feat(docker): add PIGuard prompt-injection sidecar to compose

- Add piguard (daemon) and piguard-gateway (HTTP bridge) services to all
  odek docker-compose profiles.
- Mount a read-only ./piguard/models volume for the one-time-exported ONNX
  model and add docker/piguard/download-model.sh to populate it.
- Wire bundled config.restricted.json and config.godmode.json to point the
  guard at http://piguard-gateway:8080/detect.
- Document setup, optional surfaces, and how to disable the sidecar in
  docker/README.md.

Author: jkyberneees

docker/.env.example

@@ -71,6 +71,17 @@ GIT_COMMITTER_EMAIL=you@example.com
 # ODEK_SCHEDULES_TELEGRAM_ADMIN_CHATS=11111111   # operator chat IDs that may manage schedules and /restart
 # ODEK_SCHEDULES_TELEGRAM_ADMIN_USERS=11111111   # operator user IDs that may manage schedules and /restart
 
+# ── Prompt-injection guard (PIGuard sidecar) ─────────────────────────────
+# The bundled config.*.json files point the guard at the in-compose sidecar.
+# To fall back to the local rule-only guard (no sidecar, no model download),
+# uncomment:
+# ODEK_GUARD_PROVIDER=local
+#
+# To enable optional surfaces, uncomment and set true:
+# ODEK_GUARD_SCAN_SKILLS=true
+# ODEK_GUARD_SCAN_TOOL_OUTPUTS=true
+# ODEK_GUARD_SCAN_TELEGRAM=true
+
 # ── Semantic embeddings (llama.cpp sidecar; see docker/README.md) ────────
 # The compose file runs a private llama.cpp server (the `llama-embeddings`
 # service) that gives odek real semantic embeddings. Both bundled configs set

