local_context

Source for model-only local-context refresh messages.

Prefix for synthetic human messages (e.g. interrupt cancellation notices).

Such messages are written to the messages channel for the agent's benefit on resume but are not user-authored, so they are filtered out of both the rendered transcript and a thread's initial prompt. Shared here so the single producer (textual_adapter) and its consumers (app, sessions) agree on one literal.

Neutralize control characters and deceptive Unicode in untrusted text.

Untrusted strings (MCP server errors, config-file contents, tool output) can carry ANSI escape sequences, other control characters, or invisible Unicode that corrupts the terminal, breaks out of a layout, or injects fake lines into logs and prompts. This first removes the invisible/bidi code points flagged by strip_dangerous_unicode, then replaces every remaining Unicode "Other" (control/format) character with a space.

Concatenate all section functions into the full detection script.

Independent sections run as parallel background jobs writing to temp files, then results are concatenated in the original display order. The header (sets CWD, IN_GIT, and ROOT) and project section run first because later sections depend on their variables.

State for local context middleware.

Inject local context (git state, project structure, etc.) into the system prompt.

Runs a bash detection script via backend.execute() on first interaction and stores that snapshot for stable system-prompt injection. After each summarization event, changed context is appended as an internal conversation message so the cached prompt prefix stays byte-identical.

Because the script runs inside the backend, it works for both local shells and remote sandboxes.