ENG-2071: stop naming Picker-granted Drive files in anton's prompt - #417
Merged
martyna-mindsdb merged 1 commit intoSep 1, 2026
Merged
Conversation
…rompt (ENG-2071)
build_datasource_context() listed every `_picked_files` entry for a
google_drive connection. It has no project in scope — `projects` is a
cowork concept — so the list was unscoped and named files the user had
granted inside *other* projects, together with "you MUST include every
file above".
cowork-server already renders this list correctly, scoped via
ConnectionsService.picked_files_by_project() ("that's the scoping leak
this closes"), and with richer prose. Both ran on desktop, so the
correctly-scoped block and the unscoped one appeared in the same prompt
a few hundred tokens apart. This removes the duplicate and leaves
cowork-server as the single renderer.
The availability paragraph stays, and its trigger is unchanged: presence
of picked files is still parsed (not merely truthy-checked), so a
Picker-only connection still fires it and a `_picked_files` holding only
malformed entries still reads as "none".
Removes ~238 tokens per LLM call for every user with a Drive connection.
Security: this only removes data from the prompt. No new input is
accepted, no credential handling changes, and the exposure it closes is
file names/ids crossing a project boundary within one user's own
account (not cross-tenant — the underlying Drive grant is
connection-wide either way).
martyna-mindsdb
approved these changes
Sep 1, 2026
martyna-mindsdb
deleted the
alejandrocantu/eng-2071-google-picker-files-listed-twice
branch
September 1, 2026 10:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the unscoped half of the duplicated Google Drive guidance. Ticket: ENG-2071 (assigned to @martyna-slawinska — raising the PR so the diff isn't stuck on a laptop; happy to hand it over).
The problem
build_datasource_context()listed every_picked_filesentry for agoogle_driveconnection. It has no project in scope —projectsis a cowork concept — so the list was unscoped and named files the user had granted inside other projects, under "you MUST include every file above".cowork-server already renders this list correctly, scoped through
ConnectionsService.picked_files_by_project()(whose docstring says "A file tagged to OTHER projects only is excluded — that's the scoping leak this closes"), and with richer prose (resourceKey,supportsAllDrives, thecorporawarning). Both ran on desktop, so the correctly-scoped block and the unscoped one landed in the same prompt a few hundred tokens apart.Not an edge case:
PickedFile.projectsis populated whenever a file is picked via the chat composer or the Project files rail — the ordinary in-project flow.Why anton's copy is the one that goes
The two were introduced six days apart and never reconciled —
ebf3a59f(2026-07-08, cowork-server) and089c287a(2026-07-14, anton, "review fixes" from ENG-687 PR #241). The review evidently intended a move; the original was never deleted.The project filter cannot be ported into anton:
build_datasource_context(vault, active_only=...)has no project name. So cowork-server stays the single renderer.What is deliberately unchanged
The availability paragraph and its exact trigger. Presence of picked files is still computed through
_parse_picked_filesrather than a bare truthiness check, so a Picker-only connection still fires it and a_picked_filesholding only malformed entries still reads as "none". Gating onauth_type == "oauth"alone would have been a quieter second behaviour change riding along.Accepted consequence, stated so it's a decision and not an oversight: a pure anton CLI user with
_picked_filesset no longer gets the picked-files guidance. The Picker is a cowork-only flow, so a CLI-only user never has that field populated. CLI coverage would need the project name transported into anton — the same transport ENG-1157 designs, and it belongs there.Recovers ~238 tokens per LLM call for every user with a Drive connection.
Tests
datasource|vault|drive|prompt|scrub|connection.test_file_granted_in_another_project_is_not_named, which is the leak itself.test_build_chat_session_google_drive.pywas updated deliberately rather than deleted — it now asserts the availability paragraph still reaches the real assembled prompt while file ids do not.Security
This only removes data from the prompt. No new input accepted, no credential handling changed. The exposure it closes is file names/ids crossing a project boundary within one user's own account — not cross-tenant, since the underlying Drive grant is connection-wide either way.
Delivery
cowork-server vendors anton from git
main, so merging here ships nothing on its own. This reaches desktop only after it lands on antonmainand cowork-server cuts a version.