Skip to content

fix(ai): add output sanitization and length limiting to AI integrations#1231

Merged
chaliy merged 1 commit intomainfrom
fix/issue-1174-ai-output-sanitization
Apr 12, 2026
Merged

fix(ai): add output sanitization and length limiting to AI integrations#1231
chaliy merged 1 commit intomainfrom
fix/issue-1174-ai-output-sanitization

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented Apr 11, 2026

Summary

Closes #1174

  • JS integrations (Anthropic, OpenAI): maxOutputLength (default 100k) truncates output, sanitizeOutput wraps in <tool_output> XML boundary markers
  • Python integrations (LangChain, PydanticAI, DeepAgents): max_output_length parameter with truncation
  • Prevents context window flooding and prompt injection via tool output

Test plan

  • Python linting passes (ruff check && ruff format --check)
  • TypeScript changes maintain backward compatibility (all options are optional)
  • Output truncation adds [truncated] marker

Closes #1174 — Adds maxOutputLength (default: 100k chars) with
truncation and sanitizeOutput option (XML boundary markers) to JS
integrations (Anthropic, OpenAI). Adds max_output_length to Python
integrations (LangChain, PydanticAI, DeepAgents). Prevents context
window flooding and adds defense-in-depth against prompt injection
via tool output.
@chaliy chaliy force-pushed the fix/issue-1174-ai-output-sanitization branch from 46e1f0b to b8ce77a Compare April 11, 2026 23:32
@chaliy chaliy merged commit 9de78ab into main Apr 12, 2026
27 checks passed
@chaliy chaliy deleted the fix/issue-1174-ai-output-sanitization branch April 12, 2026 03:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

sec(js): AI framework integrations pass raw tool output to LLM without output sanitization

1 participant