For the HTTP address above, start Sentient in HTTP mode first with {HTTP_START_COMMAND}. Keep it on this
- computer only.
+ computer only, and replace <engine token> with the engine token: the HTTP address asks for it
+ on every call.
- For the HTTP address above, start Sentient in HTTP mode first with {HTTP_START_COMMAND}. Keep it on this
- computer only, and replace <engine token> with the engine token: the HTTP address asks for it
- on every call.
+ For the HTTP address above, start Sentient in HTTP mode first with {HTTP_START_COMMAND}. The settings
+ above start Sentient's launcher instead of connecting directly: the launcher adds Sentient's sign-in itself, so no key ever goes into
+ the file. Keep it on this computer only.
@@ -96,7 +116,7 @@ export function SentientMcpSection({ id }: { id?: string }) {
setValue('integrations.mcp_server_memories_skip_review', v, { immediate: true })}
/>
+
+
+
-
diff --git a/desktop/src/lib/api.ts b/desktop/src/lib/api.ts
index c7a7489ac..516b38ce0 100644
--- a/desktop/src/lib/api.ts
+++ b/desktop/src/lib/api.ts
@@ -649,6 +649,8 @@ export const api = {
// §5 integrations ------------------------------------------------------------
integrations: {
+ /** Replace the MCP-only key (#443): apps holding the old one stop working until they restart. */
+ replaceMcpKey: () => http.post<{ rotated: boolean }>('/api/mcp/token/rotate'),
list: () => http.getAdd Sentient to your app
- Turn the switch on first, then add Sentient to the app you use. The app starts Sentient for you each time it needs it. -
-
-
+
- For the HTTP address above, start Sentient in HTTP mode first with {HTTP_START_COMMAND}. The settings
- above start Sentient's launcher instead of connecting directly: the launcher adds Sentient's sign-in itself, so no key ever goes into
- the file. Keep it on this computer only.
+ Turn the switch on first, then add Sentient to the app you use. The app starts Sentient for you each time it needs it. The settings hold no address and no
+ key: the command finds the running Sentient by itself.
- There are no tools to send messages, delete things or run commands. -
- A task made this way still needs you to approve its plan in Sentient before it runs. -
- When an app asks Sentient a question, Sentient's own tools still follow Sentient's approval rules and ask you when they should. +
- A task made this way is made in the app's name, and its plan always waits for your approval before it runs. +
- + When an app asks Sentient a question, Sentient treats the words as the app's, not yours: anything that sends, deletes or runs code asks you first, + in the window and as a notification. + +
- A memory an app saves waits in Review for your approval, unless you allow saving right away above.
per span, never an , or ![]()
.
+// Run with `npm test` (no Electron needed).
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import React, { type ComponentProps } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import ReactMarkdown from 'react-markdown'
+import remarkGfm from 'remark-gfm'
+import rehypeHighlight from 'rehype-highlight'
+
+const remarkPlugins = [remarkGfm]
+const rehypePlugins: ComponentProps['rehypePlugins'] = [[rehypeHighlight, { detect: false }]]
+
+function render(note: string): string {
+ return renderToStaticMarkup(
+ React.createElement(ReactMarkdown, { remarkPlugins, rehypePlugins, skipHtml: true }, note)
+ )
+}
+
+// The engine's code-span rule (sentient/app_names.py::code_span): a fence one backtick
+// longer than the longest run inside, with a space inside each end.
+function codeSpan(text: string): string {
+ const longest = (text.match(/`+/g) ?? []).reduce((n, run) => Math.max(n, run.length), 0)
+ return `${'`'.repeat(longest + 1)} ${text} ${'`'.repeat(longest + 1)}`
+}
+
+function approvalNote(appName: string): string {
+ return `An app called ${codeSpan(appName)} wants to: Runs code`
+}
+
+function count(html: string, tag: string): number {
+ return html.split(tag).length - 1
+}
+
+// Every hostile name from review 5641825878, plus backticks, entities and other schemes.
