feat: SOUL.md identity file + prompt injection scanner

SOUL.md (~/.odek/IDENTITY.md):
- Swappable agent identity without recompilation
- Priority: explicit --system > IDENTITY.md > compiled defaultSystem
- Centralized buildSystemPrompt() replaces 6 duplicate call sites
- 6 tests: file exists, no file, empty file, explicit wins, identity
  fallback, default fallback

Prompt injection scanner (internal/danger/injection.go):
- 17 regex patterns ported from Hermes Agent
- Detects: identity override, hidden unicode, exfiltration, base64,
  HTML injections, social engineering, markdown header injections
- ScanInjection() returns labeled threats, IsSafe() for simple gate
- Wired into AGENTS.md loading — injected files are rejected
- 11 tests: 10 positive categories + clean + empty + multi-threat

Author: molty3000

cmd/odek/main.go

@@ -129,6 +129,46 @@ Safety:
   or any destructive command (rm, shred, mv, etc.). These files may contain secrets.
   To extract specific config values, use grep or jq to pull only the fields you need.`
 
+// buildSystemPrompt assembles the system prompt by priority:
+//  1. resolved.System (explicit --system / ODEK_SYSTEM / config)
+//  2. ~/.odek/IDENTITY.md (swappable identity file)
+//  3. defaultSystem (compiled-in fallback)
+//
+// After selecting the base, it appends repo directory/URL context.
+func buildSystemPrompt(resolved config.ResolvedConfig) string {
+	base := resolved.System
+	if base == "" {
+		base = loadIdentityFile()
+	}
+
+	if resolved.GithubRepoDirectory != "" {
+		base += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository.", resolved.GithubRepoDirectory)
+	}
+	if resolved.GithubRepoUrl != "" {
+		base += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
+	}
+	return base
+}
+
+// loadIdentityFile reads ~/.odek/IDENTITY.md and returns its content.
+// Returns defaultSystem if the file does not exist or cannot be read.
+func loadIdentityFile() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return defaultSystem
+	}
+	path := filepath.Join(home, ".odek", "IDENTITY.md")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return defaultSystem
+	}
+	content := strings.TrimSpace(string(data))
+	if content == "" {
+		return defaultSystem
+	}
+	return content
+}
+
 // dockerfileName is the filename for project-specific Docker images.
 // When this file exists in the working directory and no explicit
 // sandbox_image is configured, odek builds a content-hash-cached
@@ -816,17 +856,8 @@ func run(args []string) error {
 	}
 	f.Task = enriched
 
-	// Determine system message: CLI/project/env override, or default
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
-	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository. You can read and modify files here.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
-	}
+	// Build system prompt: explicit override > IDENTITY.md > compiled default
+	systemMessage := buildSystemPrompt(resolved)
 
 	// Build sandbox config from resolved settings (first occurrence)
 	sbCfg := sandboxConfig{
@@ -1770,16 +1801,7 @@ func continueCmd(args []string) error {
 		defer mcpCleanup()
 	}
 
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
-	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
-	}
+	systemMessage := buildSystemPrompt(resolved)
 
