Repository navigation
Conversation
Shell output can legitimately carry NUL bytes (a git-uploadpack capability advertisement is HEAD\0multi_ack ...). Captured verbatim, they land in session history, and providers that reject NUL in request strings (Venice) then refuse every later replay of the session with 'Invalid request parameters' - the session is effectively bricked and recovery needed the revert API (anomalyco#58354). Two layers: the shell tool strips NUL where the capture becomes tool text (a NUL is never meaningful in the text an agent reads), and the replay-to-LLM boundary scrubs tool text again, so sessions recorded before the capture-side fix work again instead of needing a revert. Fixes anomalyco#58354
github-actions
Bot
added
the
needs:compliance
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 72 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
|
Thanks for working on this, and for the clear explanation of the capture and replay layers! I think this duplicates #58361, which also fixes #58354. It removes NUL bytes in If you think something is missing there, such as removing NULs from the shell output before it's stored, please comment on or test #58361. Also, |
|
Acknowledged — #58361's approach in Good catch on the literal NUL in |
Fixes #58354.
Capture layer — the shell tool strips NUL bytes where the captured output becomes tool text. Shell output can legitimately carry NUL (a git-uploadpack capability advertisement is
HEADmulti_ack thin-pack ...), and a NUL is never meaningful in the text an agent reads — but captured verbatim it lands in session history.Replay layer — the to-LLM boundary scrubs NUL from tool text again, so a session that was recorded before this fix and is already poisoned stops failing: every request replayed the byte, Venice answered
String must not contain null byteswith a 400, and the issue's recovery path was the revert API. With this layer the poisoned session simply works.Together: the turn with the tool call still succeeds (as before), and every later prompt succeeds too.
Test: a replay case in
session-runner-message.test.tsfeeds a completed bash tool whose text carriesHEADmulti_ackand asserts the lowered messages contain no NUL while the readable text survives — 30/30 in the file. The wider core suite's shell/session failures on this Windows machine are pre-existing (50 of them on the untouched base; they spawn real shells) and unrelated to this change.