atabey 0.0.14 → 0.0.16

package/framework-mcp/dist/framework-mcp/src/tools/shell/run_command.js

@@ -1,102 +1,175 @@
-import { exec } from "child_process";
+import { spawn } from "child_process";
 import { Metrics } from "../../utils/metrics.js";
+import { resolveActiveAgent, getAgentTier } from "../../utils/permissions.js";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import path from "path";
+// Each entry defines the executable and its allowed args prefix
 const COMMAND_ALLOW_LIST = [
     // Package managers
-    "npm test",
-    "npm run",
-    "npm install",
-    "npm ci",
-    "npm audit",
-    "npx vitest",
-    "npx tsc",
-    "npx eslint",
-    "yarn test",
-    "yarn run",
-    "yarn install",
-    "pnpm test",
-    "pnpm run",
-    "pnpm install",
+    { cmd: "npm", args: ["test"] },
+    { cmd: "npm", args: ["run"] },
+    { cmd: "npm", args: ["install"] },
+    { cmd: "npm", args: ["ci"] },
+    { cmd: "npm", args: ["audit"] },
+    { cmd: "npx", args: ["vitest"] },
+    { cmd: "npx", args: ["tsc"] },
+    { cmd: "npx", args: ["eslint"] },
+    { cmd: "yarn", args: ["test"] },
+    { cmd: "yarn", args: ["run"] },
+    { cmd: "yarn", args: ["install"] },
+    { cmd: "pnpm", args: ["test"] },
+    { cmd: "pnpm", args: ["run"] },
+    { cmd: "pnpm", args: ["install"] },
     // Git
-    "git status",
-    "git diff",
-    "git log",
-    "git branch",
-    "git stash",
-    "git add",
-    "git commit",
-    "git push",
-    "git pull",
-    "git fetch",
-    "git merge",
-    "git rebase",
-    "git checkout",
-    "git reset",
+    { cmd: "git", args: ["status"] },
+    { cmd: "git", args: ["diff"] },
+    { cmd: "git", args: ["log"] },
+    { cmd: "git", args: ["branch"] },
+    { cmd: "git", args: ["stash"] },
+    { cmd: "git", args: ["add"] },
+    { cmd: "git", args: ["commit"] },
+    { cmd: "git", args: ["push"] },
+    { cmd: "git", args: ["pull"] },
+    { cmd: "git", args: ["fetch"] },
+    { cmd: "git", args: ["merge"] },
+    { cmd: "git", args: ["rebase"] },
+    { cmd: "git", args: ["checkout"] },
+    { cmd: "git", args: ["reset"] },
     // Build tools
-    "npm run build",
-    "npx tsc",
-    "npx vite build",
-    "npx webpack",
-    "npx rollup",
-    "npx esbuild",
-    "make",
-    "cmake",
-    "dotnet test",
-    "dotnet format",
-    "dotnet build",
-    "dotnet run",
-    "dotnet restore",
-    "go test",
-    "go fmt",
-    "go build",
-    "go run",
-    "go vet",
-    "go mod",
-    "pytest",
-    "ruff check",
-    "ruff format",
-    "mvn",
-    "./gradlew",
-    "cargo test",
-    "cargo build",
-    "cargo check",
-    "cargo fmt",
-    // File operations (safe) — NOTE: "rm -rf" and "rm -r" intentionally excluded.
-    // Only "rmdir" is allowed to prevent dangerous commands like "rm -rf /".
-    "mkdir",
-    "cp",
-    "mv",
-    "rmdir",
-    "cat",
-    "ls",
-    "touch",
-    "head",
-    "tail",
-    "wc",
-    "grep",
-    "find",
-    "sort",
-    "uniq",
-    "echo",
-    "pwd",
-    "which",
-    "file",
-    "du",
-    "df",
+    { cmd: "make" },
+    { cmd: "cmake" },
+    { cmd: "dotnet", args: ["test"] },
+    { cmd: "dotnet", args: ["format"] },
+    { cmd: "dotnet", args: ["build"] },
+    { cmd: "dotnet", args: ["run"] },
+    { cmd: "dotnet", args: ["restore"] },
+    { cmd: "go", args: ["test"] },
+    { cmd: "go", args: ["fmt"] },
+    { cmd: "go", args: ["build"] },
+    { cmd: "go", args: ["run"] },
+    { cmd: "go", args: ["vet"] },
+    { cmd: "go", args: ["mod"] },
+    { cmd: "pytest" },
+    { cmd: "ruff", args: ["check"] },
+    { cmd: "ruff", args: ["format"] },
+    { cmd: "mvn" },
+    { cmd: "./gradlew" },
+    { cmd: "cargo", args: ["test"] },
+    { cmd: "cargo", args: ["build"] },
+    { cmd: "cargo", args: ["check"] },
+    { cmd: "cargo", args: ["fmt"] },
+    // File operations (safe) — spawn prevents shell injection
+    { cmd: "mkdir" },
+    { cmd: "cp" },
+    { cmd: "mv" },
+    { cmd: "rmdir" },
+    { cmd: "cat" },
+    { cmd: "ls" },
+    { cmd: "touch" },
+    { cmd: "head" },
+    { cmd: "tail" },
+    { cmd: "wc" },
+    { cmd: "grep" },
+    { cmd: "find" },
+    { cmd: "sort" },
+    { cmd: "uniq" },
+    { cmd: "echo" },
+    { cmd: "pwd" },
+    { cmd: "which" },
+    { cmd: "file" },
+    { cmd: "du" },
+    { cmd: "df" },
 ];
-const TIMEOUT = 30000; // 30 seconds
+const TIMEOUT = parseInt(process.env.MCP_COMMAND_TIMEOUT_MS || "30000", 10);
+/**
+ * Checks if a parsed command represents a state-mutating (write) operation.
+ */
+function isWriteCommand(parsed) {
+    const cmd = parsed.cmd;
+    const firstArg = parsed.args[0] || "";
+    const writeCmds = ["mkdir", "cp", "mv", "rmdir", "touch", "make", "cmake", "./gradlew", "mvn"];
+    if (writeCmds.includes(cmd))
+        return true;
+    if (cmd === "npm" && ["install", "ci", "audit", "run"].includes(firstArg))
+        return true;
+    if (cmd === "yarn" && ["install", "run"].includes(firstArg))
+        return true;
+    if (cmd === "pnpm" && ["install", "run"].includes(firstArg))
+        return true;
+    if (cmd === "git" && ["add", "commit", "push", "pull", "merge", "rebase", "checkout", "reset"].includes(firstArg))
+        return true;
+    if (cmd === "dotnet" && ["build", "run", "restore"].includes(firstArg))
+        return true;
+    if (cmd === "go" && ["build", "run", "mod"].includes(firstArg))
+        return true;
+    if (cmd === "cargo" && ["build", "check"].includes(firstArg))
+        return true;
+    return false;
+}
+/**
+ * Parse a command string into executable + args array.
+ * Uses spawn for safety (no shell injection).
+ */
+function parseCommand(cmdString) {
+    const parts = cmdString.trim().split(/\s+/);
+    if (parts.length === 0)
+        return null;
+    return { cmd: parts[0], args: parts.slice(1) };
+}
+/**
+ * Check if a parsed command matches the allow list.
+ */
+function isAllowed(parsed) {
+    return COMMAND_ALLOW_LIST.some(entry => {
+        if (entry.cmd !== parsed.cmd)
+            return false;
+        if (!entry.args)
+            return true; // Any args allowed for this cmd
+        if (!parsed.args || parsed.args.length < entry.args.length)
+            return false;
+        // Check that args start with the allowed prefix
+        return entry.args.every((arg, i) => parsed.args[i] === arg);
+    });
+}
 export function handleRunCommand(projectRoot, args) {
     const command = args.command;
-    const isAllowed = COMMAND_ALLOW_LIST.some(allowedCmd => command.startsWith(allowedCmd));
-    if (!isAllowed) {
-        const errorMsg = `Command not allowed: "${command}". Only commands starting with the following are allowed: ${COMMAND_ALLOW_LIST.join(", ")}`;
+    // Parse command into executable + args
+    const parsed = parseCommand(command);
+    if (!parsed) {
+        return Promise.resolve({
+            content: [{ type: "text", text: "ERROR: Empty command." }],
+            isError: true,
+        });
+    }
+    // Resolve active agent and tier to check command permission
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const absoluteFrameworkPath = path.isAbsolute(frameworkDir)
+        ? frameworkDir
+        : path.resolve(projectRoot, frameworkDir);
+    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
+    if (activeAgent) {
+        const tier = getAgentTier(activeAgent);
+        if (tier === "recon" && isWriteCommand(parsed)) {
+            return Promise.resolve({
+                isError: true,
+                content: [{
+                        type: "text",
+                        text: `[RBAC] Permission Denied: Agent ${activeAgent} (tier: recon) is not allowed to run write/build command "${command}". Recon agents are restricted to read-only commands.`
+                    }]
+            });
+        }
+    }
+    if (!isAllowed(parsed)) {
+        const allowedList = COMMAND_ALLOW_LIST.map(e => e.args ? `${e.cmd} ${e.args.join(" ")}` : e.cmd);
+        const errorMsg = `Command not allowed: "${command}". Only the following are allowed: ${allowedList.join(", ")}`;
         Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command} (denied)`, errorMsg);
         return Promise.resolve({
             content: [{ type: "text", text: `ERROR: ${errorMsg}` }],
             isError: true,
         });
     }
-    // Harden to prevent shell command injection / chaining
-    const hasShellMetacharacters = /[;&|><$`\n\r]/.test(command);
+    // Reject any args containing shell metacharacters
+    const hasShellMetacharacters = parsed.args.some(a => /[;&|><$`\n\r]/.test(a));
     if (hasShellMetacharacters) {
         const errorMsg = "Command rejected: Shell metacharacters are forbidden to prevent command injection.";
         Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command} (denied: metacharacters)`, errorMsg);
@@ -106,12 +179,30 @@ export function handleRunCommand(projectRoot, args) {
         });
     }
     return new Promise((resolve) => {
-        exec(command, { cwd: projectRoot, timeout: TIMEOUT }, (error, stdout, stderr) => {
+        const child = spawn(parsed.cmd, parsed.args, {
+            cwd: projectRoot,
+            timeout: TIMEOUT,
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => { stdout += data.toString(); });
+        child.stderr.on("data", (data) => { stderr += data.toString(); });
+        child.on("error", (err) => {
+            const errorMsg = `Failed to start command: ${err.message}`;
+            Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command}`, errorMsg);
+            resolve({
+                content: [{ type: "text", text: `ERROR: ${errorMsg}` }],
+                isError: true,
+            });
+        });
+        child.on("close", (code) => {
             const output = stdout + stderr;
             const tokens = Metrics.estimateTokens(output);
             Metrics.logUsage(projectRoot, "@mcp", `run_shell_command: ${command}`, tokens);
-            if (error) {
-                const errorMsg = `Command failed with exit code ${error.code}: ${error.message}.`;
+            if (code !== 0) {
+                const errorMsg = `Command failed with exit code ${code}.`;
                 Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command}`, errorMsg);
                 resolve({
                     content: [{ type: "text", text: `ERROR: ${errorMsg}. Output: ${output}` }],
@@ -121,11 +212,12 @@ export function handleRunCommand(projectRoot, args) {
             }
             // Truncate long outputs
             const MAX_OUTPUT_LENGTH = 5000;
-            let truncatedOutput = output;
-            if (output.length > MAX_OUTPUT_LENGTH) {
-                truncatedOutput = output.substring(0, MAX_OUTPUT_LENGTH) + "... [TRUNCATED] ..."; // Simplified
-            }
-            resolve({ content: [{ type: "text", text: truncatedOutput }] });
+            const truncatedOutput = output.length > MAX_OUTPUT_LENGTH
+                ? output.substring(0, MAX_OUTPUT_LENGTH) + "... [TRUNCATED] ..."
+                : output;
+            resolve({
+                content: [{ type: "text", text: truncatedOutput }],
+            });
         });
     });
 }

package/framework-mcp/dist/framework-mcp/src/utils/auth.js

@@ -5,12 +5,18 @@
  * When MCP_AUTH_TOKEN is set, all MCP and API requests require
  * Authorization: Bearer <token> header.
  *
+ * Supports multi-user setup via MCP_AUTH_USERS:
+ *   MCP_AUTH_USERS=alice:key1,bob:key2,cmdr:key3
+ *
+ * Each user gets their own API key. Tool calls and audit logs
+ * are tagged with the authenticated user's name.
+ *
  * Environment Variables:
- *   MCP_AUTH_TOKEN     - API key for authentication (optional)
+ *   MCP_AUTH_TOKEN     - Master API key for admin access (optional)
  *   MCP_AUTH_USERS     - Comma-separated list of user:token pairs (optional)
  *                        Example: "alice:key1,bob:key2"
  *
- * If neither is set, authentication is disabled (open access).
+ * If neither is set, authentication is disabled (open access / anonymous).
  */
 let authUsers = [];
 let masterToken = null;
@@ -27,14 +33,14 @@ export function initAuth() {
         }).filter(u => u.token);
     }
     if (masterToken) {
-        console.error(`[AUTH] Master token configured (${masterToken.length} chars)`);
+        process.stderr.write(`[AUTH] Master token configured (${masterToken.length} chars)\n`);
     }
     if (authUsers.length > 0) {
-        console.error(`[AUTH] ${authUsers.length} user(s) configured: ${authUsers.map(u => u.name).join(", ")}`);
+        process.stderr.write(`[AUTH] ${authUsers.length} user(s) configured: ${authUsers.map(u => u.name).join(", ")}\n`);
     }
     if (!masterToken && authUsers.length === 0) {
-        console.error("[AUTH] No authentication configured - OPEN ACCESS");
-        console.error("[AUTH] Set MCP_AUTH_TOKEN=<key> or MCP_AUTH_USERS=user1:key1,user2:key2 to enable");
+        process.stderr.write("[AUTH] No authentication configured - OPEN ACCESS (anonymous users)\n");
+        process.stderr.write("[AUTH] Set MCP_AUTH_TOKEN=<key> or MCP_AUTH_USERS=user1:key1,user2:key2 to enable\n");
     }
 }
 /**
@@ -43,7 +49,7 @@ export function initAuth() {
  */
 export function authenticate(req) {
     if (!masterToken && authUsers.length === 0) {
-        // Auth disabled - allow all
+        // Auth disabled - allow all as anonymous
         return { authenticated: true, user: "anonymous" };
     }
     const authHeader = req.headers["authorization"];
@@ -64,6 +70,53 @@ export function authenticate(req) {
     }
     return { authenticated: false, user: "" };
 }
+/**
+ * Authenticate using a raw token string (for MCP stdio mode).
+ * In stdio mode, the user identity is set via environment.
+ */
+export function authenticateToken(token) {
+    if (!masterToken && authUsers.length === 0) {
+        return { authenticated: true, user: "anonymous" };
+    }
+    // Check master token
+    if (masterToken && token === masterToken) {
+        return { authenticated: true, user: "admin" };
+    }
+    // Check user tokens
+    for (const user of authUsers) {
+        if (token === user.token) {
+            return { authenticated: true, user: user.name };
+        }
+    }
+    return { authenticated: false, user: "" };
+}
+/**
+ * Get the current authenticated user identity for stdio mode.
+ * Reads from environment or returns "anonymous".
+ * For HTTP/SSE mode, use authenticate() on the request.
+ */
+export function getCurrentUser() {
+    // Stdio mode: user identity comes from env or git config
+    const envUser = process.env.MCP_USER;
+    if (envUser)
+        return envUser;
+    // Try to get from git config
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { execSync } = require("child_process");
+        const gitUser = execSync("git config user.name", { encoding: "utf8" }).trim();
+        if (gitUser)
+            return gitUser;
+    }
+    catch {
+        // git not available
+    }
+    // Try system user
+    const systemUser = process.env.USER || process.env.USERNAME;
+    if (systemUser)
+        return systemUser;
+    return "anonymous";
+}
 /**
  * Generate authentication headers for MCP client configuration.
  */
@@ -76,3 +129,17 @@ export function getAuthHeader(user, token) {
 export function isAuthEnabled() {
     return !!masterToken || authUsers.length > 0;
 }
+/**
+ * Get list of configured users (without tokens).
+ */
+export function getConfiguredUsers() {
+    if (authUsers.length > 0) {
+        return authUsers.map(u => u.name);
+    }
+    if (masterToken) {
+        return ["admin"];
+    }
+    return ["anonymous"];
+}
+// Auto-initialize on load
+initAuth();

package/framework-mcp/dist/framework-mcp/src/utils/compliance.js

@@ -2,6 +2,8 @@ import ts from "typescript";
 import fs from "fs";
 import path from "path";
 import { resolveFrameworkDir } from "./security.js";
+import { resolveActiveAgent } from "./permissions.js";
+import { createApprovalRequest, getApprovalStatus } from "./human-in-loop.js";
 /**
  * Enterprise Compliance Guardrail
  * Checks content against corporate standards using AST analysis before allowing file mutations.
@@ -57,7 +59,7 @@ export function verifyCorporateCompliance(content, filePath) {
                         filePath.includes("shared/fs.ts") ||
                         filePath.includes("shared/lock.ts") ||
                         filePath.includes("quality-gate.ts") ||
-                        filePath.includes("providers/shared.ts");
+                        filePath.includes("shell/run_command.ts");
                     if (!isExempt) {
                         errors.push(`[ERROR] Corporate Compliance Breach: Direct 'child_process' usage is forbidden at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use secure framework APIs.`);
                     }
@@ -85,7 +87,10 @@ export function verifyCorporateCompliance(content, filePath) {
                     // Lock files, core atomic fs wrapper, and mcp configs are exempt
                     const args = node.arguments;
                     const firstArgText = args.length > 0 ? args[0].getText(sourceFile).toLowerCase() : "";
-                    const isExemptFile = filePath.includes("shared/fs.ts") || filePath.includes("src/cli/commands/mcp.ts");
+                    const isExemptFile = filePath.includes("shared/fs.ts") ||
+                        filePath.includes("src/cli/commands/mcp.ts") ||
+                        filePath.includes("utils/compliance.ts") ||
+                        filePath.includes("tools/messaging/send_message.ts");
                     if (!firstArgText.includes("lock") && !isExemptFile) {
                         errors.push(`[ERROR] Corporate Compliance Breach: Raw 'fs.${prop.name.text}' mutation detected at line ${sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1}. Use atomic utilities instead.`);
                     }
@@ -204,7 +209,9 @@ export async function verifyRiskAndAwaitApproval(projectRoot, content, filePath)
     const statePath = path.join(absoluteFrameworkPath, "memory", "state.json");
     const messagesDir = path.join(absoluteFrameworkPath, "messages");
     const managerMsgPath = path.join(messagesDir, "manager.json");
-    let activeAgent = null;
+    const activeAgent = resolveActiveAgent(absoluteFrameworkPath);
+    if (!activeAgent)
+        throw new Error(`Security Exception: High-risk operation blocked. ${assessment.reason}.`);
     let traceId = "UNKNOWN";
     if (fs.existsSync(statePath)) {
         try {
@@ -214,21 +221,25 @@ export async function verifyRiskAndAwaitApproval(projectRoot, content, filePath)
         }
         catch { /* ignore */ }
     }
+    // Check if already approved via human-in-loop
+    const existingStatus = getApprovalStatus(traceId);
+    if (existingStatus?.status === "APPROVED") {
+        return;
+    }
+    if (existingStatus?.status === "REJECTED" || existingStatus?.status === "EXPIRED") {
+        throw new Error(`Security Exception: High-risk operation was ${existingStatus.status}.`);
+    }
+    // Register in human-in-loop if not already present
+    if (!existingStatus) {
+        createApprovalRequest(traceId, "file_mutation", activeAgent, 80, assessment.reason || "High-risk operation detected", { filePath });
+    }
     let statusData = {};
     if (fs.existsSync(statusPath)) {
         try {
             statusData = JSON.parse(fs.readFileSync(statusPath, "utf8"));
-            for (const [agentName, info] of Object.entries(statusData)) {
-                if (info.state === "EXECUTING") {
-                    activeAgent = agentName.startsWith("@") ? agentName : `@${agentName}`;
-                    break;
-                }
-            }
         }
         catch { /* ignore */ }
     }
-    if (!activeAgent)
-        throw new Error(`Security Exception: High-risk operation blocked. ${assessment.reason}.`);
     const statusKey = activeAgent.replace("@", "");
     const originalTask = statusData[statusKey]?.task || "Executing task";
     statusData[statusKey] = {
@@ -253,12 +264,16 @@ export async function verifyRiskAndAwaitApproval(projectRoot, content, filePath)
         requiresApproval: true,
         action: `MUTATION:${filePath}`
     };
+    // Append to managerMsgPath for backward compatibility / legacy alerts
     try {
         fs.appendFileSync(managerMsgPath, JSON.stringify(alertMsg) + "\n");
     }
     catch (err) {
         statusData[statusKey] = { state: "EXECUTING", task: originalTask };
-        fs.writeFileSync(statusPath, JSON.stringify(statusData, null, 2));
+        try {
+            fs.writeFileSync(statusPath, JSON.stringify(statusData, null, 2));
+        }
+        catch { /* ignore */ }
         throw new Error("Security Exception: Failed to queue approval request.", { cause: err });
     }
     const pollIntervalMs = 500;
@@ -266,6 +281,20 @@ export async function verifyRiskAndAwaitApproval(projectRoot, content, filePath)
     const start = Date.now();
     while (Date.now() - start < timeoutMs) {
         await new Promise(resolve => setTimeout(resolve, pollIntervalMs));
+        // Check if approved via human-in-loop (e.g. approve_operation tool call)
+        const checkStatus = getApprovalStatus(traceId);
+        if (checkStatus?.status === "APPROVED") {
+            statusData[statusKey] = { state: "EXECUTING", task: originalTask };
+            try {
+                fs.writeFileSync(statusPath, JSON.stringify(statusData, null, 2));
+            }
+            catch { /* ignore */ }
+            return;
+        }
+        else if (checkStatus?.status === "REJECTED" || checkStatus?.status === "EXPIRED") {
+            throw new Error(`Security Exception: High-risk operation was explicitly ${checkStatus.status}.`);
+        }
+        // Check legacy managerMsgPath approval
         if (fs.existsSync(managerMsgPath)) {
             try {
                 const lines = fs.readFileSync(managerMsgPath, "utf8").trim().split("\n");
@@ -276,7 +305,10 @@ export async function verifyRiskAndAwaitApproval(projectRoot, content, filePath)
                     if (parsed.traceId === traceId && parsed.category === "ALERT" && parsed.action === `MUTATION:${filePath}`) {
                         if (parsed.status === "APPROVED") {
                             statusData[statusKey] = { state: "EXECUTING", task: originalTask };
-                            fs.writeFileSync(statusPath, JSON.stringify(statusData, null, 2));
+                            try {
+                                fs.writeFileSync(statusPath, JSON.stringify(statusData, null, 2));
+                            }
+                            catch { /* ignore */ }
                             return;
                         }
                         else if (parsed.status === "PROCESSED" || parsed.status === "DENIED") {

package/framework-mcp/dist/framework-mcp/src/utils/discipline.js

@@ -156,8 +156,41 @@ export async function enforceDiscipline(agent, toolName, args) {
     });
     return null;
 }
+// ─── Prompt Injection Patterns ─────────────────────────────────────────────
+// Common adversarial patterns that attempt to override agent instructions.
