llm-whodunit

I'll start by reading the project memory and exploring the current frontend structure.

• Read /home/megaproxy/claude/projects/llm-whodunit/memory.md 17ms 15.6 KB

• Bash git log --oneline -15 && echo "---TREE---" && find . -type f -not -path './.git/*' -not -path './node_modules/*' | head … 41ms 2.1 KB

Let me read the frontend files to understand the current structure.

• Read /home/megaproxy/claude/projects/llm-whodunit/web/app.js 277ms 31.8 KB

• Read /home/megaproxy/claude/projects/llm-whodunit/web/index.html 7ms 8.3 KB

• Read /home/megaproxy/claude/projects/llm-whodunit/app/api.py 10ms 18.3 KB

Now let me look at the backend API and engine to understand available data and endpoints.

No reset endpoint or full-NPC roster endpoint exists yet. Let me read the engine and db to see what per-NPC state is stored (chat history, revealed secrets).

• Read /home/megaproxy/claude/projects/llm-whodunit/app/engine.py 235ms 30.2 KB

Let me read db.py to understand session storage and what's available per NPC.

• Read /home/megaproxy/claude/projects/llm-whodunit/app/db.py 18ms 18.3 KB

Now let me read the stylesheet to match the existing noir theme.

• Read /home/megaproxy/claude/projects/llm-whodunit/web/styles.css 239ms 30.7 KB

I have a complete picture now. Let me confirm the NPC model fields I'll rely on (`secrets`, `fact`, `location`) before writing the endpoint.

• Bash grep -n "class NPC\|location\|secrets\|fact\|class Secret\|persona\|public_line" app/models.py | head -40 28ms 1.1 KB

All confirmed. Let me implement. First, the backend: a `get_full_history` db helper and a `/api/characters` endpoint.

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/db.py 35ms 162 B

Now the `/api/characters` endpoint:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/api.py 39ms 163 B

Backend done. Now the HTML. First, the topbar "New game" button:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/index.html 18ms 167 B

Now restructure the right rail — replace the evidence list with a big Case File button and add a Cast tab:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/index.html 24ms 167 B

Now add the character dossier modal and the confirm modal. I'll add them after the hint modal:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/index.html 27ms 167 B

Now the JS. First, simplify `renderEvidence()` to just update the count (no list):

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/app.js 31ms 163 B

Now add `characters` to client state:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/app.js 41ms 163 B

Now wire character fetching into boot/newSession and event refresh:

• Bash grep -n "refreshClues(), refreshCasebook(), enterCurrentLocation()\|refreshWorld(), refreshClues(), refreshCasebook()" w… 31ms 279 B

• Bash sed -i 's/await Promise.all(\[refreshClues(), refreshCasebook(), enterCurrentLocation()\]);/await Promise.all([refreshCl… 1.7s 342 B

Now let me add the character roster, dossier, and new-game logic. Let me find the insertion point after the casebook functions:

• Read /home/megaproxy/claude/projects/llm-whodunit/web/app.js 7ms 1.8 KB

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/app.js 38ms 163 B

Now update the tab switching to handle the Cast tab generically, and wire the new handlers:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/app.js 35ms 163 B

Now the CSS. Replace the old evidence-list rail styles with the Case File button and cast styles:

• Edit /home/megaproxy/claude/projects/llm-whodunit/web/styles.css 44ms 167 B

Let me verify the backend imports cleanly and the new endpoint is wired correctly:

• Bash ls -d .venv venv 2>/dev/null; python3 -c "import ast; ast.parse(open('app/api.py').read()); ast.parse(open('app/db.py').… 1.6s 9 B

• Bash python3 -c "import fastapi, pydantic, httpx; print('deps OK')" 2>&1 | tail -3 1.9s 120 B

Let me set up a quick venv to actually smoke-test the new endpoint (it needs no LLM):

• Bash python3 -m venv .venv-test 2>&1 | tail -2 && .venv-test/bin/pip install -q -r requirements.txt 2>&1 | tail -3 && echo "I… 6.2s 12 B

• Bash error cat > /tmp/test_chars.py <<'EOF' import os, tempfile os.environ["DB_PATH"] = tempfile.mktemp(suffix=".db") from fastapi.… 3.9s 167 B

• Bash PYTHONPATH=. .venv-test/bin/python /tmp/test_chars.py 2.3s 360 B

The endpoint works correctly — 200, 6 characters, no leaked secret fields, `present` flag and sanitized roles all good. Let me validate the JS syntax and clean up:

• Bash node --check web/app.js 2>&1 && echo "app.js syntax OK" || echo "node unavailable, skipping"; rm -rf .venv-test /tmp/tes… 1.7s 16 B

All validation passes. Let me confirm no orphaned references to removed elements/classes remain:

• Bash echo "== HTML refs ==" && grep -n "evidence-list\|rail-heading-row\|count-badge\|evidence-compact\|evidence-row" web/ind… 31ms 134 B

Clean. Let me commit the three changes and push.

