fix(agent): re-anchor before session_search for ambiguous continuations

[ilonagaja509-glitch]

Fixes #30498

Problem

SESSION_SEARCH_GUIDANCE encouraged session_search whenever cross-session context might exist, but did not distinguish between:

• explicit historical recall (where session_search should be used)
• ambiguous continuation requests in gateway threads (where current session/thread/project state should be checked first)

For ambiguous continuations like "continue", "remaining work", or "what were we doing" in a gateway thread, the agent could pick a cross-thread search result and treat it as the active task context, leading to incorrect file edits or status reports.

Solution

Update SESSION_SEARCH_GUIDANCE to include re-anchoring rule:

• Treat session_search as cross-session history lookup, not the source of truth for ambiguous continuations
• For ambiguous continuation requests, first re-anchor on the active session/thread and inspect current project/board state
• Only use session_search afterward for explicitly historical context

Tests

Added test test_session_search_guidance_requires_reanchoring_for_ambiguous_continuations asserting the new guidance includes:

• re-anchoring requirement
• current active session handling
• ambiguous continuation distinction
• cross-session recall still supported

[keegoid-codex]

Severity

• [CAT-3] low. Prompt guidance and substring-only tests change no runtime contract.

VERDICT: approve

---

codex-review posting override: forced to --comment because reviewer lacks verified write permission (viewerPermission=READ; was --approve). GitHub only counts approvals from WRITE, MAINTAIN, or ADMIN reviewers.

[keegoid-cc]

[DEV SecOps] verdict: PASS
verified at d0d4ed7

• PR: fix(agent): re-anchor before session_search for ambiguous continuations #30502
• Scope inspected: agent/prompt_builder.py and tests/agent/test_prompt_builder.py; 15 added / 1 removed; one commit.
• Prompt-injection: no new instruction-bearing or hidden-Unicode steering in added guidance/test lines, PR body, title, or commit message. Existing prompt-injection fixture strings in tests/agent/test_prompt_builder.py are pre-existing scanner tests, not modified by this PR.
• Dependencies / lockfiles: no manifest or lockfile files touched; no new dependency to registry-check.
• CI / workflow injection: no workflow or CI files touched; no new pull_request_target, secrets.*, self-hosted runner, or github.event/inputs interpolation surface.
• Generated/copied code provenance: no new >30-line generated/copied block; small hand-authored guidance/test assertion change only.
• Secrets / suspicious behavior: no secret patterns, network egress, shell execution, base64/eval/exec/subprocess, or credential-exfiltration patterns in the diff.
• Residual risk: read-only static inspection only; did not execute PR code or tests.

[keegoid-cc]

[DEV SecOps] verdict: PASS
verified at d0d4ed7

• Prompt-injection: no findings. Scanned changed prompt string, added test comments/string literals, PR title/body, and commit message against trigger fixture plus hidden-Unicode controls; no trigger or steering payload found. Note: PR intentionally changes SESSION_SEARCH_GUIDANCE, but added text narrows session_search behavior and does not introduce credential, tool, or authority escalation instructions.
• Dependency / lockfile: no findings. No package manifests or lockfiles changed.
• CI / workflow injection: no findings. No workflow or CI files changed.
• Generated/copied code provenance: no findings. Diff is small (+15/-1 across two existing Python files); no large generated/copied block.
• Secret exposure / suspicious ops: no findings. Added lines contain no secrets, tokens, subprocess/shell/network calls, base64 blobs, or file-permission changes.
• Read-only checks used: gh-as cc PR metadata and diff, git fetch of pinned commit object without checkout, static diff/context inspection, trigger/unicode/secret/ops pattern scans. Did not execute PR code.
• Residual risk: limited to functional prompt-policy semantics outside SecOps scope; functional reviewer should decide whether the re-anchor wording is product-correct.

[lkz-de]

Thanks for putting this together. I agree with the direction here: the re-anchor guidance is a useful prompt-level mitigation for ambiguous continuation requests.

I opened #70105 as the runtime/tool-layer follow-up for the same failure mode. The gap this PR cannot close by itself is that session_search results currently do not tell the model which conversation a hit came from, and group-context recall is not scoped to the active chat by default. So a fresh or expired group session can still get a plausible-looking result from another chat and treat it as local history.

#70105 keeps this re-anchor idea but adds the enforceable provenance/scoping layer: chat-origin metadata in session_search results, same-chat default scope for group-like contexts, explicit scope="all" for cross-conversation recall, same_origin=false labels, and warnings on foreign-session reads/scrolls.

So I see the two as complementary: this PR improves the guidance, and #70105 makes the default enforceable at the tool layer. Happy to rebase #70105 around whatever lands first, or trim the overlapping prompt-guidance lines there if maintainers prefer to land this smaller guidance PR separately.