From 0e04123188ce53707d7f6ec14543c0fb1e83757e Mon Sep 17 00:00:00 2001 From: Illia Polosukhin Date: Tue, 10 Mar 2026 18:05:59 +0000 Subject: [PATCH] fix: stop XML-escaping tool output content (#598) (#874) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(ci): secrets can't be used in step if conditions [skip-regression-check] (#787) GitHub Actions step-level `if:` doesn't have access to `secrets` context. Replace `if: secrets.X != ''` with `continue-on-error: true` and let the Set token step handle the fallback. Co-authored-by: Claude Sonnet 4.6 * fix(ci): clean up staging pipeline — remove hacks, skip redundant checks [skip-regression-check] (#794) - Remove continue-on-error from staging-ci.yml app token steps (secrets are configured) - Skip test.yml and code_style.yml on PRs targeting staging (staging-ci.yml already runs tests before promoting, promotion PR gets full CI on main) - Allow ironclaw-ci[bot] in Claude Code review for bot-created promotion PRs Co-authored-by: Claude Opus 4.6 * fix(ci): run fmt + clippy on staging PRs, skip Windows clippy [skip-regression-check] (#802) - Remove branches:[main] filter from code_style.yml so it runs on all PRs - Gate clippy-windows with `if: github.base_ref == 'main'` (skip on staging PRs) - Update rollup job to allow skipped clippy-windows - Simplify claude-review.yml to only trigger on labeled event (avoids duplicate runs) Co-authored-by: Claude Opus 4.6 * feat: persist user_id in save_job and expose job_id on routine runs (#709) * feat: persist worker events to DB and fix activity tab rendering In-process Worker (used by Scheduler::dispatch_job) now persists events via save_job_event at key execution points: plan creation, LLM responses, tool_use, tool_result, and job completion/failure/stuck. Event data shapes match the container worker format so the gateway activity tab renders them correctly. Frontend: tool_result errors now show a red X icon with danger styling instead of a silent empty output. The result event falls back to the error field when message is absent. Co-Authored-By: Claude Opus 4.6 * feat: wire RoutineEngine into gateway for direct manual trigger firing Replace the message-channel hack in routines_trigger_handler with a direct call to RoutineEngine::fire_manual(), ensuring FullJob routines dispatch correctly when triggered from the web UI. Inject the engine into GatewayState from Agent::run after construction. Also persists user_id in save_job for both PG and libSQL backends, removes the source='sandbox' filter so all jobs are visible, and exposes job_id on RoutineRunInfo for the frontend job link. Co-Authored-By: Claude Opus 4.6 * fix: remove stale gateway_state argument from Agent::new test call sites The gateway_state parameter was removed from Agent::new during rebase (replaced by post-construction set_routine_engine_slot), but three test call sites still passed the extra None argument. Co-Authored-By: Claude Opus 4.6 * fix: address PR review — restore sandbox source filter, remove blank lines - Revert removal of `source = 'sandbox'` filter in all SandboxStore queries (8 sites across PG and libSQL). Sandbox-specific APIs should stay scoped to sandbox jobs; unified job listing for the Jobs tab should use a separate query path. - Remove extra blank lines in agent_loop.rs and worker.rs that caused formatting CI failure. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 * fix: address review — regenerate Cargo.lock, add user_id regression test - Regenerate Cargo.lock from main's lockfile to eliminate dependency version downgrades (anyhow, syn, etc.) that were churn from rebase. - Add regression test verifying user_id round-trips through save_job and get_job in the libSQL backend. Co-Authored-By: Claude Opus 4.6 * style: remove trailing blank line in libsql jobs.rs [skip-regression-check] Co-Authored-By: Claude Opus 4.6 * test: add Postgres-side regression test for user_id persistence in save_job Mirrors the existing libSQL test (test_save_job_persists_user_id) for the Postgres backend. Gated behind #[cfg(feature = "postgres")] + #[ignore] since it requires a running PostgreSQL instance (integration tier). Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 * feat(llm): per-provider unsupported parameter filtering (#749, #728) (#809) Add declarative `unsupported_params` field to provider definitions in providers.json. Parameters listed are stripped from requests before sending, preventing 400 errors from providers that reject them (e.g. gpt-5 family and kimi-k2.5 rejecting custom temperature values). - Add `unsupported_params` to ProviderDefinition and RegistryProviderConfig - Propagate from registry through config resolution - Generic strip helpers handle temperature, max_tokens, stop_sequences - Apply filtering in RigAdapter and AnthropicOAuthProvider - Mark openai and tinfoil providers as unsupporting temperature - Update openai default model to gpt-5-mini Co-authored-by: Claude Opus 4.6 * fix: stop XML-escaping tool output content in wrap_for_llm (#598) Remove content escaping that corrupted JSON in tool output. The structural boundary is preserved but content now passes through raw, fixing downstream parse failures. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Henry Park Co-authored-by: Claude Sonnet 4.6 --- src/safety/mod.rs | 11 ++--------- tests/support/trace_llm.rs | 10 +--------- 2 files changed, 3 insertions(+), 18 deletions(-) diff --git a/src/safety/mod.rs b/src/safety/mod.rs index 50167fc0..e9027792 100644 --- a/src/safety/mod.rs +++ b/src/safety/mod.rs @@ -164,7 +164,7 @@ impl SafetyLayer { "\n{}\n", escape_xml_attr(tool_name), sanitized, - escape_xml_content(content) + content ) } @@ -213,13 +213,6 @@ fn escape_xml_attr(s: &str) -> String { .replace('>', ">") } -/// Escape XML content. -fn escape_xml_content(s: &str) -> String { - s.replace('&', "&") - .replace('<', "<") - .replace('>', ">") -} - #[cfg(test)] mod tests { use super::*; @@ -235,7 +228,7 @@ mod tests { let wrapped = safety.wrap_for_llm("test_tool", "Hello ", true); assert!(wrapped.contains("name=\"test_tool\"")); assert!(wrapped.contains("sanitized=\"true\"")); - assert!(wrapped.contains("Hello <world>")); + assert!(wrapped.contains("Hello ")); } #[test] diff --git a/tests/support/trace_llm.rs b/tests/support/trace_llm.rs index e09ee9d9..ba3e5744 100644 --- a/tests/support/trace_llm.rs +++ b/tests/support/trace_llm.rs @@ -429,7 +429,7 @@ impl TraceLlm { } /// Strip `...\n` - /// wrapper and unescape XML entities from safety-layer output. + /// wrapper from safety-layer output. fn unwrap_tool_output(content: &str) -> std::borrow::Cow<'_, str> { let trimmed = content.trim(); if let Some(rest) = trimmed.strip_prefix("") { let body = inner[..close].trim(); - // Reverse XML escaping applied by safety layer. - if body.contains("&") || body.contains("<") || body.contains(">") { - return std::borrow::Cow::Owned( - body.replace("&", "&") - .replace("<", "<") - .replace(">", ">"), - ); - } return std::borrow::Cow::Borrowed(body); } }