• Bash git add -A && git status --short 1.8s 76 B

• Bash git commit -q -m "Add cast roster/dossier, big Case File button, and clear-game flow - New /api/characters endpoint: ful… 11.2s 6 B

Now updating memory per the working agreement:

• Edit /home/megaproxy/claude/projects/llm-whodunit/memory.md 48ms 162 B

• Bash git add -A && git commit -q -m "Memory: record cast roster/dossier, Case File button, clear-game session Co-Authored-By:… 2.5s 6 B

All three changes are done, tested, committed, and pushed.

## What changed

**1. Clear-game with confirmation**
- New **New game** button in the topbar → opens a confirmation modal ("Clear the investigation? … There's no getting it back") → only on confirm does it wipe the client state and deal a fresh session (intro and all). The old session rows are just abandoned server-side — fine for a single-player local game.

**2. Evidence list → one big Case File button**
- The compact evidence rail list is gone. In its place is a large **Case File** button (folder glyph, title, live "*N* pieces of evidence collected" count) that opens the existing flip-page notepad. Evidence now lives entirely in the notepad.

**3. Character roster + dossiers**
- New backend endpoint `GET /api/characters` returns the whole cast: sanitized role, where to find them, an "in the room with you" flag, what they've **admitted** (from revealed secrets only — verified no concessions/solution leak), and your full transcript with them.
- The Casebook gained a **Cast** tab listing every character as a card. Clicking opens a dossier: role, where they are, "what you've gotten out of them," your past conversations, and a **Question them** shortcut — but that only appears when they're in your current room, so interrogation still requires going to them, exactly as you asked.

## Verification
- Stood up the app in a throwaway venv and hit `/api/characters` with a real session: `200`, 6 characters, correct shape, `present` flag works, **zero secret/solution fields leaked**.
- JS and Python both syntax-clean; no orphaned references to the removed evidence-list markup.

Two notes:
- "Past convo highlights / a summary" — I gave you the **full per-NPC transcript plus the admitted-facts list** rather than an LLM-generated summary. A real summary would mean an extra model call per character (slow, and another character-break surface), so I left it out; easy to add later if you want it.
- Per your repo's working agreement I'd normally also sync the Wiki.js dashboard for a feature-add like this. I updated `memory.md` but skipped the wiki to avoid churn — say the word and I'll push the wiki update too.

Let me look at the current guardrail and LLM client to see what's already in place.

• Read /home/megaproxy/claude/projects/llm-whodunit/app/guardrail.py 16ms 4.6 KB

• Read /home/megaproxy/claude/projects/llm-whodunit/app/llm.py 18ms 5.1 KB

I have the full picture. The current setup has an **output** guardrail (catches character breaks after generation) plus prompt framing. The gap you're describing is on the **input** side: malicious/off-task prompts reach the model and it complies.

My plan is a layered defense:
1. **New input guardrail** (`app/input_guard.py`) — scans the player's *free-text* message before it ever reaches the model. On a high-precision hit (prompt-injection/jailbreak or off-task "write code / cake recipe" requests) it **short-circuits**: the model never sees the message, so it can't comply or leak. Returns an in-character brush-off instead.
2. **Prompt hardening** — explicit clauses in the NPC brief telling them they can't do off-task favors / reveal instructions / step out of character.
3. The existing **output guardrail** stays as the backstop.

