mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-13 14:32:03 +00:00
Marc-André Bombeck
0511e36ac9
The Coach SNAPSHOT was spliced into the prompt bare. Its JSON leaves are not all server-computed: lab analyte, panel and unit names are transcribed by a model out of an uploaded PDF and stored verbatim as the biomarker name, so a hostile document chooses those strings. The about-me block has been fenced since v1.16.1; extend the same pattern rather than adding per-field escapes. - Move the fence markers and the wrapping primitive into a shared data-fence module. Content is scrubbed against every known marker, not just its own pair, so text in one block cannot forge another block's boundary. - Fence the SNAPSHOT with an explicit data/instruction frame. - Fence the OCR text handed to the document extractor; the previous 'OCR TEXT:' label was a label, not a boundary. - Sanitise analyte, panel and unit at the labs source, which feeds both the snapshot prompt and the labs_read tool result, and the medication label in the adherence storyline. - Capture a ---REMEMBER--- sentinel as proposed rather than active. It was the only model-driven write with no confirm step, and the reminder recall block fed it back into every later turn. Proposed reminders are already excluded from that block and already carry a confirm control.