docker/README.md

@@ -22,10 +22,13 @@ For the full walkthrough, threat model, and tuning, see
 docker/
 ├── Dockerfile               # multi-stage build of the odek binary
 ├── Dockerfile.embeddings    # llama.cpp embeddings sidecar (bundled GGUF)
-├── docker-compose.yml       # odek (4 profiles) + searxng + llama-embeddings
+├── docker-compose.yml       # odek (4 profiles) + searxng + llama-embeddings + piguard
 ├── config.restricted.json   # Restricted permission policy
 ├── config.godmode.json      # Godmode (YOLO) permission policy
 ├── .env.example             # copy to .env, add your API key
+├── piguard/                 # PIGuard model download helper
+│   ├── download-model.sh
+│   └── models/              # populated once by download-model.sh
 └── workspace/               # the dir the agent works in (mounted in)
 ```
 
@@ -246,6 +249,79 @@ See [`../docs/MEMORY.md`](../docs/MEMORY.md) → *Pluggable Embeddings*,
   sidecar, so nothing leaves the compose network; if you repoint it at a cloud API, that
   text egresses.
 
+## Prompt-injection guard (PIGuard sidecar)
+
+The compose setup can run a private **[go-prompt-injection-guard](https://github.com/BackendStack21/go-prompt-injection-guard)**
+sidecar for a semantic second opinion on high-trust inputs — no external guard API, no keys.
+
+What it guards:
+
+- **Memory** — legacy facts, `memory` tool writes, Extended Memory atoms/recall/user model.
+- **System prompt** — `IDENTITY.md`, `--system`, and project-level `AGENTS.md`.
+- **MCP descriptions** — tool descriptions supplied by MCP servers.
+- Optionally: skills, Telegram captions/transcripts, and external tool outputs.
+
+Both bundled configs (`config.restricted.json` and `config.godmode.json`) set:
+
+```json
+"guard": {
+  "provider": "piguard",
+  "url": "http://piguard-gateway:8080/detect",
+  "scan": { "memory": true, "system_prompt": true, "mcp_descriptions": true }
+}
+```
+
+The sidecar is internal-only (no host port) and reachable only by the odek containers
+over the compose network at `http://piguard-gateway:8080`.
+
+### One-time model download
+
+The PIGuard model (~735 MB) is **not** baked into the image — it is exported once and
+mounted read-only from `./piguard/models`. Before starting odek with the guard for the
+first time, run:
+
+```bash
+./piguard/download-model.sh
+```
+
+This downloads the export script and requirements from the guard repo, exports the ONNX
+model and tokenizer inside a disposable Python container, and copies the result to
+`docker/piguard/models/`. It is safe to re-run; it skips if the model is already present.
+
+### Running with the guard
+
+No extra flags are needed — the bundled configs already point at the sidecar. The guard
+container (`piguard`) and its HTTP bridge (`piguard-gateway`) co-start with every odek
+profile:
+
+```bash
+docker compose --profile restricted up --build
+```
+
+If the sidecar is unavailable, the odek guard falls back to the local rule-based scan
+(`danger.ScanInjection`) because `fallback_to_local` is `true`.
+
+### Disabling the sidecar
+
+To use the local rule scan only (no model download, no extra container), set in `.env`:
+
+```bash
+ODEK_GUARD_PROVIDER=local
+```
+
+Or edit the `guard` block in `config.*.json` to `"provider": "local"`.
+
+### Optional guard surfaces
+
+The bundled configs enable only the core surfaces. To also guard skills, tool outputs, or
+Telegram media, set the corresponding `guard.scan.*` flag in `config.*.json` or via env:
+
+```bash
+ODEK_GUARD_SCAN_SKILLS=true
+ODEK_GUARD_SCAN_TOOL_OUTPUTS=true
+ODEK_GUARD_SCAN_TELEGRAM=true
+```
+
 ## Verify the profiles differ
 
 - **Restricted**: ask it to `rm -rf` everything in `/workspace` → denied, never runs.

docker/config.godmode.json

@@ -28,6 +28,21 @@
     "dims": 768,
     "timeout_seconds": 10
   },
+  "guard": {
+    "provider": "piguard",
+    "url": "http://piguard-gateway:8080/detect",
+    "threshold": 0.9,
+    "timeout_seconds": 5,
+    "fallback_to_local": true,
+    "scan": {
+      "memory": true,
+      "system_prompt": true,
+      "mcp_descriptions": true,
+      "skills": false,
+      "tool_outputs": false,
+      "telegram": false
+    }
+  },
   "memory": {
     "enabled": true,
     "facts_limit_user": 1500,

docker/config.restricted.json

@@ -28,6 +28,21 @@
     "dims": 768,
     "timeout_seconds": 10
   },
+  "guard": {
+    "provider": "piguard",
+    "url": "http://piguard-gateway:8080/detect",
+    "threshold": 0.9,
+    "timeout_seconds": 5,
+    "fallback_to_local": true,
+    "scan": {
+      "memory": true,
+      "system_prompt": true,
+      "mcp_descriptions": true,
+      "skills": false,
+      "tool_outputs": false,
+      "telegram": false
+    }
+  },
   "memory": {
     "enabled": true,
     "facts_limit_user": 1500,

docker/docker-compose.yml

@@ -30,7 +30,7 @@ services:
       - ./workspace:/workspace
       - ./config.restricted.json:/home/odek/.odek/config.json:ro
     restart: "no"
-    depends_on: [searxng, llama-embeddings]
+    depends_on: [searxng, llama-embeddings, piguard-gateway]
 
