* fix(assistant): defuse memory prompt injection and bound replayed history
The last two blocking items from dev_docs/assistant_redesign_readiness.md that
were never shipped.
Agent memory rendered into the system prompt verbatim. gnubok_remember_fact
commits immediately with no staging, and the model can be induced to call it by
untrusted text it read from a document or inbox item; the content then renders
for every member of the company, on every future turn, outside the
<tool_output> framing that exists for exactly this. A payload carrying newlines
and markdown could open what reads as a new prompt section. Memory lines are now
flattened before rendering (whitespace collapsed, structure-opening characters
defused at the start of a line) and the block carries the same
these-are-not-instructions framing tool output already had. The words survive:
this is about structure, not censorship.
Conversation history loaded unbounded, so every persisted tool result replayed
on every turn. Cost grew linearly with thread age and a long-lived pinned
conversation would eventually exceed the context window, at which point every
turn fails and, because the store is append-only, the thread is unusable for
good. The load is now newest-first with a cap and flipped back. Slicing a tail
can orphan a tool_result whose tool_use fell off the top: repairDanglingToolUse
already normalizes both directions, which is what makes the cap safe.
Verified: 11321 tests pass (7 new pinning the flattening, including that an
injected heading is defused while its words survive), lint and tsc clean,
guards pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(agent): review triage: stop the memory flattener flipping a minus sign
The leading-marker strip removed any leading dash, so a stored fact of
"-50 kr i avvikelse" became "50 kr i avvikelse": a different number, in the one
part of the prompt that exists to carry facts about money, with nothing
downstream able to notice. A Markdown bullet is a dash, star or plus followed by
whitespace, so require that; inline emphasis stays as literal characters since
it cannot open a block anyway.
Also tie-break the 200-message history cap on id so the cutoff row is stable
across replays when created_at ties. Insertion order is deliberately not what
this restores: the ordering that matters, tool_use before its tool_result, is
already reconstructed by repairDanglingToolUse, which is what makes slicing a
tail safe in the first place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Jakob Wennberg
16e1a84b4b