mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
e545023e46
The injection guard is RoboCo's own hook (user-prompt-hook.sh), not a runtime built-in, so it can be recreated at our input boundary regardless of runtime — opencode's lack of a blocking pre-prompt hook is irrelevant. - prompt_guard.detect_injection: the deny patterns ported to reusable Python. - IntakeDriver._run_turn scans every interactive turn before sending it to the model and denies a match as an error chunk. Covers BOTH Grok (opencode) and the Claude SDK intake (which runs with setting_sources=[] and so never loaded the bash hook — it was unguarded too). - The one-shot grok entrypoint scans ROBOCO_INITIAL_PROMPT and refuses a poisoned task prompt (parity with the Claude UserPromptSubmit deny). - Broadened the pattern (Python + the bash hook, kept in sync) to catch the multi-qualifier canonical phrasing "ignore all previous instructions", which the single-qualifier original missed — without false-positiving on "ignore the linting rules" (an intermediate non-qualifier word breaks it). So Grok now has the command/secret-exfil guard (secret-scrub), the cost cap, AND the injection guard. Verified: 94 agent_sdk tests pass; bash + Python agree on detect/miss cases.