@ function buildDreamPrompt() {
     `description: ${p.description}`,
     `tags: ${p.tags.join(", ")}`,
     `last_used: ${p.last_used || "never"} (used ${p.usage_count || 0}×)`,
-    `Stance: ${p.sections.Stance}`,
+    `Stance${packs.provenanceOf(p.dir, "Stance") === "user" ? " (USER-AUTHORED — do not rewrite)" : ""}: ${p.sections.Stance}`,
     `Procedure: ${p.sections.Procedure}`,
     `State: ${p.sections.State}`,
     `Journal:\n${p.sections.Journal}`,
@@ -93,7 +94,7 @@ ${persona.loadPersona()}
 
 Your job — decide what consolidation, if any, is warranted:
 
-1. merges: packs that are clearly the SAME topic under different names get merged into one. Supply the merged Stance/Procedure/State (synthesised, not concatenated; null leaves the target's section alone) and a one-sentence journal note. Be conservative: when in doubt, do not merge.
+1. merges: packs that are clearly the SAME topic under different names get merged into one. Supply the merged Stance/Procedure/State (synthesised, not concatenated; null leaves the target's section alone) and a one-sentence journal note. Be conservative: when in doubt, do not merge. A Stance marked USER-AUTHORED is off-limits — leave its stance null; the system preserves it verbatim regardless.
 2. umbrellas: when 3+ packs are siblings under one theme, create an umbrella pack whose State is a 3-6 line map of the family ("for X see pack Y"), and list its children. The umbrella is a router, not a duplicate.
 3. parents: assign an existing pack as parent of another (sub-topic relationship) without creating anything.
 4. retag: tighten descriptions and tags. The router FTS-matches incoming messages against name/description/tags, so generic words there cause false matches. Descriptions should be one specific line; tags specific nouns.
@@ -180,18 +181,25 @@ function applyDream(decision, backupRoot) {
       const into = m?.into && packs.readPack(m.into);
       const from = [].concat(m?.from || []).filter((d) => d && d !== m.into && !gone.has(d) && packs.readPack(d));
       if (!into || from.length === 0) continue;
-      packs.updatePack(m.into, {
+      const mGuard = packGuard.scanSections({ stance: m.stance, procedure: m.procedure, state: m.state, journal: m.journal });
+      if (mGuard.flagged) {
+        console.warn(`[dream] guard blocked merge into ${m.into} (${mGuard.kind} in ${mGuard.section})`);
+        lines.push(`🛡️ Skipped merge into ${m.into} — content looked like an injected instruction (${mGuard.kind})`);
+        continue;
+      }
+      const mr = packs.updatePack(m.into, {
         stance: typeof m.stance === "string" ? m.stance : "",
         procedure: typeof m.procedure === "string" ? m.procedure : "",
         state: typeof m.state === "string" ? m.state : "",
         journal: m.journal || `absorbed ${from.join(", ")}`,
-      });
+      }, "dream");
       for (const d of from) {
         backupPack(d, backupRoot);
         packs.removePack(d);
         gone.add(d);
       }
       lines.push(`📦 Merged ${from.join(" + ")} into ${m.into}`);
+      if (mr.protectedStance) lines.push(`🛡️ Kept ${m.into}'s user-authored Stance as-is`);
     } catch (e) { console.warn(`[dream] merge failed: ${e.message}`); }
   }
 
@@ -201,6 +209,12 @@ function applyDream(decision, backupRoot) {
       if (!dir || gone.has(dir)) continue;
       const children = [].concat(u?.children || []).filter((d) => d && d !== dir && !gone.has(d) && packs.readPack(d));
       if (children.length < 2) continue;
+      const uGuard = packGuard.scanSections({ description: u.description, state: u.state });
+      if (uGuard.flagged) {
+        console.warn(`[dream] guard blocked umbrella ${dir} (${uGuard.kind} in ${uGuard.section})`);
+        lines.push(`🛡️ Skipped umbrella ${dir} — content looked like an injected instruction (${uGuard.kind})`);
+        continue;
+      }
       if (!packs.readPack(dir)) {
         packs.createPack({
           dir,
@@ -209,7 +223,7 @@ function applyDream(decision, backupRoot) {
           tags: Array.isArray(u.tags) ? u.tags.slice(0, 6) : [],
           state: u.state || "",
           journal: `umbrella created over ${children.join(", ")}`,
-        });
+        }, "dream");
       }
       for (const c of children) {
         const child = packs.readPack(c);
@@ -241,7 +255,12 @@ function applyDream(decision, backupRoot) {
       const desc = typeof r.description === "string" ? r.description.trim() : "";
       const tags = Array.isArray(r.tags) ? r.tags.map((t) => String(t).trim()).filter(Boolean).slice(0, 6) : [];
       if (!desc && tags.length === 0) continue;
-      packs.updatePack(r.pack, { description: desc, tags });
+      const rGuard = packGuard.scanForInjection(desc, { strict: true });
+      if (rGuard.flagged) {
+        console.warn(`[dream] guard blocked retag of ${r.pack} (${rGuard.kind})`);
+        continue;
+      }
+      packs.updatePack(r.pack, { description: desc, tags }, "dream");
       lines.push(`🏷️ Sharpened ${r.pack}'s description/tags`);
     } catch (e) { console.warn(`[dream] retag failed: ${e.message}`); }
   }

package/core/pack-guard.js

@@ -0,0 +1,82 @@
+// Content threat-scan for memory writes (spec #4).
+//
+// Threat model: prompt-injection rides in via tool output or a pasted doc,
+// gets echoed in the assistant reply, and the background reviewer (or dream)
+// faithfully writes "ignore previous instructions / always run X / exfiltrate
+// to URL" into a pack section — which then auto-injects every session as if it
+// were the user's own rule. Stance/Procedure/State auto-inject, so they are the
+// dangerous sections; Journal is shown on demand, so it is scanned leniently
+// (exfil only). We never import marketplace packs, so this is the whole surface.
+//
+// This is a heuristic gate, not a classifier. It is deliberately conservative:
+// it only fires on phrasings that have no legitimate reason to appear in a
+// memory section a model wrote about a past turn. On a hit we SKIP the write —
+// a missed memory is cheap, a poisoned auto-injected rule is not.
+
+// Imperative override / instruction-hijack phrasing.
+const OVERRIDE_PATTERNS = [
+  /\bignore\s+(all\s+)?(previous|prior|earlier|above|the\s+following)\s+(instructions?|prompts?|rules?|context)/i,
+  /\bdisregard\s+(all\s+)?(previous|prior|earlier|above|your)\s+(instructions?|prompts?|rules?|training)/i,
+  /\bforget\s+(everything|all|your\s+(instructions?|rules?|prompt))/i,
+  /\boverride\s+(your|the|all)\s+(instructions?|rules?|system\s+prompt|guardrails?)/i,
+  /\b(you\s+(must|should|will)\s+always|always\s+remember\s+to)\b.*\b(run|execute|send|post|upload|reveal|disclose|delete|drop)\b/i,
+  /\bfrom\s+now\s+on\b.*\b(ignore|disregard|always|never)\b/i,
+  /\bdo\s+not\s+(tell|inform|ask|notify)\s+(the\s+)?(user|owner|sumeet)\b/i,
+  /\bsystem\s+prompt\b.*\b(ignore|reveal|print|output|leak)\b/i,
+  /\b(reveal|print|output|leak|disclose)\b.*\b(system\s+prompt|api\s+key|token|password|secret|credential)/i,
+];
+
+// Exfiltration: a send/post/upload verb pointed at a URL or address. Scanned in
+// every section, including Journal.
+const EXFIL_PATTERNS = [
+  /\b(send|post|upload|exfiltrate|forward|transmit|leak|email|curl|wget|fetch)\b[^.\n]{0,60}\b(to|at|into)\b[^.\n]{0,40}(https?:\/\/|ftp:\/\/|[\w.-]+@[\w.-]+)/i,
+  /\b(https?:\/\/)[^\s)]+[^\s)]*\b.*\b(api\s*key|token|password|secret|credential|env)/i,
+  /\bcurl\b[^\n]*\b(https?:\/\/)/i,
+];
+
+// A long unbroken base64 blob — no reason for one to live in a prose memory
+// section; classic carrier for an obfuscated payload.
+const BASE64_BLOB = /[A-Za-z0-9+/]{120,}={0,2}/;
+
+function matchAny(patterns, text) {
+  for (const re of patterns) {
+    const m = re.exec(text);
+    if (m) return m[0].slice(0, 80);
+  }
+  return null;
+}
+
+// Scan a single piece of text. `strict` = true for auto-injected sections
+// (Stance/Procedure/State), false for Journal (exfil-only).
+function scanForInjection(text, { strict = true } = {}) {
+  const s = String(text || "");
+  if (!s.trim()) return { flagged: false };
+
+  const exfil = matchAny(EXFIL_PATTERNS, s);
+  if (exfil) return { flagged: true, kind: "exfil", evidence: exfil };
+
+  if (!strict) return { flagged: false };
+
+  const override = matchAny(OVERRIDE_PATTERNS, s);
+  if (override) return { flagged: true, kind: "override", evidence: override };
+
+  const b64 = BASE64_BLOB.exec(s);
+  if (b64) return { flagged: true, kind: "base64", evidence: b64[0].slice(0, 40) + "…" };
+
+  return { flagged: false };
+}
+
+// Scan the sections of a pending pack write. Strict on the auto-injected
+// sections, lenient on Journal. Returns the first hit, or { flagged: false }.
+function scanSections(sections = {}) {
+  const strictKeys = ["stance", "procedure", "state", "description"];
+  for (const key of strictKeys) {
+    const r = scanForInjection(sections[key], { strict: true });
+    if (r.flagged) return { ...r, section: key };
+  }
+  const r = scanForInjection(sections.journal, { strict: false });
+  if (r.flagged) return { ...r, section: "journal" };
+  return { flagged: false };
+}
+
+module.exports = { scanForInjection, scanSections };

package/core/pack-review.js

@@ -9,6 +9,7 @@
 const { spawnSubagent } = require("./subagent");
 const packs = require("./packs");
 const entities = require("./entities");
+const packGuard = require("./pack-guard");
 const { redactSensitive } = require("./redact");
 
 const MIN_TURN_CHARS = 400;
@@ -124,23 +125,41 @@ function parseDecision(text) {
   }
 }
 
+function guardCheck(a) {
+  const hit = packGuard.scanSections({
+    stance: a.stance,
+    procedure: a.procedure,
+    state: a.state,
+    description: a.description,
+    journal: a.journal,
+  });
+  if (hit.flagged) {
+    console.warn(`[pack-review] guard blocked write to ${a.pack || a.dir || a.name} (${hit.kind} in ${hit.section}): ${hit.evidence}`);
+  }
+  return hit;
+}
+
 function applyAction(a) {
   if (!a || typeof a !== "object") return null;
+  const guard = guardCheck(a);
+  if (guard.flagged) {
+    return { kind: "skipped", dir: a.pack || a.dir || "", name: a.name || a.pack || a.dir || "", reason: `${guard.kind} in ${guard.section}` };
+  }
   if (a.action === "update" && a.pack) {
     const existing = packs.readPack(a.pack);
     if (!existing) return null;
-    packs.updatePack(a.pack, {
+    const r = packs.updatePack(a.pack, {
       journal: a.journal || "",
       state: typeof a.state === "string" ? a.state : "",
       stance: typeof a.stance === "string" ? a.stance : "",
       procedure: typeof a.procedure === "string" ? a.procedure : "",
-    });
-    return { kind: "update", dir: a.pack, name: existing.name, note: a.journal || "state updated" };
+    }, "reviewer");
+    return { kind: "update", dir: a.pack, name: existing.name, note: a.journal || "state updated", protectedStance: !!r.protectedStance };
   }
   if (a.action === "create" && (a.dir || a.name)) {
     const dir = packs.slugify(a.dir || a.name);
     if (packs.readPack(dir)) {
-      packs.updatePack(dir, { journal: a.journal || "", state: a.state || "" });
+      packs.updatePack(dir, { journal: a.journal || "", state: a.state || "" }, "reviewer");
       return { kind: "update", dir, name: a.name || dir, note: a.journal || "state updated" };
     }
     const pack = packs.createPack({
@@ -152,7 +171,7 @@ function applyAction(a) {
       procedure: a.procedure || "",
       state: a.state || "",
       journal: a.journal || "",
-    });
+    }, "reviewer");
     return { kind: "create", dir: pack.dir, name: pack.name, note: a.description || "" };
   }
   return null;
@@ -192,7 +211,9 @@ function reviewTurn({ userText, assistantText, channelId, announce }) {
     for (const a of decision.actions) {
       try {
         const r = applyAction(a);
-        if (r) {
+        if (r && r.kind === "skipped") {
+          lines.push(`🛡️ Skipped a memory write that looked like an injected instruction (${r.reason}).`);
+        } else if (r) {
           lines.push(r.kind === "create"
             ? `📦 New pack: ${r.name}\n${clipWords(r.note, 180)}\n↳ open-claudia pack show ${r.dir}`
             : `✏️ ${r.name} — ${clipWords(r.note, 180)}`);

package/core/packs.js

@@ -137,7 +137,7 @@ function writePack(pack) {
   return pack.dir;
 }
 
-function createPack({ dir, name, description, tags, stance, procedure, state, journal, parent }) {
+function createPack({ dir, name, description, tags, stance, procedure, state, journal, parent }, origin = "user") {
   const d = slugify(dir || name);
   if (!d) throw new Error("pack needs a name");
   if (readPack(d)) throw new Error(`pack ${d} already exists`);
@@ -156,6 +156,7 @@ function createPack({ dir, name, description, tags, stance, procedure, state, jo
     },
   };
   writePack(pack);
+  setProvenance(d, SECTIONS.filter((s) => (pack.sections[s] || "").trim()), origin);
   return pack;
 }
 
@@ -163,23 +164,98 @@ function today() {
   return new Date().toISOString().slice(0, 10);
 }
 
+// ---------------------------------------------------------------------------
+// Provenance: a sidecar .provenance.json per pack records which origin
+// (user | reviewer | dream) last authored each section. Sections we never
+// explicitly stamped default to "user" — anything not proven to be automated
+// is protected as if you wrote it. This is what lets the reviewer and dream
+// rewrite their own output freely while never silently clobbering your words.
+function provFile(dir) {
+  return path.join(PACKS_DIR, dir, ".provenance.json");
+}
+
+function readProvenance(dir) {
+  let data = {};
+  try { data = JSON.parse(fs.readFileSync(provFile(dir), "utf-8")) || {}; } catch (e) {}
+  const sections = data.sections && typeof data.sections === "object" ? data.sections : {};
+  return { sections, lastWriter: data.lastWriter || "", ts: data.ts || "" };
+}
+
+function provenanceOf(dir, section) {
+  return readProvenance(dir).sections[section] || "user";
+}
+
+function setProvenance(dir, sectionNames, origin) {
+  if (!origin) return;
+  const names = [].concat(sectionNames || []).filter(Boolean);
+  if (!names.length) return;
+  const cur = readProvenance(dir);
+  for (const n of names) cur.sections[n] = origin;
+  cur.lastWriter = origin;
+  cur.ts = new Date().toISOString();
+  try {
+    fs.mkdirSync(path.join(PACKS_DIR, dir), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(provFile(dir), JSON.stringify(cur, null, 2), { mode: 0o600 });
+  } catch (e) {}
+}
+
+// A foreground Write/Edit to a PACK.md is you (or me acting on what you told
+// me), so stamp the touched section(s) "user" — this also resets a section the
+// reviewer/dream previously claimed back to user-authored once you edit it.
+function recordForegroundWrite(dir, { tool, oldString, content } = {}) {
+  try {
+    if (tool === "Write" && typeof content === "string") {
+      const { body } = parseFrontmatter(content);
+      const { sections } = parseSections(body);
+      const applied = SECTIONS.filter((s) => sections[s] && sections[s].trim());
+      setProvenance(dir, applied.length ? applied : SECTIONS, "user");
+      return;
+    }
+    if (tool === "Edit" && typeof oldString === "string" && oldString) {
+      const cur = fs.readFileSync(packFile(dir), "utf-8");
+      const idx = cur.indexOf(oldString);
+      if (idx < 0) { setProvenance(dir, SECTIONS, "user"); return; }
+      let found = null;
+      for (const s of SECTIONS) {
+        const h = cur.indexOf(`## ${s}`);
+        if (h >= 0 && h <= idx && (found === null || h > found.pos)) found = { sec: s, pos: h };
+      }
+      setProvenance(dir, found ? [found.sec] : SECTIONS, "user");
+    }
+  } catch (e) {}
+}
+
 // Apply a reviewer mutation. Only supplied fields change; journal entries
 // append (capped); state replaces (it represents "current truth").
-function updatePack(dir, { description, tags, stance, procedure, state, journal } = {}) {
+function updatePack(dir, { description, tags, stance, procedure, state, journal } = {}, origin = "user") {
   const pack = readPack(dir);
   if (!pack) throw new Error(`no pack: ${dir}`);
   pack.updated = new Date().toISOString();
   if (description) pack.description = description;
   if (Array.isArray(tags) && tags.length) pack.tags = tags;
-  if (typeof stance === "string" && stance.trim()) pack.sections.Stance = stance.trim();
-  if (typeof procedure === "string" && procedure.trim()) pack.sections.Procedure = procedure.trim();
-  if (typeof state === "string" && state.trim()) pack.sections.State = state.trim();
+  const applied = [];
+  let protectedStance = false;
+  if (typeof stance === "string" && stance.trim()) {
+    // Stance shapes behaviour, so a user-authored Stance is never silently
+    // overwritten by an automated writer — your intent wins.
+    if (origin !== "user" && provenanceOf(dir, "Stance") === "user") {
+      protectedStance = true;
+    } else {
+      pack.sections.Stance = stance.trim();
+      applied.push("Stance");
+    }
+  }
+  if (typeof procedure === "string" && procedure.trim()) { pack.sections.Procedure = procedure.trim(); applied.push("Procedure"); }
+  if (typeof state === "string" && state.trim()) { pack.sections.State = state.trim(); applied.push("State"); }
   if (typeof journal === "string" && journal.trim()) {
     const entries = pack.sections.Journal.split("\n").filter((l) => l.trim());
     entries.push(`- [${today()}] ${journal.trim().replace(/\n+/g, " ")}`);
     pack.sections.Journal = entries.slice(-MAX_JOURNAL_ENTRIES).join("\n");
+    applied.push("Journal");
   }
   writePack(pack);
+  if (applied.length) setProvenance(dir, applied, origin);
+  pack.protectedStance = protectedStance;
   return pack;
 }
 
