mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
3025fbaeb3
Review finding with a real in-repo instance: the structured runtime's per-spawn final-assembly wrapper (prepend, post-next) re-injects structured_output OUTSIDE the mode filter, so a structured child in plan mode would see a tool the gate then denies — the soft policy and the hard gate telling different stories. The suggested fix (make the mode filter outermost) cannot beat that instance: prepend unshifts, so the per-spawn listener always registers later and wraps outer. Two-part resolution instead. Semantically, structured_output enters the shipped plan allowlist — it is a child's pure result channel, the same ask/report class as ask_user_question and exit_plan_mode, so the filter, the re-injection, and the gate now agree wherever a structured child runs in plan mode. Mechanically, the filter registers with prepend anyway: it now wraps outside every append-registered listener regardless of load order (regression test pins a pre-registered post-next mutator being filtered), narrowing the documented cosmetic residual to prepend-after-load listeners only, where the gate still covers execution. Severity note: no execution breach existed — the gate held throughout; this closes the prompt-honesty gap.