Bohdan Triapitsyn
34e8a24b20
The panel stored notes, todos and plans inside one shared JSON file that six unrelated domains also wrote to, synchronised itself through window CustomEvents, and could only read plans. It is now Project knowledge: server-owned storage with explicit routes, a store with rollback, a section sidebar, plans that open and edit in place, and search across all of it. Notes and plans the user pins travel with every message sent in that project. Pinning is project state, not an attachment to one message, so it holds until unpinned and the work status panel names what is riding along and can detach it. Agent memory is added alongside, in two scopes: what is true about the user, and what is true about this codebase. The split is not cosmetic — a wrong project fact costs one project and is noticed, while a wrong global fact quietly shapes every session everywhere and the user has no code to check it against. It stays separate from notes so an agent mistake cannot land in what the user wrote. Sessions receive an index of titles only; bodies are read on demand, because an index carrying full text grows until it crowds out the conversation. Deciding what a session must be told, and whether it has been told, now lives on the server. The client owned it before, which meant sessions started without a UI — scheduled tasks, sessions the agent dispatches — received nothing at all, and a tab's record of what it had sent outlived the conversation: after compaction the agent no longer held the block while the tab went on believing it did. What was delivered is recorded in the session's own metadata, and compaction restores it through the runtime that already restores pinned messages, in the same turn. Agent memory ships dark behind OPENCHAMBER_MEMORY_ENABLE: unset, there is no tool, no routes, no session index, no settings row and no panel tab. Absent rather than switched off, so nothing invites turning on a feature that has not been announced. Pinned notes and plans are unaffected and ship as normal.
62 lines
2.8 KiB
JavaScript
62 lines
2.8 KiB
JavaScript
/**
|
|
* Text that tries to talk to the model rather than describe something.
|
|
*
|
|
* Memory is the one place where text from outside can settle permanently. The
|
|
* agent browses a page, decides a line on it is worth keeping, and saves it —
|
|
* from then on it rides into every session in every project. An injection
|
|
* anywhere else lives for one conversation; here it lives until someone
|
|
* notices.
|
|
*
|
|
* Patterns, not a model: this runs on every write and every index build, and a
|
|
* classifier there would cost more than the whole feature. That buys only the
|
|
* blunt cases, which is the honest expectation — it raises the floor rather
|
|
* than closing the door.
|
|
*
|
|
* A match never deletes anything. The entry is stored, kept out of what the
|
|
* model is shown, and flagged for the user, because a silently dropped entry
|
|
* hides the attempt from the only party who can judge it.
|
|
*/
|
|
|
|
const PATTERNS = [
|
|
// Trying to displace instructions already in play.
|
|
/\bignore\s+(?:all\s+|any\s+)?(?:previous|prior|earlier|above)\s+(?:instructions?|prompts?|rules?|context)\b/i,
|
|
/\bdisregard\s+(?:all\s+|any\s+)?(?:previous|prior|earlier|above)\s+(?:instructions?|prompts?|rules?)\b/i,
|
|
/\bforget\s+(?:everything|all)\s+(?:you|above|before)\b/i,
|
|
/\boverrid(?:e|ing)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions?)\b/i,
|
|
|
|
// Trying to reassign who the model is.
|
|
/\byou\s+are\s+now\s+(?:a|an|the)\b/i,
|
|
/\bfrom\s+now\s+on[,\s]+(?:you|act|behave|respond)\b/i,
|
|
/\bact\s+as\s+(?:if\s+you\s+are\s+)?(?:a|an|the)\s+\w+\s+with\s+no\s+(?:restrictions?|limits?|rules?)\b/i,
|
|
|
|
// Forging turn structure so the text reads as a different speaker.
|
|
/^\s*(?:system|assistant|developer)\s*:/im,
|
|
/<\|(?:im_start|im_end|system|endoftext)\|>/i,
|
|
/\[\/?(?:INST|SYS)\]/,
|
|
|
|
// Aimed at the guardrails themselves.
|
|
/\b(?:bypass|disable|turn\s+off)\s+(?:all\s+)?(?:safety|security|guardrails?|filters?|restrictions?)\b/i,
|
|
/\bdeveloper\s+mode\s+(?:enabled|on|activated)\b/i,
|
|
|
|
// Asking for what the model was told, or for credentials to travel.
|
|
/\b(?:print|reveal|repeat|output|show)\s+(?:me\s+)?(?:your|the)\s+(?:system\s+prompt|instructions|initial\s+prompt)\b/i,
|
|
/\b(?:send|post|upload|exfiltrate)\s+(?:the\s+|your\s+)?(?:api\s+key|token|credentials?|secrets?|env)\b/i,
|
|
];
|
|
|
|
/**
|
|
* The first pattern this text trips, or null. The name is returned rather than
|
|
* a boolean so the panel can tell the user what was matched instead of leaving
|
|
* them with an unexplained warning.
|
|
*/
|
|
export const findThreatPattern = (value) => {
|
|
if (typeof value !== 'string' || value.length === 0) {
|
|
return null;
|
|
}
|
|
const match = PATTERNS.find((pattern) => pattern.test(value));
|
|
return match ? match.source.slice(0, 80) : null;
|
|
};
|
|
|
|
export const looksLikeInjection = (...values) => (
|
|
values.some((value) => findThreatPattern(value) !== null)
|
|
);
|