RSPEED-2885: filter internal details from /v1/responses stream

.gitignore

@@ -196,4 +196,7 @@ dev-tools/mcp-mock-server/.certs/
 requirements.*.backup
 
 # Local run files
-local-run.yaml
+local-run.yaml
+
+# Sisyphus planning files
+.sisyphus/

docs/responses.md

@@ -613,7 +613,7 @@ The `instructions` field on the `/v1/responses` endpoint follows the same server
 
 If the server configuration sets `disable_query_system_prompt` to `true`, any request that includes a non-null `instructions` value is rejected with a `422 Unprocessable Entity` error. The error message references the `instructions` field specifically.
 
-This means that even when `instructions` is omitted from the request, the response will always contain a resolved `instructions` value reflecting the server-side default or configured system prompt.
+If the server substituted the system prompt, the response sets `instructions` to the placeholder `<server prompt applied>` instead of echoing the actual prompt. If the client provided their own `instructions`, they are echoed back unchanged. Server-deployed MCP tool definitions are also filtered from the response `tools` array; client-provided tools are preserved.
 
 ### Streaming Differences
 

src/app/endpoints/responses.py

@@ -36,6 +36,7 @@
 from authorization.middleware import authorize
 from client import AsyncLlamaStackClientHolder
 from configuration import configuration
+from constants import SUBSTITUTED_INSTRUCTIONS_PLACEHOLDER
 from log import get_logger
 from models.config import Action
 from models.requests import ResponsesRequest
@@ -179,9 +180,11 @@ async def responses_endpoint_handler(
 
     responses_request = responses_request.model_copy(deep=True)
     check_configuration_loaded(configuration)
+    client_instructions = responses_request.instructions
     responses_request.instructions = get_system_prompt(
         responses_request.instructions, field_name="instructions"
     )
+    instructions_substituted = client_instructions is None
     started_at = datetime.now(UTC)
     user_id = auth[0]
 
@@ -302,6 +305,7 @@ async def responses_endpoint_handler(
         moderation_result=moderation_result,
         inline_rag_context=inline_rag_context,
         filter_server_tools=filter_server_tools,
+        instructions_substituted=instructions_substituted,
     )
 
 
@@ -314,6 +318,7 @@ async def handle_streaming_response(
     moderation_result: ShieldModerationResult,
     inline_rag_context: RAGContext,
     filter_server_tools: bool = False,
+    instructions_substituted: bool = False,
 ) -> StreamingResponse:
     """Handle streaming response from Responses API.
 
@@ -326,6 +331,7 @@ async def handle_streaming_response(
         moderation_result: Result of shield moderation check
         inline_rag_context: Inline RAG context to be used for the response
         filter_server_tools: Whether to filter server-deployed MCP tool events from the stream
+        instructions_substituted: Whether the server substituted the instructions
     Returns:
         StreamingResponse with SSE-formatted events
     """
@@ -365,6 +371,7 @@ async def handle_streaming_response(
                 turn_summary=turn_summary,
                 inline_rag_context=inline_rag_context,
                 filter_server_tools=filter_server_tools,
+                instructions_substituted=instructions_substituted,
             )
         except RuntimeError as e:  # library mode wraps 413 into runtime error
             if is_context_length_error(str(e)):
@@ -496,6 +503,45 @@ async def shield_violation_generator(
     yield "data: [DONE]\n\n"
 
 
+def _sanitize_response_dict(
+    response_dict: dict[str, Any],
+    configured_mcp_labels: set[str],
+    instructions_substituted: bool = False,
+) -> None:
+    """Sanitize a serialized response object in-place to remove internal details.
+
+    Strips fields that expose server-side implementation details from the
+    response object before it is forwarded to the client:
+
+    - ``instructions``: when the server substituted its own system prompt
+      (because the client sent ``None`` or a different value was resolved),
+      the value is replaced with a placeholder slug to avoid leaking the
+      actual prompt.  When the client provided their own instructions and
+      they were used as-is, the value is left unchanged.
+    - ``tools``: server-deployed MCP tool definitions are removed; client-
+      provided tools (those whose ``server_label`` is not in
+      ``configured_mcp_labels``) are preserved
+
+    Args:
+        response_dict: Mutable dict produced by ``model_dump`` on a response
+            object.  Modified in-place.
+        configured_mcp_labels: Set of ``server_label`` values that identify
+            server-deployed MCP servers.
+        instructions_substituted: Whether the server substituted the
+            instructions (True) or the client provided them (False).
+    """
+    if instructions_substituted:
+        response_dict["instructions"] = SUBSTITUTED_INSTRUCTIONS_PLACEHOLDER
+    # else: leave instructions as-is (echo back client's value)
+
+    if tools := response_dict.get("tools"):
+        response_dict["tools"] = [
+            tool
+            for tool in tools
+            if tool.get("server_label") not in configured_mcp_labels
+        ]
+
+
 def _is_server_mcp_output_item(
     item: dict[str, Any], configured_mcp_labels: set[str]
 ) -> bool:
@@ -611,6 +657,7 @@ async def response_generator(
     turn_summary: TurnSummary,
     inline_rag_context: RAGContext,
     filter_server_tools: bool = False,
+    instructions_substituted: bool = False,
 ) -> AsyncIterator[str]:
     """Generate SSE-formatted streaming response with LCORE-enriched events.
 
@@ -622,6 +669,7 @@ async def response_generator(
         turn_summary: TurnSummary to populate during streaming
         inline_rag_context: Inline RAG context to be used for the response
         filter_server_tools: Whether to filter server-deployed MCP tool events from the stream
+        instructions_substituted: Whether the server substituted the instructions
     Yields:
         SSE-formatted strings for streaming events, ending with [DONE]
     """
@@ -631,9 +679,7 @@ async def response_generator(
 
     latest_response_object: Optional[OpenAIResponseObject] = None
     sequence_number = 0
-    configured_mcp_labels = (
-        {s.name for s in configuration.mcp_servers} if filter_server_tools else set()
-    )
+    configured_mcp_labels = {s.name for s in configuration.mcp_servers}
     # Track output indices of server-deployed MCP calls to filter their events
     server_mcp_output_indices: set[int] = set()
 
@@ -657,6 +703,11 @@ async def response_generator(
 
         if "response" in chunk_dict:
             chunk_dict["response"]["conversation"] = normalized_conv_id
+            _sanitize_response_dict(
+                chunk_dict["response"],
+                configured_mcp_labels,
+                instructions_substituted,
+            )
             tools = chunk_dict["response"].get("tools")
             if tools is not None:
                 chunk_dict["response"]["tools"] = (
@@ -794,6 +845,7 @@ async def handle_non_streaming_response(
     moderation_result: ShieldModerationResult,
     inline_rag_context: RAGContext,
     filter_server_tools: bool = False,
+    instructions_substituted: bool = False,
 ) -> ResponsesResponse:
     """Handle non-streaming response from Responses API.
 
@@ -806,6 +858,7 @@ async def handle_non_streaming_response(
         moderation_result: Result of shield moderation check
         inline_rag_context: Inline RAG context to be used for the response
         filter_server_tools: Whether to filter server-deployed MCP tool output
+        instructions_substituted: Whether the server substituted the instructions
     Returns:
         ResponsesResponse with the completed response
     """
@@ -904,7 +957,11 @@ async def handle_non_streaming_response(
             skip_userid_check=skip_userid_check,
             topic_summary=topic_summary,
         )
+    configured_mcp_labels = {s.name for s in configuration.mcp_servers}
     response_dict = api_response.model_dump(exclude_none=True)
+    _sanitize_response_dict(
+        response_dict, configured_mcp_labels, instructions_substituted
+    )
     tools = response_dict.get("tools")
     if tools is not None:
         response_dict["tools"] = translate_vector_store_ids_to_user_facing(

src/constants.py

@@ -229,6 +229,10 @@
 
 DEFAULT_VIOLATION_MESSAGE = "I cannot process this request due to policy restrictions."
 
+# Placeholder slug used in responses when the server substituted its own
+# system prompt for the client's instructions.  Avoids leaking the actual
+# server prompt back to the client.
+SUBSTITUTED_INSTRUCTIONS_PLACEHOLDER = "<server prompt applied>"
 # Input size limits for API request validation
 # Maximum character length for the question field in /v1/infer requests (32 KiB)
 RLSAPI_V1_QUESTION_MAX_LENGTH = 32_768