fix: sanitize block reply previews

anyech · anyech · commit ce48bdb792d3 · 2026-05-25T21:04:17.000Z
diff --git a/src/auto-reply/reply/dispatch-from-config.test.ts b/src/auto-reply/reply/dispatch-from-config.test.ts
@@ -5615,6 +5615,68 @@ describe("dispatchReplyFromConfig", () => {
     expect(blockReplySettled).toBe(true);
   });
 
+
+  it("sanitizes internal runtime context before queued and dispatched block replies", async () => {
+    setNoAbort();
+    const dispatcher = createDispatcher();
+    const ctx = buildTestCtx({ Provider: "whatsapp" });
+    const queuedTexts: string[] = [];
+    const dispatchedTexts: string[] = [];
+    const internalBlock = [
+      "Visible intro.",
+      "<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>",
+      "OpenClaw runtime event.",
+      "This context is runtime-generated, not user-authored. Keep internal details private.",
+      "",
+      "[Internal task completion event]",
+      "source: subagent",
+      "task: LEAK_SENTINEL_STRICT_BOUNDARIES",
+      "## Active Subagents",
+      "task_json=should-not-appear",
+      "<<<END_OPENCLAW_INTERNAL_CONTEXT>>>",
+      "Visible outro.",
+    ].join("\n");
+    const replyResolver = async (
+      _ctx: MsgContext,
+      opts?: GetReplyOptions,
+    ): Promise<ReplyPayload | undefined> => {
+      await opts?.onBlockReply?.({ text: internalBlock });
+      return undefined;
+    };
+    (dispatcher.sendBlockReply as ReturnType<typeof vi.fn>).mockImplementation(
+      (payload: ReplyPayload) => {
+        if (payload.text) {
+          dispatchedTexts.push(payload.text);
+        }
+        return true;
+      },
+    );
+
+    await dispatchReplyFromConfig({
+      ctx,
+      cfg: emptyConfig,
+      dispatcher,
+      replyResolver,
+      replyOptions: {
+        onBlockReplyQueued: (payload) => {
+          if (payload.text) {
+            queuedTexts.push(payload.text);
+          }
+        },
+      },
+    });
+
+    expect(queuedTexts).toEqual(["Visible intro.\n\nVisible outro."]);
+    expect(dispatchedTexts).toEqual(["Visible intro.\n\nVisible outro."]);
+    for (const text of [...queuedTexts, ...dispatchedTexts]) {
+      expect(text).not.toContain("LEAK_SENTINEL_STRICT_BOUNDARIES");
+      expect(text).not.toContain("## Active Subagents");
+      expect(text).not.toContain("task_json=");
+      expect(text).not.toContain("Internal task completion event");
+      expect(text).not.toContain("source: subagent");
+    }
+  });
+
   it("forwards payload metadata into onBlockReplyQueued context", async () => {
     setNoAbort();
     const dispatcher = createDispatcher();
diff --git a/src/auto-reply/reply/dispatch-from-config.ts b/src/auto-reply/reply/dispatch-from-config.ts
@@ -10,6 +10,7 @@ import {
   resolveSessionAgentId,
 } from "../../agents/agent-scope.js";
 import { selectAgentHarness } from "../../agents/harness/selection.js";
+import { sanitizeUserFacingText } from "../../agents/pi-embedded-helpers/sanitize-user-facing-text.js";
 import {
   buildModelAliasIndex,
   resolveDefaultModelForAgent,
@@ -1154,6 +1155,15 @@ export async function dispatchReplyFromConfig(
     return await normalizeReplyMediaPayloadPaths(payload);
   };
 
+  const sanitizeVisibleBlockPayload = (payload: ReplyPayload): ReplyPayload | null => {
+    if (!payload.text) {
+      return payload;
+    }
+    const text = sanitizeUserFacingText(payload.text, { errorContext: Boolean(payload.isError) });
+    const nextPayload = { ...payload, text: text.trim() ? text : undefined };
+    return hasOutboundReplyContent(nextPayload, { trimText: true }) ? nextPayload : null;
+  };
+
   const routeReplyToOriginating = async (
     payload: ReplyPayload,
     options?: { abortSignal?: AbortSignal; mirror?: boolean },
@@ -2245,30 +2255,34 @@ export async function dispatchReplyFromConfig(
                 if (payload.isReasoning === true) {
                   return;
                 }
+                const sanitizedPayload = sanitizeVisibleBlockPayload(payload);
+                if (!sanitizedPayload) {
+                  return;
+                }
                 // Accumulate block text for TTS generation after streaming.
                 // Exclude status notices — they are informational UI signals
                 // and must not be synthesised into the spoken reply.
-                const isStatusNotice = isReplyPayloadStatusNotice(payload);
-                if (payload.text && !isStatusNotice) {
+                const isStatusNotice = isReplyPayloadStatusNotice(sanitizedPayload);
+                if (sanitizedPayload.text && !isStatusNotice) {
                   const joinsBufferedTtsDirective =
                     cleanBlockTtsDirectiveText?.hasBufferedDirectiveText() === true;
                   if (accumulatedBlockText.length > 0) {
                     accumulatedBlockText += "\n";
                   }
-                  accumulatedBlockText += payload.text;
+                  accumulatedBlockText += sanitizedPayload.text;
                   if (accumulatedBlockTtsText.length > 0 && !joinsBufferedTtsDirective) {
                     accumulatedBlockTtsText += "\n";
                   }
-                  accumulatedBlockTtsText += payload.text;
+                  accumulatedBlockTtsText += sanitizedPayload.text;
                   blockCount++;
                 }
                 const visiblePayload =
-                  payload.text && cleanBlockTtsDirectiveText && !isStatusNotice
+                  sanitizedPayload.text && cleanBlockTtsDirectiveText && !isStatusNotice
                     ? (() => {
-                        const text = cleanBlockTtsDirectiveText.push(payload.text);
-                        return { ...payload, text: text.trim() ? text : undefined };
+                        const text = cleanBlockTtsDirectiveText.push(sanitizedPayload.text);
+                        return { ...sanitizedPayload, text: text.trim() ? text : undefined };
                       })()
-                    : payload;
+                    : sanitizedPayload;
                 if (!hasOutboundReplyContent(visiblePayload, { trimText: true })) {
                   return;
                 }