   # ── Godmode (all permissions) — non-interactive, disposable container ──
   odek-godmode:
@@ -50,7 +50,7 @@ services:
       - ./workspace:/workspace
       - ./config.godmode.json:/home/odek/.odek/config.json:ro
     restart: "no"
-    depends_on: [searxng, llama-embeddings]
+    depends_on: [searxng, llama-embeddings, piguard-gateway]
 
   # ── Telegram bot — Restricted (approvals via inline keyboards) ──
   # State (sessions, skills, telegram.pid) lives in the local ./.odek folder —
@@ -74,7 +74,7 @@ services:
       - ./.odek:/home/odek/.odek
       - ./config.restricted.json:/home/odek/.odek/config.json:ro
     restart: unless-stopped
-    depends_on: [searxng, llama-embeddings]
+    depends_on: [searxng, llama-embeddings, piguard-gateway]
 
   # ── Telegram bot — Godmode (no prompts; unrestricted) ──
   # Same ./.odek state folder; config.godmode.json is layered on top of
@@ -93,7 +93,7 @@ services:
       - ./.odek:/home/odek/.odek
       - ./config.godmode.json:/home/odek/.odek/config.json:ro
     restart: unless-stopped
-    depends_on: [searxng, llama-embeddings]
+    depends_on: [searxng, llama-embeddings, piguard-gateway]
 
   # ── llama.cpp embeddings — local backend for the shared "embedding" block ──
   # Co-starts with every odek profile so semantic embeddings work out of the box
@@ -151,3 +151,45 @@ services:
     # SearXNG needs outbound internet to query upstream engines (Google, Bing,
     # DuckDuckGo, …). Behind the advanced allowlisting egress proxy, permit those.
     restart: unless-stopped
+
+  # ── PIGuard prompt-injection sidecar ─────────────────────────────────────
+  # Optional semantic second-opinion guard for memory, system prompt, MCP
+  # descriptions, skills, Telegram, and tool outputs. The daemon loads a
+  # one-time-exported ONNX model (~735 MB); run ./piguard/download-model.sh
+  # before starting an odek profile to populate ./piguard/models.
+  #
+  # The daemon speaks newline-delimited JSON over a private Unix socket; the
+  # gateway bridges that to plain HTTP on the compose network so odek can use
+  # its existing HTTP-based piguard client without sharing a socket volume.
+  piguard:
+    profiles: ["restricted", "godmode", "telegram-restricted", "telegram-godmode"]
+    image: ghcr.io/backendstack21/go-prompt-injection-guard:v1.0.0
+    command:
+      - "--socket=/run/piguard/piguard.sock"
+      - "--model-dir=/models"
+      - "--max-batch=32"
+      - "--batch-wait=5ms"
+    volumes:
+      - ./piguard/models:/models:ro
+      - piguard-sock:/run/piguard
+    healthcheck:
+      test: ["CMD-SHELL", "test -S /run/piguard/piguard.sock"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 60s
+    restart: unless-stopped
+
+  piguard-gateway:
+    profiles: ["restricted", "godmode", "telegram-restricted", "telegram-godmode"]
+    image: ghcr.io/backendstack21/go-prompt-injection-guard-gateway:v1.0.0
+    command: ["--addr=:8080", "--socket=/run/piguard/piguard.sock"]
+    volumes:
+      - piguard-sock:/run/piguard
+    depends_on:
+      piguard:
+        condition: service_healthy
+    restart: unless-stopped
+
+volumes:
+  piguard-sock:

docker/piguard/.gitignore

@@ -0,0 +1,7 @@
+# PIGuard model files — downloaded once by download-model.sh; do not commit.
+*.onnx
+*.data
+*.json
+tokenizer.*
+!/.gitkeep
+!/.gitignore

docker/piguard/download-model.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Download the PIGuard ONNX model and tokenizer into docker/piguard/models/.
+# This is a one-time step required before the PIGuard sidecar can start in
+# Docker Compose. The exported model is ~735 MB.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MODEL_DIR="${SCRIPT_DIR}/models"
+mkdir -p "${MODEL_DIR}"
+
+if [ -f "${MODEL_DIR}/model.onnx" ] && [ -f "${MODEL_DIR}/tokenizer.json" ]; then
+  echo "PIGuard model already present in ${MODEL_DIR}; nothing to do."
+  exit 0
+fi
+
+PIGUARD_REF="${PIGUARD_REF:-v1.0.0}"
+
+echo "Downloading and exporting PIGuard model (${PIGUARD_REF})..."
+echo "Output directory: ${MODEL_DIR}"
+
+# Run the export in a disposable Python container so no host Python/toolchain is
+# required. The guard repo's export_onnx.py downloads the model from HuggingFace
+# and converts it to ONNX.
+docker run --rm \
+  -v "${MODEL_DIR}:/out" \
+  -e HF_HOME=/tmp \
+  python:3.12-slim bash -c "
+    set -euo pipefail
+    apt-get update >/dev/null
+    apt-get install -y --no-install-recommends git curl ca-certificates >/dev/null
+    git clone --depth 1 --branch '${PIGUARD_REF}' \
+      https://github.com/BackendStack21/go-prompt-injection-guard.git /src
+    cd /src
+    pip install --no-cache-dir -r scripts/requirements.txt >/dev/null
+    python scripts/export_onnx.py
+    cp ~/.cache/piguard/onnx/* /out/
+  "
+
+echo "Done. Model files written to ${MODEL_DIR}:"
+ls -lh "${MODEL_DIR}"

docker/piguard/models/.gitkeep

@@ -0,0 +1,2 @@
+# Placeholder so the empty models directory is tracked by git.
+# Real model files (*.onnx, tokenizer.json, config.json) are gitignored.