Baldwinzc 2e9ee329ce

fix(middleware): sanitize bare string blocks in list-form user content (#4668) ...

InputSanitizationMiddleware's text extraction only collected dict blocks
with type == "text", so a HumanMessage whose content list carried a bare
str item (a shape message_content_to_text treats as text and some IM/SDK
clients send) yielded no text at all — the request passed through
unwrapped and unescaped, letting forged framework tags (<system-reminder>
etc.) reach the model untouched.  The sibling rfind-fallback path in
_process_request already neutralized bare strings individually, and both
ToolResultSanitizationMiddleware and ToolOutputBudgetMiddleware treat
bare strings as text; the extraction helper was the odd one out.

Collect bare string blocks alongside text-block dicts (skipping empty
items, matching message_content_to_text), merging them into the single
sanitized text block on rebuild while interleaved non-text blocks keep
their positions.

2026-08-05 08:06:01 +08:00

..

lead_agent

feat(extensions): add middleware plugin foundation (#4636)

2026-08-04 22:33:26 +08:00

memory

fix(memory): prevent task-scoped data from entering long-term memory (#4604)

2026-08-01 08:39:28 +08:00

middlewares

fix(middleware): sanitize bare string blocks in list-form user content (#4668)

2026-08-05 08:06:01 +08:00

__init__.py

feat(checkpoint): dual-mode checkpoint storage with LangGraph DeltaChannel (#4292)

2026-07-22 08:33:29 +08:00

factory.py

feat(memory): add mem0 HTTP memory backend (#4528)

2026-07-29 07:11:20 +08:00

features.py

feat(memory): add memory tool sets (#4023)

2026-07-11 15:28:16 +08:00

goal_state.py

feat(runtime): implement goal continuations (#3858)

2026-07-03 08:49:33 +08:00

human_input.py

feat(frontend):enhance the ask_clarification interaction with visualized card (#3956)

2026-07-06 22:34:41 +08:00

thread_state.py

feat(checkpoint): make delta snapshot_frequency configurable (#4516)

2026-07-28 23:21:23 +08:00