fix(security): separate untrusted channel metadata from system prompt (thanks @KonstantinMirin)

This commit is contained in:
Peter Steinberger
2026-02-03 23:02:28 -08:00
parent 6fdb136688
commit 35eb40a700
13 changed files with 289 additions and 29 deletions

View File

@@ -67,6 +67,7 @@ export type ExternalContentSource =
| "email"
| "webhook"
| "api"
| "channel_metadata"
| "web_search"
| "web_fetch"
| "unknown";
@@ -75,6 +76,7 @@ const EXTERNAL_SOURCE_LABELS: Record<ExternalContentSource, string> = {
email: "Email",
webhook: "Webhook",
api: "API",
channel_metadata: "Channel metadata",
web_search: "Web Search",
web_fetch: "Web Fetch",
unknown: "External",