fix(security): Harden Lisp reader against macro injection in reason loop

literate/reason.org

@@ -69,8 +69,9 @@ The `think` function represents the "intuitive" side of the agent. It identifies
                      ;; Ensure we are working with a string for read-from-string
                      (cleaned (if (stringp thought) (string-trim '(#\Space #\Newline #\Tab) thought) thought)))
                 (if (stringp cleaned)
+                    (let ((*read-eval* nil))
                       (handler-case (read-from-string cleaned)
-                      (error (c) (list :type :EVENT :payload (list :sensor :syntax-error :code cleaned :error (format nil "~a" c)))))
+                        (error (c) (list :type :EVENT :payload (list :sensor :syntax-error :code cleaned :error (format nil "~a" c))))))
                     cleaned))
               (list :type :LOG :payload (list :text (format nil "Skill '~a' triggered (Deterministic only)" (skill-name active-skill))))))
         nil)))

literate/setup.org

@@ -50,6 +50,8 @@ setup_system() {
         [ -n "$anthropic_key" ] && sed -i "s|ANTHROPIC_API_KEY=.*|ANTHROPIC_API_KEY=\"$anthropic_key\"|" .env
         read -p "OpenAI API Key: " openai_key < /dev/tty
         [ -n "$openai_key" ] && sed -i "s|OPENAI_API_KEY=.*|OPENAI_API_KEY=\"$openai_key\"|" .env
+        read -p "OpenRouter API Key: " openrouter_key < /dev/tty
+        [ -n "$openrouter_key" ] && sed -i "s|OPENROUTER_API_KEY=.*|OPENROUTER_API_KEY=\"$openrouter_key\"|" .env
 
         echo -e "\n${YELLOW}--- Memex Folder Structure ---${NC}"
         echo "Enter the absolute paths for your existing folder structure (press Enter to accept default)."

opencortex.sh

@@ -41,6 +41,8 @@ setup_system() {
         [ -n "$anthropic_key" ] && sed -i "s|ANTHROPIC_API_KEY=.*|ANTHROPIC_API_KEY=\"$anthropic_key\"|" .env
         read -p "OpenAI API Key: " openai_key < /dev/tty
         [ -n "$openai_key" ] && sed -i "s|OPENAI_API_KEY=.*|OPENAI_API_KEY=\"$openai_key\"|" .env
+        read -p "OpenRouter API Key: " openrouter_key < /dev/tty
+        [ -n "$openrouter_key" ] && sed -i "s|OPENROUTER_API_KEY=.*|OPENROUTER_API_KEY=\"$openrouter_key\"|" .env
 
         echo -e "\n${YELLOW}--- Memex Folder Structure ---${NC}"
         echo "Enter the absolute paths for your existing folder structure (press Enter to accept default)."

src/reason.lisp

@@ -44,8 +44,9 @@
                      ;; Ensure we are working with a string for read-from-string
                      (cleaned (if (stringp thought) (string-trim '(#\Space #\Newline #\Tab) thought) thought)))
                 (if (stringp cleaned)
+                    (let ((*read-eval* nil))
                       (handler-case (read-from-string cleaned)
-                      (error (c) (list :type :EVENT :payload (list :sensor :syntax-error :code cleaned :error (format nil "~a" c)))))
+                        (error (c) (list :type :EVENT :payload (list :sensor :syntax-error :code cleaned :error (format nil "~a" c))))))
                     cleaned))
               (list :type :LOG :payload (list :text (format nil "Skill '~a' triggered (Deterministic only)" (skill-name active-skill))))))
         nil)))