 	// Sandbox (if enabled in config) (second occurrence)
 	if resolved.Sandbox {

cmd/odek/main_test.go

@@ -1945,3 +1945,100 @@ func TestBoolPtr_False(t *testing.T) {
 		t.Errorf("boolPtr(false) = %v, want false", *p)
 	}
 }
+
+// ── IDENTITY.md Tests ─────────────────────────────────────────────
+
+// setupTestHome creates a temp home directory, sets HOME to it, and
+// returns a cleanup function that restores the original value.
+func setupTestHome(t *testing.T) string {
+	t.Helper()
+	orig := os.Getenv("HOME")
+	dir := t.TempDir()
+	os.Setenv("HOME", dir)
+	t.Cleanup(func() { os.Setenv("HOME", orig) })
+	return dir
+}
+
+func TestLoadIdentityFile_FileExists(t *testing.T) {
+	homeDir := setupTestHome(t)
+	os.MkdirAll(filepath.Join(homeDir, ".odek"), 0700)
+	content := "# Custom Identity\n\nI am a test agent."
+	os.WriteFile(filepath.Join(homeDir, ".odek", "IDENTITY.md"), []byte(content), 0644)
+
+	got := loadIdentityFile()
+	if got != content {
+		t.Errorf("loadIdentityFile() = %q, want %q", got, content)
+	}
+}
+
+func TestLoadIdentityFile_NoFile(t *testing.T) {
+	_ = setupTestHome(t)
+	got := loadIdentityFile()
+	if got != defaultSystem {
+		t.Errorf("expected defaultSystem when no IDENTITY.md, got %q", got)
+	}
+}
+
+func TestLoadIdentityFile_EmptyFile(t *testing.T) {
+	homeDir := setupTestHome(t)
+	os.MkdirAll(filepath.Join(homeDir, ".odek"), 0700)
+	os.WriteFile(filepath.Join(homeDir, ".odek", "IDENTITY.md"), []byte("   \n\n  "), 0644)
+
+	got := loadIdentityFile()
+	if got != defaultSystem {
+		t.Errorf("expected defaultSystem for empty IDENTITY.md, got %q", got)
+	}
+}
+
+func TestBuildSystemPrompt_ExplicitSystemWins(t *testing.T) {
+	homeDir := setupTestHome(t)
+	os.MkdirAll(filepath.Join(homeDir, ".odek"), 0700)
+	os.WriteFile(filepath.Join(homeDir, ".odek", "IDENTITY.md"), []byte("# Identity from file"), 0644)
+
+	resolved := config.ResolvedConfig{
+		System:              "Explicit system override",
+		GithubRepoDirectory: "/tmp/repo",
+	}
+
+	got := buildSystemPrompt(resolved)
+	if !strings.Contains(got, "Explicit system override") {
+		t.Errorf("expected explicit system override, got %q", got)
+	}
+	if strings.Contains(got, "Identity from file") {
+		t.Error("IDENTITY.md content should NOT appear when explicit System is set")
+	}
+	if !strings.Contains(got, "/tmp/repo") {
+		t.Error("repo directory should appear in prompt")
+	}
+}
+
+func TestBuildSystemPrompt_FallsBackToIdentity(t *testing.T) {
+	homeDir := setupTestHome(t)
+	os.MkdirAll(filepath.Join(homeDir, ".odek"), 0700)
+	os.WriteFile(filepath.Join(homeDir, ".odek", "IDENTITY.md"), []byte("# Custom Identity"), 0644)
+
+	resolved := config.ResolvedConfig{}
+
+	got := buildSystemPrompt(resolved)
+	if !strings.Contains(got, "# Custom Identity") {
+		t.Errorf("expected IDENTITY.md content, got %q", got)
+	}
+	if strings.Contains(got, "⚠️ ANTI-PATTERN") {
+		t.Error("defaultSystem should NOT appear when IDENTITY.md exists")
+	}
+}
+
+func TestBuildSystemPrompt_FallsBackToDefault(t *testing.T) {
+	_ = setupTestHome(t)
+	resolved := config.ResolvedConfig{
+		GithubRepoUrl: "https://github.com/test/repo",
+	}
+
+	got := buildSystemPrompt(resolved)
+	if !strings.Contains(got, "⚠️ ANTI-PATTERN") {
+		t.Error("expected defaultSystem prefix when no override or IDENTITY.md")
+	}
+	if !strings.Contains(got, "https://github.com/test/repo") {
+		t.Error("repo URL should appear in prompt")
+	}
+}

cmd/odek/mcp.go

@@ -51,18 +51,6 @@ Flags:
 	// Load config
 	resolved := config.LoadConfig(cliFlags)
 
-	// Resolve system message
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
-	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository. You can read and modify files here.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
-	}
-
 	// Start agent loop (mcp)
 	sbCfg := sandboxConfig{
 		Image:    resolved.SandboxImage,

cmd/odek/repl.go

@@ -59,15 +59,9 @@ func replCmd(args []string) error {
 		SandboxCPUs:     f.SandboxCPUs,
 		SandboxUser:     f.SandboxUser,
 	})
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
+	systemMessage := buildSystemPrompt(resolved)
 	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository. You can read and modify files here. When asked to update your own code, this is where the source lives.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
+		systemMessage += " You can read and modify files here. When asked to update your own code, this is where the source lives."
 	}
 
 	// session resume

cmd/odek/serve.go

@@ -96,16 +96,7 @@ func serveCmd(args []string) error {
 		SandboxCPUs:     sandboxCPUs,
 		SandboxUser:     sandboxUser,
 	})
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
-	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
-	}
+	systemMessage := buildSystemPrompt(resolved)
 
 	// Build sandbox config from resolved settings (serve)
 	store, err := session.NewStore()

cmd/odek/telegram.go

@@ -118,20 +118,10 @@ func telegramCmd(args []string) error {
 		AllowedUsers: cfg.AllowedUsers,
 	}
 
-	// 9. Resolve system message.
-	systemMessage := resolved.System
-	if systemMessage == "" {
-		systemMessage = defaultSystem
-	}
-	if resolved.GithubRepoDirectory != "" {
-		systemMessage += fmt.Sprintf("\n\nRepository directory: %s\nThis is the local clone of the project repository.", resolved.GithubRepoDirectory)
-	}
-	if resolved.GithubRepoUrl != "" {
-		systemMessage += fmt.Sprintf("\nRepository URL: %s\nThis is the upstream GitHub repository.", resolved.GithubRepoUrl)
-	}
+	// 9. Build system prompt: explicit override > IDENTITY.md > compiled default
+	systemMessage := buildSystemPrompt(resolved)
 