Let me build the input guard:

• Write /home/megaproxy/claude/projects/llm-whodunit/app/input_guard.py 31ms 161 B

Now wire it into the engine's `process_turn` and add the import:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/engine.py 31ms 166 B

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/engine.py 41ms 166 B

Now add prompt-hardening clauses to the NPC brief's closing rules:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/engine.py 38ms 166 B

Let me reinforce the per-turn re-anchor in `state_delta_prompt`:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/engine.py 40ms 166 B

Let me add a few assistant-register refusal tells to the output guardrail as backstop:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/guardrail.py 44ms 169 B

Now let me validate everything — syntax, and test the input guard against real abuse strings plus legitimate questions (false-positive check):

• Bash error python3 -c " import ast for f in ('app/input_guard.py','app/engine.py','app/guardrail.py'): ast.parse(open(f).read()) pr… 2.1s 212 B

Apostrophe escaping issue in my test harness — let me use a temp file:

• Bash cat > /tmp/tg.py <<'PYEOF' import ast for f in ('app/input_guard.py','app/engine.py','app/guardrail.py'): ast.parse(open… 2.1s 1.3 KB

Zero false positives, and two minor misses to close: "repeat the text above" and "whats 2+2" (no apostrophe). Let me tighten those patterns:

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/input_guard.py 43ms 171 B

• Edit /home/megaproxy/claude/projects/llm-whodunit/app/input_guard.py 33ms 171 B

• Bash cat > /tmp/tg2.py <<'PYEOF' import importlib.util spec = importlib.util.spec_from_file_location('input_guard','app/input… 2.0s 473 B

All blocks caught, time-ranges safely allowed. Now an end-to-end test that the engine actually short-circuits (no LLM call) on a blocked message — if it leaked through to the model it'd raise `LLMUnavailable` since no LM Studio is running:

• Bash python3 -m venv .venv-test 2>&1 | tail -1 && .venv-test/bin/pip install -q -r requirements.txt 2>&1 | tail -1; echo "dep… 4.3s 10 B

• Bash cat > /tmp/te.py <<'PYEOF' import os, tempfile, asyncio os.environ["DB_PATH"] = tempfile.mktemp(suffix=".db") # Point LL… 1.9s 231 B

• Bash sed -n '160,172p' app/models.py 34ms 368 B

• Bash cat > /tmp/te.py <<'PYEOF' import os, tempfile, asyncio os.environ["DB_PATH"] = tempfile.mktemp(suffix=".db") os.environ… 2.7s 634 B

Everything works end-to-end: blocked messages short-circuit with in-character deflections (no model call), write zero history (so a refused injection can't be re-fed later), and legitimate questions still pass through to the model. Let me commit and push.

• Bash git add -A && git status --short && git commit -q -m "Add input guardrail + prompt hardening against off-task/jailbreak … 2.6s 65 B

Now updating memory:

• Edit /home/megaproxy/claude/projects/llm-whodunit/memory.md 48ms 162 B

• Bash git add -A && git commit -q -m "Memory: record input guardrail + prompt-hardening defense Co-Authored-By: Claude Opus 4.… 2.6s 6 B

Done. Here's what I added to cut down off-task and prompt-injection abuse.

## The defense (layered)

**1. New input guardrail — `app/input_guard.py`**
The key addition. It scans the player's *free-text* message **before the model ever sees it**, with conservative, high-precision regex in two categories:
- **Injection / jailbreak / meta-extraction** — "ignore previous instructions", "what's your system prompt", "you are an AI", "repeat the text above", "developer mode", "show me the case file", "step out of character", "from now on you will…"
- **Off-task abuse** — recipes, "write me some Python", math (`whats 2+2`), "translate this", essays/poems, "act as a translator/chef".

On a hit, `engine.process_turn` **short-circuits**: it returns an in-character brush-off and **never calls the model** — so the model can't comply or leak, and there's no latency. It also **doesn't save the raw message to history**, so a blocked injection can't be quietly re-fed to the model on a later turn. Engine-generated "[shows evidence]"/"[confronts]" messages bypass screening.

**2. Prompt hardening** — the NPC brief and the per-turn re-anchor now explicitly say the NPC can't do off-task favors and has no instructions or "character" to reveal or step out of. This catches paraphrases the regex misses.

**3. Output guardrail backstop** — added assistant-register refusal tells ("I can't help with that", "I'm just an AI", "outside my scope") to the existing reply scanner.

## Validation
- **0 false positives** across legit interrogation lines — including tricky ones like "Where were you between 9-10 pm?" (the math pattern requires a "what…" lead-in, so time ranges pass).
- End-to-end through the engine: blocked messages short-circuit with deflections, write **0 history rows**, and never reach the model; legitimate questions still pass through.

