Investigate CLI Prompt Injection on Trails

Yes — at the CLI/hook layer it works.

What I found:

• Injection text lives in cmd/entire/cli/lifecycle.go:
  • A trail ties together the context for a branch. Use \entire trail` to view, create, update, or watch it.`
• It emits once per normal session on TurnStart, gated by clone-local .git/entire/preferences.json having "trails_enabled": true.
• Agents render it as:
  • Claude/Codex/Gemini: hookSpecificOutput.additionalContext
  • Pi/OpenCode: {"inject_context": "..."} which their extension/plugin parses and injects.

I verified:

• Targeted tests pass:
  • ContextInjector
  • TrailsEnabledForRepo
  • OpenCode plugin injection test
• Manual hook simulation in a temp repo with trails_enabled:true produced the expected stdout payload for Claude, Codex, Gemini, Pi, and OpenCode.
• Second turn emits nothing, as intended.
• With trails_enabled:false, emits nothing and marks the session decided.

Caveats:

• I did not run real-agent E2E; that would cost tokens.
• It only works if the local trails-enabled cache exists and is true. That cache is only refreshed during entire enable; already-enabled clones or stale false/nil caches won’t get the injection until re-enable or another cache refresh path is added.

Conclusion: the mechanism works, but its practical reliability depends on the trails_enabled cache being populated.

For this repo/session: no, not effectively.

Findings:

• Entire is enabled: .entire/settings.json has "enabled": true.
• Pi extension is installed and has the injection plumbing.
• Current Pi session state has context_injection_decided: true.
• But the local trail enablement cache is missing:
  • expected: .git/entire/preferences.json
  • actual: missing
• Since the code fails closed on missing cache, the hook marks injection “decided” but emits nothing.
• I checked the current Pi transcript: no hidden entire-context injected message was present.

Also: .opencode/plugins/entire.ts in this repo looks stale; it does not include the newer inject_context / experimental.chat.system.transform logic.

So: the code works generally, but this repo’s local hook state/cache means the trail prompt injection did not reach this current Pi session.

Short answer: the preferences file works as a local gate, but the population/refresh path is weak — in this repo it is not populated even though trails are accessible.

What I verified:

• Current repo path resolves to:
  • .git/entire/preferences.json
• Currently it is missing.
• settings.LoadClonePreferences() treats missing as {} → trailsEnabled == nil → injection gate is false.
• Temporarily writing:
  • {"trails_enabled": true} made the gate read true
  • {"trails_enabled": false} made it read false
• Existing test passes:
  • TestTrailsEnabledForRepo_ReadsClonePreference

But importantly:

• go run ./cmd/entire/main.go trail list --limit 1 --status any works in this repo and shows trails exist/access is enabled:
  • Recent trails · 1/631
• Yet .git/entire/preferences.json is absent.
• So normal trail usage does not refresh/write the cache.
• It looks like only entire enable writes this via reportRepoEnabled(), and that path is best-effort/silent. Existing enabled clones can easily never get the cache.

Current session impact:

• Latest Pi session has context_injection_decided: true.
• Since prefs were missing at first turn, the session failed closed and won’t retry even if prefs are added later.
• I checked the current Pi transcript: no hidden entire-context injected message; matches containing the text were from our visible discussion/tool output, not the injection.

So: preferences.json itself works; relying on it for this feature does not work reliably in this repo unless the cache is created before a new agent session starts.

Yes — preferences.json is safe from git, but the refresh model is too sparse.

• It lives at .git/entire/preferences.json via settings.ClonePreferencesFile = "entire/preferences.json".
• That is inside the git common dir, not the worktree.
• So it is not committed and not really “gitignored”; Git simply doesn’t track .git/… contents.
• In linked worktrees it is shared through the common git dir.

Reliability improvements I’d make:

1. Refresh on successful trail commands

   • Any successful entire trail list/show/create/update/delete/finding/watch response proves trails are enabled/accesssible.
   • So after those 2xx responses, call saveTrailsEnabledForRepo(ctx, true).
   • This alone would have fixed this repo, because entire trail list works here but didn’t populate prefs.

2. Refresh on definitive disabled responses

   • On 404/403/410 from trails endpoints, save false.
   • On network errors, auth errors, 5xx: do not overwrite the cache.

