🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 Overbroad NO_REPLY lead-fragment suppression hides legitimate assistant streaming deltas (e.g., "No")

Description

isSilentReplyLeadFragment() suppresses any assistant delta whose trimmed, uppercased content is an ASCII [A-Z_]+ prefix of SILENT_REPLY_TOKEN ("NO_REPLY").

This creates unintended content filtering / output integrity issues for legitimate short replies because:

• Case-insensitive normalization (toUpperCase()) makes "No" match "NO".
• The prefix check matches very short/common strings like "N", "NO", and "NO_".
• In emitChatDelta, matching texts are returned early and not broadcast to clients.

Concrete examples of legitimate assistant outputs whose streaming deltas will be suppressed:

• "No" (common refusal opener)
• "NO" (legitimate all-caps reply)
• "NO_" (can appear in code/identifiers)
• "N" (single-letter response)

While the final message may still be delivered on lifecycle end, any client behavior that relies on deltas for timely display/logging/audit (or where final events are delayed/lost) will experience a denial-of-service style degradation and unexpected filtering triggered purely by prompting the assistant to begin with these strings.

Vulnerable code:

function isSilentReplyLeadFragment(text: string): boolean {
  const normalized = text.trim().toUpperCase();
  ...
  return SILENT_REPLY_TOKEN.startsWith(normalized);
}

And the suppression is applied here:

if (isSilentReplyLeadFragment(cleaned)) {
  return;
}

Recommendation

Narrow the matching so only actual silent-token lead fragments produced by the system are suppressed, without catching common legitimate text.

Options (choose one):

1. Require an underscore (or a minimum length) so that "No"/"NO" are not suppressed:

function isSilentReplyLeadFragment(text: string): boolean {
  const normalized = text.trim().toUpperCase();
  if (!normalized) return false;

  ​// Only suppress fragments that look like the control token (contain '_')
  if (!normalized.includes("_")) return false;
  if (!/^[A-Z_]+$/.test(normalized)) return false;
  if (normalized === SILENT_REPLY_TOKEN) return false;

  return SILENT_REPLY_TOKEN.startsWith(normalized);
}

2. Alternatively, only suppress when the original text is already all-caps/underscore (no toUpperCase()), so mixed-case natural language like "No" is not affected.

Also add tests asserting that delta events for common replies like "No"/"NO" are (or are not) emitted according to the desired behavior.

Analyzed PR: #32116 at commit b9c7e65

_{Last updated on: 2026-03-02T20:12:39Z}

Greptile Summary

This PR fixes a bug where streaming NO_REPLY control tokens would leak early fragments like NO to users during silent-response flows. The fix introduces a isSilentReplyLeadFragment() function that detects prefixes of NO_REPLY (N, NO, NO_, NO_RE, etc.) and suppresses delta emission until content disambiguates.

Key changes:

• Added lead-fragment detection using regex pattern /^[A-Z_]+$/ and prefix matching against NO_REPLY
• Moved buffer update before silent-reply checks (critical: ensures final message logic has correct buffered value)
• Suppresses streaming deltas for lead fragments while preserving legitimate short replies like No in final messages
• Added comprehensive test coverage for both the bug fix and edge case preservation

Technical approach: The solution buffers all text regardless of whether it's a lead fragment, then suppresses only the delta emission. This ensures the final message at lifecycle end has the complete text to determine if it's truly NO_REPLY (suppressed) or a legitimate reply like No (preserved).

Confidence Score: 5/5

• This PR is safe to merge with no identified risks
• Score reflects well-scoped bug fix with clear logic, comprehensive test coverage (including edge case for legitimate 'No' replies), no breaking changes, and effective solution to user-visible issue. The buffer-first approach elegantly handles both streaming suppression and final message correctness.
• No files require special attention

_{Last reviewed commit: b9c7e65}

Landed via temp rebase onto main.

• Gate: pnpm test src/gateway/server-chat.agent-events.test.ts
• Land commit: LAND_SHA_PLACEHOLDER
• Merge commit: MERGE_SHA_PLACEHOLDER

Thanks @CONTRIB_PLACEHOLDER!

Correction: landed details.

• Gate: pnpm test src/gateway/server-chat.agent-events.test.ts
• Land commit: bf06538
• Merge commit: bf06538

Thanks @liuxiaopai-ai!