fix(redact): strip complete CSI/SGR sequences from shadow copy (#81012) - #81079
Closed
Enough1122 wants to merge 4 commits into
Closed
fix(redact): strip complete CSI/SGR sequences from shadow copy (#81012)#81079Enough1122 wants to merge 4 commits into
Enough1122 wants to merge 4 commits into
Conversation
NousResearch#81052) When a queued-follow-up turn finishes before the stream consumer confirms final delivery, gateway/run.py falls back to adapter.send(first_response) and the normal completion pipeline then issues the same text a second time. Track (chat_id, session_key) tuples delivered via the fallback path in a set scoped to the pending-message handling block; the normal completion send decision at the (_streamed or _content_delivered) guard now also checks the set, so a successful fallback delivery suppresses the duplicate send. The set keys on (chat_id, session_key) so different chats / sessions running on the same gateway are not cross-suppressed.
…tate (NousResearch#81050) The web dashboard's remove path only called _remove_mcp_server(name), which deleted the server entry from config.yaml but left the OAuth token files (.json, .client.json, .meta.json) on disk under mcp-tokens/. The CLI `hermes mcp remove` path already routed through MCPOAuthManager.remove() to delete all three; this commit mirrors that on the dashboard side so a server removed via the UI cannot be revived at the next gateway restart by leftover meta.json metadata.
…lity (NousResearch#81014) When a memory provider (e.g. Mnemosyne) is configured but the 'memory' toolset is not in the agent's tool surface (platform_toolsets / disabled_toolsets), the provider's system_prompt_block() was injected unconditionally — instructing the model to call tools that do not exist in the tool schema. inject_memory_provider_tools() already gated the tool injection; build_system_prompt() did not. Two changes: 1. MemoryManager.build_system_prompt() now consults memory_provider_tools_enabled() once set_tool_gating() has recorded the agent's toolset configuration, suppressing the provider block when tools are gated out. Legacy callers that never call set_tool_gating() retain the old behavior. 2. inject_memory_provider_tools() now logs a WARNING with the suppressed schema count when the gate fires, so an operator reading agent.log can correlate the dangling instructions with the gate. agent_init.py calls set_tool_gating() on the manager before inject_memory_provider_tools() runs.
…esearch#81012) A vendor-prefixed token wrapped in ANSI color codes leaked entirely because _mask_control_split_tokens stripped only the ESC byte, leaving [32m glued to the token head; the literal m defeated the (?<![A-Za-z0-9_-]) lookbehind in _PREFIX_RE. Build the shadow copy in two steps: (1) strip complete CSI sequences (\x1b\[[0-9;?]*[A-Za-z]), reusing the pattern shape from tools/ansi_strip.py, then (2) strip remaining bare control chars. The order matters — stripping the bare ESC byte first would leave the same glue. The join guard's "original span only contains token-body or control chars" invariant now also accepts CSI positions, so the shadow match can extend through a CSI byte without being rejected as crossing a non-token-character class. The line-boundary skip (\n / \r) is preserved verbatim — that's the button [ref=e3] regression guard (NousResearch#77484 / NousResearch#80987), not the bug being fixed. Verified: 6 new regression tests (CSI-wrapped, 256-color, CSI+newline split, adjacent-text not swallowed, bare-ESC, newline-only regression) plus 98 existing redact tests all pass.
alt-glitch
added
type/security
Collaborator
Contributor
Author
|
Duplicate of #81060 (same issue). Closing in favor of the earlier PR to avoid double-fixing the same issue. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #81012 — redact: complete CSI/SGR sequences defeat prefix masking (ESC-byte-only stripping leaves 'm'-glue).