 freemo
|
7b1020e735
|
feat(security): implement Prompt Injection Mitigation (5 mechanisms)
Implement spec-mandated prompt injection protections:
1. Input sanitization (PromptSanitizer.sanitize_user_input): escapes HTML
entities, strips C0/C1 control characters, rejects 8 known injection
patterns including instruction override, role assumption, ChatML tags,
and boundary marker spoofing.
2. Prompt boundary markers (PromptSanitizer.wrap_user_content): wraps user
content with [USER_CONTENT_START]/[USER_CONTENT_END] markers;
augment_system_prompt() prepends boundary recognition instructions.
3. Output validation: existing schema_validator.py validates tool I/O
against JSON Schema in ToolRuntime.execute() (verified, tested).
4. Tool capability restrictions: existing _enforce_capabilities() in
lifecycle.py enforces read_only/writes/checkpointable/side_effects
declarations (verified, tested).
5. Unsafe tool gating: existing _enforce_capabilities() blocks unsafe
tools unless allow_unsafe_tools=true in automation profile (verified,
tested).
Integrates sanitizer into session prompt construction, invariant text
processing, and action argument handling paths.
ISSUES CLOSED: #572
|
2026-03-08 22:19:40 +00:00 |
|
 CoreRasurae
|
f2f7aa5dc9
|
feat(core): add v3 lifecycle models, automation levels, subplan support, and security hardening
Implement multiple Stage A/B/E/SEC milestones for the v3 lifecycle system:
- Stage A5.3+A5.4: Add LifecycleActionModel and LifecyclePlanModel SQLAlchemy
models with to_domain()/from_domain() conversion methods
- Stage A5.6: Implement ActionRepository with full CRUD, namespace/state
queries, referential integrity checks, and retry decorator
- Stage E1: Add subplan domain models (ExecutionMode, SubplanMergeStrategy,
SubplanConfig, SubplanStatus, SubplanAttempt, SubplanFailureHandler) with
computed properties on Plan (is_subplan, is_root_plan, depth, has_subplans)
- Stage A6: Add AutomationLevel enum (MANUAL, REVIEW_BEFORE_APPLY,
FULL_AUTOMATION), settings integration, PlanLifecycleService auto-progression,
pause/resume, and CLI commands (--automation-level, set-automation-level)
- Stage SEC1: Remove eval()/exec() from stream_router.py, replace with named
operation and transform registries; code blocks and unregistered transforms
now raise StreamRoutingError
- Add langchain-anthropic dependency
- Update BDD tests for security changes and relax ADR directory requirement
|
2026-02-12 20:19:42 +00:00 |
|