3. Add freshness metadata

   • Extend clone prefs with e.g.
     • trails_enabled_checked_at
     • trails_enabled_repo / remote key
   • Avoid stale true after origin changes or after trails are disabled.

4. Refresh opportunistically before agent turns

   • On SessionStart, if cache is missing/stale, kick off a bounded/background refresh.
   • Don’t do slow network work in TurnStart.
   • If cache is unknown, don’t set context_injection_decided; otherwise a missing cache permanently suppresses injection for that session.

5. Keep hook-time gate simple

   • TurnStart should only read local prefs:
     • fresh true → inject + mark decided
     • fresh false → mark decided/no inject
     • unknown/stale → request refresh, don’t mark decided

The key bug is: missing prefs currently behaves like false and is sticky per session. Better is unknown → refresh + retry later.

If we mean “not stale ever”, triggers alone aren’t enough. The safest model is:

1. Validate on use

   • Before injecting, only trust a cache entry if it matches current:
     • repo key: forge/owner/repo
     • origin URL hash or canonical remote
     • API base/core/context identity
     • checked timestamp / generation
   • If it doesn’t match: treat as unknown, not false.

2. Refresh on agent SessionStart

   • Best safe trigger for prompt injection.
   • It happens before TurnStart, off the direct model-prompt path.
   • If cache is missing/stale, do a bounded refresh.
   • If refresh hasn’t completed by TurnStart, don’t mark injection decided; try next turn.

3. Refresh on every successful trail API command

   • trail list/show/create/update/delete/finding/watch
   • Any 2xx from repo-scoped trail endpoint → write trails_enabled: true.
   • 403/404/410 → write false.
   • Network/5xx/timeouts → don’t overwrite.

4. Invalidate on identity changes

   • auth login/logout/use
   • ENTIRE_API_BASE_URL / context/core change
   • origin remote changes
   • mirror remote changes
   • For remote changes, don’t need active trigger if prefs stores repo_key; read path can detect mismatch.

5. Use a TTL

   • Even with triggers, server-side state can change without CLI knowing.
   • Positive and negative entries should expire.
   • For reliability, I’d make SessionStart revalidate if older than e.g. 1 hour; trail commands refresh opportunistically.

Key behavioral change: unknown/stale must not set context_injection_decided. Current behavior makes missing prefs sticky for the whole session, which is the main bug.

Implemented the trail context-injection cache refresh changes.

Key changes:

• Added scoped/fresh trail enablement cache in .git/entire/preferences.json:
  • trails_enabled
  • trails_enabled_checked_at
  • trails_enabled_repo_key
  • trails_enabled_api_base
  • trails_enabled_auth_key
• TurnStart now only reads local cache and injects only when cache is fresh true.
• Missing/stale/mismatched cache is now unknown and does not set ContextInjectionDecided.
• SessionStart does a bounded best-effort refresh before prompt-time injection.
• Repo-scoped entire trail ... commands refresh the cache opportunistically:
  • success → cache true
  • definitive 403/404/410 probe result → cache false
  • network/auth/5xx/ambiguous → no overwrite
• Cache is invalidated by repo/API/auth identity mismatch.
• Added tests for cache freshness/scope/auth mismatch and context injection decision behavior.
• Updated docs in docs/architecture/agent-guide.md.

Validation run:

• go test ./cmd/entire/cli/...
• mise run lint

Note: I did not create this repo’s .git/entire/preferences.json; with the updated binary, it will be populated by SessionStart refresh or a successful entire trail ... command.

Done.

• Branch: dip/trail-context-cache-refresh
• Commit: de2087233 Gate trail injection on enablement cache
• Pushed to: origin/dip/trail-context-cache-refresh
• PR URL: https://github.com/entireio/cli/pull/new/dip/trail-context-cache-refresh

Validation run:

• mise run check
• mise run lint

Working tree is clean.

Done — created and connected the branch via entire trail.

• Trail: #652
• URL: https://entire.io/gh/entireio/cli/trails/652
• Branch: dip/trail-context-cache-refresh
• Status: open
• Working tree: clean
• Local .git/entire/preferences.json now exists.

Updated trail #652 with detailed refresh/cache triggers and prompt-path behavior.

URL: https://entire.io/gh/entireio/cli/trails/652

Updated the trail wording to say unauthenticated responses (401) explicitly and clarify that network/timeouts/rate limits/5xx stay untouched because they can come and go.

