🔧 update: inject sender userId into LLM context so owner is correctly identified via web dashboard

packages/core/src/loop.ts

@@ -130,6 +130,18 @@
   return text;
 }
 
+/**
+ * Strip characters from a userId that could break the sender-identity marker
+ * format or serve as a prompt-injection vector when embedded in a system prompt.
+ * 
+ * Backticks (`) are stripped to prevent escaping the marker's backticks.
+ * Square brackets [] are stripped to prevent breaking the marker format.
+ * Newlines (\n\r) are stripped to prevent multi-line injection.
+ */
+function sanitizeUserIdForPrompt(userId: string): string {
+  return userId.replace(/[`\\[\\]\\n\\r]/g, '');
+}
+
 // ---------------------------------------------------------------------------
 // Shield — in-memory pending approvals (conversational flow)
 // ---------------------------------------------------------------------------
@@ -873,8 +885,14 @@
   const sanitizedMessage = sanitizeMessage(message, userId, context.ownerId);
 
   // Build messages
+  // Embed sender identity directly in the system prompt so the LLM can
+  // correctly apply owner-vs-friend rules for this entire turn (including any
+  // follow-up tool-result messages). Placing it in a separate system message
+  // would leave subsequent tool-follow-up user messages without a sender marker
+  // and would shift message indices expected by tests.
+  const senderIdentityPrompt = `\n\n[Current message sender: userId = \`${sanitizeUserIdForPrompt(userId)}\`]`;
   const messages: Message[] = [
-    { role: 'system', content: systemPrompt },
+    { role: 'system', content: systemPrompt + senderIdentityPrompt },
     ...history,
     { role: 'user', content: sanitizedMessage },
   ];

packages/core/tests/loop.test.ts

@@ -52,6 +52,11 @@
     expect(systemPrompt).toContain('## Plugin Setup Guidance');
     expect(systemPrompt).toContain('For Discord, explain that they need to create an application');
     expect(systemPrompt).toContain('do not pretend the plugin is configured');
+    // Sender-identity must be embedded in the system prompt so the LLM always
+    // knows who sent the message — verify the marker is present and the very
+    // next message is the user turn (no separate system message in between).
+    expect(systemPrompt).toContain('[Current message sender: userId = `web:test`]');
+    expect(firstPrompt.at(-1)?.role).toBe('user');
   });
 
   test('turns structured write tool calls into a natural final reply', async () => {
@@ -113,6 +118,11 @@
 
     expect(result).toBe('I refreshed the configuration. Please restart Tiny Claw when convenient.');
     expect(prompts).toHaveLength(2);
+    // Sender-identity is embedded in the system prompt (prompts[0][0]) and
+    // immediately followed by the user message — no separate system entry.
+    expect(prompts[0]?.[0]?.role).toBe('system');
+    expect(prompts[0]?.[0]?.content).toContain('[Current message sender: userId = `web:test`]');
+    expect(prompts[0]?.at(-1)?.role).toBe('user');
     expect(prompts[1]?.at(-2)?.role).toBe('assistant');
     expect(prompts[1]?.at(-2)?.content).toContain('I used these tools and the results were:');
     expect(prompts[1]?.at(-2)?.content).toContain('Restart required: refresh config');
@@ -285,5 +295,17 @@
     );
     expect(prompts[1]?.at(-1)?.role).toBe('user');
     expect(prompts[1]?.at(-1)?.content).toContain('respond naturally to my original message');
-  });
-});
+    });
+    });
+
+    describe('sanitizeUserIdForPrompt', () => {
+    const { sanitizeUserIdForPrompt } = require('../src/loop.js');
+
+    test('strips backticks, brackets, and newlines', () => {
+    expect(sanitizeUserIdForPrompt('test`[id]\n')).toBe('testid');
+    expect(sanitizeUserIdForPrompt('normal-id')).toBe('normal-id');
+    expect(sanitizeUserIdForPrompt('')).toBe('');
+    expect(sanitizeUserIdForPrompt('`[\\n\\r]')).toBe('');
+    });
+    });
+    };// This is to close the outer describe block that was truncated in the initial read