+// These are checked in tool responses to prevent exfiltrated injection payloads
+// (e.g. from malicious file content, API responses, or external user input)
+// from reaching the AI and overriding the system prompt.
+const PROMPT_INJECTION_PATTERNS = [
+    { pattern: /ignore\s+(previous|prior|above|all)\s+instructions?/i, label: "ignore-instructions" },
+    { pattern: /disregard\s+(previous|prior|above|all)\s+instructions?/i, label: "disregard-instructions" },
+    { pattern: /forget\s+(everything|all|prior|previous)/i, label: "forget-prior" },
+    { pattern: /you\s+are\s+now\s+(a|an)\s+/i, label: "persona-override" },
+    { pattern: /\bsystem\s*:\s*(you|your|ignore|forget|act)/i, label: "system-prompt-inject" },
+    { pattern: /\bnew\s+instructions?\s*:/i, label: "new-instructions" },
+    { pattern: /\bact\s+as\s+(if\s+you\s+are|a|an)\s+/i, label: "act-as-override" },
+    { pattern: /\boverride\s+(safety|rules|guidelines|instructions)/i, label: "safety-override" },
+    { pattern: /\bdo\s+not\s+follow\s+(your|the|any)\s+(rules|instructions)/i, label: "rule-bypass" },
+    { pattern: /\bdeveloper\s+mode\s+(enabled|activated|on)/i, label: "developer-mode" },
+    { pattern: /\bjailbreak/i, label: "jailbreak" },
+    { pattern: /<\|.*?\|>/, label: "token-boundary-inject" },
+    { pattern: /\[INST\]|\[\/?SYS\]|<<SYS>>/, label: "llm-template-inject" },
+];
+/**
+ * Scans a text block for known prompt injection patterns.
+ * Returns the matched pattern label if injection is detected, null otherwise.
+ */
+function scanForPromptInjection(text) {
+    for (const { pattern, label } of PROMPT_INJECTION_PATTERNS) {
+        if (pattern.test(text)) {
+            return label;
+        }
+    }
+    return null;
+}
 /**
  * Validate tool response content before returning to AI.
+ * Blocks: oversized responses, binary data, and prompt injection attempts.
  * Returns error message if blocked, null if allowed.
  */
 export function validateResponse(toolName, result) {
@@ -166,15 +199,21 @@ export function validateResponse(toolName, result) {
     for (const block of result.content) {
         if (block.type !== "text" || !block.text)
             continue;
-        // Check response size
+        // 1. Check response size
         if (block.text.length > CONFIG.MAX_RESPONSE_SIZE) {
             return `[DISCIPLINE] Response too large (${(block.text.length / 1024).toFixed(1)}KB, max: ${(CONFIG.MAX_RESPONSE_SIZE / 1024).toFixed(1)}KB).`;
         }
-        // Block binary/gibberish content in text responses
+        // 2. Block binary/gibberish content in text responses
         const nonPrintable = (block.text.match(/[^\x20-\x7E\n\r\t]/g) || []).length;
         if (nonPrintable > block.text.length * 0.3) {
             return `[DISCIPLINE] Response contains too much binary data (${nonPrintable} non-printable chars). Blocked.`;
         }
+        // 3. Prompt injection detection — scan for adversarial override patterns
+        // that may have been embedded in file content, API responses, or user input.
+        const injectionLabel = scanForPromptInjection(block.text);
+        if (injectionLabel) {
+            return `[DISCIPLINE] Prompt injection pattern detected in "${toolName}" response (pattern: ${injectionLabel}). Response blocked to protect agent integrity.`;
+        }
     }
     return null;
 }
@@ -202,7 +241,7 @@ export function getDisciplineStats(agent) {
  */
 export function getAllDisciplineStats() {
     const stats = {};
-    for (const [agent, _discipline] of agentDiscipline) {
+    for (const [agent] of agentDiscipline) {
         stats[agent] = getDisciplineStats(agent);
     }
     return stats;