Repository navigation
feat(agent): port the prompt-injection defenses from Decepticon (Phase 2b-ii, middleware) - #4
Merged
Merged
Conversation
…e 2b-ii, middleware) Port the two defender-critical middleware layers with their original behavioral tests (1,186 lines of tests travel with them): - UntrustedOutputMiddleware — quarantine ledger + injected system policy for untrusted tool output (carries the AuditSink abstraction; AutoBot wires a file sink at the AutoBot state dir when the graph lands) - PromptInjectionShieldMiddleware — deny-listed tool-output wrapping, unicode tag-smuggling detection/stripping, trusted-internal-tool resolution with the documented fallback (AutoBot's steady state: no skills registries) - _injection_detector — the shared detector (stdlib only) Package deps gain the LangChain runtime (agent layer only — the contract layer stays langchain-free, TID251 scope extended to autobot/agent/**). Decepticon's slot-registry test replaced with AutoBot-steady-state fallback coverage; the assembly wiring test lands with the blue_cell graph. 223 unit tests passed in the middleware suite.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First implementation PR of the agent runtime (design doc).
Ports the two defender-critical middleware layers with their original behavioral tests (1,186 lines of tests travel with them — no behavior re-derivation):
Package deps gain the LangChain runtime (agent layer only — the contract layer stays langchain-free; TID251 scope extended to
autobot/agent/**). Decepticon's slot-registry test replaced with steady-state fallback coverage; the assembly wiring test lands with the blue_cell graph (next PRs: thin factory → graph+server+compose).223 unit tests passed;
make ci-lintclean.