Fix contextual metadata fallbacks

Skip contextual user response items in metadata and rollout fallback scanning, and truncate code-mode notify output before preserving it.

Author: ericjuta

codex-rs/core/src/context/contextual_user_message.rs

@@ -1,72 +1,10 @@
 use codex_protocol::items::HookPromptItem;
+use codex_protocol::items::is_contextual_user_fragment as protocol_is_contextual_user_fragment;
 use codex_protocol::items::parse_hook_prompt_fragment;
 use codex_protocol::models::ContentItem;
 
-use super::AdditionalContextUserFragment;
-use super::EnvironmentContext;
-use super::FragmentRegistration;
-use super::FragmentRegistrationProxy;
-use super::GoalContext;
-use super::LegacyApplyPatchExecCommandWarning;
-use super::LegacyModelMismatchWarning;
-use super::LegacyUnifiedExecProcessLimitWarning;
-use super::SkillInstructions;
-use super::SubagentNotification;
-use super::TurnAborted;
-use super::UserInstructions;
-use super::UserShellCommand;
-
-static USER_INSTRUCTIONS_REGISTRATION: FragmentRegistrationProxy<UserInstructions> =
-    FragmentRegistrationProxy::new();
-static ENVIRONMENT_CONTEXT_REGISTRATION: FragmentRegistrationProxy<EnvironmentContext> =
-    FragmentRegistrationProxy::new();
-static ADDITIONAL_CONTEXT_REGISTRATION: FragmentRegistrationProxy<AdditionalContextUserFragment> =
-    FragmentRegistrationProxy::new();
-static SKILL_INSTRUCTIONS_REGISTRATION: FragmentRegistrationProxy<SkillInstructions> =
-    FragmentRegistrationProxy::new();
-static USER_SHELL_COMMAND_REGISTRATION: FragmentRegistrationProxy<UserShellCommand> =
-    FragmentRegistrationProxy::new();
-static TURN_ABORTED_REGISTRATION: FragmentRegistrationProxy<TurnAborted> =
-    FragmentRegistrationProxy::new();
-static SUBAGENT_NOTIFICATION_REGISTRATION: FragmentRegistrationProxy<SubagentNotification> =
-    FragmentRegistrationProxy::new();
-static GOAL_CONTEXT_REGISTRATION: FragmentRegistrationProxy<GoalContext> =
-    FragmentRegistrationProxy::new();
-static LEGACY_UNIFIED_EXEC_PROCESS_LIMIT_WARNING_REGISTRATION: FragmentRegistrationProxy<
-    LegacyUnifiedExecProcessLimitWarning,
-> = FragmentRegistrationProxy::new();
-static LEGACY_APPLY_PATCH_EXEC_COMMAND_WARNING_REGISTRATION: FragmentRegistrationProxy<
-    LegacyApplyPatchExecCommandWarning,
-> = FragmentRegistrationProxy::new();
-static LEGACY_MODEL_MISMATCH_WARNING_REGISTRATION: FragmentRegistrationProxy<
-    LegacyModelMismatchWarning,
-> = FragmentRegistrationProxy::new();
-
-static CONTEXTUAL_USER_FRAGMENTS: &[&dyn FragmentRegistration] = &[
-    &USER_INSTRUCTIONS_REGISTRATION,
-    &ENVIRONMENT_CONTEXT_REGISTRATION,
-    &ADDITIONAL_CONTEXT_REGISTRATION,
-    &SKILL_INSTRUCTIONS_REGISTRATION,
-    &USER_SHELL_COMMAND_REGISTRATION,
-    &TURN_ABORTED_REGISTRATION,
-    &SUBAGENT_NOTIFICATION_REGISTRATION,
-    &GOAL_CONTEXT_REGISTRATION,
-    &LEGACY_UNIFIED_EXEC_PROCESS_LIMIT_WARNING_REGISTRATION,
-    &LEGACY_APPLY_PATCH_EXEC_COMMAND_WARNING_REGISTRATION,
-    &LEGACY_MODEL_MISMATCH_WARNING_REGISTRATION,
-];
-
-fn is_standard_contextual_user_text(text: &str) -> bool {
-    CONTEXTUAL_USER_FRAGMENTS
-        .iter()
-        .any(|fragment| fragment.matches_text(text))
-}
-
 pub(crate) fn is_contextual_user_fragment(content_item: &ContentItem) -> bool {
-    let ContentItem::InputText { text } = content_item else {
-        return false;
-    };
-    parse_hook_prompt_fragment(text).is_some() || is_standard_contextual_user_text(text)
+    protocol_is_contextual_user_fragment(content_item)
 }
 
 pub(crate) fn parse_visible_hook_prompt_message(
@@ -83,7 +21,7 @@ pub(crate) fn parse_visible_hook_prompt_message(
             fragments.push(fragment);
             continue;
         }
-        if is_standard_contextual_user_text(text) {
+        if is_contextual_user_fragment(content_item) {
             continue;
         }
         return None;

