cleveragents-core

Author	SHA1	Message	Date
freemo	7b1020e735	feat(security): implement Prompt Injection Mitigation (5 mechanisms) CI / benchmark-publish (pull_request) Has been skipped Details CI / lint (pull_request) Successful in 15s Details CI / build (pull_request) Successful in 16s Details CI / quality (pull_request) Successful in 18s Details CI / typecheck (pull_request) Successful in 36s Details CI / security (pull_request) Successful in 36s Details CI / unit_tests (pull_request) Successful in 3m46s Details CI / docker (pull_request) Successful in 39s Details CI / integration_tests (pull_request) Successful in 4m30s Details CI / coverage (pull_request) Successful in 4m35s Details CI / lint (push) Successful in 12s Details CI / build (push) Successful in 16s Details CI / quality (push) Successful in 16s Details CI / security (push) Successful in 33s Details CI / typecheck (push) Successful in 35s Details CI / benchmark-regression (push) Has been skipped Details CI / unit_tests (push) Successful in 2m7s Details CI / docker (push) Successful in 39s Details CI / integration_tests (push) Successful in 3m4s Details CI / coverage (push) Successful in 4m35s Details CI / benchmark-publish (push) Has been cancelled Details CI / benchmark-regression (pull_request) Successful in 29m37s Details Implement spec-mandated prompt injection protections: 1. Input sanitization (PromptSanitizer.sanitize_user_input): escapes HTML entities, strips C0/C1 control characters, rejects 8 known injection patterns including instruction override, role assumption, ChatML tags, and boundary marker spoofing. 2. Prompt boundary markers (PromptSanitizer.wrap_user_content): wraps user content with [USER_CONTENT_START]/[USER_CONTENT_END] markers; augment_system_prompt() prepends boundary recognition instructions. 3. Output validation: existing schema_validator.py validates tool I/O against JSON Schema in ToolRuntime.execute() (verified, tested). 4. Tool capability restrictions: existing _enforce_capabilities() in lifecycle.py enforces read_only/writes/checkpointable/side_effects declarations (verified, tested). 5. Unsafe tool gating: existing _enforce_capabilities() blocks unsafe tools unless allow_unsafe_tools=true in automation profile (verified, tested). Integrates sanitizer into session prompt construction, invariant text processing, and action argument handling paths. ISSUES CLOSED: #572	2026-03-08 22:19:40 +00:00

1 Commits