@inetafrica/open-claudia 2.6.25 → 2.6.26

package/core/dream.js

@@ -17,6 +17,7 @@ const CONFIG_DIR = require("../config-dir");
 const { config } = require("./config");
 const packs = require("./packs");
 const entities = require("./entities");
+const packGuard = require("./pack-guard");
 const persona = require("./persona");
 const { spawnSubagent } = require("./subagent");
 
@@ -180,6 +181,12 @@ function applyDream(decision, backupRoot) {
       const into = m?.into && packs.readPack(m.into);
       const from = [].concat(m?.from || []).filter((d) => d && d !== m.into && !gone.has(d) && packs.readPack(d));
       if (!into || from.length === 0) continue;
+      const mGuard = packGuard.scanSections({ stance: m.stance, procedure: m.procedure, state: m.state, journal: m.journal });
+      if (mGuard.flagged) {
+        console.warn(`[dream] guard blocked merge into ${m.into} (${mGuard.kind} in ${mGuard.section})`);
+        lines.push(`🛡️ Skipped merge into ${m.into} — content looked like an injected instruction (${mGuard.kind})`);
+        continue;
+      }
       const mr = packs.updatePack(m.into, {
         stance: typeof m.stance === "string" ? m.stance : "",
         procedure: typeof m.procedure === "string" ? m.procedure : "",
@@ -202,6 +209,12 @@ function applyDream(decision, backupRoot) {
       if (!dir || gone.has(dir)) continue;
       const children = [].concat(u?.children || []).filter((d) => d && d !== dir && !gone.has(d) && packs.readPack(d));
       if (children.length < 2) continue;
+      const uGuard = packGuard.scanSections({ description: u.description, state: u.state });
+      if (uGuard.flagged) {
+        console.warn(`[dream] guard blocked umbrella ${dir} (${uGuard.kind} in ${uGuard.section})`);
+        lines.push(`🛡️ Skipped umbrella ${dir} — content looked like an injected instruction (${uGuard.kind})`);
+        continue;
+      }
       if (!packs.readPack(dir)) {
         packs.createPack({
           dir,
@@ -242,6 +255,11 @@ function applyDream(decision, backupRoot) {
       const desc = typeof r.description === "string" ? r.description.trim() : "";
       const tags = Array.isArray(r.tags) ? r.tags.map((t) => String(t).trim()).filter(Boolean).slice(0, 6) : [];
       if (!desc && tags.length === 0) continue;
+      const rGuard = packGuard.scanForInjection(desc, { strict: true });
+      if (rGuard.flagged) {
+        console.warn(`[dream] guard blocked retag of ${r.pack} (${rGuard.kind})`);
+        continue;
+      }
       packs.updatePack(r.pack, { description: desc, tags }, "dream");
       lines.push(`🏷️ Sharpened ${r.pack}'s description/tags`);
     } catch (e) { console.warn(`[dream] retag failed: ${e.message}`); }