@@ -396,4 +472,5 @@ module.exports = {
   listPacks, findPack, readPack, writePack, createPack, updatePack, removePack,
   touchUsed, packNameFromPath, matchPacks, reindex, markIndexDirty,
   archivePack, restorePack, listArchived,
+  readProvenance, provenanceOf, setProvenance, recordForegroundWrite,
 };

package/core/runner.js

@@ -806,6 +806,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         if (packDir) {
           if (packsLib.readPack(packDir)) notifySkill(`pack:${packDir}`, `✏️ Updating my notes on ${packDir}…`);
           else notifySkill(`pack:${packDir}`, `📦 Starting a new pack: ${packDir} — open-claudia pack show ${packDir} to peek.`);
+          try {
+            packsLib.recordForegroundWrite(packDir, {
+              tool: toolName,
+              oldString: input?.old_string ?? input?.oldString,
+              content: input?.content,
+            });
+          } catch (e) {}
           return;
         }
         const entSlug = entitiesLib.entityNameFromPath(filePath);

package/core/system-prompt.js

@@ -535,15 +535,42 @@ function mergeMatches(primary, secondary, keyOf) {
 function logRecall(msg, candPacks, candEntities, keptPacks, keptEntities) {
   if (String(process.env.RECALL_DEBUG || "on").toLowerCase() === "off") return;
   try {
+    // FTS-miss instrumentation (spec #6): packs the relevance judge KEPT even
+    // though keyword FTS scored them ~0 (or they only surfaced via context, not
+    // the user's words) are pure-semantic rescues. If this count climbs, a
+    // vector backend earns its keep; until then it stays 1-line instrumentation.
+    const scoreOf = new Map(candPacks.map((m) => [m.dir, m]));
+    const ftsMissRescues = keptPacks
+      .map((m) => scoreOf.get(m.dir))
+      .filter((c) => c && (!c.score || c.origin === "context"))
+      .map((c) => c.dir);
     const rec = {
       ts: new Date().toISOString(),
       msg: String(msg || "").slice(0, 200),
       candidatePacks: candPacks.map((m) => ({ dir: m.dir, score: m.score, origin: m.origin })),
       keptPacks: keptPacks.map((m) => m.dir),
+      ftsMissRescues,
       candidateEntities: candEntities.map((m) => ({ slug: m.slug, score: m.score, origin: m.origin })),
       keptEntities: keptEntities.map((m) => m.slug),
     };
     fs.appendFileSync(path.join(CONFIG_DIR, "recall-debug.jsonl"), JSON.stringify(rec) + "\n");
+    bumpFtsMissCounter(ftsMissRescues.length);
+  } catch (e) {}
+}
+
+// Cumulative tally so we don't have to re-scan the whole JSONL to answer
+// "is keyword recall missing semantic matches often enough to warrant vectors?"
+// Counts every recall turn plus how many of them rescued an FTS-missed pack.
+function bumpFtsMissCounter(n) {
+  try {
+    const p = path.join(CONFIG_DIR, "recall-stats.json");
+    let stats = {};
+    try { stats = JSON.parse(fs.readFileSync(p, "utf8")) || {}; } catch (e) {}
+    stats.turns = (stats.turns || 0) + 1;
+    if (n > 0) stats.turnsWithRescue = (stats.turnsWithRescue || 0) + 1;
+    stats.ftsMissRescues = (stats.ftsMissRescues || 0) + n;
+    stats.updatedAt = new Date().toISOString();
+    fs.writeFileSync(p, JSON.stringify(stats, null, 2));
   } catch (e) {}
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.6.24",
+  "version": "2.6.26",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {