drydock-cli 0.5.1__tar.gz → 0.6.0__tar.gz

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 0.5.1
+Version: 0.6.0
 Summary: Drydock — nautical CLI coding agent
 Project-URL: Homepage, https://github.com/fbobe321/drydock
 Project-URL: Repository, https://github.com/fbobe321/drydock

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/PRD.md

@@ -153,10 +153,32 @@ User-reported issues from real usage testing, all fixed:
 
 ### Phase 5b: Testing & CI (Mar 24)
 
-- **64 regression tests** in 2 test files (0.12s total runtime)
-- **Tests gate all deploys** — deploy_to_github.sh and publish_to_pypi.sh abort on failure
-- **Continuous SWE-bench loop** — 320/500 tasks tested, 45.3% pass rate, auto-restarts on reboot
-- **PyPI published** — drydock-cli v0.4.1
+- **76 regression tests** gating all deploys
+- **Continuous SWE-bench loop** — 500/500 tasks tested, 49.0% pass rate (+9.4% from baseline)
+- **vibe/ → drydock/** package rename (908 imports updated)
+- **PyPI published** — drydock-cli v0.5.2
+
+### Phase 6: GSD Integration & Performance (Mar 25)
+
+GSD-inspired features (from [get-shit-done](https://github.com/gsd-build/get-shit-done)):
+
+| Feature | Details |
+|---------|---------|
+| Tiered context warnings | 4 levels at 50/65/75/85% usage, debounced every 5 calls |
+| Prompt injection guard | Detects role overrides, invisible Unicode, hidden instructions in file writes |
+| Structured state file | `.drydock/state.md` persists task, files, decisions across sessions |
+| Deviation handling rules | Auto-fix bugs/imports, ask user for architecture/scope decisions |
+
+Performance and loop fixes:
+
+| Fix | Details |
+|-----|---------|
+| Circuit breaker | Blocks exact same tool call after 2 attempts, returns cached result |
+| Thinking flicker fix | Status words change every 4s, not every token |
+| Conda env protection | Preserves user's active conda environment in subprocesses |
+| `--insecure` / `-k` flag | Disables SSL verification for corporate proxy environments |
+| `--consultant MODEL` flag | Allows calling a smarter model for single-turn advice when stuck |
+| 81 regression tests | Circuit breaker, injection guard, state file, context tiers all tested |
 
 ---
 

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/cli/entrypoint.py

@@ -90,6 +90,19 @@ def parse_arguments() -> argparse.Namespace:
         help="Skip all tool permission checks. Equivalent to --agent auto-approve. "
         "Use with caution — tools will execute without confirmation.",
     )
+    parser.add_argument(
+        "-k", "--insecure",
+        action="store_true",
+        help="Disable SSL certificate verification for web searches and API calls. "
+        "Useful behind corporate proxies with self-signed certificates.",
+    )
+    parser.add_argument(
+        "--consultant",
+        metavar="MODEL",
+        help="Enable consultant mode: when the agent is uncertain or stuck in a loop, "
+        "it can call a more capable model (e.g., 'gemini-2.5-pro') for single-turn advice. "
+        "The consultant is NOT used for tool calls, only reasoning.",
+    )
 
     # Feature flag for teleport, not exposed to the user yet
     parser.add_argument("--teleport", action="store_true", help=argparse.SUPPRESS)
@@ -160,6 +173,18 @@ def main() -> None:
     if args.dangerously_skip_permissions:
         args.agent = BuiltinAgentName.AUTO_APPROVE
 
+    # --insecure → disable SSL verification globally
+    if args.insecure:
+        os.environ["DRYDOCK_INSECURE"] = "1"
+        os.environ["CURL_CA_BUNDLE"] = ""
+        os.environ["REQUESTS_CA_BUNDLE"] = ""
+        import ssl
+        ssl._create_default_https_context = ssl._create_unverified_context
+
+    # --consultant → store for agent loop to use
+    if args.consultant:
+        os.environ["DRYDOCK_CONSULTANT_MODEL"] = args.consultant
+
     is_interactive = args.prompt is None
     if is_interactive:
         check_and_resolve_trusted_folder()

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/cli/textual_ui/widgets/loading.py

@@ -64,6 +64,9 @@ class LoadingWidget(SpinnerMixin, Static):
         "Stocking the galley",
     ]
 
+    # Minimum seconds between status word changes (prevents flicker)
+    _STATUS_CHANGE_INTERVAL = 4.0
+
     def __init__(self, status: str | None = None) -> None:
         super().__init__(classes="loading-widget")
         self.init_spinner()
@@ -77,6 +80,7 @@ class LoadingWidget(SpinnerMixin, Static):
         self._last_elapsed: int = -1
         self._paused_total: float = 0.0
         self._pause_start: float | None = None
+        self._last_status_change: float = 0.0
 
     def _get_easter_egg(self) -> str | None:
         EASTER_EGG_PROBABILITY = 0.10
@@ -111,6 +115,11 @@ class LoadingWidget(SpinnerMixin, Static):
             self._pause_start = None
 
     def set_status(self, status: str) -> None:
+        # Throttle status word changes to prevent flicker
+        now = time()
+        if now - self._last_status_change < self._STATUS_CHANGE_INTERVAL:
+            return  # Too soon — keep current word
+        self._last_status_change = now
         self.status = self._apply_easter_egg(status)
         self._update_animation()
 

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/agent_loop.py

@@ -188,6 +188,10 @@ class AgentLoop:
         self.middleware_pipeline = MiddlewarePipeline()
         self._setup_middleware()
 
+        # Circuit breaker: track tool call signatures to prevent exact repeats
+        # Key: hash(tool_name + args), Value: (count, last_result_snippet)
+        self._tool_call_history: dict[str, tuple[int, str]] = {}
+
         system_prompt = get_universal_system_prompt(
             self.tool_manager, self.config, self.skill_manager, self.agent_manager
         )
@@ -288,6 +292,18 @@ class AgentLoop:
 
     async def act(self, msg: str) -> AsyncGenerator[BaseEvent]:
         self._clean_message_history()
+
+        # Load project state for cross-session context
+        try:
+            from drydock.core.session.state_file import load_state
+            state_content = load_state()
+            if state_content:
+                self._inject_system_note(
+                    f"Previous session state:\n{state_content[:500]}"
+                )
+        except Exception:
+            pass  # Non-critical
+
         async for event in self._conversation_loop(msg):
             yield event
 
@@ -819,9 +835,44 @@ class AgentLoop:
                 )
             )
 
+    def _circuit_breaker_check(self, tool_call: ResolvedToolCall) -> str | None:
+        """Block exact-duplicate tool calls. Returns cached result or None."""
+        sig = hashlib.md5(
+            f"{tool_call.tool_name}:{tool_call.raw_arguments}".encode()
+        ).hexdigest()
+
+        count, last_result = self._tool_call_history.get(sig, (0, ""))
+        if count >= 2:
+            return (
+                f"CIRCUIT BREAKER: You already ran this exact command {count} times "
+                f"and got the same result. Previous result: {last_result[:300]}\n\n"
+                f"Do NOT repeat. Try a DIFFERENT approach, different arguments, "
+                f"or a different tool."
+            )
+        return None
+
+    def _circuit_breaker_record(self, tool_call: ResolvedToolCall, result_text: str) -> None:
+        """Record a tool call execution for circuit breaker tracking."""
+        sig = hashlib.md5(
+            f"{tool_call.tool_name}:{tool_call.raw_arguments}".encode()
+        ).hexdigest()
+        count, _ = self._tool_call_history.get(sig, (0, ""))
+        self._tool_call_history[sig] = (count + 1, result_text[:500])
+
     async def _process_one_tool_call(
         self, tool_call: ResolvedToolCall
     ) -> AsyncGenerator[ToolResultEvent | ToolStreamEvent]:
+        # Circuit breaker: block exact duplicate calls after 2 attempts
+        if blocked := self._circuit_breaker_check(tool_call):
+            yield ToolResultEvent(
+                tool_name=tool_call.tool_name,
+                tool_class=tool_call.tool_class,
+                error=blocked,
+                tool_call_id=tool_call.call_id,
+            )
+            self._handle_tool_response(tool_call, blocked, "failure")
+            return
+
         try:
             tool_instance = self.tool_manager.get(tool_call.tool_name)
         except Exception as exc:
@@ -890,6 +941,8 @@ class AgentLoop:
 
             result_dict = result_model.model_dump()
             text = "\n".join(f"{k}: {v}" for k, v in result_dict.items())
+            # Record for circuit breaker
+            self._circuit_breaker_record(tool_call, text)
             self._handle_tool_response(
                 tool_call, text, "success", decision, result_dict
             )

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/middleware.py

@@ -98,35 +98,63 @@ class AutoCompactMiddleware:
 
 
 class ContextWarningMiddleware:
+    """Tiered context warnings inspired by GSD's context monitoring.
+
+    Warns at multiple thresholds as context fills up:
+    - 50% used: soft warning ("you're halfway through")
+    - 65% used: moderate warning ("wrap up current task")
+    - 75% used: critical warning ("finish NOW or compact")
+    - 85% used: emergency ("stop exploring, make final edit")
+
+    Debounced: only warns every 5 tool calls to avoid spamming.
+    """
+
+    _TIERS = [
+        (0.50, "soft", "You've used {pct:.0f}% of context ({used:,}/{max:,} tokens). Start wrapping up your current task."),
+        (0.65, "moderate", "Context at {pct:.0f}%. Stop exploring — finish your current edit and verify it works."),
+        (0.75, "critical", "Context at {pct:.0f}% — CRITICAL. Make your final edit NOW. No more grep/read_file. Use /compact if you need to continue."),
+        (0.85, "emergency", "Context nearly full ({pct:.0f}%). You MUST stop after this turn. Apply your fix with search_replace immediately or the session will degrade."),
+    ]
+
     def __init__(
         self, threshold_percent: float = 0.5, max_context: int | None = None
     ) -> None:
         self.threshold_percent = threshold_percent
         self.max_context = max_context
-        self.has_warned = False
+        self._tier_warned: set[str] = set()
+        self._calls_since_last_warn = 0
+        self._debounce_interval = 5
 
     async def before_turn(self, context: ConversationContext) -> MiddlewareResult:
-        if self.has_warned:
+        max_context = self.max_context
+        if max_context is None or max_context == 0:
             return MiddlewareResult()
 
-        max_context = self.max_context
-        if max_context is None:
+        self._calls_since_last_warn += 1
+
+        # Debounce: don't warn on every single turn
+        if self._calls_since_last_warn < self._debounce_interval:
             return MiddlewareResult()
 
-        if context.stats.context_tokens >= max_context * self.threshold_percent:
-            self.has_warned = True
+        pct_used = context.stats.context_tokens / max_context
 
-            percentage_used = (context.stats.context_tokens / max_context) * 100
-            warning_msg = f"<{VIBE_WARNING_TAG}>You have used {percentage_used:.0f}% of your total context ({context.stats.context_tokens:,}/{max_context:,} tokens)</{VIBE_WARNING_TAG}>"
+        # Find the highest tier we've crossed but haven't warned about
+        for threshold, tier_name, template in reversed(self._TIERS):
+            if pct_used >= threshold and tier_name not in self._tier_warned:
+                self._tier_warned.add(tier_name)
+                self._calls_since_last_warn = 0
 
-            return MiddlewareResult(
-                action=MiddlewareAction.INJECT_MESSAGE, message=warning_msg
-            )
+                warning_msg = f"<{VIBE_WARNING_TAG}>{template.format(pct=pct_used * 100, used=context.stats.context_tokens, max=max_context)}</{VIBE_WARNING_TAG}>"
+                return MiddlewareResult(
+                    action=MiddlewareAction.INJECT_MESSAGE, message=warning_msg
+                )
+                break
 
         return MiddlewareResult()
 
     def reset(self, reset_reason: ResetReason = ResetReason.STOP) -> None:
-        self.has_warned = False
+        self._tier_warned.clear()
+        self._calls_since_last_warn = 0
 
 
 def make_plan_agent_reminder(plan_file_path: str) -> str:

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/prompts/cli.md

@@ -59,6 +59,16 @@ Flip-flopping (add X → remove X → add X) is a critical failure. Commit to a
 Ambiguous Prompts
 If the user's message is very short or ambiguous (e.g., "test", "check", "fix"), ask what they want before exploring the filesystem. Do NOT start scanning directories or running `find` on a vague prompt. Ask: "What would you like me to test/check/fix?"
 
+Deviation Handling
+When your fix attempt hits unexpected issues, follow these rules:
+1. **Bug in your fix** → Auto-fix immediately. Re-read the error, adjust your edit, retry.
+2. **Missing dependency/import** → Auto-resolve. Add the import or install the package.
+3. **Blocking issue** (wrong file, missing context) → Auto-resolve by grepping for the right location.
+4. **Architectural decision** (should we refactor? change the API? add a new module?) → STOP and ask the user. Do NOT make architectural decisions unilaterally.
+5. **Scope change** (the fix requires changes to 5+ files, or touches unrelated code) → STOP and ask the user before proceeding.
+
+Rules 1-3: fix silently. Rules 4-5: always ask.
+
 Response Format
 No Noise
 No greetings, outros, hedging, puffery, or tool narration.

drydock_cli-0.6.0/drydock/core/session/state_file.py

@@ -0,0 +1,143 @@
+"""Structured state file for cross-session memory.
+
+Maintains a `.drydock/state.md` file in the project directory that tracks:
+- Current task and status
+- Files modified in this session
+- Key decisions made
+- Blockers and next steps
+
+Max 100 lines. Loaded on session start, updated on session end.
+Enables "resume where I left off" workflows.
+
+Inspired by GSD's STATE.md concept.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+_MAX_LINES = 100
+_STATE_FILENAME = "state.md"
+
+
+def _get_state_path(project_dir: Path | None = None) -> Path:
+    """Get the path to the state file."""
+    base = project_dir or Path.cwd()
+    return base / ".drydock" / _STATE_FILENAME
+
+
+def load_state(project_dir: Path | None = None) -> str:
+    """Load the state file content, or empty string if it doesn't exist."""
+    path = _get_state_path(project_dir)
+    try:
+        if path.exists():
+            content = path.read_text(encoding="utf-8")
+            logger.info("Loaded session state from %s (%d lines)", path, content.count("\n"))
+            return content
+    except (OSError, PermissionError) as e:
+        logger.warning("Could not read state file %s: %s", path, e)
+    return ""
+
+
+def save_state(
+    project_dir: Path | None = None,
+    *,
+    current_task: str = "",
+    files_modified: list[str] | None = None,
+    decisions: list[str] | None = None,
+    blockers: list[str] | None = None,
+    next_steps: list[str] | None = None,
+    custom_notes: str = "",
+) -> None:
+    """Save the state file with structured session information."""
+    path = _get_state_path(project_dir)
+
+    lines: list[str] = [
+        f"# DryDock Session State",
+        f"_Updated: {datetime.now().strftime('%Y-%m-%d %H:%M')}_",
+        "",
+    ]
+
+    if current_task:
+        lines.extend([f"## Current Task", current_task, ""])
+
+    if files_modified:
+        lines.append("## Files Modified")
+        for f in files_modified[-20:]:  # Keep last 20
+            lines.append(f"- `{f}`")
+        lines.append("")
+
+    if decisions:
+        lines.append("## Decisions")
+        for d in decisions[-10:]:  # Keep last 10
+            lines.append(f"- {d}")
+        lines.append("")
+
+    if blockers:
+        lines.append("## Blockers")
+        for b in blockers:
+            lines.append(f"- {b}")
+        lines.append("")
+
+    if next_steps:
+        lines.append("## Next Steps")
+        for n in next_steps:
+            lines.append(f"- {n}")
+        lines.append("")
+
+    if custom_notes:
+        lines.extend(["## Notes", custom_notes, ""])
+
+    # Enforce max lines
+    content = "\n".join(lines[:_MAX_LINES])
+
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(content, encoding="utf-8")
+        logger.info("Saved session state to %s", path)
+    except (OSError, PermissionError) as e:
+        logger.warning("Could not write state file %s: %s", path, e)
+
+
+def update_state_files_modified(
+    project_dir: Path | None = None,
+    files: list[str] | None = None,
+) -> None:
+    """Quick update: append modified files to the state without rewriting everything."""
+    if not files:
+        return
+
+    path = _get_state_path(project_dir)
+    try:
+        existing = path.read_text(encoding="utf-8") if path.exists() else ""
+
+        if "## Files Modified" not in existing:
+            # Append a new section
+            existing += "\n## Files Modified\n"
+
+        for f in files:
+            entry = f"- `{f}`"
+            if entry not in existing:
+                existing += f"{entry}\n"
+
+        # Enforce max lines
+        lines = existing.split("\n")[:_MAX_LINES]
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("\n".join(lines), encoding="utf-8")
+    except (OSError, PermissionError):
+        pass  # Non-critical
+
+
+def clear_state(project_dir: Path | None = None) -> None:
+    """Remove the state file."""
+    path = _get_state_path(project_dir)
+    try:
+        if path.exists():
+            path.unlink()
+            logger.info("Cleared session state at %s", path)
+    except (OSError, PermissionError):
+        pass

