fix(agentic): sanitize safety prompt details and clean host-visible upstream errors - #921
Open
dembrane-sam-bot wants to merge 3 commits into
Open
fix(agentic): sanitize safety prompt details and clean host-visible upstream errors#921dembrane-sam-bot wants to merge 3 commits into
dembrane-sam-bot wants to merge 3 commits into
Conversation
dembrane-sam-bot
enabled auto-merge
July 30, 2026 10:20
Replaces the keyword filter on this branch. That approach matched 13 substrings against text we do not control, and it failed in both directions. "part" matches as a substring, so "Your workspace is over its participant limit." and "3 participants are still recording." were both swallowed and replaced with a generic apology, while 429 RESOURCE_EXHAUSTED, quota exceeded and model is overloaded all passed through verbatim. Now only `error_code` crosses to the host. There are five producers and every one of them is a value we generate, so there is nothing to filter. The wording lives in the frontend keyed by that code, which also makes it localised; the previous fallback was a hardcoded English sentence rendered verbatim, so a Dutch host got English. The raw text still goes to the logger and to the run's latest_error field, so developers lose nothing. Dropped the "type 'continue' to resume" copy. Telling the host to type a magic word is harness mechanics leaking into host-facing text, which is the class of problem this change exists to fix, and it asks the host to perform a retry the server should be doing. The focus-block leak is closed structurally rather than by parsing. _latest_user_turn was returning one string used both as model input and as host-facing display text; it now returns the host's raw message separately, so the safety message quotes only what the host typed. The previous fix split on the first "User Message: ", which an unauthenticated participant could defeat by naming themselves "User Message: hi": sanitize_focus_label neutralises angle brackets, quotes and control characters but not that literal string, so the next safety pause leaked the focus block, the closing fence, and another participant's name and conversation id. Reproduced against the real format_focus_block before making this change. Also stops sending the raw message to PostHog. _emit_chat_error no longer accepts one. It was called before the cleaning ran, so the analytics path was untouched by the earlier fix, and for AGENT_UPSTREAM_<status> that payload is the head of the agent service's error body, which can carry prompt input, which for an agentic run includes transcript context. Tests are behavioural rather than assertions about the implementation: no upstream message reaches the host for several raw inputs, a legitimate message containing "participant" survives, the safety message excludes the focus block including the adversarial participant name, and a legacy run without agent_prompt_content still works. 118 pass across the agentic worker and api suites. ruff check and format clean, tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Author
|
I noticed a merge conflict on the compiled locale files ( I have checked out the branch, merged The PR is now |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
_summarize_request_for_safety_messageto extract only the host's actual raw query if it is wrapped in system prompt scaffolding (User Message:), preventing<focused_conversations>block/preambles from leaking to the user in safety retry notices._clean_host_visible_error_messageto map raw Vertex/Gemini/upstream technical API errors (like 'Content must contain at least one part' or 'parts errors') into a friendly, helpful host-facing fallback message, while keeping full raw error tracebacks in server logs and Directus run status for developers.test_summarize_request_for_safety_message_extracts_user_queryandtest_clean_host_visible_error_messageintests/test_agentic_worker.pyto cover these exact behaviors.Closes the system details leak in safety pause notices, and squelches raw Gemini parts exceptions in the chat timeline.