fix(fireworks): disable FirePass Kimi reasoning leak by frankekn · Pull Request #63607 · openclaw/openclaw

frankekn · 2026-04-09T07:22:27Z

Summary

Problem: FirePass Kimi K2.5 can emit full reasoning in visible content when OpenClaw sends the normal OpenAI-compatible payload.
Why it matters: users can see the model's internal reasoning text even when OpenClaw should keep thinking hidden.
What changed: Fireworks Kimi K2.5 now defaults to reasoning: false, and the Fireworks provider wrapper forces thinking: { type: "disabled" } while stripping reasoning fields before the request is sent.
What did NOT change (scope boundary): no shared OpenAI transport/parser changes and no behavior changes for non-Fireworks or non-Kimi models.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related #
This PR fixes a bug or regression

Root Cause (if applicable)

Root cause: Fireworks Pass Kimi can return reasoning in visible content unless thinking is explicitly disabled, while the bundled Fireworks provider still advertised Kimi as reasoning-enabled and forwarded reasoning settings.
Missing detection / guardrail: there was no Fireworks-owned provider wrapper that normalized Kimi requests away from reasoning mode.
Contributing context (if known): Fireworks' OpenClaw setup script already writes reasoning: false, but the bundled provider catalog and dynamic-model path had drifted from that expectation.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: extensions/fireworks/stream.test.ts, extensions/fireworks/index.test.ts
Scenario the test should lock in: Fireworks Kimi requests force thinking: { type: "disabled" }, strip reasoning fields, and do not mark Kimi models as reasoning-enabled.
Why this is the smallest reliable guardrail: the leak is provider-specific request shaping, so the provider seam is the narrowest place that can catch it deterministically.
Existing test that already covers this (if any): src/agents/pi-embedded-runner/minimax-stream-wrappers.test.ts covers the adjacent hidden-thinking wrapper pattern.
If no new test is added, why not: N/A

User-visible / Behavior Changes

FirePass Kimi K2.5 no longer runs with OpenClaw reasoning enabled by default.
OpenClaw now sends Fireworks Kimi requests with thinking: { type: "disabled" } to prevent visible reasoning leakage.

Diagram (if applicable)

Before:
[user prompt] -> [Fireworks Kimi with reasoning-capable payload] -> [reasoning may appear in visible content]

After:
[user prompt] -> [Fireworks Kimi with thinking disabled] -> [normal visible answer only]

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: Node 22 + pnpm
Model/provider: Fireworks Pass accounts/fireworks/routers/kimi-k2p5-turbo
Integration/channel (if any): OpenAI-compatible provider transport
Relevant config (redacted): Fireworks API key via env only

Steps

Send a Fireworks Pass Kimi request without explicitly disabling thinking.
Observe Fireworks can return reasoning in visible content.
Apply the provider wrapper and rerun the same request path.

Expected

Visible response text should contain only the answer.

Actual

Before the fix, reasoning could appear in visible content.
After the fix, the same path returns only visible answer text.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios: focused provider tests passed; live Fireworks Pass replay returned visible text only and no thinking text.
Edge cases checked: non-Kimi Fireworks models stay untouched; non-Fireworks providers stay untouched; pre-existing MiniMax wrapper tests still pass.
What you did not verify: full repo pnpm build / full-suite gate in this worktree.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps:

Risks and Mitigations

Risk: a future Fireworks Kimi model id variant may not match the current helper.
- Mitigation: matching is isolated in extensions/fireworks/model-id.ts and covered by focused tests.

aisle-research-bot · 2026-04-09T07:22:40Z

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

#	Severity	Title
1	🟡 Medium	Fireworks Kimi thinking-disable wrapper can be bypassed via onPayload reintroducing reasoning fields

1. 🟡 Fireworks Kimi thinking-disable wrapper can be bypassed via onPayload reintroducing reasoning fields

Property	Value
Severity	Medium
CWE	CWE-840
Location	`src/agents/pi-embedded-runner/stream-payload-utils.ts:10-18`

Description

createFireworksKimiThinkingDisabledWrapper intends to force Fireworks Kimi models to disable thinking/chain-of-thought by patching the request payload. However, streamWithPayloadPatch applies patchPayload before invoking the caller-provided options.onPayload hook.

This means a caller (or downstream wrapper) can undo the sanitization by re-adding reasoning, reasoning_effort, etc. inside onPayload, causing the final payload that is sent to the provider to include reasoning controls again. If the purpose of this wrapper is to prevent visible chain-of-thought leakage, the current ordering is a functional/security bypass.

Vulnerable flow:

sink: payload object that will be used for the provider request
patch: deletes reasoning keys and sets thinking={type:"disabled"}
bypass: originalOnPayload runs after patch and can re-add removed fields

Vulnerable code:

onPayload: (payload) => {
  if (payload && typeof payload === "object") {
    patchPayload(payload as Record<string, unknown>);
  }
  return originalOnPayload?.(payload, model);
},

Recommendation

Ensure the enforced patch cannot be undone by user callbacks.

Option A (enforce after user hook):

onPayload: (payload) => {
  const result = originalOnPayload?.(payload, model);
  if (payload && typeof payload === "object") {
    patchPayload(payload as Record<string, unknown>);
  }
  return result;
},

Option B (stronger isolation): clone before invoking originalOnPayload, and/or deep-clone and freeze the payload used for sending so later mutations cannot reintroduce disallowed fields.

Also consider documenting the contract: whether patchPayload is meant as a hard policy (non-overridable) or a default that user hooks may override.

