Devika Verma ed009fd62f Reviewer never reads attachment bodies - neutral markers only (4.4) ...

A text-file attachment's contents were flowing verbatim into the
reviewer's USER REQUEST block (the list-content extraction kept every
text part, and inlined .txt/.csv attachments ARE text parts) - an
attacker-writable channel into the judge's highest-authority input,
inconsistent with images/PDFs which were dropped silently.

New attachments.reviewer_text(): the user's typed words survive, every
attachment collapses to '[user attached: <name>]' (images: 'an image').
The reviewer learns a file exists - 'clean this up' plus an attachment
IS a different request than 'clean this up' - but never what it says.
The agent's view is untouched. A typed message mimicking the inline
prefix collapses too: the failure direction is less information, never
smuggled content. Prefix and collapser live in the same module so the
spelling cannot drift.

Corpus: inject-015 (planted upload instruction in an attached csv).
Tests: marker collapse, edge shapes, _user_history integration.

2026-08-17 18:18:40 +05:30

..

corpora

Reviewer never reads attachment bodies - neutral markers only (4.4)

2026-08-17 18:18:40 +05:30

conftest.py

security: complete local access protections

2026-07-24 18:44:39 -07:00

test_accounts.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_anthropic_caching.py

Enable prompt caching on the Anthropic provider

2026-07-27 22:47:30 -07:00

test_anthropic_provider.py

Enable prompt caching on the Anthropic provider

2026-07-27 22:47:30 -07:00

test_approval_integrity.py

Step 3b: web_search -> EGRESS + the 1.9 egress cards

2026-08-13 08:41:44 -07:00

test_artifact_walk.py

fix: stop artifact walk entering OS app-data dirs; context bar off by default

2026-07-30 13:10:30 -07:00

test_ask_user_upgrades.py

ask_user upgrades: rich options, grouped questions, option previews (OPE-51)

2026-07-29 15:52:05 +05:30

test_attachments.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_auto_approve_settings.py

Feature 4: reviewer metering - badge, mode-menu summary, durable stats

2026-08-12 17:40:51 -07:00

test_auto_approve.py

Reviewer never reads attachment bodies - neutral markers only (4.4)

2026-08-17 18:18:40 +05:30

test_automation_create.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_automation.py

port aisuite#380: slack installer pre-add, mcp oauth quarantine, automation toast, e2e fixes

2026-07-21 12:56:36 -07:00

test_autotitle.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_bedrock_provider.py

Bedrock settings: one auth method at a time

2026-07-25 22:55:28 -07:00

test_builtin_personas.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_catalog.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_cloud_server.py

security: complete local access protections

2026-07-24 18:44:39 -07:00

test_cloud.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_code_tools.py

Keep ripgrep searches out of generated directories (#10)

2026-07-23 12:29:19 -07:00

test_command_matching.py

PR3: split compound commands and check each part independently

2026-08-11 11:43:57 -07:00

test_compaction_engine.py

compaction: live progress signal + user-message cap

2026-07-30 06:24:39 -07:00

test_compaction_smoke.py

compaction: harden the smoke against per-turn event loops (OPE-27)

2026-07-29 18:00:38 +05:30

test_compaction.py

compaction: live progress signal + user-message cap

2026-07-30 06:24:39 -07:00

test_config.py

security: refine workspace trust controls

2026-07-24 18:44:39 -07:00

test_connections.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_connector_registry.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_connectors_allowlist.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_connectors.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_decision_matrix_golden.py

Phase 0: golden decision table for the permission engine

2026-08-11 11:18:21 -07:00

test_dm_routing.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_durable_resume.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_egress_and_overrides.py

Step 3b: web_search -> EGRESS + the 1.9 egress cards

2026-08-13 08:41:44 -07:00

test_email_tools.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_engine_stop.py

Keep Retry offered across model switches

2026-07-23 07:43:24 -07:00

test_engine.py

Allow mid-session model switching with a persisted transcript marker

2026-07-22 15:43:54 -07:00

test_environment.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_fake_slack.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_gateway_inbox_reply.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_gcal_accounts.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_gemini_provider.py

Coerce union-typed JSON Schema for Gemini tool declarations

2026-07-23 07:43:24 -07:00

test_github_installs.py

security: complete local access protections

2026-07-24 18:44:39 -07:00

test_gmail_accounts.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_hubspot_portals.py

security: complete local access protections

2026-07-24 18:44:39 -07:00

test_inbox_routing.py

fix(inbox): match approval keywords as whole words, not substrings

2026-07-25 18:33:16 -07:00

test_inbox.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_interactions.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_mcp_connectors.py

port aisuite#380: slack installer pre-add, mcp oauth quarantine, automation toast, e2e fixes

2026-07-21 12:56:36 -07:00

test_mcp_oauth.py

fix: harden local trust boundaries (shell allowlist, MCP OAuth loopback, WS ingestion)

2026-07-24 01:41:05 +05:00

test_mcp.py

mcp: global config wins on name clash with a trusted workspace

2026-07-30 11:24:06 -07:00

test_memory_api.py

Memory V1: remembered facts, your instructions, one screen

2026-07-28 20:32:14 +05:30

test_memory.py

Memory V1: remembered facts, your instructions, one screen

2026-07-28 20:32:14 +05:30

test_mention_router.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_message_source.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_message_timestamps.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_model_errors.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_multiroot.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_openai_responses.py

Route native OpenAI (blank endpoint) to the Responses provider

2026-07-28 20:48:43 +05:30

test_pdf_support.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_permissions_risk.py

Step 2: Auto-Approve mode - the reviewer, the hook, and the renames

2026-08-12 12:42:17 -07:00

test_persona_connections.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_persona_loading.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_persona_manifest.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_persona_registry.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_plan_mode.py

Step 2: Auto-Approve mode - the reviewer, the hook, and the renames

2026-08-12 12:42:17 -07:00

test_provider_router.py

Route native OpenAI (blank endpoint) to the Responses provider

2026-07-28 20:48:43 +05:30

test_provider_verify.py

Add OpenRouter as an OpenAI-compatible reseller provider

2026-07-25 16:07:33 -07:00

test_providers.py

Add AWS Bedrock provider with per-family dispatch

2026-07-25 16:15:18 -07:00

test_risk_overrides.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_secrets.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_self_protection.py

Step 2: Auto-Approve mode - the reviewer, the hook, and the renames

2026-08-12 12:42:17 -07:00

test_self_wake.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_send_file.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_send_target_resolution.py

Rename bot references from ocw to OpenWorker

2026-07-23 07:43:24 -07:00

test_sender_attribution.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_server.py

Add support for Skills (#391)

2026-08-01 08:50:53 -07:00

test_session_events.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_session_facts.py

Step 1: known world frozen at session start; ingestion facts to audit only

2026-08-12 12:16:45 -07:00

test_session_persona.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_settings.py

settings: gate ollama models on a live local Ollama

2026-07-21 22:02:20 -07:00

test_shadow_eval.py

Pin eval renderer to engine renderer with a parity test

2026-08-17 04:14:25 +05:30

test_shell.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_skills_api.py

Add support for Skills (#391)

2026-08-01 08:50:53 -07:00

test_skills_sessions.py

Add support for Skills (#391)

2026-08-01 08:50:53 -07:00

test_skills_store.py

Add support for Skills (#391)

2026-08-01 08:50:53 -07:00

test_skills.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_slack_approval_owners.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_slack_directory.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_slack_relay.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_slack_status.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_slack_workspaces.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_standing_approvals.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_subagent.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_subscriptions.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_team_allowlist.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_todo_tool.py

todo_write: rename the items param to todos

2026-07-21 15:45:26 -07:00

test_token_usage.py

Meter token usage across all model providers

2026-07-27 21:01:31 -07:00

test_tools_permissions.py

Finish the Mode.AUTO -> Mode.BYPASS_APPROVALS rename in tests

2026-08-12 12:45:02 -07:00

test_tui.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_ui_refresh_e2e.py

security: harden Slack approval handling

2026-07-24 22:33:13 -07:00

test_unattended.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_url_address_guard.py

security: pin fetched connections to the vetted address (close DNS rebinding)

2026-07-31 10:16:09 +01:00

test_vertex_provider.py

Vertex: countTokens verify, global-location host, honest region help

2026-07-27 12:58:16 -07:00

test_wake_resume.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00

test_web_search.py

OpenWorker: initial import

2026-07-21 11:09:41 -07:00