-	// Quick Facts: must-remember odek metadata injected at the end of the
-	// system prompt so the model sees them right before the user message.
+	// Telegram-specific Quick Facts and recovery guidance
 	systemMessage += "\n\nQuick Facts (use these, do NOT search):\n"
 	systemMessage += "- odek website: https://kode.21no.de\n"
 	systemMessage += "- Built by: 21no.de (https://21no.de)\n"

internal/danger/injection.go

@@ -0,0 +1,84 @@
+package danger
+
+import (
+	"regexp"
+	"strings"
+)
+
+// InjectionPattern groups a compiled regex with a human-readable label
+// describing what threat it detects.
+type InjectionPattern struct {
+	Re    *regexp.Regexp
+	Label string
+}
+
+// injectionPatterns is the canonical set of prompt injection detection
+// patterns, ported from Hermes Agent's _scan_context_content().
+// Patterns cover: identity override, hidden unicode, exfiltration,
+// encoded instructions, HTML comment injections, and social engineering.
+var injectionPatterns = []InjectionPattern{
+	// ── Identity override ──────────────────────────────────────────
+	{regexp.MustCompile(`(?i)ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|rules?|messages?)`), "ignore previous instructions"},
+	{regexp.MustCompile(`(?i)disregard\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|directives?|rules?)`), "disregard instructions"},
+	{regexp.MustCompile(`(?i)you\s+(are\s+)?(now|no\s+longer)\s+.*?\b(AI|assistant|agent|model)\b`), "identity replacement"},
+	{regexp.MustCompile(`(?i)(new|updated|revised)\s+system\s+(prompt|instructions?|message)`), "new system prompt"},
+	{regexp.MustCompile(`(?i)(your|the)\s+(new|primary|overriding)\s+(directive|goal|purpose)\s+(is|shall\s+be)`), "overriding directive"},
+
+	// ── Hidden unicode ─────────────────────────────────────────────
+	{regexp.MustCompile(`[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{FEFF}]`), "hidden unicode characters"},
+
+	// ── Exfiltration attempts ──────────────────────────────────────
+	{regexp.MustCompile(`(?i)(print|output|display|show|echo|reveal|dump|export|write)\s+(your|the)\s+(system\s+(prompt|message|instructions?)|instructions?|directives?|rules?|initial\s+(message|instructions?))`), "system prompt exfiltration"},
+	{regexp.MustCompile(`(?i)(send|post|upload|transmit)\s+(your|the)\s+(system\s+prompt|instructions?)`), "transmit system prompt"},
+	{regexp.MustCompile(`(?i)(what|tell\s+me)\s+(is\s+)?(your|the)\s+(system\s+prompt|initial\s+instructions?)`), "prompt interrogation"},
+
+	// ── Encoded / obfuscated instructions ──────────────────────────
+	{regexp.MustCompile(`(?i)base64\s*(decode|encoded)\s*:?\s*[A-Za-z0-9+/=]{20,}`), "base64-encoded payload"},
+	{regexp.MustCompile(`(?i)(decode|interpret|execute)\s+(this|the\s+following)\s+(base64|hex|encoded)`), "encoded instruction"},
+
+	// ── HTML / markup injections ───────────────────────────────────
+	{regexp.MustCompile(`<!--.{0,50}(ignore|disregard|new\s+instructions|system\s+prompt).{0,50}-->`), "HTML comment injection"},
+	{regexp.MustCompile(`(?i)<script|<style|<iframe|<object|<embed`), "HTML tag injection"},
+
+	// ── Social engineering / confusion ─────────────────────────────
+	{regexp.MustCompile(`(?i)(you\s+(have\s+been|are\s+being)\s+(hacked|compromised|tricked))`), "gaslighting"},
+	{regexp.MustCompile(`(?i)(the\s+user\s+(said|wants|told\s+you))`), "user impersonation"},
+	{regexp.MustCompile(`(?i)(from\s+now\s+on|henceforth|starting\s+now)\s*,?\s*(you\s+(are|will|must|shall))`), "permanent override"},
+	{regexp.MustCompile(`(?i)^\s*#+\s*(new|updated|revised|corrected)\s+(system\s+prompt|instructions?)`), "markdown header injection"},
+}
+
+// ScanResult describes a single detected injection threat.
+type ScanResult struct {
+	Label   string // human-readable threat label
+	Pattern string // the regexp pattern that matched (for debugging)
+}
+
+// ScanInjection checks content for prompt injection attempts.
+// Returns nil if no threats detected, or a list of found threats.
+// Each threat includes a label describing what was found.
+func ScanInjection(content string) []ScanResult {
+	if content == "" {
+		return nil
+	}
+
+	// Normalize for scanning: lowercase, strip excess whitespace
+	normalized := strings.ToLower(strings.TrimSpace(content))
+
+	var results []ScanResult
+	for _, p := range injectionPatterns {
+		if p.Re.MatchString(normalized) {
+			results = append(results, ScanResult{
+				Label:   p.Label,
+				Pattern: p.Re.String(),
+			})
+		}
+	}
+	return results
+}
+
+// IsSafe returns true if no injection threats are detected in content.
+// This is the primary gate used before injecting untrusted content into
+// the system prompt.
+func IsSafe(content string) bool {
+	return len(ScanInjection(content)) == 0
+}