codex-rs/core/src/context/fragment.rs

@@ -1,33 +1,6 @@
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::ResponseItem;
-use std::marker::PhantomData;
-
-/// Type-erased registration for a contextual user fragment.
-///
-/// Implementations are used by context filtering code to recognize injected
-/// fragments without constructing the concrete context payload.
-pub(crate) trait FragmentRegistration: Sync {
-    fn matches_text(&self, text: &str) -> bool;
-}
-
-pub(crate) struct FragmentRegistrationProxy<T> {
-    _marker: PhantomData<fn() -> T>,
-}
-
-impl<T> FragmentRegistrationProxy<T> {
-    pub(crate) const fn new() -> Self {
-        Self {
-            _marker: PhantomData,
-        }
-    }
-}
-
-impl<T: ContextualUserFragment> FragmentRegistration for FragmentRegistrationProxy<T> {
-    fn matches_text(&self, text: &str) -> bool {
-        T::matches_text(text)
-    }
-}
 
 /// Context payload that is injected as a message fragment.
 ///

codex-rs/core/src/context/mod.rs

@@ -13,9 +13,6 @@ mod goal_context;
 mod guardian_followup_review_reminder;
 mod hook_additional_context;
 mod image_generation_instructions;
-mod legacy_apply_patch_exec_command_warning;
-mod legacy_model_mismatch_warning;
-mod legacy_unified_exec_process_limit_warning;
 mod model_switch_instructions;
 mod network_rule_saved;
 mod permissions_instructions;
@@ -39,17 +36,12 @@ pub(crate) use contextual_user_message::is_contextual_user_fragment;
 pub(crate) use contextual_user_message::parse_visible_hook_prompt_message;
 pub(crate) use environment_context::EnvironmentContext;
 pub use fragment::ContextualUserFragment;
-pub(crate) use fragment::FragmentRegistration;
-pub(crate) use fragment::FragmentRegistrationProxy;
 pub(crate) use fragments::AdditionalContextDeveloperFragment;
 pub(crate) use fragments::AdditionalContextUserFragment;
 pub use goal_context::GoalContext;
 pub(crate) use guardian_followup_review_reminder::GuardianFollowupReviewReminder;
 pub(crate) use hook_additional_context::HookAdditionalContext;
 pub(crate) use image_generation_instructions::ImageGenerationInstructions;
-pub(crate) use legacy_apply_patch_exec_command_warning::LegacyApplyPatchExecCommandWarning;
-pub(crate) use legacy_model_mismatch_warning::LegacyModelMismatchWarning;
-pub(crate) use legacy_unified_exec_process_limit_warning::LegacyUnifiedExecProcessLimitWarning;
 pub(crate) use model_switch_instructions::ModelSwitchInstructions;
 pub(crate) use network_rule_saved::NetworkRuleSaved;
 pub use permissions_instructions::PermissionsInstructions;

codex-rs/core/src/tools/code_mode/mod.rs

@@ -132,12 +132,16 @@ impl CodeModeTurnHost for CoreTurnHost {
         if text.trim().is_empty() {
             return Ok(());
         }
+        let output = FunctionCallOutputPayload::from_content_items(truncate_code_mode_result(
+            vec![FunctionCallOutputContentItem::InputText { text }],
+            None,
+        ));
         self.exec
             .session
             .inject_response_items(vec![ResponseInputItem::CustomToolCallOutput {
                 call_id,
                 name: Some(PUBLIC_TOOL_NAME.to_string()),
-                output: FunctionCallOutputPayload::from_text(text),
+                output,
             }])
             .await
             .map_err(|_| {
@@ -328,8 +332,10 @@ fn build_freeform_tool_payload(
 #[cfg(test)]
 mod tests {
     use super::build_nested_tool_payload;
+    use super::truncate_code_mode_result;
     use crate::tools::context::ToolPayload;
     use codex_code_mode::CodeModeToolKind;
+    use codex_protocol::models::FunctionCallOutputContentItem;
     use codex_tools::ToolName;
     use serde_json::json;
 
@@ -366,4 +372,24 @@ mod tests {
             other => panic!("expected freeform payload, got {other:?}"),
         }
     }
+
+    #[test]
+    fn truncate_code_mode_result_bounds_text_items() {
+        let original = "notification output ".repeat(1_000);
+        let items = truncate_code_mode_result(
+            vec![FunctionCallOutputContentItem::InputText {
+                text: original.clone(),
+            }],
+            Some(10),
+        );
+
+        let [FunctionCallOutputContentItem::InputText { text }] = items.as_slice() else {
+            panic!("expected a single text item");
+        };
+        assert_ne!(text, &original);
+        assert!(
+            text.contains("tokens truncated"),
+            "expected token truncation marker, got {text}"
+        );
+    }
 }

codex-rs/protocol/src/items.rs

@@ -35,6 +35,77 @@ use std::path::PathBuf;
 use std::time::Duration;
 use ts_rs::TS;
 
+const CONTEXTUAL_USER_MARKERS: &[(&str, &str)] = &[
+    ("# AGENTS.md instructions for ", "</INSTRUCTIONS>"),
+    (
+        crate::protocol::ENVIRONMENT_CONTEXT_OPEN_TAG,
+        crate::protocol::ENVIRONMENT_CONTEXT_CLOSE_TAG,
+    ),
+    ("<skill>", "</skill>"),
+    ("<user_shell_command>", "</user_shell_command>"),
+    ("<turn_aborted>", "</turn_aborted>"),
+    ("<subagent_notification>", "</subagent_notification>"),
+    ("<goal_context>", "</goal_context>"),
+];
+
+const LEGACY_CONTEXTUAL_USER_PREFIXES: &[&str] = &[
+    "Warning: The maximum number of unified exec processes you can keep open is",
+    "Warning: Your account was flagged for potentially high-risk cyber activity",
+];
+
+pub fn is_contextual_user_message_content(message: &[ContentItem]) -> bool {
+    message.iter().any(is_contextual_user_fragment)
+}
+
+pub fn is_contextual_user_fragment(content_item: &ContentItem) -> bool {
+    let ContentItem::InputText { text } = content_item else {
+        return false;
+    };
+    parse_hook_prompt_fragment(text).is_some()
+        || is_standard_contextual_user_text(text)
+        || is_legacy_contextual_user_text(text)
+}
+
+fn is_standard_contextual_user_text(text: &str) -> bool {
+    CONTEXTUAL_USER_MARKERS
+        .iter()
+        .any(|(start, end)| matches_marked_text(start, end, text))
+        || matches_additional_context_user_text(text)
+}
+
+fn matches_marked_text(start_marker: &str, end_marker: &str, text: &str) -> bool {
+    let trimmed_start = text.trim_start();
+    let starts_with_marker = trimmed_start
+        .get(..start_marker.len())
+        .is_some_and(|candidate| candidate.eq_ignore_ascii_case(start_marker));
+    let trimmed = trimmed_start.trim_end();
+    let ends_with_marker = trimmed
+        .get(trimmed.len().saturating_sub(end_marker.len())..)
+        .is_some_and(|candidate| candidate.eq_ignore_ascii_case(end_marker));
+    starts_with_marker && ends_with_marker
+}
+
+fn matches_additional_context_user_text(text: &str) -> bool {
+    let trimmed = text.trim();
+    let Some(rest) = trimmed.strip_prefix("<external_") else {
+        return false;
+    };
+    let Some((key, value_and_close)) = rest.split_once('>') else {
+        return false;
+    };
+
+    value_and_close.ends_with(&format!("</external_{key}>"))
+}
+
+fn is_legacy_contextual_user_text(text: &str) -> bool {
+    let trimmed = text.trim();
+    LEGACY_CONTEXTUAL_USER_PREFIXES
+        .iter()
+        .any(|prefix| trimmed.starts_with(prefix))
+        || (trimmed.starts_with("Warning: apply_patch was requested via ")
+            && trimmed.ends_with("Use the apply_patch tool instead of exec_command."))
+}
+
 #[allow(clippy::large_enum_variant)]
 #[derive(Debug, Clone, Deserialize, Serialize, TS, JsonSchema)]
 #[serde(tag = "type")]
@@ -637,4 +708,22 @@ mod tests {
             }
         );
     }
+
+    #[test]
+    fn detects_contextual_user_message_content() {
+        let content = vec![ContentItem::InputText {
+            text: "<environment_context>\n<cwd>/tmp</cwd>\n</environment_context>".to_string(),
+        }];
+
+        assert!(is_contextual_user_message_content(&content));
+    }
+
+    #[test]
+    fn ignores_regular_user_message_content() {
+        let content = vec![ContentItem::InputText {
+            text: "please inspect the diff".to_string(),
+        }];
+
+        assert!(!is_contextual_user_message_content(&content));
+    }
 }

codex-rs/rollout/src/list.rs

@@ -22,6 +22,7 @@ use crate::protocol::EventMsg;
 use crate::state_db;
 use codex_file_search as file_search;
 use codex_protocol::ThreadId;
+use codex_protocol::items::is_contextual_user_message_content;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::RolloutItem;
@@ -1249,6 +1250,9 @@ fn response_item_preview(item: &ResponseItem) -> Option<String> {
     if role != "user" {
         return None;
     }
+    if is_contextual_user_message_content(content) {
+        return None;
+    }
     for item in content {
         if let ContentItem::InputText { text } = item {
             let message = strip_user_message_prefix(text.as_str());