fix: make FOLLOW_UP_REMINDER opt-in via env var#37
Closed
leo-dower wants to merge 1 commit intoPleasePrompto:mainfrom
Closed
fix: make FOLLOW_UP_REMINDER opt-in via env var#37leo-dower wants to merge 1 commit intoPleasePrompto:mainfrom
leo-dower wants to merge 1 commit intoPleasePrompto:mainfrom
Conversation
The hardcoded reminder appended to every ask_question answer uses
imperative language ("EXTREMELY IMPORTANT:", "before you reply to the
user...") that well-aligned assistants may flag as prompt injection,
causing spurious security warnings and potentially blocked tool output.
Introduces NOTEBOOKLM_FOLLOW_UP_REMINDER env var (default false) to
control whether the reminder is appended. Behavior is preserved for
users who opt in by setting it to true.
Addresses PleasePrompto#28.
Owner
|
Thanks @leo-dower — your security framing was exactly right and v2.0.0 ships the same default: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the
FOLLOW_UP_REMINDERappended toask_questionanswers opt-in via a new environment variableNOTEBOOKLM_FOLLOW_UP_REMINDER(defaultfalse). Addresses #28.Why
The hardcoded reminder currently appended to every
ask_questionanswer reads:This pattern — caps
EXTREMELY IMPORTANT, imperative language directed at the assistant ("before you reply to the user"), instructions to take follow-up tool actions — is functionally indistinguishable from adversarial prompt injection. Well-aligned assistants (e.g., Claude Code) are instructed by their system prompts to flag suspected prompt injection in tool output before continuing. In practice this means everyask_questioncall generates a user-facing security warning, which is noisy and confusing.See my comment on #28 for more context: #28 (comment)
Changes
src/config.ts— addsfollowUpReminderEnabled: booleanto theConfiginterface, defaults tofalseinDEFAULTS, and adds env var override viaNOTEBOOKLM_FOLLOW_UP_REMINDERinapplyEnvOverrides.src/tools/handlers.ts— wraps theFOLLOW_UP_REMINDERconcatenation in a ternary that checksCONFIG.followUpReminderEnabled. The constant itself is preserved unchanged so users who opt in get the exact same behavior as before.docs/configuration.md— documents the new env var in the Response formatting section.Default choice
I set the default to
false(opt-in) for three reasons:Happy to flip the default to
true(preserving backward compatibility) if you prefer — just let me know and I'll update the PR. The flag itself is the important part.Test plan
npm run buildpasses without errorsdist/tools/handlers.jsshows the conditional appenddist/config.jsincludes the new default and env var overrideNOTEBOOKLM_FOLLOW_UP_REMINDER=true— reminder should appearI can provide manual test logs if useful.
Backward compatibility
Behavioral change: existing users who rely on the reminder will need to set
NOTEBOOKLM_FOLLOW_UP_REMINDER=truein their environment to preserve the old behavior. This is documented indocs/configuration.md. If this is a concern, I can invert the default totrue(opt-out) and still solve the security flagging issue for users who set it tofalse.🤖 Generated with Claude Code