Follow-up to #6616 covering the remaining user-injected prompt markers that
the original PR did not touch (reporter's second comment on #6576 explicitly
flagged these). Azure OpenAI Default/DefaultV2 content filters treat any
bracketed [SYSTEM: ...] as prompt-injection and reject with HTTP 400.
Remaining call sites renamed:
- cli.py: background-process notifications (watch_disabled, watch_match,
completion), MCP reload notice (4 live + 1 docstring)
- gateway/run.py: same notification paths + auto-loaded skill banner +
MCP reload notice (5 live + 1 docstring)
- tools/process_registry.py: comment reference
Not renamed:
- environments/hermes_base_env.py '[SYSTEM]\n{content}' — RL training
trajectory rendering only, never sent to Azure, part of a symmetric
[USER]/[ASSISTANT]/[TOOL] scheme.
AUTHOR_MAP: buraysandro9@gmail.com -> ygd58.
Salvages #6616 and extends the fix to the remaining 10 call sites the original PR did not cover. Closes #6576.
Root cause
Azure OpenAI Default/DefaultV2 content filters treat bracketed
[SYSTEM: ...]meta-instructions as prompt-injection attempts and reject requests with HTTP 400.[IMPORTANT:preserves the semantic meaning for every model while bypassing the heuristic.Why not just merge #6616
The reporter's second comment on #6576 explicitly flagged that the trigger word appears in many more places than #6616 touched. #6616 only renamed
agent/skill_commands.py(2) andcron/scheduler.py(3) — Azure users would still hit the filter on watch-pattern / completion notifications, MCP reload notices, and gateway auto-loaded skill banners.Changes
agent/skill_commands.py[SYSTEM:cron/scheduler.py[SYSTEM:cli.pygateway/run.pytools/process_registry.pyNot renamed:
environments/hermes_base_env.pyuses[SYSTEM]\n{content}for Atropos RL training trajectory rendering — never sent through Azure, part of a symmetric[USER]/[ASSISTANT]/[TOOL]scheme. Leaving it alone.Attribution
Commit
bed192135is @ygd58's original commit cherry-picked onto current main with authorship preserved. Commit029d44fa9is the extension sweep + AUTHOR_MAP entry.Validation
python -c 'import py_compile; ...'on all 5 touched files: OKgrep '\[SYSTEM:' --include="*.py"in non-test files returns zero results (except the RL[SYSTEM]no-colon case, intentionally preserved)[SYSTEM:prefix; test files that feed synthetictext="[SYSTEM: ...]"are independent of the production strings and still pass their own logic.