fix(memory): scrub echoed context before persistence by badMade · Pull Request #478 · badMade/hermes-agent

badMade · 2026-05-23T04:18:21Z

Motivation

Prevent ephemeral recalled memory wrapped in <memory-context> fences (injected at API-call time) from being persisted if a model/provider echoes that wrapper back in assistant output. Persisting such echoes enables replay/chaining and leaks private memory into future turns.
Reintroduce storage-boundary sanitization so the final persisted assistant message is safe for session logs, the Responses API store, and replay paths while preserving visible answer text.

Description

Reapplies sanitize_context(...) to assistant content in AIAgent._build_assistant_message after think-block stripping so <memory-context> fences are removed before a message is normalized and appended; change located in run_agent.py (around the assistant message builder).
Adjusts the regression test in tests/run_agent/test_run_agent.py to assert persisted assistant content no longer contains memory-context markers and that visible answer text remains intact.
Keeps streaming-path scrubber behavior unchanged (streaming deltas still handled by StreamingContextScrubber) and limits the change to the storage/persistence boundary.

Testing

Ran targeted unit tests: PYTHONPATH=$PWD/.venv/lib/python3.14/site-packages python -m pytest -o addopts='' tests/run_agent/test_run_agent.py::TestBuildAssistantMessage tests/agent/test_streaming_context_scrubber.py -q, all selected tests passed (32 passed in CI run of the suite subset).
Verified codex/streaming tests: PYTHONPATH=$PWD/.venv/lib/python3.14/site-packages python -m pytest -o addopts='' tests/run_agent/test_run_agent_codex_responses.py::test_interim_commentary_preserves_assistant_content tests/run_agent/test_run_agent_codex_responses.py::test_stream_delta_strips_leaked_memory_context -q, both tests passed.
Performed static checks: python -m py_compile run_agent.py and git diff --check, both succeeded with a clean working tree.

Codex Task

gemini-code-assist · 2026-05-23T04:18:24Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR prevents ephemeral recalled memory wrapped in <memory-context> fences (injected at request time) from being persisted if echoed back by a model/provider, by reintroducing storage-boundary sanitization for assistant messages.

Changes:

Apply sanitize_context(...) to stored assistant content in AIAgent._build_assistant_message after <think>-block stripping.
Update the unit test to assert persisted assistant content no longer contains memory-context markers and preserves the visible answer text.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`run_agent.py`	Scrubs stored assistant content via `sanitize_context(...)` at the persistence boundary to prevent durable replay of echoed memory fences.
`tests/run_agent/test_run_agent.py`	Updates regression coverage to assert memory-context wrappers are removed from persisted assistant content.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

        if isinstance(_san_content, str) and _san_content:
-            _san_content = self._strip_think_blocks(_san_content).strip()
+            _san_content = sanitize_context(
+                self._strip_think_blocks(_san_content)
+            ).strip()


-        containing literal <memory-context> markers — that's legitimate text
-        (e.g. documentation, code) that the model may emit.  Streaming-path
-        leak prevention is handled by StreamingContextScrubber upstream."""
+    def test_memory_context_in_stored_content_is_scrubbed(self, agent):


+        assert "memory-context" not in result["content"].lower()
+        assert "stale memory" not in result["content"]
+        assert result["content"] == "Visible answer"


github-actions · 2026-05-23T05:24:23Z

🔎 Lint report: `badmade/fix-memory-context-leak-issue` vs `origin/main`

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 8322 on HEAD, 8322 on base (➖ 0)

🆕 New issues (34):

Rule	Count
`invalid-argument-type`	30
`unresolved-attribute`	3
`unsupported-operator`	1

First entries

run_agent.py:9758: [invalid-argument-type] invalid-argument-type: Argument to function `lmstudio_model_reasoning_options` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:8979: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_request_timeout` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:8895: [invalid-argument-type] invalid-argument-type: Argument to bound method `ContextCompressor.update_model` is incorrect: Expected `int`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:9610: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_profile` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:13122: [invalid-argument-type] invalid-argument-type: Argument to function `estimate_usage_cost` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:13124: [invalid-argument-type] invalid-argument-type: Argument to function `estimate_usage_cost` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:5847: [unsupported-operator] unsupported-operator: Operator `in` is not supported between objects of type `Literal["/"]` and `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:8978: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:13165: [invalid-argument-type] invalid-argument-type: Argument to bound method `SessionDB.update_token_counts` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:10033: [unresolved-attribute] unresolved-attribute: Attribute `lower` is not defined on `dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy`, `int & ~AlwaysFalsy`, `dict[Unknown, Unknown] & ~AlwaysFalsy` in union `(str & ~AlwaysFalsy) | (Unknown & ~AlwaysFalsy) | (dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:13161: [invalid-argument-type] invalid-argument-type: Argument to bound method `SessionDB.update_token_counts` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:14081: [invalid-argument-type] invalid-argument-type: Argument to bound method `ContextCompressor.update_model` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:12375: [invalid-argument-type] invalid-argument-type: Argument to function `apply_anthropic_cache_control_long_lived` is incorrect: Expected `bool`, found `int | str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | dict[Unknown, Unknown]`
run_agent.py:13627: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown, Unknown] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:4277: [invalid-argument-type] invalid-argument-type: Argument to `AIAgent.__init__` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:3400: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_stale_timeout` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:11607: [unresolved-attribute] unresolved-attribute: Attribute `strip` is not defined on `dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy`, `int & ~AlwaysFalsy`, `dict[Unknown, Unknown] & ~AlwaysFalsy` in union `(str & ~AlwaysFalsy) | (Unknown & ~AlwaysFalsy) | (dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:9172: [invalid-argument-type] invalid-argument-type: Argument to function `get_transport` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:12381: [invalid-argument-type] invalid-argument-type: Argument to function `apply_anthropic_cache_control` is incorrect: Expected `bool`, found `int | str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | dict[Unknown, Unknown]`
run_agent.py:5419: [invalid-argument-type] invalid-argument-type: Argument to function `parse_rate_limit_headers` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:7307: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`
run_agent.py:3400: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_stale_timeout` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:9593: [invalid-argument-type] invalid-argument-type: Argument to function `_get_anthropic_max_output` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:13077: [invalid-argument-type] invalid-argument-type: Argument to function `normalize_usage` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
run_agent.py:9785: [invalid-argument-type] invalid-argument-type: Argument to function `github_model_reasoning_efforts` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown | str, Unknown | str | dict[str, str]] | int | dict[Unknown, Unknown]`
... and 9 more

✅ Fixed issues (41):

Rule	Count
`invalid-argument-type`	35
`unresolved-attribute`	5
`unsupported-operator`	1

First entries

run_agent.py:7817: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_request_timeout` is incorrect: Expected `str | None`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:5419: [invalid-argument-type] invalid-argument-type: Argument to function `parse_rate_limit_headers` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:5847: [unresolved-attribute] unresolved-attribute: Attribute `split` is not defined on `dict[Unknown, Unknown]`, `int`, `dict[Unknown | str, Unknown | str | dict[str, str]]` in union `str | Unknown | Divergent | ... omitted 3 union elements`
cli.py:8658: [invalid-argument-type] invalid-argument-type: Argument to function `estimate_usage_cost` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:8610: [unresolved-attribute] unresolved-attribute: Attribute `strip` is not defined on `dict[Unknown, Unknown] & ~AlwaysFalsy`, `int & ~AlwaysFalsy`, `dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy` in union `Divergent | (Unknown & ~AlwaysFalsy) | (str & ~AlwaysFalsy) | ... omitted 4 union elements`
run_agent.py:4277: [invalid-argument-type] invalid-argument-type: Argument to `AIAgent.__init__` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:14081: [invalid-argument-type] invalid-argument-type: Argument to bound method `ContextCompressor.update_model` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:13169: [invalid-argument-type] invalid-argument-type: Argument to bound method `SessionDB.update_token_counts` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:9172: [invalid-argument-type] invalid-argument-type: Argument to function `get_transport` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:8978: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `Divergent | Unknown | str | ... omitted 3 union elements`
run_agent.py:9610: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_profile` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:4866: [invalid-argument-type] invalid-argument-type: Argument to function `save_trajectory` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:13081: [invalid-argument-type] invalid-argument-type: Argument to function `normalize_usage` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:9785: [invalid-argument-type] invalid-argument-type: Argument to function `github_model_reasoning_efforts` is incorrect: Expected `str | None`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:9593: [invalid-argument-type] invalid-argument-type: Argument to function `_get_anthropic_max_output` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:14085: [invalid-argument-type] invalid-argument-type: Argument to bound method `ContextCompressor.update_model` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:12379: [invalid-argument-type] invalid-argument-type: Argument to function `apply_anthropic_cache_control_long_lived` is incorrect: Expected `bool`, found `int | Divergent | Unknown | ... omitted 3 union elements`
run_agent.py:13165: [invalid-argument-type] invalid-argument-type: Argument to bound method `SessionDB.update_token_counts` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:7307: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 4 union elements`
run_agent.py:3400: [invalid-argument-type] invalid-argument-type: Argument to function `get_provider_stale_timeout` is incorrect: Expected `str`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
run_agent.py:13099: [invalid-argument-type] invalid-argument-type: Argument to function `save_context_length` is incorrect: Expected `str`, found `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:12385: [invalid-argument-type] invalid-argument-type: Argument to function `apply_anthropic_cache_control` is incorrect: Expected `bool`, found `int | Divergent | Unknown | ... omitted 3 union elements`
run_agent.py:8898: [invalid-argument-type] invalid-argument-type: Argument to bound method `ContextCompressor.update_model` is incorrect: Expected `str`, found `Divergent | Unknown | str | ... omitted 3 union elements`
run_agent.py:5847: [unsupported-operator] unsupported-operator: Operator `in` is not supported between objects of type `Literal["/"]` and `str | Unknown | Divergent | ... omitted 3 union elements`
run_agent.py:13128: [invalid-argument-type] invalid-argument-type: Argument to function `estimate_usage_cost` is incorrect: Expected `str | None`, found `str | Unknown | dict[Unknown, Unknown] | int | dict[Unknown | str, Unknown | str | dict[str, str]]`
... and 16 more

Unchanged: 4335 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

github-actions · 2026-05-23T07:22:25Z

Auto-merge: checks failing

The following checks did not pass:

test (cancelled)

Please fix the failing checks before this PR can be merged.

View workflow run

badMade · 2026-05-23T13:20:38Z

@claude code review

badMade · 2026-05-23T13:25:01Z

@jules code review

badMade · 2026-05-27T01:06:54Z

@copilot, fix all failing checks.

…tests

Copilot · 2026-05-27T04:19:29Z

@copilot, fix all failing checks.

Addressed in commit 8d6d3c3. I fixed the failing check by updating the inline-think test harness to bind AIAgent._strip_think_blocks on the mocked agent, then re-ran the affected tests (TestInlineThinkBlockExtraction, TestBuildAssistantMessage, and related streaming/codex regressions), which now pass.

…xt test with scrub semantics Two lost-in-merge regressions in tests/run_agent/test_run_agent.py: 1. _FakeProviderMemoryManager class was deleted but two TestConcurrentToolExecution tests still instantiate it, raising NameError. Restore the minimal double from #209. 2. test_memory_context_in_stored_content_is_preserved was renamed to _is_scrubbed in #478 and the assertions inverted to match the storage-boundary scrub the production code now performs. The pre-rename version kept the old "preserve" assertions, which fail against the correct production behaviour. Update the test to its post-#478 form.

* fix: restore session/auth helpers lost in merge conflicts A series of merge resolutions dropped several helpers while keeping their call sites and tests. The result was a broad cluster of NameError / AttributeError / TypeError failures across gateway, cron, web-tools and api-server tests. - gateway/run.py: restore `team_id` definition in `_is_user_authorized`; it was deleted but two call sites still reference it. - gateway/session_context.py: restore `get_terminal_cwd` / `set_terminal_cwd` / `reset_terminal_cwd` helpers (and the underlying `_TERMINAL_CWD` ContextVar) that run_agent.py imports. - tools/web_tools.py: rename `_ddgs_package_importable` to `_ddgs_package_available` (with a backward-compat alias) so tests can monkeypatch the expected symbol; drop ddgs from the auto-detect fallback so just having the package importable doesn't silently opt users into a rate-limited HTML-scraping backend. - gateway/platforms/webhook.py: reject unresolved `${VAR}` placeholder secrets; treating them as real HMAC secrets silently weakened auth. - gateway/platforms/api_server.py: restore `_constant_time_equal` so unicode API keys compare safely instead of raising TypeError from `hmac.compare_digest`. * fix(api_server): guard _constant_time_equal against None inputs Defense in depth: the existing _check_auth caller early-returns when self._api_key is falsy, so None can't actually reach this helper today, but accepting Optional[str] and short-circuiting to False keeps the helper safe for any future caller and matches the type the call site already permits. * fix(web_tools): delegate _ddgs_package_available to the safe helper A bare ``import ddgs`` executes any local ``ddgs.py`` shadowing the installed package on sys.path. The provider module already has a safer non-importing check (metadata + find_spec, verified by test_availability_does_not_import_shadowed_local_module). Delegate to it so both call paths share the same protection. * fix(approval): restore set_/reset_/get_current_run_id helpers A prior merge removed these helpers from tools/approval.py but kept the api_server callers that import them, breaking every /v1/runs request with ImportError. Restore the contextvar (`_approval_run_id`) and the three accessors so the API run path can bind a per-task run id to pending gateway approvals again. Clears the 7 failures under tests/gateway/test_api_server_runs.py. * fix(api_server): restore proxy_scope authentication A prior merge deleted gateway/proxy_scope_auth.py and stripped the HMAC-signature check from the /v1/chat/completions handler, while leaving the tests that exercise both paths. Restore the module and re-wire the handler: - Imports verify_proxy_scope_signature + signature/timestamp headers from gateway.proxy_scope_auth. - Uses ``"hermes_proxy_scope" in body`` (not truthy check) so an explicit JSON ``null`` is rejected with 400. - Returns 403 with "trusted gateway proxy authentication" when the signature is missing or invalid. Clears the 3 TestChatCompletionsEndpoint failures. * fix(run_agent): harden assistant-message scrub against non-str helper return When _strip_think_blocks is mocked in tests (TestInlineThinkBlockExtraction binds only _build_assistant_message + _extract_reasoning, leaving every other method as a MagicMock), it returns a MagicMock instead of a string. sanitize_context() then crashes because re.sub expects str/bytes. Guard the scrub: if _strip_think_blocks returns a string, sanitize that; otherwise fall back to sanitizing the original _san_content. Production agents always return a string, so behavior there is unchanged. Clears the 7 TestInlineThinkBlockExtraction failures. * fix(api_server): SSRF-block private/internal image URLs A prior merge dropped the is_safe_url() check on http(s) image URLs from _normalize_multimodal_content, leaving only the scheme guard. Image URLs pointing at private/internal addresses now reach the multimodal pipeline and can exfiltrate internal-network content (test_private_image_url_rejected, test_cloud_metadata_image_url_rejected). Re-add the check before the URL is normalized into the image part. * fix(tests): restore _FakeProviderMemoryManager and align memory-context test with scrub semantics Two lost-in-merge regressions in tests/run_agent/test_run_agent.py: 1. _FakeProviderMemoryManager class was deleted but two TestConcurrentToolExecution tests still instantiate it, raising NameError. Restore the minimal double from #209. 2. test_memory_context_in_stored_content_is_preserved was renamed to _is_scrubbed in #478 and the assertions inverted to match the storage-boundary scrub the production code now performs. The pre-rename version kept the old "preserve" assertions, which fail against the correct production behaviour. Update the test to its post-#478 form. * fix(tools_config): restore HASS_TOKEN opt-in + cross-platform MCP server fanout Two lost-in-merge regressions in hermes_cli/tools_config.py: - _implicit_default_off_toolsets no longer dropped homeassistant from default_off when HASS_TOKEN was set. That regressed Norbert's HA cron setup (the original PR NousResearch#14798 carve-out) because cron / cli would silently drop the toolset even though the operator had provisioned credentials. Restore the HASS_TOKEN check. - _get_platform_tools required platform_toolsets to explicitly re-list every globally configured MCP server (exa, web-search-prime, etc.) to keep them enabled. Once a platform had any explicit builtin toolset list, MCP servers vanished. Restore the simpler rule: no_mcp opts out; otherwise enabled_mcp_servers always fan out — explicit builtin selection is the platform allowlist, not the MCP allowlist. Clears 2 test_tools_config failures and the related test_reasoning_command "exa in toolsets" assertion. * fix(browser_tool): use url_contains_secret for navigate's secret check The inline secret-block in browser_navigate only ran one urllib.unquote pass, so a URL with double-percent-encoded prefixes (sk%252Dant%252D…) slipped through and reached the browser. agent.redact.url_contains_secret applies repeated decoding (3 passes) and also splits the URL into component values before matching, so it catches the multi-encode tricks that test_blocks_percent_encoded_api_key_in_url and test_blocks_split_api_key_in_query_values exercise. Clears 2 test_browser_secret_exfil failures. * fix: enforce SSRF + attachment-auth gates lost in merge Two adjacent security regressions: - tools/browser_tool.py: pre-navigation SSRF check skipped local backends (`not _is_local_backend()` short-circuited the guard) even though the surrounding comment explicitly states local backends must enforce it too — browser_snapshot can return local-file / internal-service responses in reduced-tool configurations. Drop the local-backend skip so the guard fires unless the operator opts in via ``browser.allow_private_urls``. - gateway/platforms/qqbot/adapter.py: restore the attachment pre-auth gate from #349. _handle_c2c/_handle_group/_handle_guild/_handle_dm now check `_is_source_authorized_for_attachment_processing` before calling `_process_attachments`, and forward a text-only event when the sender isn't allowlisted. This prevents an unauthorized sender from forcing the bot to fetch attacker-controlled attachment URLs (SSRF amplification, large-file DoS, redirect attacks). Failure-closed when gateway_runner isn't attached yet, with a throttled warning so startup races don't spam the log. Clears 2 test_browser_ssrf_local failures and test_unauthorized_c2c_skips_attachment_processing. * fix(kanban): scope worker child reaping to known PIDs only dispatch_once() was calling waitpid(-1, WNOHANG) on every tick, which reaps any zombie child of the gateway process — including non-kanban subprocesses (npm install, agent-browser, etc.) whose callers rely on their own Popen.wait()/subprocess.run() exit status. That broke unrelated tools whenever the kanban dispatcher ran in the same process. Restore the scoped reaper from #393: track each kanban worker PID in _known_worker_child_pids when it's persisted via _set_worker_pid, and in dispatch_once only waitpid those specific PIDs. Windows is still a no-op (no zombies / no WNOHANG). Clears test_source_gates_waitpid_loop. * fix(api_server): propagate SSE batch flush failures to main streaming loop When the batched-delta background task ("_batch_flush_after") hit a ConnectionResetError on response.write(), the exception was swallowed in the detached task and the main loop kept waiting on stream_q for items that would never arrive — the streaming endpoint hung until the client timed out and the agent was never interrupted. Restore #398's fix: catch the flush exception in the background task, stash it in _batch_error, and push a sentinel into stream_q so the main loop re-raises it on dequeue. Both the live loop and the drain path honour the sentinel. Clears test_stream_batched_delta_disconnect_interrupts_agent. * fix(browser_tool): honor restricted PATH for Homebrew/user-writable trust roots A prior merge widened _SANE_PATH_DIRS to include /opt/homebrew/{bin,sbin} and /usr/local/{bin,sbin} unconditionally and made _browser_candidate_path_dirs always inject Homebrew node prefixes. Cron / systemd / locked-down operator configs that intentionally strip those trust roots from PATH would silently get them injected back, defeating the restriction. Restore #234's design: - _SANE_PATH_DIRS only includes Termux + system dirs (/usr/{bin,sbin}, /{bin,sbin}). - _browser_candidate_path_dirs(existing_path) takes the operator-provided PATH and only adds Homebrew node prefixes / /usr/local / hermes-managed Node bin when the operator already opted into that trust root. - _find_agent_browser passes os.environ.get("PATH","") through to _merge_browser_path so the gating actually fires (previously it passed ""). Clears all 4 test_browser_homebrew_paths failures. --------- Co-authored-by: Claude <noreply@anthropic.com>

fix(memory): scrub echoed context before persistence

a6c20f0

Copilot AI review requested due to automatic review settings May 23, 2026 04:18

badMade added codex aardvark labels May 23, 2026 — with ChatGPT Codex Connector

Copilot AI reviewed May 23, 2026

View reviewed changes

Copilot started reviewing on behalf of badMade May 23, 2026 06:54 View session

Merge branch 'main' into badmade/fix-memory-context-leak-issue

6d5fadc

badMade added the reviewed label May 23, 2026

badMade added 2 commits May 25, 2026 21:33

Merge branch 'main' into badmade/fix-memory-context-leak-issue

f1b24cc

Merge branch 'main' into badmade/fix-memory-context-leak-issue

22f23d0

Merge branch 'main' into badmade/fix-memory-context-leak-issue

e3f41c6

Copilot started work on behalf of badMade May 27, 2026 04:13 View session

test(reasoning): bind _strip_think_blocks in inline think extraction …

8d6d3c3

…tests

Copilot finished work on behalf of badMade May 27, 2026 04:19

Merge branch 'main' into badmade/fix-memory-context-leak-issue

5bcb38e

github-actions Bot merged commit 22e5a7b into main May 28, 2026
15 of 16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(memory): scrub echoed context before persistence#478

fix(memory): scrub echoed context before persistence#478
github-actions[bot] merged 7 commits into
mainfrom
badmade/fix-memory-context-leak-issue

badMade commented May 23, 2026

Uh oh!

gemini-code-assist Bot commented May 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 23, 2026 •

edited

Loading

Uh oh!

badMade commented May 23, 2026

Uh oh!

badMade commented May 23, 2026

Uh oh!

badMade commented May 27, 2026

Uh oh!

Copilot AI commented May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

badMade commented May 23, 2026

Motivation

Description

Testing

Uh oh!

gemini-code-assist Bot commented May 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔎 Lint report: badmade/fix-memory-context-leak-issue vs origin/main

ruff

ty (type checker)

Uh oh!

github-actions Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-merge: checks failing

Uh oh!

badMade commented May 23, 2026

Uh oh!

badMade commented May 23, 2026

Uh oh!

badMade commented May 27, 2026

Uh oh!

Copilot AI commented May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented May 23, 2026 •

edited

Loading

🔎 Lint report: `badmade/fix-memory-context-leak-issue` vs `origin/main`

github-actions Bot commented May 23, 2026 •

edited

Loading