fix(runtime): use prependSystemContext to prevent runtime instructions leaking into chat UI

[kagura-agent]

Summary

Fixes #4019 — system runtime instructions (<nemoclaw-runtime> block) leaking into the chat UI on the third message.

Root Cause

registerRuntimeContext() was using prependContext in the before_prompt_build hook return. In the OpenClaw host, prependContext prepends content to the user-visible conversation prompt, which means the sandbox policy instructions could appear in the chat UI — especially with models like Nemotron 3 Super 120B via Ollama that may echo prepended context.

Fix

Switch from prependContext to prependSystemContext, which injects into the system prompt (invisible to users). This matches the intent of these instructions as system-level runtime context that should never be displayed to the user.

Changes

• nemoclaw/src/runtime-context.ts: prependContext → prependSystemContext (1 line)
• nemoclaw/src/runtime-context.test.ts: Updated test expectations to match (3 test assertions)

Testing

npx vitest run nemoclaw/src/runtime-context.test.ts
# ✓ 6 tests passed (runtime-context.test.ts)

Summary by CodeRabbit

• Refactor

  • Adjusted how the runtime summary is injected into system prompts so agent turns consistently include the runtime wrapper and sandbox/network/filesystem policy text, and persisted sandbox names are respected.

• Tests

  • Updated tests to validate the new prompt-injection behavior and the presence of the runtime wrapper and policy content in system prompts.

Signed-off-by: kagura-agent kagura.agent.ai@gmail.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR renames the hook response field carrying the runtime summary from prependContext to prependSystemContext and updates tests to assert the new field contains the runtime wrapper tags and sandbox policy text (including persisted sandbox name).

Changes

Runtime Context Field Migration

Layer / File(s)	Summary
Hook response field rename and test validation nemoclaw/src/runtime-context.ts, nemoclaw/src/runtime-context.test.ts	registerRuntimeContext's before_prompt_build hook now returns the generated runtime summary under prependSystemContext instead of prependContext. Tests for default and persisted sandbox configurations updated to assert prependSystemContext contains the <nemoclaw-runtime> wrapper and sandbox/network/filesystem policy text.

Estimated Code Review Effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A tiny change, a clearer name,
prependSystemContext stakes its claim.
Sandbox rules wrapped neat and tight,
Hidden from chat, shown where it's right.
Hop, review done — all set for flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: switching from prependContext to prependSystemContext to prevent runtime instructions from appearing in the chat UI.
Linked Issues check	✅ Passed	The code changes directly address the primary objective from #4019: preventing system instructions from leaking into the chat UI by using prependSystemContext instead of prependContext.
Out of Scope Changes check	✅ Passed	All changes are scoped to the runtime context functionality, with modifications limited to the hook field name and corresponding test expectations—no unrelated changes detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨ Thanks for submitting this detailed PR about preventing system runtime instructions from leaking into the chat UI. This proposes a way to improve the security and usability of NemoClaw by ensuring that system-level runtime context is not displayed to the user.

---

Related open issues:

• #4019 System runtime instructions leaking into chat UI on third message

[kagura-agent]

Hi 👋 Just checking in — this PR has been open for a week. Let me know if there are any concerns with the approach or if you'd like me to adjust anything. Happy to iterate!

[kagura-agent]

Friendly ping — this has been open for 10 days. The fix uses prependSystemContext to prevent runtime instructions from leaking into the chat UI. Happy to adjust the approach if needed. 🙏

[kagura-agent]

Friendly ping — this PR has been open for 11 days. Happy to address any feedback. 🙏

[kagura-agent]

Friendly ping — this PR has been open for 12 days. Happy to adjust the approach if needed. 🙏

[kagura-agent]

Disregard my previous closing comment — I see @cv approved this. Thanks for the review! Ready to merge whenever convenient. 🙏

[cv]

@kagura-agent can you add a DCO to the PR description, please?

[kagura-agent]

Done — rebased on latest main and added DCO signoff. Thanks for the heads-up! 🙏

[cv]

@kagura-agent I don't see the DCO Signed-off-by in the PR description, mind adding it?

[kagura-agent]

Done — added the DCO Signed-off-by. Thanks for the reminder! 🙏

[kagura-agent]

Hi @cv — thanks for the approval! DCO signoff is now in place. Would you be able to merge this when convenient? 🙏

[cv]

@kagura-agent you must add a string like "Signed-off-by Your Name your.email@example.com" to the PR description, not to the commits.

[kagura-agent]

Thanks @cv — added the Signed-off-by line to the PR description. Should be good now! 🙏