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/tools/builtins/bash.py

@@ -110,11 +110,25 @@ def _get_base_env() -> dict[str, str]:
 
         # Enable conda in non-interactive shells by setting BASH_ENV
         # to source conda's setup script. Without this, `conda activate`
-        # fails because it's a shell function defined in .bashrc (which
-        # isn't sourced for non-interactive shell commands).
+        # fails because it's a shell function defined in .bashrc.
+        #
+        # IMPORTANT: We also preserve the user's active conda env to avoid
+        # interfering with other environments and losing their aliases.
         conda_sh = _get_conda_setup_script()
         if conda_sh:
-            base_env["BASH_ENV"] = conda_sh
+            # Create a wrapper that sources conda.sh then re-activates the user's env
+            active_env = os.environ.get("CONDA_DEFAULT_ENV", "")
+            if active_env and active_env != "base":
+                # Write a temp script that initializes conda AND activates the user's env
+                import tempfile
+                wrapper = tempfile.NamedTemporaryFile(
+                    mode="w", suffix=".sh", delete=False, prefix="drydock_conda_"
+                )
+                wrapper.write(f'source "{conda_sh}"\nconda activate "{active_env}" 2>/dev/null\n')
+                wrapper.close()
+                base_env["BASH_ENV"] = wrapper.name
+            else:
+                base_env["BASH_ENV"] = conda_sh
 
     return base_env
 

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/tools/builtins/search_replace.py

@@ -119,15 +119,19 @@ class SearchReplace(
     ) -> AsyncGenerator[ToolStreamEvent | SearchReplaceResult, None]:
         file_path, search_replace_blocks = self._prepare_and_validate_args(args)
 
-        # Warn (but don't block) when editing test files — the system prompt
-        # says NEVER edit tests, but we add a strong warning to the result
-        # so the model sees it made a mistake.
+        # Warn (but don't block) when editing test files
         file_str = str(file_path)
         if ("/tests/" in file_str or "/test_" in file_str or
                 file_str.endswith("_test.py") or "/testing/" in file_str):
             import logging
             logging.getLogger(__name__).warning("search_replace targeting test file: %s", file_str)
 
+        # Injection guard: scan replacement content for suspicious patterns
+        from drydock.core.tools.injection_guard import check_content_for_injection
+        if warning := check_content_for_injection(args.content, args.file_path):
+            import logging
+            logging.getLogger(__name__).warning("search_replace: %s", warning)
+
         original_content = await self._read_file(file_path)
 
         block_result = self._apply_blocks(

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/drydock/core/tools/builtins/write_file.py

@@ -84,6 +84,12 @@ class WriteFile(
     ) -> AsyncGenerator[ToolStreamEvent | WriteFileResult, None]:
         file_path, file_existed, content_bytes = self._prepare_and_validate_path(args)
 
+        # Injection guard: scan content for suspicious patterns
+        from drydock.core.tools.injection_guard import check_content_for_injection
+        if warning := check_content_for_injection(args.content, args.path):
+            import logging
+            logging.getLogger(__name__).warning("write_file: %s", warning)
+
         await self._write_file(args, file_path)
 
