Method sanitizeForPrompt

cli/workspace/memory.go:130–140

sanitizeForPrompt neutralizes prompt-injection / exec / persistence payloads in memory before it is injected into the system prompt. Memory is auto-curated and should never carry shell scripts, so it uses the stricter ScopeMemory. The on-disk store is never modified.

(s string)

// is auto-curated and should never carry shell scripts, so it uses the
// stricter ScopeMemory. The on-disk store is never modified.
func (ms *MemoryStore) sanitizeForPrompt(s string) string {
	if s == "" || !threatscan.Enabled() {
		return s
	}
	sanitized, blocked := threatscan.Sanitize(s, threatscan.ScopeMemory)
	if blocked > 0 && ms.logger != nil {
		ms.logger.Warn("threatscan: neutralized lines in memory context",
			zap.Int("blocked", blocked))
	}
	return sanitized
}

// AttachVectorIndex attaches a vector index used by HyDE Phase 3b.
// Pass nil to detach.