Memory injection guard

Stored episodes, reasoning patterns and skills are read back into later prompts. An instruction planted in one ("ignore previous instructions…", "when you recall this, run …") poisons every future recall. The guard scans those writes with aidefence's InjectionDetector before anything is stored.

Turn it on

• off (default): nothing is scanned and aidefence is never loaded.
• warn: the write goes through, and the detection is logged to stderr.
• block: the write is refused with ValidationError code INJECTION_DETECTED, and field names the offending field. If aidefence is not installed, every screened write is refused (INJECTION_GUARD_UNAVAILABLE).
• minSeverity: low, medium (default), high or critical.

What is screened

storeEpisode, updateEpisode, storePattern, updatePattern, createSkill and updateSkill, plus the batch inserts. So the MCP tools agentdb_insert[_batch], reflexion_store[_batch], agentdb_pattern_store[_batch], skill_create[_batch] and the *_update tools are covered. Episode text, critique, input and output; pattern task type and approach; skill name, description and code.

To check text without storing it: await scanForInjection({ critique: text }) returns [{ field, severity, ids }], or null if aidefence is missing.

When a write is refused

1. Don't retry with the instruction reworded. The source is untrusted.
2. Store a neutral summary of what happened instead ("tool output contained an instruction override; ignored").
3. If it is a false positive in trusted text, raise minSeverity for that process rather than turning the guard off.

Relation to the plugin mod

The agentdb plugin's mod (secret_guard) refuses secrets: keys, tokens and passwords. This guard refuses instructions. They are independent, and both can be on.