Suppress internal agent failure traces before channel delivery#89125
Conversation
|
Codex review: found issues before merge. Reviewed June 2, 2026, 12:19 PM ET / 16:19 UTC. Summary PR surface: Source +70, Tests +99. Total +169 across 8 files. Reproducibility: yes. from source and related live reports: current main lacks shared compact failure stripping, while #89415 captured the Telegram leak; I did not run a live channel reproduction. Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Mantis proof suggestion Risk before merge
Maintainer options:
Next step before merge
Security Review findings
Review detailsBest possible solution: Land only after the raw command/path trace is stripped without deleting the existing mutating-tool warning contract, with focused Discord and generic-channel coverage for the safe replacement behavior. Do we have a high-confidence way to reproduce the issue? Yes from source and related live reports: current main lacks shared compact failure stripping, while #89415 captured the Telegram leak; I did not run a live channel reproduction. Is this the best way to solve the issue? No as written: centralizing trace stripping is the right direction, but the patch should preserve a safe user warning for policy-visible mutating failures rather than dropping the payload completely. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against 388dc56ba572. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +70, Tests +99. Total +169 across 8 files. View PR surface stats
Acceptance criteria:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
@clawsweeper re-review Addressed the code finding in follow-up commit
Local proof:
The PR body now also calls out the remaining live Discord proof gap separately. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
@clawsweeper re-review Added redacted real behavior proof to the PR body:
I also left the remaining gap explicit: this was not a deployed live Discord gateway run of this exact branch. Public Discord channel names, author IDs, guild IDs, channel IDs, and message IDs are redacted. |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
|
Hi - I raised issue #89415 but clawsweeper closed it as duplicate. My codex felt this PR in it's current state would not resolve the gh search issue that was one of the issues i encountered. @fuller-stack-dev - could you maybe look at the ticket I mentioned and check / amend your PR to account for this case if needed? Thanks |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
84905d9 to
0ffedba
Compare
|
Landed via rebase onto main.
Thanks @fuller-stack-dev! |
Summary
analysis:,commentary:,thinking:, andreasoning:.Verification
node scripts/run-vitest.mjs src/shared/text/assistant-visible-text.test.ts src/agents/embedded-agent-helpers.sanitizeuserfacingtext.test.ts extensions/discord/src/monitor/reply-delivery.test.ts extensions/discord/src/monitor/message-handler.process.test.tsnode scripts/run-vitest.mjs src/auto-reply/reply/followup-runner.test.ts -t "tool progress"git diff --checkReal behavior proof
Behavior addressed: Internal agent/tool failure trace lines such as
⚠️ 🛠️ \run ... (agent)` failedare no longer delivered as user-visible Discord messages when they are the only final text. Discord delivery also continues to suppress plain internal channel-label lines such asanalysis:andcommentary:` while still sending media, channelData, and presentation payloads when their text scrubs empty.Real environment tested: Local OpenClaw source checkout on current
origin/mainplus real Discord archive evidence from a redacted OpenClaw Discord channel. Discrawl status reported the archive current at2026-06-01T15:48:21Zwith 1,478,897 messages; the leaked Discord rows below are from May 20-25, 2026. Discord channel names, author identifiers, guild identifiers, channel identifiers, and message identifiers are intentionally redacted from the public PR text.Exact steps or command run after this patch: Queried the Discord archive for real leaked messages with redacted presentation fields, then invoked the patched Discord sanitizer directly with the same visible failure shape:
Before evidence: Copied live Discord archive output shows the actual leaked user-visible messages this PR targets, with channel and author identifiers redacted:
{ "columns": ["created_at", "channel", "author", "content"], "rows": [ [ "2026-05-25T17:42:52.029Z", "<redacted-discord-channel>", "<redacted-discord-bot>", "⚠️ 🛠️ `run python3 inline script (heredoc) (agent)` failed" ], [ "2026-05-25T17:01:58.578Z", "<redacted-discord-channel>", "<redacted-discord-bot>", "⚠️ 🛠️ `pkill -f \"gh pr view\" || true (agent)` failed" ] ] }Evidence after fix: The patched Discord sanitizer drops the text-only leaked failure payload and preserves only the media payload after stripping its internal
commentary:/analysis:text:[ { "mediaUrl": "https://example.com/result.png" } ]Observed result after fix: The text-only leaked failure message produced no deliverable Discord payload. The media sample remained deliverable, but the internal channel-label text was removed. Focused sanitizer and Discord tests also passed, including the process test that suppresses warning-only final replies instead of sending them.
What was not tested: A deployed live Discord gateway running this exact branch was not exercised. The proof combines copied output from real Discord archive rows, with public identifiers redacted, and direct execution of the patched Discord send-boundary sanitizer in a local source checkout.