+const hostileNames = [
+ '[Fix it](https://evil.co) **NOW**',
+ 'https://evil.co/allow',
+ 'www.evil.co',
+ 'WWW.EVIL.CO',
+ '',
+ '_https://evil.co',
+ 'support@evil.co',
+ 'mailto:evil@evil.co',
+ 'xmpp:foo@evil.co',
+ '',
+ '[evil]',
+ '[^1] see [x][y]',
+ 'a `b` c',
+ '`x'
+]
+
+test('an approval note with a hostile app name renders one code span, no link', () => {
+ for (const name of hostileNames) {
+ const html = render(approvalNote(name))
+ assert.equal(count(html, ''), 1, name)
+ assert.equal(count(html, ''), 1, name)
+ assert.ok(!html.includes(' ${html}`)
+ assert.ok(!html.includes(' ${html}`)
+ assert.ok(!html.includes(' ${html}`)
+ }
+})
+
+test('the maintainer’s example renders its characters, not a link', () => {
+ const html = render(approvalNote('[Fix it](https://evil.co) **NOW**'))
+ assert.ok(html.includes('[Fix it](https://evil.co) **NOW**'), html)
+})
+
+test('a plan-ready note with a hostile name and a hostile title renders two code spans, no link', () => {
+ const note = `I've created a new plan for an app called ${codeSpan('www.evil.co')}: ${codeSpan('See [this](https://evil.co) now')}`
+ const html = render(note)
+ assert.equal(count(html, ''), 2, html)
+ assert.ok(!html.includes(' AsyncIterator[
# the note names the app that is asking (the turn's mark on this channel), framed
# as a name rather than a sentence the app could speak as Sentient: the name is
# the client's own handshake text, cleaned where the turn was marked, and, the
- # note being rendered as Markdown, escaped so it cannot form a link or emphasis
+ # note being rendered as Markdown, put in a code span so Markdown cannot parse
+ # it into a link or emphasis
who = ctx.untrusted
framed = framed_app_name(who)
message = f"{framed} wants to: {label}: {target}" if target else f"{framed} wants to: {label}"
diff --git a/sentient/app_names.py b/sentient/app_names.py
index c3d42f8de..34240e3e7 100644
--- a/sentient/app_names.py
+++ b/sentient/app_names.py
@@ -5,7 +5,7 @@
will be erased unless you tap Allow now.", and uncleaned that sentence would land in the
approval notification the user decides from. Every surface that shows the name therefore
takes it from here: control characters and newlines stripped, capped at 40 characters, and
-the notes that quote it frame it as a name (``An app called "..."``) instead of letting it
+the notes that quote it frame it as a name (``An app called `...` ``) instead of letting it
speak as if it were Sentient.
"""
@@ -21,32 +21,36 @@
_WS = re.compile(r"\s+")
-# Punctuation Markdown can act on where a note is rendered as such (the desktop renders
-# approval and plan-ready notes as Markdown): emphasis, code, links, images, HTML, strikes.
-_MARKDOWN_PUNCT = re.compile(r"([\\`*{}\[\]()#<>!|~_])")
-_SCHEME = re.compile(r"(?i)\b([a-z][a-z0-9+.-]*)://")
-_WWW = re.compile(r"(?i)\bwww\.")
+# Backtick runs, for sizing a code-span fence one longer than any run inside.
+_BACKTICK_RUN = re.compile(r"`+")
-def _escape_markdown(text: str) -> str:
- """The text with nothing left that Markdown can act on: punctuation backslash-escaped
- in one pass (so an introduced backslash is never escaped again), and URL schemes and
- www. broken so GFM cannot autolink them. What renders is still the same characters."""
- text = _MARKDOWN_PUNCT.sub(r"\\\1", text)
- text = _SCHEME.sub(r"\1\\://", text)
- return _WWW.sub(r"www\\.", text)
+def code_span(text: str) -> str:
+ """The text as one inline code span: a fence one backtick longer than the longest
+ run of backticks inside, with a space inside each end (rendered away).
+
+ Nothing inside a code span is parsed, so this is what a Markdown-rendered note uses
+ for app-controlled text. Backslash escaping cannot do this job: remark-gfm resolves
+ escapes before it looks for autolinks, so `https\\://evil.co` still arrives as a live
+ link (review 5641825878)."""
+ if not text or not text.strip():
+ return text
+ fence = "`" * (max((len(m.group(0)) for m in _BACKTICK_RUN.finditer(text)), default=0) + 1)
+ return f"{fence} {text} {fence}"
def framed_app_name(name: object, *, capital: bool = True) -> str:
"""The app name as it may go into a Markdown-rendered note (approval, plan-ready).
- The name itself is already cleaned (see clean_app_name); this only neutralises what
- Markdown would do with it: a client calling itself "[Fix it](https://evil.co) **NOW**"
- must not arrive as a live link with bold text right above Allow and Deny. Plain-text
- surfaces (the turn mark, the Review list, notify titles) keep the unescaped name."""
+ The name itself is already cleaned (see clean_app_name); this only stops Markdown
+ from acting on it: a client calling itself "[Fix it](https://evil.co) **NOW**" must
+ not arrive as a live link with bold text right above Allow and Deny. The name goes
+ in an inline code span, so nothing inside it is parsed at all — links, autolinks
+ (bare URLs and emails included), emphasis, images. Plain-text surfaces (the turn
+ mark, the Review list, notify titles) keep the bare name."""
if not isinstance(name, str) or not name or name.lower() == "an mcp app":
return "An MCP app" if capital else "an MCP app"
- framed = f'an app called "{_escape_markdown(name)}"'
+ framed = f"an app called {code_span(name)}"
return framed[0].upper() + framed[1:] if capital else framed
diff --git a/sentient/tasks/service.py b/sentient/tasks/service.py
index 4cb9cb679..0ad7e9b3d 100644
--- a/sentient/tasks/service.py
+++ b/sentient/tasks/service.py
@@ -47,7 +47,7 @@
from sentient.agent import dry_run, outcomes
from sentient.agent import grants as grant_rules
from sentient.agent.prompt import mark_outside
-from sentient.app_names import framed_app_name
+from sentient.app_names import code_span, framed_app_name
from sentient.llm.jobs import detached
from sentient.llm.provider import PlainProviderError, ProviderError
from sentient.memory import scopes as memory_scopes
@@ -1814,10 +1814,12 @@ async def _plan(self, task_id: str, *, auto_approve: bool = False) -> None:
if mcp_tasks.is_mcp_task(task):
# the note names the app that asked for the task, framed as a name like the
# approval notes do: the name is the app's own text, cleaned where it came in,
- # and, the note being rendered as Markdown, escaped so it cannot form a link
+ # and, the note being rendered as Markdown, put in a code span so Markdown
+ # cannot parse it into a link. The plan's title is the app's prompt word for
+ # word, so it goes in a code span too
who = (task.get("original_context") or {}).get("app")
framed = framed_app_name(who, capital=False)
- message = f"I've created a new plan for {framed}: '{short}'"
+ message = f"I've created a new plan for {framed}: {code_span(short)}"
await self._notify(task, message, "Plan ready for approval", "approval_needed")
async def _planned_script(
diff --git a/tests/mcp_server/test_review_fixes.py b/tests/mcp_server/test_review_fixes.py
index 15389f66b..40fcb69ac 100644
--- a/tests/mcp_server/test_review_fixes.py
+++ b/tests/mcp_server/test_review_fixes.py
@@ -236,7 +236,7 @@ def test_a_task_created_with_the_mcp_token_waits_for_plan_approval(engine_client
if ready:
break
time.sleep(0.1)
- assert ready and 'an app called "Claude Code"' in ready[0]["message"] # named, and framed as a name
+ assert ready and 'an app called ` Claude Code `' in ready[0]["message"] # named, and framed as a name
def test_with_the_feature_off_the_mcp_token_opens_nothing_but_status(engine_client_off):
@@ -547,7 +547,7 @@ async def answer(ev):
notes = [n for n in await s.notifications.list() if n["kind"] == "approval"]
assert notes, "the approval must also land as a notification"
# the handshake name "claude-code" shows framed, under its display name
- assert notes[0]["message"].startswith('An app called "Claude Code" wants to: '), notes[0]["message"]
+ assert notes[0]["message"].startswith('An app called ` Claude Code ` wants to: '), notes[0]["message"]
s.approvals.resolve(ev.approval_id, "allow")
events = []
@@ -585,21 +585,28 @@ def test_a_task_from_a_hostile_app_name_is_cleaned_and_framed(engine_client):
if ready:
break
time.sleep(0.1)
- assert ready and 'an app called "Sentient Security Center' in ready[0]["message"]
+ assert ready and 'an app called ` Sentient Security Center' in ready[0]["message"]
assert "tap Allow" not in ready[0]["message"] # the instruction tail is cut off by the cap
def test_markdown_in_an_app_name_is_neutralised_in_the_notes():
# the approval and plan-ready notes are rendered as Markdown in the app: a link-shaped
- # name must not arrive as a live link with bold text above Allow and Deny (review 5637731781)
- from sentient.app_names import framed_app_name
+ # name must not arrive as a live link with bold text above Allow and Deny. Backslash
+ # escaping cannot stop GFM autolinks (review 5641825878), so the name goes in an
+ # inline code span, whose contents Markdown never parses
+ from sentient.app_names import code_span, framed_app_name
hostile = "[Fix it](https://evil.co) **NOW**"
- assert framed_app_name(hostile) == r'An app called "\[Fix it\]\(https\://evil.co\) \*\*NOW\*\*"'
- assert framed_app_name(hostile, capital=False).startswith('an app called "')
- assert "https://" not in framed_app_name("see https://evil.co now")
- assert "www.evil.co" not in framed_app_name("visit www.evil.co")
- assert framed_app_name("Claude Code") == 'An app called "Claude Code"'
+ assert framed_app_name(hostile) == "An app called ` [Fix it](https://evil.co) **NOW** `"
+ assert framed_app_name(hostile, capital=False) == "an app called ` [Fix it](https://evil.co) **NOW** `"
+ # the fence grows past any backticks in the name, so the span never breaks early
+ assert framed_app_name("a `b` c") == "An app called `` a `b` c ``"
+ assert framed_app_name("`x") == "An app called `` `x ``"
+ # bare URLs and emails ride inside the span unparsed, not as links
+ assert framed_app_name("see https://evil.co") == "An app called ` see https://evil.co `"
+ assert framed_app_name("support@evil.co") == "An app called ` support@evil.co `"
+ assert code_span("") == ""
+ assert framed_app_name("Claude Code") == "An app called ` Claude Code `"
assert framed_app_name(None) == "An MCP app"
assert framed_app_name("an MCP app") == "An MCP app"
assert framed_app_name("An MCP app", capital=False) == "an MCP app"
@@ -620,9 +627,10 @@ async def answer(ev):
notes = [n for n in await s.notifications.list() if n["kind"] == "approval"]
assert notes, "the approval must also land as a notification"
message = notes[0]["message"]
- # the name is quoted and escaped: no live link, no bold, no bare URL
- assert message.startswith(r'An app called "\[Fix it\]\(https\://evil.co\)'), message
- assert "[Fix it](https://evil.co)" not in message and "**NOW**" not in message
+ # the name sits in one code span, verbatim: nothing inside it is parsed,
+ # and no escape backslashes leak into the rendered text
+ assert message.startswith('An app called ` [Fix it](https://evil.co) **NOW** ` wants to: '), message
+ assert "\\[" not in message and "\\*" not in message
s.approvals.resolve(ev.approval_id, "allow")
events = []
@@ -636,7 +644,8 @@ async def answer(ev):
def test_a_plan_ready_note_does_not_render_a_link_shaped_app_name(engine_client):
- # the plan-ready note is rendered as Markdown too, so it shares the same escape
+ # the plan-ready note is rendered as Markdown too, so it shares the same code span;
+ # the plan's title is the app's prompt word for word, so it is code-spanned as well
c = engine_client
made = c.post("/api/tasks", json={"prompt": "Tidy the downloads folder",
"app": "[Fix it](https://evil.co) **NOW**"},
@@ -659,5 +668,6 @@ def test_a_plan_ready_note_does_not_render_a_link_shaped_app_name(engine_client)
time.sleep(0.1)
assert ready, "the plan-ready note must exist"
message = ready[0]["message"]
- assert r'an app called "\[Fix it\]\(https\://evil.co\)' in message, message
- assert "[Fix it](https://evil.co)" not in message and "**NOW**" not in message
+ assert 'an app called ` [Fix it](https://evil.co) **NOW** `' in message, message
+ assert '` Tidy the downloads folder `' in message, message
+ assert "\\[" not in message and "\\*" not in message