@@ -628,8 +628,6 @@ const MAX_TOOL_DESC_LEN = 6998;
  * for "whether to allow", verified live to clear the filter while preserving
  * the instruction's meaning.
  *
- * Scope note: the first entries only ever appeared in tool descriptions, but
- * this one lives in request #2 (the system prompt) and could equally appear
  * Scope note: the sanitizer only ever touches *instruction surfaces* —
  * tool descriptions and the #2 system prompt, where a meaning-preserving
  * reword loses nothing. It deliberately does NOT touch data fields:
@@ -669,7 +667,7 @@ export function sanitizeToolDescriptionForCognitionForTests(description: string)
   return sanitizeTextForCognition(description);
 }
 
-/** Text sanitizer applied to every string the adapter puts on the wire. */
+/** Test-only: exercise the sanitizer used for system text and tool descriptions. */
 export function sanitizeTextForCognitionForTests(text: string): string {
   return sanitizeTextForCognition(text);
 }
 
@@ -6,7 +6,7 @@ import { createDevinAdapter, mapDevinToolCallStartForTests, mapOcxMessagesToDevi
 import { buildGetChatMessageRequestForTests, sanitizeTextForCognitionForTests, sanitizeToolDescriptionForCognitionForTests } from "../../src/adapters/devin/cloud-direct/chat";
 import { DEVIN_MODEL_CONTEXT_WINDOWS, DEVIN_STATIC_MODELS, collapseDevinModelUid } from "../../src/adapters/devin/live-models";
 import { parseCatalogBuffer } from "../../src/adapters/devin/cloud-direct/catalog";
-import { encodeMessage, encodeString, encodeVarintField } from "../../src/adapters/devin/cloud-direct/wire";
+import { encodeMessage, encodeString, encodeVarintField, iterFields } from "../../src/adapters/devin/cloud-direct/wire";
 import { DEPRECATED_OAUTH_PROVIDER_ALIASES, OAUTH_PROVIDERS, resolveRefreshPolicy } from "../../src/oauth";
 import { DEVIN_DEFAULT_API_SERVER } from "../../src/oauth/devin";
 import { saveCredential } from "../../src/oauth/store";
@@ -304,7 +304,7 @@ describe("devin adapter", () => {
     expect(sanitizeToolDescriptionForCognitionForTests(nearMiss)).toBe(nearMiss);
   });
 
-  test("rewrites the Codex escalation-instruction phrase in every wire field", () => {
+  test("rewrites the Codex escalation phrase on instruction surfaces and preserves data", () => {
     // This trigger lives in Codex's <permissions instructions> boilerplate,
     // which Codex sends as system prompt — not in a tool description. The
     // clause was isolated live: the full sentence is refused while every
@@ -318,6 +318,9 @@ describe("devin adapter", () => {
     // Flexible whitespace/case, same as the other Codex entries.
     expect(sanitizeTextForCognitionForTests(trigger.toUpperCase()))
       .toContain("whether to allow the action");
+    expect(sanitizeTextForCognitionForTests(trigger.replaceAll(" ", "\n  "))).toBe(
+      "asking the user whether to allow the action in the `justification` parameter",
+    );
 
     // The phrase is rewritten on instruction surfaces — #2 (system prompt)
     // and tool descriptions — but data fields must stay byte-exact: a user
@@ -342,17 +345,23 @@ describe("devin adapter", () => {
           thinking: `the prompt says: ${trigger}`,
           tool_calls: [{ id: "c1", name: "apply_patch", arguments: `{"patch":"${trigger}"}` }],
         },
+        { role: "tool", tool_call_id: "c1", content: `file bytes: ${trigger}` },
         { role: "user", content: "hello" },
       ],
       tools: [{ name: "codex_escalation", description: trigger, parameters: { type: "object" } }],
     });
-    // Instruction surfaces rewritten...
-    expect(req.includes(Buffer.from("asking the user whether to allow the action", "utf8"))).toBe(true);
+    // Decode #2 independently: a rewritten tool description cannot mask an
+    // unsanitized system prompt in a whole-buffer substring assertion.
+    const systemField = [...iterFields(req)].find((field) => field.num === 2);
+    expect(systemField?.value).toEqual(Buffer.from(
+      `<permissions instructions>\n- Include a short question asking the user whether to allow the action in the \`justification\` parameter. e.g. "Do it?"\n</permissions>`,
+    ));
     // ...but data fields preserve the literal bytes (user text, thinking,
     // tool-call arguments all still carry the verbatim trigger).
     expect(req.includes(Buffer.from(`here is a quote: ${trigger}`, "utf8"))).toBe(true);
     expect(req.includes(Buffer.from(`the prompt says: ${trigger}`, "utf8"))).toBe(true);
     expect(req.includes(Buffer.from(`{"patch":"${trigger}"}`, "utf8"))).toBe(true);
+    expect(req.includes(Buffer.from(`file bytes: ${trigger}`, "utf8"))).toBe(true);
 
     // A request where the ONLY trigger carrier is a tool description must
     // come out clean — pins encodeToolDef specifically.
Original file line number	Diff line number	Diff line change
`@@ -628,8 +628,6 @@ const MAX_TOOL_DESC_LEN = 6998;`
`628`	`628`	`* for "whether to allow", verified live to clear the filter while preserving`
`629`	`629`	`* the instruction's meaning.`
`630`	`630`	`*`
`631`		`- * Scope note: the first entries only ever appeared in tool descriptions, but`
`632`		`- * this one lives in request #2 (the system prompt) and could equally appear`
`633`	`631`	`* Scope note: the sanitizer only ever touches instruction surfaces —`
`634`	`632`	`* tool descriptions and the #2 system prompt, where a meaning-preserving`
`635`	`633`	`* reword loses nothing. It deliberately does NOT touch data fields:`
`@@ -669,7 +667,7 @@ export function sanitizeToolDescriptionForCognitionForTests(description: string)`
`669`	`667`	`return sanitizeTextForCognition(description);`
`670`	`668`	`}`
`671`	`669`
`672`		`-/** Text sanitizer applied to every string the adapter puts on the wire. */`
	`670`	`+/** Test-only: exercise the sanitizer used for system text and tool descriptions. */`
`673`	`671`	`export function sanitizeTextForCognitionForTests(text: string): string {`
`674`	`672`	`return sanitizeTextForCognition(text);`
`675`	`673`	`}`