Prevent model protocol envelopes from leaking into chat - #793
Draft
Y1fe1Zh0u wants to merge 2 commits into
Draft
Conversation
Private Runs now complete from normal Assistant content and normalized provider stop reasons. Group Runs stage structured mentions through the dedicated at tool before the existing handoff preflight, keeping public text separate from routing intent. Constraint: Preserve one-version compatibility for legacy finish checkpoints while removing finish from new model-visible tool schemas Rejected: Parse arbitrary final-answer text as control JSON | would corrupt legitimate user-requested JSON responses Confidence: high Scope-risk: broad Reversibility: clean Directive: Keep Assistant content, provider termination, Group mention intent, and delivery side effects as separate contracts Tested: 164 focused backend tests; git diff --check Not-tested: Real provider and live Group child-Run E2E
Normalize embedded reasoning and exact textual tool structures before Runtime completion can publish them. Legacy Group finish JSON is decoded through the existing validation and handoff path, while unverified textual results receive one bounded repair instead of being shown as executed output. Ordinary user-requested JSON remains untouched. Constraint: Thinking must use the existing reasoning channel and tool activity must use real tool events. Rejected: Strip all JSON-looking output | would corrupt legitimate JSON answers and still bypass tool execution. Confidence: high Scope-risk: moderate Directive: Do not broaden JSON detection without preserving ordinary user-requested JSON responses. Tested: 2117 backend pytest tests; focused Ruff checks; git diff --check Not-tested: Live provider and browser E2E
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
finishcontrol tool.<think>...</think>blocks into the existing structured reasoning channel instead of publishing them as message content.<result>/<tool_result>text with one bounded repair instead of presenting invented output as an executed result.Root cause
The Runtime treated any non-empty tool-free provider response as publishable Assistant content. Some providers place reasoning or pseudo tool protocol in that content, so
<think>blocks, textual results, and the old Group finish JSON shape could reach the visible message body without structured execution or validation.User impact
Private Agent chat now uses the existing Thinking and tool UI paths for structured activity. Group replies no longer expose legacy finish control fields, while Group mention routing still uses stable participant IDs and preflight validation.
Validation
2117 passed85 passedgit diff --check: passedNot tested