package/core/pack-guard.js

@@ -0,0 +1,82 @@
+// Content threat-scan for memory writes (spec #4).
+//
+// Threat model: prompt-injection rides in via tool output or a pasted doc,
+// gets echoed in the assistant reply, and the background reviewer (or dream)
+// faithfully writes "ignore previous instructions / always run X / exfiltrate
+// to URL" into a pack section — which then auto-injects every session as if it
+// were the user's own rule. Stance/Procedure/State auto-inject, so they are the
+// dangerous sections; Journal is shown on demand, so it is scanned leniently
+// (exfil only). We never import marketplace packs, so this is the whole surface.
+//
+// This is a heuristic gate, not a classifier. It is deliberately conservative:
+// it only fires on phrasings that have no legitimate reason to appear in a
+// memory section a model wrote about a past turn. On a hit we SKIP the write —
+// a missed memory is cheap, a poisoned auto-injected rule is not.
+
+// Imperative override / instruction-hijack phrasing.
+const OVERRIDE_PATTERNS = [
+  /\bignore\s+(all\s+)?(previous|prior|earlier|above|the\s+following)\s+(instructions?|prompts?|rules?|context)/i,
+  /\bdisregard\s+(all\s+)?(previous|prior|earlier|above|your)\s+(instructions?|prompts?|rules?|training)/i,
+  /\bforget\s+(everything|all|your\s+(instructions?|rules?|prompt))/i,
+  /\boverride\s+(your|the|all)\s+(instructions?|rules?|system\s+prompt|guardrails?)/i,
+  /\b(you\s+(must|should|will)\s+always|always\s+remember\s+to)\b.*\b(run|execute|send|post|upload|reveal|disclose|delete|drop)\b/i,
+  /\bfrom\s+now\s+on\b.*\b(ignore|disregard|always|never)\b/i,
+  /\bdo\s+not\s+(tell|inform|ask|notify)\s+(the\s+)?(user|owner|sumeet)\b/i,
+  /\bsystem\s+prompt\b.*\b(ignore|reveal|print|output|leak)\b/i,
+  /\b(reveal|print|output|leak|disclose)\b.*\b(system\s+prompt|api\s+key|token|password|secret|credential)/i,
+];
+
+// Exfiltration: a send/post/upload verb pointed at a URL or address. Scanned in
+// every section, including Journal.
+const EXFIL_PATTERNS = [
+  /\b(send|post|upload|exfiltrate|forward|transmit|leak|email|curl|wget|fetch)\b[^.\n]{0,60}\b(to|at|into)\b[^.\n]{0,40}(https?:\/\/|ftp:\/\/|[\w.-]+@[\w.-]+)/i,
+  /\b(https?:\/\/)[^\s)]+[^\s)]*\b.*\b(api\s*key|token|password|secret|credential|env)/i,
+  /\bcurl\b[^\n]*\b(https?:\/\/)/i,
+];
+
+// A long unbroken base64 blob — no reason for one to live in a prose memory
+// section; classic carrier for an obfuscated payload.
+const BASE64_BLOB = /[A-Za-z0-9+/]{120,}={0,2}/;
+
+function matchAny(patterns, text) {
+  for (const re of patterns) {
+    const m = re.exec(text);
+    if (m) return m[0].slice(0, 80);
+  }
+  return null;
+}
+
+// Scan a single piece of text. `strict` = true for auto-injected sections
+// (Stance/Procedure/State), false for Journal (exfil-only).
+function scanForInjection(text, { strict = true } = {}) {
+  const s = String(text || "");
+  if (!s.trim()) return { flagged: false };
+
+  const exfil = matchAny(EXFIL_PATTERNS, s);
+  if (exfil) return { flagged: true, kind: "exfil", evidence: exfil };
+
+  if (!strict) return { flagged: false };
+
+  const override = matchAny(OVERRIDE_PATTERNS, s);
+  if (override) return { flagged: true, kind: "override", evidence: override };
+
+  const b64 = BASE64_BLOB.exec(s);
+  if (b64) return { flagged: true, kind: "base64", evidence: b64[0].slice(0, 40) + "…" };
+
+  return { flagged: false };
+}
+
+// Scan the sections of a pending pack write. Strict on the auto-injected
+// sections, lenient on Journal. Returns the first hit, or { flagged: false }.
+function scanSections(sections = {}) {
+  const strictKeys = ["stance", "procedure", "state", "description"];
+  for (const key of strictKeys) {
+    const r = scanForInjection(sections[key], { strict: true });
+    if (r.flagged) return { ...r, section: key };
+  }
+  const r = scanForInjection(sections.journal, { strict: false });
+  if (r.flagged) return { ...r, section: "journal" };
+  return { flagged: false };
+}
+
+module.exports = { scanForInjection, scanSections };

package/core/pack-review.js

@@ -9,6 +9,7 @@
 const { spawnSubagent } = require("./subagent");
 const packs = require("./packs");
 const entities = require("./entities");
+const packGuard = require("./pack-guard");
 const { redactSensitive } = require("./redact");
 
 const MIN_TURN_CHARS = 400;
@@ -124,8 +125,26 @@ function parseDecision(text) {
   }
 }
 
