Skip to content

Gateway tool progress leaks raw shell commands and code bodies to messaging chats #41955

@GodsBoy

Description

@GodsBoy

Problem

Since #41215 (render terminal tool calls as native bash code blocks on markdown platforms), merged 2026-06-07, messaging gateways (WhatsApp, Telegram, Slack, and others) post a terminal tool call's full command into the chat as an untruncated fenced bash block, before the final answer.

Confirmed live from WhatsApp and Telegram with display.tool_progress on:

📋 todo: "planning 5 task(s)"
```bash
set -euo pipefail
cd /path/to/repo
python3 - <<'PY'
import json
print(json.dumps({'ok': True}))
PY
```

Before #41215, terminal progress was a short preview truncated to 40 characters, the same compact line every other tool uses. #41215 replaced that with the full command in a ```bash block on markdown platforms, in both all/`new` and `verbose` modes, so the complete command body (heredocs and all) now reaches the chat.

To be clear about scope: the short truncated previews are fine and not the problem. Lines like terminal: "set -e printf 'node: '...", search_files: "manifest.yaml", read_file: "/path/...", or todo: "updating 2 task(s)" are useful context. The bug is specifically the full, untruncated terminal command reaching the chat.

Impact

Complete shell commands (internal paths, systemctl restarts, rm -rf, secrets typed on a command line) are exposed to everyone in the conversation. On shared or customer facing channels this is a privacy and information disclosure problem.

Expected behavior

Terminal progress on messaging platforms should show the short truncated preview line it used before #41215, not the full command. CLI and TUI are unaffected.

Notes

Introduced by #41215. display.tool_progress_command only gates the /verbose slash command and is unrelated.

Related: #7161 (request to quiet gateway tool progress by default) and #23506 (hide memory tool progress).

Environment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Medium — degraded but workaround existscomp/gatewayGateway runner, session dispatch, deliverytype/securitySecurity vulnerability or hardening

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions