masci / banks

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix: only parse marked output as chat messages (#78)

* fix: only parse marked output as chat messages

Prompt.chat_messages() parsed every line of the rendered template as a
possible ChatMessage, so template data that rendered to message JSON was
returned as a privileged system, assistant or tool message.

Each Prompt now carries a secret sentinel in its render context. The chat
tag, the tool filter and the media filters mark everything they emit with
it, and the parsers accept only marked lines and markers; anything else
stays plain text. The sentinel is per instance rather than per render
because the render cache keys on the context, so a sentinel that changed
between renders would make cached text unparseable. text() strips it, so
its output is unchanged and the marker cannot leak to whoever supplies
the data.

The same round trip through rendered text also affected
CompletionExtension._body_to_messages(), where data could inject tool
definitions as well as messages, and chat_message_from_text(), where data
could inject content blocks such as remote image URLs through the
no-chat-block fallback. Both are covered.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix formatter

* fix: match sentinel past leading indentation

Only block tags get their indentation trimmed by lstrip_blocks, so a
`{{ ... | tool }}` line inside a completion block renders indented. The
sentinel check required the marker at the start of the line and silently
dropped those tools, breaking function calling. The JSON parser used to
tolerate the indentation, so this was a regression.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

113 of 119 branches covered (94.96%)

Branch coverage included in aggregate %.

96 of 97 new or added lines in 12 files covered. (98.97%)

4 existing lines in 2 files now uncovered.

941 of 996 relevant lines covered (94.48%)

0.94 hits per line