Yes.

Implemented behavior:

• api.Client.TrailsEnabled() returns false, nil only for:

  • 403
  • 404
  • 410

• It returns an error for:

  • 401 unauthenticated
  • network/transport errors
  • timeouts
  • rate limits/other ambiguous statuses
  • 5xx

• refreshTrailsEnabledCacheForScope() only writes the cache after TrailsEnabled() returns nil error.

  • So 401 and network/5xx/etc. do not overwrite the cache.

Also, if auth fails before a client is created (entire login missing/invalid), runAuthenticatedDataAPI() exits before any trail cache refresh/write path runs.

Updated the trail body with simpler language and combined the successful entire trail ... / create triggers into one bullet.

Done. Reduced the new code comments substantially, amended the commit, and force-pushed the branch.

• New commit: 790b787c0 Gate trail injection on enablement cache
• Branch: dip/trail-context-cache-refresh
• Validation: mise run lint
• Working tree: clean.

Understood — sorry. I won’t amend commits again.

Going forward I’ll make follow-up changes as new commits only, and avoid history rewrites unless you explicitly ask.

If you want, I can repair this branch history by restoring the original commit plus a new “reduce comments” commit, but that would require one more force push.

It’s cached in the clone-local git common dir:

.git/entire/preferences.json

Fields include:

• trails_enabled
• trails_enabled_checked_at
• trails_enabled_repo_key
• trails_enabled_api_base
• trails_enabled_auth_key

In code: settings.ClonePreferencesFile = "entire/preferences.json" under the git common dir.

Merged latest origin/main, resolved the cmd/entire/cli/trail_cmd.go conflict, committed normally, and pushed.

• Merge commit: b23fa8d0a
• Branch: dip/trail-context-cache-refresh
• Validation: mise run check
• Working tree: clean

Fixed with a follow-up commit (no amend).

What changed:

• Added settings.ModifyClonePreferences(...), which holds a .git/entire/preferences.json.lock flock across load → mutate → atomic save.
• Switched trail enablement cache writes to use it.
• Switched review picker / migration clone-preference updates to use it too, so unrelated fields are preserved under concurrent writers.

Validation:

• mise run check
• mise run lint

Pushed:

• 6c8f798e8 Lock clone preference updates

Addressed with a follow-up commit (no amend):

• Reduced SessionStart trail refresh cap from 3s to 1s.
• Kept the 3s bound for non-startup best-effort trail command refreshes.
• Updated the trail body to document the 1s SessionStart cap.

Validation:

• go test ./cmd/entire/cli
• mise run lint

Pushed:

• 89df02466 Shorten session trail refresh timeout

Fixed with a follow-up commit (no amend):

• SessionStart now resolves the repo/API/auth scope and saves it as a per-session local scope hint.
• TurnStart now reads only local files:
  • the per-session trail scope hint
  • clone-local preferences
• No git remote get-url, auth resolution, or network work runs from emitContextInjection.
• If the scope hint is missing, injection stays unknown/retryable.

Validation:

• go test ./cmd/entire/cli -run 'TestHandleLifecycleTurnStart_ContextInjection|TestTrailsEnabledForRepo' -count=1
• mise run lint

Pushed:

• 3ae6e8d61 Keep trail injection prompt path local

Trail body updated to document this.

Validated live locally.

Checks performed:

• Real API trail lookup works:
  • go run ./cmd/entire/main.go trail show dip/trail-context-cache-refresh
  • Returned trail #652 successfully.
• Cache file is present and fresh:
  • .git/entire/preferences.json
  • trails_enabled: true
  • scope matches gh/entireio/cli, https://entire.io, current auth identity.
• Simulated real Pi hooks locally:
  • SessionStart wrote a per-session scope hint under .git/entire-sessions/...trail-scope.json.
  • Temporarily changed origin to a bogus repo before TurnStart.
  • TurnStart still emitted:
  • That verifies injection used the saved local scope hint + local prefs, not a live git remote get-url scope resolution on the prompt path.
• Restored origin, removed the temporary validation session files.
• Working tree is clean.
• Tests/lint on current code passed:
  • go test ./cmd/entire/cli ./cmd/entire/cli/settings ./cmd/entire/cli/review
  • mise run lint