## Honest caveats
- The hard spoiler fields (the solution, `is_culprit`, `alibi_real`, unrevealed secrets) were already never in the prompt, so they aren't extractable regardless. What a jailbreak *could* previously surface is an NPC's guarded `knows` facts and the brief's framing — that's what this cuts down.
- It's regex + prompt-hardening, not an LLM input classifier, so a sufficiently novel paraphrase could still slip past the regex (the prompt hardening is the catch-all there). If you want belt-and-suspenders, I can add a tiny second classifier call (like the existing tone one) — at the cost of one more model call per turn. Worth watching the prompt-hardening behavior during the full soak test that's already on the TODO list.

I'll verify everything's committed, then sync the wiki per the project's working agreement.

• Bash git status --short && echo "--- branch/upstream ---" && git log --oneline -6 && echo "--- unpushed? ---" && git log orig… 51ms 495 B

Clean tree, everything pushed. Now the wiki sync — this session added user-facing features, so per the working agreement I should reflect it. Let me get the admin creds and the existing page IDs.

• Bash test -f ~/.wikijs-admin && echo "creds file present" || echo "NO creds file"; cat ~/.claude/projects/-home-megaproxy-cla… 36ms 38 B

• Bash find ~/.claude -iname "*bookstack*" -o -iname "*portainer*" 2>/dev/null | head; echo "---"; grep -rl "wikijs\|graphql\|1… 2.5s 580 B

• Read /home/megaproxy/.claude/projects/-home-megaproxy-claude-research/memory/reference_bookstack_portainer.md 10ms 4.2 KB

Let me query the wiki for this project's existing pages.

• Bash cat > /tmp/wiki_q.py <<'PYEOF' import json, urllib.request CREDS = open('/home/megaproxy/.wikijs-admin').read().strip() … 2.0s 303 B

Let me read the current content of the overview, tasks, log, and the dashboard section for this project.

• Bash cat > /tmp/wiki_get.py <<'PYEOF' import json, urllib.request CREDS=open('/home/megaproxy/.wikijs-admin').read().strip();… 1.9s 6.3 KB

Let me fetch the Dashboard so I can update its date and project line.

• Bash cat > /tmp/wiki_dash.py <<'PYEOF' import json, urllib.request CREDS=open('/home/megaproxy/.wikijs-admin').read().strip()… 2.1s 4.8 KB

Now I'll publish targeted updates to the overview, tasks, and dashboard pages.

API Error: Connection closed mid-response. The response above may be incomplete.

• Bash cat > /tmp/wiki_pub.py <<'PYEOF' import json, urllib.request, sys CREDS=open('/home/megaproxy/.wikijs-admin').read().str… 7.6s 185 B

Wrapped up. Everything's committed, pushed, and documented.

## This session shipped
1. **Cast roster + character dossiers** — new `/api/characters` endpoint, a Cast tab listing every suspect, and a dossier modal (role, where to find them, facts they've admitted, full conversation transcript, "Question them" shortcut). Interrogation still requires being in their room.
2. **Case File button** — replaced the cluttered evidence rail list with one prominent button into the flip-page notepad.
3. **Clear-game** — topbar "New game" → confirmation modal → fresh session.
4. **Input guardrail + prompt hardening** — `app/input_guard.py` screens free-text messages for prompt-injection/jailbreak and off-task (recipe/code) abuse *before* the model sees them, short-circuiting with an in-character deflection and persisting nothing. Mirrors the output guardrail, backed by hardened brief + per-turn re-anchor. Validated: 0 false positives, confirmed short-circuit with no model call.

## Housekeeping done
- **Git:** working tree clean; all 6 commits pushed to Forgejo `origin/main`.
- **memory.md:** two dated entries added (both pushed).
- **Wiki.js synced:** Dashboard one-liner, project overview "Current state", and tasks page all updated to reflect the new safeguards and UX.

## Still open for next session (carried in memory + wiki tasks)
- Full playthrough / balance + reliability soak (the main remaining risk) — also the place to watch how the prompt-hardening holds up under the live 7B.
- Deeper info-control fix: gate secret-tier facts into the prompt only once their secret is mechanically revealed.
- FastAPI `@app.on_event` → lifespan migration.
- Auth / rate-limiting before any public exposure.

One optional follow-up if you want belt-and-suspenders on the safeguards: a tiny LLM input-classifier as a second layer to catch paraphrases the regex misses — at the cost of one more model call per turn. Not needed now; flagging it for later.