Analyzed PR: #63607 at commit f7a3bbe

_{Last updated on: 2026-04-09T08:50:42Z}

greptile-apps · 2026-04-09T07:26:26Z

Greptile Summary

This PR fixes a visible reasoning leak in the Fireworks Kimi K2.5 provider: Fireworks can return chain-of-thought in visible content unless thinking: { type: "disabled" } is sent explicitly. The fix introduces a wrapStreamFn that intercepts Kimi requests, forces thinking disabled, and strips any outbound reasoning fields — isolated entirely within the Fireworks extension without touching shared transport or other providers.

The change is well-scoped, correctly implemented, and covered by focused unit tests on both the catalog metadata path and the stream wrapper path.

Confidence Score: 5/5

Safe to merge — all changes are correctly scoped to the Fireworks extension with no shared transport side effects.

No P0 or P1 findings. The stream wrapper, catalog metadata, and dynamic model resolution all correctly disable thinking for Kimi models and pass through everything else. The one observation (indirect constant expression in provider-catalog.ts) is a P2 style suggestion that does not affect correctness.

No files require special attention.

Vulnerabilities

No security concerns identified. The change restricts outbound payload fields (strips reasoning parameters) rather than expanding network access or handling secrets. No new permissions, tokens, or network calls introduced.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/fireworks/provider-catalog.ts
Line: 24

Comment:
**Indirect constant expression for `reasoning`**

`!isFireworksKimiModelId(FIREWORKS_DEFAULT_MODEL_ID)` evaluates to a compile-time-stable `false` (since the constant always contains `"kimi-k2p5"`). The intent is correct, but calling a helper on a known constant can be surprising to readers. A direct `reasoning: false` with a brief comment stating why would make the invariant explicit without the indirection.

```suggestion
      reasoning: false, // Kimi K2.5 streams reasoning in visible content; disable at catalog level
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: disable FirePass Kimi reasoning lea..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e2178525a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

frankekn · 2026-04-09T08:09:19Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1468d317aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-09T08:18:52Z

+  ctx: ProviderWrapStreamFnContext,
+): StreamFn | undefined {
+  if (
+    ctx.provider !== "fireworks" ||


Apply Fireworks hardening for provider aliases too

wrapFireworksProviderStream exits unless ctx.provider === "fireworks", but this provider explicitly supports aliases (aliases: ["fireworks-ai"] in extensions/fireworks/index.ts). The hook is still resolved for aliases, so requests configured under fireworks-ai skip this wrapper and won’t get thinking: { type: "disabled" } or reasoning-field stripping, leaving the reasoning-leak path unfixed for a supported provider id.

Useful? React with 👍 / 👎.

frankekn · 2026-04-09T08:51:15Z

@codex review

chatgpt-codex-connector · 2026-04-09T08:59:44Z

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

* fix: disable FirePass Kimi reasoning leak * fix: preserve Fireworks wrapper fallbacks * fix: harden Fireworks Kimi model matching * fix: restore Fireworks payload sanitization

fix: disable FirePass Kimi reasoning leak

7e21785

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Apr 9, 2026

greptile-apps Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread extensions/fireworks/provider-catalog.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 9, 2026

View reviewed changes

Comment thread extensions/fireworks/stream.ts Outdated

fix: preserve Fireworks wrapper fallbacks

360b553

openclaw-barnacle Bot added agents Agent runtime and tooling size: M and removed size: S labels Apr 9, 2026

fix: harden Fireworks Kimi model matching

1468d31

chatgpt-codex-connector Bot reviewed Apr 9, 2026

View reviewed changes

fix: restore Fireworks payload sanitization

f7a3bbe

openclaw-barnacle Bot removed the agents Agent runtime and tooling label Apr 9, 2026

frankekn merged commit 3e062ac into main Apr 9, 2026
34 of 37 checks passed

frankekn deleted the fireworks-kimi-reasoning-fix branch April 9, 2026 09:09

github-actions Bot mentioned this pull request Apr 9, 2026

📡 Upstream Digest — 2026-04-09 10:53 UTC curtismercier/openclaw-mods#519

Open

This was referenced May 1, 2026

[Bug]: kimi/k2p6 returns incomplete terminal response and gateway status probe times out #74205

Closed

fix: preserve K2.6 reasoning payload fields to prevent incomplete terminal replies #74289

Closed

clawsweeper Bot mentioned this pull request May 5, 2026

fix(fireworks): pin Kimi thinking policy off #77732

Merged

clawsweeper Bot mentioned this pull request Jun 15, 2026

feat(fireworks): catalog DeepSeek V4 Pro, MiniMax M2.7, GLM-5.1, GPT-OSS 120B reasoning models #92217

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(fireworks): disable FirePass Kimi reasoning leak#63607

fix(fireworks): disable FirePass Kimi reasoning leak#63607
frankekn merged 4 commits into
mainfrom
fireworks-kimi-reasoning-fix

frankekn commented Apr 9, 2026

Uh oh!

aisle-research-bot Bot commented Apr 9, 2026 •

edited

Loading

Description

Recommendation

Uh oh!

greptile-apps Bot commented Apr 9, 2026

Vulnerabilities

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

frankekn commented Apr 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Uh oh!

frankekn commented Apr 9, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

frankekn commented Apr 9, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

Uh oh!

aisle-research-bot Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

Description

Recommendation

Uh oh!

greptile-apps Bot commented Apr 9, 2026

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

frankekn commented Apr 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

frankekn commented Apr 9, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aisle-research-bot Bot commented Apr 9, 2026 •

edited

Loading