viewer(#972 defense-in-depth): strip OOC authoring-preamble leaks in sanitizeNarration

[100yenadmin]

What

Defense-in-depth viewer arm for the 2026-06-17 craft audit's OOC authoring-preamble leak. Adds a high-confidence, OOC-only whole-sentence-drop (_AUTHORING_PREAMBLE) to sanitizeNarration in viewer/openworlds/screen-table.jsx, so the first-person DM "thinking out loud" lines the audit found shipping to players verbatim are stripped before the chronicle renders them:

• "Now let me seat <X> as the player character"
• "Continuity check — … let me correct that"
• "Let me set the order of it"
• "Here's how round one actually went:"
• "let me set their advancement through the engine"

Why this, given #972 already shipped

The primary fix landed in #972: the DM SKILL.md FICTION-ONLY rule + the deterministic narration_no_ooc_leak gate in qa/assert_behavioral.py::_NARRATION_LEAK — that stops the leak at the source (the DM prompt). This PR is the viewer backstop for anything that still reaches the viewer (old transcripts, edge cases): the engine stays the sole writer; this is a read/projection filter only.

How

• New _AUTHORING_PREAMBLE regex wired into the existing _isScaffoldingSentence (whole-sentence drop) + _hasScaffolding (fast path) — the same [playtest][P1-critical] DM scaffolding leaks into player Chronicle — dice tallies + plot-structure jargon ('spine hook'/'cold open') + 'beat complete' stage-directions #347/[a11y][major] Chronicle floods the accessibility tree by beat 2 — Do/Declare unreachable for AT users #752 sentence-level machinery that already strips dice tallies / plot-craft jargon / stage-directions. Fully additive: no existing arm changed or weakened.
• Patterns mirror _NARRATION_LEAK byte-for-byte (the 5 authoring-preamble arms; the 6th — inciting incident — is already covered by the file's _CRAFT_JARGON, so it's not duplicated). A comment cross-references the gate and asks future edits to keep the two layers in sync.
• The viewer deletes the matched sentence (vs. the gate, which only counts), so it must be at least as tight as the gate. The gate's machine-checked FP-hardening is carried over verbatim:
  • through the engine is verb/noun-anchored to the game-ENGINE sense → literal machinery ("Steam screamed through the engine block") survives;
  • the seat arm is full-word as the player character only → a bare in-world "PC" / "the player of the lute" survives;
  • the round-replay arm is here's how round <n> … went-anchored → a bare "round one went" survives.

Tests

3 new cases in viewer/tests/test_sanitize_narration.py (which transpile + run the real shipped .jsx via the bundled Babel):

• all 5 verbatim leaks → stripped to "";
• inline trailing-clause + multiline-beat → surgical strip (real prose survives);
• legit-fiction / dialogue FP guards → pass through verbatim.

13/13 sanitize tests pass. Full viewer/tests/ suite: 749 passed, 6 skipped, 1 pre-existing env failure unrelated to this change (test_portrait_gen subprocess: ModuleNotFoundError: No module named 'pydantic').

Lane: macOS/OpenWorlds (viewer). No engine/content changes.

Summary by CodeRabbit

• Bug Fixes

  • Fixed narration sanitization to remove out-of-character authoring preambles that were leaking into visible narrative text. Enhanced detection with additional sentence-level filtering rules.

• Tests

  • Added comprehensive test coverage verifying that authoring preambles are stripped correctly, including inline and multiline cases, while preserving legitimate narrative content.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 496a094b-b5d9-40e3-ac24-c042495e1024

📥 Commits

Reviewing files that changed from the base of the PR and between 1c18d90 and 6c01af0.

📒 Files selected for processing (2)

• viewer/openworlds/screen-table.jsx
• viewer/tests/test_sanitize_narration.py

---

📝 Walkthrough

Walkthrough

Adds a _AUTHORING_PREAMBLE regex to the viewer-side narration sanitizer in screen-table.jsx, hooking it into _isScaffoldingSentence and _hasScaffolding so first-person OOC authoring-preamble sentences are dropped by _stripScaffoldingSentences. Three new test methods cover full removal, inline/multiline surgical removal, and false-positive preservation.

Changes

Authoring Preamble Sentence Stripping

Layer / File(s)	Summary
Regex and scaffolding hook implementation viewer/openworlds/screen-table.jsx	Introduces _AUTHORING_PREAMBLE sentence-match regex for specific first-person OOC preamble phrases. Extends _isScaffoldingSentence and _hasScaffolding to treat matched sentences as scaffolding, causing _stripScaffoldingSentences to drop them. Updates the in-file doc comment to name the new family.
New tests: strip, inline/multiline, and false-positive hardening viewer/tests/test_sanitize_narration.py	Adds test_strips_ooc_authoring_preamble_leaks (full removal of five OOC phrases), test_authoring_preamble_stripped_inline_and_in_multiline_beat (surgical removal while preserving surrounding prose), and test_authoring_preamble_guard_preserves_legitimate_fiction (no false positives on similar-looking legitimate fiction).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• electricsheephq/WorldOS#338: Earlier modification to the same screen-table.jsx narration sanitizer to strip DM-internal leak text, directly in the same scaffolding-stripping code path extended here.
• electricsheephq/WorldOS#349: Extends the same _isScaffoldingSentence/_stripScaffoldingSentences logic and test_sanitize_narration.py coverage with broader DM story-craft and tally sentence removal.
• electricsheephq/WorldOS#972: Addresses the same OOC authoring-preamble leak family via QA-side regex detection and gating; this PR adds the corresponding viewer-side backstop.

Poem

🐇 Hop hop, the preambles must go,
"Now let me set the stage" — out the door, whoa!
The regex sniffs OOC lines with care,
Strips author whispers from the fiction's air.
Legitimate prose stays, the bunny swears — 🌿

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}