fix(plugins): apply output text transforms to toolcall_delta and toolcall_end events (#97769)

ZOOWH · Peter Steinberger · web-flow · commit 5a73361ed2b3 · 2026-06-30T17:15:01.000-07:00
* fix(plugins): apply output text transforms to toolcall_delta and toolcall_end events toolcall_delta and toolcall_end events bypassed the output replacement pipeline, leaking masked tokens (e.g. PII placeholders) into tool call arguments and external systems. Closes #97761 * fix(plugins): transform nested tool call arguments in output replacements Add recursive transformToolCallArgumentText to handle strings, arrays, and nested objects in tool call arguments, not just the name field. * fix(plugins): keep tool names unchanged and cover result path - Remove toolCall.name transformation to prevent breaking tool routing - Add arguments transform to stream.result()/done.message via transformContentText for tool-call content blocks * fix(plugins): narrow argument transform to toolCall content blocks only Only transform arguments on content blocks with type=toolCall to avoid touching non-tool-call blocks that happen to have an arguments field. * test(plugins): assert stream.result() tool-call content block is transformed * test(plugins): fix result-path fixture to actually contain toolCall block The previous fixture used makeAssistantMessage('final') which produces a plain text content block, not a toolCall block. The stream.result() assertion was vacuously passing. * style(plugins): fix type cast in result-path test assertion * fix(agents): preserve tool argument transforms after repair * refactor(agents): keep tool transform boundary narrow --------- Co-authored-by: Peter Steinberger <steipete@golden-gate.local>
diff --git a/docs/gateway/cli-backends.md b/docs/gateway/cli-backends.md
@@ -382,8 +382,11 @@ api.registerTextTransforms({
 ```
 
 `input` rewrites the system prompt and user prompt passed to the CLI. `output`
-rewrites streamed assistant deltas and parsed final text before OpenClaw handles
-its own control markers and channel delivery.
+rewrites streamed assistant text and parsed final text before OpenClaw handles
+its own control markers and channel delivery. For provider-backed model calls,
+`output` also restores string values inside structured tool-call arguments after
+stream repair and before tool execution. Raw provider JSON fragments remain
+unchanged; consumers should use the structured partial, end, or result payload.
 
 For CLIs that emit provider-specific JSONL events, set `jsonlDialect` on that
 backend's config. Supported dialects are `claude-stream-json` for Claude
diff --git a/src/agents/embedded-agent-runner/run/attempt.tool-call-argument-repair.test.ts b/src/agents/embedded-agent-runner/run/attempt.tool-call-argument-repair.test.ts
@@ -1,5 +1,6 @@
 // Coverage for repairing malformed streamed tool-call arguments.
 import { describe, expect, it } from "vitest";
+import { wrapStreamFnTextTransforms } from "../../plugin-text-transforms.js";
 import {
   shouldRepairMalformedToolCallArguments,
   wrapStreamFnRepairMalformedToolCallArguments,
@@ -213,6 +214,61 @@ describe("shouldRepairMalformedToolCallArguments", () => {
 });
 
 describe("openai-completions malformed tool-call argument repair", () => {
+  it("restores split replacement tokens after argument repair", async () => {
+    const partialToolCall = { type: "toolCall", name: "send", arguments: {} };
+    const streamedToolCall = { type: "toolCall", name: "send", arguments: {} };
+    const finalToolCall = { type: "toolCall", name: "send", arguments: {} };
+    const partialMessage = { role: "assistant", content: [partialToolCall] };
+    const finalMessage = { role: "assistant", content: [finalToolCall] };
+    const baseFn: FakeStreamFn = () =>
+      createFakeStream({
+        events: [
+          {
+            type: "toolcall_delta",
+            contentIndex: 0,
+            delta: '{"text":"[MAS',
+            partial: partialMessage,
+          },
+          {
+            type: "toolcall_delta",
+            contentIndex: 0,
+            delta: 'KED]"}',
+            partial: partialMessage,
+          },
+          {
+            type: "toolcall_end",
+            contentIndex: 0,
+            toolCall: streamedToolCall,
+            partial: partialMessage,
+          },
+        ],
+        resultMessage: finalMessage,
+      });
+    const repairedFn = wrapStreamFnRepairMalformedToolCallArguments(baseFn as never);
+    const transformedFn = wrapStreamFnTextTransforms({
+      streamFn: repairedFn,
+      output: [{ from: /\[MASKED\]/g, to: "John Smith" }],
+    }) as FakeStreamFn;
+    const stream = await Promise.resolve(transformedFn({} as never, {} as never, {} as never));
+    const events = [];
+    for await (const event of stream) {
+      events.push(event);
+    }
+
+    expect(
+      events
+        .filter((event) => (event as { type?: string }).type === "toolcall_delta")
+        .map((event) => (event as { delta?: string }).delta),
+    ).toEqual(['{"text":"[MAS', 'KED]"}']);
+    const endEvent = events.find(
+      (event) => (event as { type?: string }).type === "toolcall_end",
+    ) as { toolCall?: { arguments?: unknown } } | undefined;
+    expect(endEvent?.toolCall?.arguments).toEqual({ text: "John Smith" });
+    await expect(stream.result()).resolves.toMatchObject({
+      content: [{ arguments: { text: "John Smith" } }],
+    });
+  });
+
   it.each([
     ["openai-completions", "sglang"],
     ["openai-chatgpt-responses", "openai"],
diff --git a/src/agents/embedded-agent-runner/run/attempt.ts b/src/agents/embedded-agent-runner/run/attempt.ts
@@ -2872,11 +2872,10 @@ export async function runEmbeddedAttempt(
         workspaceDir: effectiveWorkspace,
         runtimeHandle: getProviderRuntimeHandle(),
       });
-      if (providerTextTransforms) {
+      if (providerTextTransforms?.input?.length) {
         activeSession.agent.streamFn = wrapStreamFnTextTransforms({
           streamFn: activeSession.agent.streamFn,
           input: providerTextTransforms.input,
-          output: providerTextTransforms.output,
           transformSystemPrompt: false,
         });
       }
@@ -3101,6 +3100,15 @@ export async function runEmbeddedAttempt(
         );
       }
 
+      // Tool-call repair can replace structured arguments from fragmented deltas.
+      // Restore provider-masked text afterward so executable args stay canonical.
+      if (providerTextTransforms?.output?.length) {
+        activeSession.agent.streamFn = wrapStreamFnTextTransforms({
+          streamFn: activeSession.agent.streamFn,
+          output: providerTextTransforms.output,
+        });
+      }
+
       if (anthropicPayloadLogger) {
         activeSession.agent.streamFn = anthropicPayloadLogger.wrapStreamFn(
           activeSession.agent.streamFn,
diff --git a/src/agents/plugin-text-transforms.test.ts b/src/agents/plugin-text-transforms.test.ts
@@ -5,6 +5,7 @@ import {
   type AssistantMessage,
   type Context,
   type Model,
+  type ToolCall,
 } from "openclaw/plugin-sdk/llm";
 import { describe, expect, it } from "vitest";
 import {
@@ -40,6 +41,14 @@ function makeAssistantMessage(text: string): AssistantMessage {
   };
 }
 
+function makeAssistantToolMessage(toolCall: ToolCall): AssistantMessage {
+  return {
+    ...makeAssistantMessage(""),
+    content: [toolCall],
+    stopReason: "toolUse",
+  };
+}
+
 describe("plugin text transforms", () => {
   it("merges registered transform groups in order", () => {
     const merged = mergePluginTextTransforms(
@@ -180,4 +189,91 @@ describe("plugin text transforms", () => {
     expect(firstEvent?.delta).toBe("red basket on the left shelf");
     expect(result.content).toEqual([{ type: "text", text: "final red basket on the left shelf" }]);
   });
+
+  it("applies output replacements to structured tool-call arguments", async () => {
+    const partialToolCall: ToolCall = {
+      type: "toolCall",
+      id: "call-1",
+      name: "search",
+      arguments: {
+        query: "[MASKED]",
+        nested: { note: "ask [MASKED] again" },
+        entries: ["[MASKED]", 7],
+      },
+    };
+    const finalToolCall: ToolCall = {
+      type: "toolCall",
+      id: "call-2",
+      name: "send_msg",
+      arguments: { text: "[MASKED]" },
+    };
+    const partial = makeAssistantToolMessage(partialToolCall);
+    const baseStreamFn: StreamFn = (_model, _context) => {
+      const stream = createAssistantMessageEventStream();
+      queueMicrotask(() => {
+        stream.push({
+          type: "toolcall_delta",
+          contentIndex: 0,
+          delta: '{"query":"[MASKED]"}',
+          partial,
+        });
+        stream.push({
+          type: "toolcall_end",
+          contentIndex: 0,
+          toolCall: partialToolCall,
+          partial,
+        });
+        stream.push({
+          type: "done",
+          reason: "toolUse",
+          message: makeAssistantToolMessage(finalToolCall),
+        });
+        stream.end();
+      });
+      return stream;
+    };
+
+    const wrapped = wrapStreamFnTextTransforms({
+      streamFn: baseStreamFn,
+      output: [{ from: /\[MASKED\]/g, to: "John" }],
+    });
+    const stream = await Promise.resolve(wrapped(model, {} as Context, undefined));
+    const events = [];
+    for await (const event of stream) {
+      events.push(event);
+    }
+
+    const deltaEvent = events.find((event) => event.type === "toolcall_delta") as
+      | { delta?: string; partial?: AssistantMessage }
+      | undefined;
+    // Raw JSON fragments are provider bytes and may split a replacement token.
+    // Structured arguments are the safe, canonical transform surface.
+    expect(deltaEvent?.delta).toBe('{"query":"[MASKED]"}');
+    expect(deltaEvent?.partial?.content[0]).toMatchObject({
+      name: "search",
+      arguments: {
+        query: "John",
+        nested: { note: "ask John again" },
+        entries: ["John", 7],
+      },
+    });
+
+    const endEvent = events.find((event) => event.type === "toolcall_end") as
+      | { toolCall?: { name?: string; arguments?: Record<string, unknown> } }
+      | undefined;
+    // Tool name is preserved — only arguments are transformed to avoid
+    // breaking tool routing by renaming a registered tool identifier.
+    expect(endEvent?.toolCall?.name).toBe("search");
+    expect(endEvent?.toolCall?.arguments).toEqual({
+      query: "John",
+      nested: { note: "ask John again" },
+      entries: ["John", 7],
+    });
+
+    const result = await stream.result();
+    expect(result.content[0]).toMatchObject({
+      name: "send_msg",
+      arguments: { text: "John" },
+    });
+  });
 });
diff --git a/src/agents/plugin-text-transforms.ts b/src/agents/plugin-text-transforms.ts
@@ -62,6 +62,9 @@ function transformContentText(content: unknown, replacements?: PluginTextReplace
   if (Object.hasOwn(next, "content")) {
     next.content = transformContentText(next.content, replacements);
   }
+  if (next.type === "toolCall" && Object.hasOwn(next, "arguments")) {
+    next.arguments = transformToolCallArgumentText(next.arguments, replacements);
+  }
   return next;
 }
 
@@ -79,6 +82,27 @@ function transformMessageText(message: unknown, replacements?: PluginTextReplace
   return next;
 }
 
+function transformToolCallArgumentText(
+  value: unknown,
+  replacements?: PluginTextReplacement[],
+): unknown {
+  if (typeof value === "string") {
+    return applyPluginTextReplacements(value, replacements);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => transformToolCallArgumentText(entry, replacements));
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      transformToolCallArgumentText(entry, replacements),
+    ]),
+  );
+}
+
 /** Apply input text replacements to a stream context. */
 function transformStreamContextText(
   context: Parameters<StreamFn>[1],
@@ -114,6 +138,17 @@ function transformAssistantEventText(
   if (next.type === "text_end" && typeof next.content === "string") {
     next.content = applyPluginTextReplacements(next.content, replacements);
   }
+  if (
+    next.type === "toolcall_end" &&
+    isRecord(next.toolCall) &&
+    Object.hasOwn(next.toolCall, "arguments")
+  ) {
+    // Tool names are routing identifiers; only argument values are text.
+    next.toolCall = {
+      ...next.toolCall,
+      arguments: transformToolCallArgumentText(next.toolCall.arguments, replacements),
+    };
+  }
   if (Object.hasOwn(next, "partial")) {
     next.partial = transformMessageText(next.partial, replacements);
   }