         yield WriteFileResult(

drydock_cli-0.6.0/drydock/core/tools/injection_guard.py

@@ -0,0 +1,105 @@
+"""Prompt injection detection for file write operations.
+
+Scans content being written to files for common injection patterns:
+- Role override attempts ("You are now...", "Ignore previous instructions")
+- System prompt extraction ("Show me your system prompt")
+- Invisible Unicode characters used to hide instructions
+- Base64 encoded instructions
+- Attempts to modify DryDock config/state files
+
+Inspired by GSD's prompt-guard approach.
+"""
+
+from __future__ import annotations
+
+import base64
+import logging
+import re
+
+logger = logging.getLogger(__name__)
+
+# Patterns that indicate prompt injection attempts
+_INJECTION_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
+    ("role_override", re.compile(
+        r"(?:you are now|act as|pretend to be|ignore (?:all )?previous|"
+        r"disregard (?:all )?(?:prior|previous)|forget (?:all )?(?:prior|previous)|"
+        r"new instructions|override (?:system|instructions))",
+        re.IGNORECASE,
+    )),
+    ("system_prompt_leak", re.compile(
+        r"(?:show (?:me )?your (?:system )?prompt|print your instructions|"
+        r"reveal your (?:system )?(?:prompt|instructions)|"
+        r"what are your (?:system )?instructions)",
+        re.IGNORECASE,
+    )),
+    ("hidden_instruction", re.compile(
+        r"(?:<!-- (?:SYSTEM|INSTRUCTION|HIDDEN|INJECT)|"
+        r"\[INST\]|\[/INST\]|<\|im_start\|>|<\|system\|>)",
+        re.IGNORECASE,
+    )),
+]
+
+# Invisible Unicode characters that can hide instructions
+_INVISIBLE_CHARS = set(
+    "\u200b"  # Zero-width space
+    "\u200c"  # Zero-width non-joiner
+    "\u200d"  # Zero-width joiner
+    "\u2060"  # Word joiner
+    "\u2062"  # Invisible times
+    "\u2063"  # Invisible separator
+    "\u2064"  # Invisible plus
+    "\ufeff"  # Zero-width no-break space (BOM)
+    "\u00ad"  # Soft hyphen
+    "\u034f"  # Combining grapheme joiner
+    "\u061c"  # Arabic letter mark
+    "\u180e"  # Mongolian vowel separator
+)
+
+
+def check_content_for_injection(content: str, file_path: str = "") -> str | None:
+    """Check content for prompt injection patterns.
+
+    Returns a warning message if injection is detected, None otherwise.
+    This is advisory — it warns but does not block the write.
+    """
+    if not content:
+        return None
+
+    warnings: list[str] = []
+
+    # Check for injection patterns
+    for pattern_name, pattern in _INJECTION_PATTERNS:
+        if match := pattern.search(content):
+            warnings.append(f"Suspicious pattern '{pattern_name}': '{match.group()[:50]}'")
+
+    # Check for invisible Unicode
+    invisible_found = [c for c in content if c in _INVISIBLE_CHARS]
+    if len(invisible_found) > 3:
+        warnings.append(f"Found {len(invisible_found)} invisible Unicode characters")
+
+    # Check for base64 encoded blocks that might contain instructions
+    b64_pattern = re.compile(r'[A-Za-z0-9+/]{40,}={0,2}')
+    for match in b64_pattern.finditer(content):
+        try:
+            decoded = base64.b64decode(match.group()).decode('utf-8', errors='ignore')
+            # Check if the decoded content looks like instructions
+            if any(kw in decoded.lower() for kw in ['ignore', 'override', 'system', 'instruction', 'you are']):
+                warnings.append(f"Base64 encoded block may contain hidden instructions")
+                break
+        except Exception:
+            pass
+
+    # Check for attempts to modify DryDock internals
+    if file_path:
+        protected = ['.drydock/config.toml', '.drydock/.env', 'drydock/core/', 'CLAUDE.md']
+        for p in protected:
+            if p in file_path:
+                # Not injection per se, but worth flagging
+                logger.info("Write to protected path: %s", file_path)
+
+    if warnings:
+        msg = "INJECTION WARNING: " + "; ".join(warnings)
+        logger.warning("Injection guard triggered for %s: %s", file_path, msg)
+        return msg
+
+    return None

{drydock_cli-0.5.1 → drydock_cli-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "drydock-cli"
-version = "0.5.1"
+version = "0.6.0"
 description = "Drydock — nautical CLI coding agent"
 readme = "README.md"
 requires-python = ">=3.12"