Repository navigation
Conversation
…nment context as prompts Codex opens a thread (and re-opens it after a cwd change) by inserting its own context as role=user response_items: the AGENTS.md chain wrapped in <INSTRUCTIONS> with an <environment_context> block appended, and bare <environment_context> messages later on. Nobody typed those, but the capture treated every role=user response_item as a prompt, so every Codex log opened with a ~10 KB copy of AGENTS.md as the first "prompt" (1,358 such logs in one brain since September) and a brain fold then read the global rules as owner instructions and re-learned them in every project. codexPromptText now strips leading injected blocks (anchored at the start and closed by the end tag, so prose that mentions a tag or an unclosed block is left alone); a message that is only injected context has no prompt text and opens no turn. isCodexUserPrompt matches, while an image-only message still counts so the last-user segmentation fallback is unchanged. Older builds' <user_instructions> wrapper is covered the same way. Tests: a rollout with the injected opener, a mid-session environment block and two typed prompts yields exactly two turns with the typed prompts for both synthetic-filter modes and never leaks the injected text; a table test pins the strip rules. go test ./internal/transcript ./internal/sweep ./internal/hooks. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In plain words
Every Codex session log in a brain opens with a copy of the user's AGENTS.md, as if they had typed it. Codex inserts its instructions and an environment block as "user" messages when a thread starts, and devbrain treated every user message as a prompt. A brain fold then reads the global rules as per-project owner instructions and re-learns them in every project.
Problem
Codex rollouts carry the injected context as
response_item/message/role: userevents:# AGENTS.md instructions for <dir>followed by<INSTRUCTIONS>…</INSTRUCTIONS>, usually with an<environment_context>…</environment_context>block appended in the same message (cwd, shell, date, permissions).<environment_context>…</environment_context>message.<user_instructions>…</user_instructions>.isCodexUserPromptaccepted any role=user response_item andcodexPromptTextreturned its text, so the injected message became the first prompt of every Codex turn log. In one brain that is 1,358 logs since September, each opening with a ~10 KB copy of AGENTS.md, plus 491 logs whose prompt is nothing but an environment block.Fix
stripCodexInjectedremoves leading injected blocks. It is anchored at the start of the text and requires the closing tag, so a prompt that merely mentions a tag, or an unclosed block, is left alone; a message that is only injected context strips to "".codexPromptTextreturns the stripped text, so an injected-only message has no prompt text and opens no turn (turn boundaries already require non-empty prompt text).isCodexUserPromptreturns false for injected-only text; an image-only message (no text at all) still counts, so the last-user segmentation fallback is unchanged.codexUserText.Raw logs are append-only, so existing logs keep their echoes; only new captures change.
Tests
TestCodexInjectedContextIsNotAPrompt: a rollout with the injected opener, a mid-session environment block and two typed prompts yields exactly the two typed turns in both synthetic-filter modes, and no prompt contains the injected text.TestStripCodexInjected: table of strip rules (instructions-only, instructions then environment, environment-only, legacy<user_instructions>, environment then typed text, typed text, prose mention, unclosed block).go test ./internal/transcript ./internal/sweep ./internal/hooks,go vet,gofmt.🤖 Generated with Claude Code