[Bug]: /rename always fails when no managed account is signed in: title review fails closed on gateway 401

[ForeverInLaw]

Product or interface

CLI - interactive TUI

Version

0.5.0 (also verified on current main, commit 73a2581)

Platform

Windows

OS version and architecture

Windows 11 x64 (build 26200)

Issue area

Other

Desktop log upload ID (optional)

No response

Steps to reproduce

Environment: BYO OpenAI-compatible provider configured in config.yaml, no managed account signed in, default permission mode.

1. Start the TUI with no managed account signed in.
2. Run /rename <new name>.
3. The rename fails with "Content validation failed" for any title, including
   plain ASCII like "test".

The failure is independent of the title content and reproduces on every attempt
while signed out.

Expected and actual behavior

Expected: /rename persists the new session title locally.

Actual: the command fails with "Content validation failed" and the draft is preserved.

Root cause: SessionRecordService.mutateSession routes every title write through titlePolicy.blocks and throws content-policy-rejected when it returns true (packages/local-runtime-v2/src/service/session-system/sessions/lifecycle/record-service.ts).
The production wiring always calls the managed gateway with scene 205 (ConfigField):

titlePolicy.blocks = (title) => input.safety.blocks(title, SAFETY_SCENE.ConfigField)

(packages/local-runtime-v2/src/application/session/runtime-session-composition.ts)

With no managed login there is no bearer token, the gateway answers 401, and the V1 checker maps 401/403 to auth_error (packages/local-runtime/src/content-safety/api.ts).
reviewBlocks blocks every verdict except api_error, so a signed-out user always gets a block for a purely local mutation.

Two details that make this look unintended:

1. Turn input and output review already skips unmanaged providers. contentReviewRequired is set only when preparation.llm.managedProvider === true, and the TUI also requires region cn (packages/local-runtime-v2/src/services.ts). BYO users chat with no review calls at all, but the session title still gets an unconditional call.
2. contentReview.enabled is parsed in packages/config/src/config.ts (parseContentReviewConfig) but nothing reads it, so there is no config escape hatch.

The same scene 205 gate also covers agent config fields via reviewAgentConfigFields in packages/local-runtime-v2/src/application/agent/agent-application.ts, so agent renames and persona edits fail the same way while signed out.

Possible directions: block only on an explicit gateway rejection (errorKind === "rejected"), matching how api_error already degrades, or skip the
review call entirely when no managed account is signed in, mirroring the managedProvider gating for turns.

Prepared fix

The fix is on a branch in my fork: https://github.com/ForeverInLaw/minimax-code/tree/fix/session-rename-without-gateway-verdict (commit ae84277). It blocks only on an explicit gateway rejection. Offline, auth and 5xx errors pass, and blank titles never call the gateway. Both reviewBlocks docstrings now note the exception, and the predicate is unit-tested.

Ran locally: typecheck, build, the focused vitest suites (151 tests pass), smoke, and /rename on the patched build while signed out, which now persists the title. Not run: the full pnpm verify list, platforms other than Windows, and a real gateway rejection (unit-tested only). I can rework it if you prefer the auth-gated variant instead.

Redacted error summary

TUI:

        × Error
        Couldn't send this message: Content validation failed. Retry. Your draft is preserved.

    Runtime log, one entry per attempt, reviewId truncated:

        WARN: [] [content-safety] review failed
    {"reviewId":"<uuid>","endpointHost":"agent.minimax.cn","apiVersion":"v1","scene":205,"durationMs":257,"failureKind":"auth","statusCode":401}

Screenshots

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.

[hetaoBackend]

This update was prepared with AI assistance and checked against the merged PR.

Thanks for the diagnosis and proposed branch. #270 is merged into main and fixes CLI/TUI session renaming when the selected provider is known to be unmanaged: that title write no longer calls the managed review gateway. Managed and unknown/legacy provider contexts retain the existing verdict policy; the shared reviewBlocks predicate was not changed.

The production-wiring regression verifies signed-out BYOK title persistence through the real record service and SQLite. Full local pnpm verify and Linux/macOS verification CI passed. The performance check remains INCONCLUSIVE due to excessive measurement spread, rather than a proven pass or regression. Native Windows interactive acceptance and a real managed gateway were not tested.

Keeping this issue open because the report also covers Agent names/persona edits: those configuration-field checks remain unchanged and need a separate policy decision, since they do not have a session-selected provider context. The parsed contentReview.enabled setting was not made into a bypass.

Please retest /rename with a build containing #270. Merged into main does not establish availability in your currently installed release.

[ForeverInLaw]

Thanks, that was fast!
Retested on Windows with a build from main (35f73f7), signed out, custom provider, I renamed a few sessions and every title persisted

Also ran the new session-title-policy suite locally on Windows: 23 tests pass, plus services.test.ts at 64