+function guardCheck(a) {
+  const hit = packGuard.scanSections({
+    stance: a.stance,
+    procedure: a.procedure,
+    state: a.state,
+    description: a.description,
+    journal: a.journal,
+  });
+  if (hit.flagged) {
+    console.warn(`[pack-review] guard blocked write to ${a.pack || a.dir || a.name} (${hit.kind} in ${hit.section}): ${hit.evidence}`);
+  }
+  return hit;
+}
+
 function applyAction(a) {
   if (!a || typeof a !== "object") return null;
+  const guard = guardCheck(a);
+  if (guard.flagged) {
+    return { kind: "skipped", dir: a.pack || a.dir || "", name: a.name || a.pack || a.dir || "", reason: `${guard.kind} in ${guard.section}` };
+  }
   if (a.action === "update" && a.pack) {
     const existing = packs.readPack(a.pack);
     if (!existing) return null;
@@ -192,7 +211,9 @@ function reviewTurn({ userText, assistantText, channelId, announce }) {
     for (const a of decision.actions) {
       try {
         const r = applyAction(a);
-        if (r) {
+        if (r && r.kind === "skipped") {
+          lines.push(`🛡️ Skipped a memory write that looked like an injected instruction (${r.reason}).`);
+        } else if (r) {
           lines.push(r.kind === "create"
             ? `📦 New pack: ${r.name}\n${clipWords(r.note, 180)}\n↳ open-claudia pack show ${r.dir}`
             : `✏️ ${r.name} — ${clipWords(r.note, 180)}`);

package/core/system-prompt.js

@@ -535,15 +535,42 @@ function mergeMatches(primary, secondary, keyOf) {
 function logRecall(msg, candPacks, candEntities, keptPacks, keptEntities) {
   if (String(process.env.RECALL_DEBUG || "on").toLowerCase() === "off") return;
   try {
+    // FTS-miss instrumentation (spec #6): packs the relevance judge KEPT even
+    // though keyword FTS scored them ~0 (or they only surfaced via context, not
+    // the user's words) are pure-semantic rescues. If this count climbs, a
+    // vector backend earns its keep; until then it stays 1-line instrumentation.
+    const scoreOf = new Map(candPacks.map((m) => [m.dir, m]));
+    const ftsMissRescues = keptPacks
+      .map((m) => scoreOf.get(m.dir))
+      .filter((c) => c && (!c.score || c.origin === "context"))
+      .map((c) => c.dir);
     const rec = {
       ts: new Date().toISOString(),
       msg: String(msg || "").slice(0, 200),
       candidatePacks: candPacks.map((m) => ({ dir: m.dir, score: m.score, origin: m.origin })),
       keptPacks: keptPacks.map((m) => m.dir),
+      ftsMissRescues,
       candidateEntities: candEntities.map((m) => ({ slug: m.slug, score: m.score, origin: m.origin })),
       keptEntities: keptEntities.map((m) => m.slug),
     };
     fs.appendFileSync(path.join(CONFIG_DIR, "recall-debug.jsonl"), JSON.stringify(rec) + "\n");
+    bumpFtsMissCounter(ftsMissRescues.length);
+  } catch (e) {}
+}
+
+// Cumulative tally so we don't have to re-scan the whole JSONL to answer
+// "is keyword recall missing semantic matches often enough to warrant vectors?"
+// Counts every recall turn plus how many of them rescued an FTS-missed pack.
+function bumpFtsMissCounter(n) {
+  try {
+    const p = path.join(CONFIG_DIR, "recall-stats.json");
+    let stats = {};
+    try { stats = JSON.parse(fs.readFileSync(p, "utf8")) || {}; } catch (e) {}
+    stats.turns = (stats.turns || 0) + 1;
+    if (n > 0) stats.turnsWithRescue = (stats.turnsWithRescue || 0) + 1;
+    stats.ftsMissRescues = (stats.ftsMissRescues || 0) + n;
+    stats.updatedAt = new Date().toISOString();
+    fs.writeFileSync(p, JSON.stringify(stats, null, 2));
   } catch (e) {}
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.6.25",
+  "version": "2.6.26",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {