fix(telegram): sanitize outbound tool traces by mushuiyu886 · Pull Request #95774 · openclaw/openclaw

mushuiyu886 · 2026-06-22T12:39:40Z

Summary

Problem: Follow-up to fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084: Google Chat now strips assistant-visible internal tool-trace failure lines before outbound delivery, but Telegram still exposed no outbound sanitizeText hook for the shared delivery pipeline to invoke.
Solution: Add Telegram's adapter-level sanitizer hook with the same SDK sanitizer chain used by the sibling Google Chat fix: sanitizeForPlainText(sanitizeAssistantVisibleText(text)).
What changed: extensions/telegram/src/outbound-adapter.ts now declares sanitizeText, and extensions/telegram/src/telegram-outbound.test.ts locks in both stripping an internal tool-trace failure line and preserving ordinary assistant prose. The follow-up commit also passes the required payload argument in those test calls so check-test-types matches the adapter contract.
What did NOT change: Out of scope / not changed: this only changes Telegram outbound text sanitization; it does not change Telegram target parsing, send routing, media handling, poll handling, chunking limits, config, protocol, public plugin metadata, compatibility/default behavior, or Bot API request construction.
Why it matters / User impact: Telegram users should see the assistant-visible answer rather than internal tool execution failure scaffolding such as ⚠️ 🛠️ ... failed appended to a final reply.
Fixes: No direct issue; this is a sibling-gap follow-up to fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084.

Origin / follow-up

Follows / completes: fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084, merged on 2026-06-22, fixed Google Chat for the same internal tool-trace leak pattern.
Gap this fills: Telegram was outside fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084's fixed surface and still had no outbound sanitizer hook, so the shared channel delivery sanitizer step had nothing Telegram-specific to call.
Consistency: This uses the same public SDK sanitizer composition as the merged Google Chat patch while keeping the change at Telegram's source-of-truth outbound adapter boundary.

Competition / linked PR analysis

Linked PR(s): Related open PR scan: no direct linked open PR for this Telegram sanitizer hook. A current open PR search for Telegram sanitizer/tool-trace follow-ups returned broad outbound or unrelated Telegram work, not this focused adapter hook gap.
Gap in linked PR(s): The merged anchor fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084 covered Google Chat only; it did not add or test telegramOutbound.sanitizeText.
Why this patch is better/canonical: The source-of-truth owner for Telegram channel delivery behavior is the Telegram outbound adapter, and this patch wires the existing canonical sanitizer hook there instead of adding downstream string filtering or send-path special cases.
Local real behavior proof advantage: The proof imports the production Telegram outbound adapter module and calls its real sanitizer hook directly, showing the exact text transformation that the shared delivery path will apply before send.

Real behavior proof

Behavior or issue addressed: Telegram outbound text removes assistant-visible internal tool-trace failure lines before delivery while preserving ordinary assistant text.
Real environment tested: Local OpenClaw source checkout on Linux, Node v22.22.0, pnpm 11.2.2, commit f85bb708b6. The command imports the actual Telegram outbound adapter production module through tsx and calls its channel sanitizer hook with the required payload shape.
Exact steps or command run after this patch:

node --import tsx -e 'import { telegramOutbound } from "./extensions/telegram/src/outbound-adapter.ts"; const trace = "Done.\n⚠️ 🛠️ `search \"Pipeline\" in /tmp/openclaw-workspace-* (agent)` failed"; console.log(JSON.stringify({ sanitizedTrace: telegramOutbound.sanitizeText?.({ text: trace, payload: { text: trace } }), ordinary: telegramOutbound.sanitizeText?.({ text: "The pipeline has 3 deals.", payload: { text: "The pipeline has 3 deals." } }) }, null, 2));'

Evidence after fix:

{
  "sanitizedTrace": "Done.",
  "ordinary": "The pipeline has 3 deals."
}

Observed result after fix: The production Telegram outbound adapter sanitizer drops the internal tool-trace failure line and returns the expected assistant-visible text. A normal outbound reply remains unchanged.
What was not tested: Outside this proof: native client rendering and Bot API round-trip. Credentials, chat identifiers, and message content are kept out of this PR. The exercised boundary is the adapter sanitizer hook immediately before send.
Fix classification: Root cause fix.

Regression Test Plan

Target test file: extensions/telegram/src/telegram-outbound.test.ts, with dependency guard coverage from src/infra/outbound/sanitize-text.test.ts and src/shared/text/assistant-visible-text.test.ts.
Scenario locked in: A Telegram outbound reply containing Done. plus an assistant-visible tool-trace failure line sanitizes to Done., while ordinary text like The pipeline has 3 deals. is preserved exactly.
Why this is the smallest reliable guardrail: The regression test exercises the Telegram adapter contract that the shared delivery path reads, so it catches the missing hook without requiring network delivery or a mocked Telegram API.

CI failure attribution

Current-head failing check: check-test-types on the initial PR head 20ea432337.
Attribution: Current PR directly introduced the failure. CI ran pnpm check:test-types, which failed only in the two newly added extensions/telegram/src/telegram-outbound.test.ts sanitizer assertions because the test calls omitted the required payload property for ChannelOutboundAdapter.sanitizeText.
Fix: The follow-up commit updates both test calls to pass payload: { text }.
Verification: The failing extensions test typecheck shard now passes locally:

node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.extensions.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions-test.tsbuildinfo

Passed with no TypeScript errors.

Additional validation

node scripts/run-vitest.mjs extensions/telegram/src/telegram-outbound.test.ts

[test] passed 1 Vitest shard
- extensions/telegram/src/telegram-outbound.test.ts passed: 12 tests

corepack pnpm format:check -- extensions/telegram/src/outbound-adapter.ts extensions/telegram/src/telegram-outbound.test.ts

All matched files use the correct format.

node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.extensions.json extensions/telegram/src/outbound-adapter.ts extensions/telegram/src/telegram-outbound.test.ts

Completed without lint findings.

git diff --check

Completed without whitespace errors.

Merge risk

Risk labels considered: message-delivery and compatibility; not auth-provider, session-state, security-boundary, or availability.
Risk explanation: This touches a message-delivery adapter hook, but it uses existing SDK sanitizer exports and does not add config, protocol, schema, dependency, target resolution, chunking, or Bot API request behavior.
Why acceptable: The diff is two Telegram files, the source change is one adapter property, and focused proof covers both the stripping behavior and preservation of ordinary outbound text.

Root Cause

Root cause: Telegram's outbound adapter lacked the sanitizeText contract hook, so src/infra/outbound/deliver.ts could not run the canonical assistant-visible delivery sanitizer for Telegram before normalized payload delivery. That missing source-of-truth mapping caused internal tool-trace failure text to remain in outbound Telegram text.
Why this is root-cause fix: The shared delivery pipeline already owns when channel sanitizer hooks run; Telegram only needed to expose the correct adapter hook. Adding sanitizeText at extensions/telegram/src/outbound-adapter.ts fixes the missing source mapping before send instead of masking the symptom later in Telegram send code.
Maintainer-ready confidence: High — the patch is limited to the Telegram outbound adapter contract and its colocated regression test, with focused production-function proof plus sanitizer dependency tests.
Patch quality notes: No fallback, broad catch, default-return shim, config compatibility branch, or downstream string special case was added. The current PR diff remains only the two Telegram files; the CI follow-up only corrects the test call shape for the existing adapter contract.
Architecture / source-of-truth check: Source-of-truth boundary is the ChannelOutboundAdapter.sanitizeText contract as implemented by the Telegram plugin adapter; the shared delivery path already consumes that contract before downstream send/payload handling.

mushuiyu886 · 2026-06-22T15:00:59Z

@clawsweeper review

clawsweeper · 2026-06-22T15:01:02Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

mushuiyu886 · 2026-06-23T01:04:40Z

@clawsweeper re-review

clawsweeper · 2026-06-23T11:34:16Z

Codex review: needs maintainer review before merge. Reviewed June 23, 2026, 7:38 AM ET / 11:38 UTC.

Summary
The PR adds a Telegram outbound sanitizer hook and regression tests so internal assistant-visible tool-trace failure lines are stripped before Telegram delivery.

PR surface: Source +3, Tests +13. Total +16 across 2 files.

Reproducibility: yes. Current main has no Telegram sanitizeText hook, and the shared delivery path only invokes channel-specific sanitizer logic when that hook exists.

Review metrics: 1 noteworthy metric.

Telegram sanitizer hooks: 1 added. This is the only runtime behavior change and it controls which outbound text reaches Telegram users before send.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Optional: attach Telegram Desktop or Bot API proof if maintainers want transport-level confidence for the visible reply-text change.

Mantis proof suggestion
A Telegram Desktop proof would directly show that the internal tool-trace line is absent from delivered chat text while ordinary reply text remains visible. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis telegram desktop proof: verify that a Telegram reply containing an internal tool-trace failure line delivers only the assistant-visible answer and preserves ordinary reply text.

Risk before merge

[P1] The patch intentionally changes Telegram outbound message text, so maintainers should be comfortable that the canonical sanitizer only strips internal trace-like lines and preserves ordinary prose.
[P1] No native Telegram/Bot API round-trip proof is attached; the adapter-level terminal proof covers the changed hook, but a short Telegram Desktop proof would give stronger visible transport confidence.

Maintainer options:

Accept Adapter-Boundary Proof (recommended)
Maintainers can accept the focused production-adapter proof plus regression tests because the changed surface is the hook the shared delivery path calls before send.
Request Telegram Desktop Proof
Ask for or run a short Telegram proof showing the internal tool-trace line absent from delivered chat text while ordinary reply text remains unchanged.
Fold Into The Broader Sanitizer Issue
If maintainers want one coordinated cross-channel decision, pause this PR and handle Telegram inside the broader non-Discord sanitizer issue.

Next step before merge

[P2] No repair lane is needed; the remaining action is maintainer review of the message-delivery risk and whether adapter-level proof is enough without Telegram Desktop proof.

Security
Cleared: The diff only imports existing SDK sanitizer helpers and changes Telegram outbound tests; it does not alter dependencies, credentials, workflows, permissions, or API execution.

Review details

Best possible solution:

Keep this as a focused Telegram adapter hook using the canonical sanitizer chain, then merge after maintainer review or optional Telegram visible proof.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main has no Telegram sanitizeText hook, and the shared delivery path only invokes channel-specific sanitizer logic when that hook exists.

Is this the best way to solve the issue?

Yes. The Telegram outbound adapter is the right owner boundary because the shared delivery pipeline already owns when sanitizer hooks run, and sibling channels use the same canonical sanitizer pattern.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e856a24754c3.

Label changes

Label changes:

add P1: The PR fixes a user-visible Telegram leak of internal tool failure scaffolding in channel replies.
add merge-risk: 🚨 message-delivery: The diff changes Telegram outbound reply text before delivery, so the key merge risk is suppressing or altering visible message content.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from importing the production Telegram outbound adapter and exercising the sanitizer hook on the failing trace pattern and ordinary text.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from importing the production Telegram outbound adapter and exercising the sanitizer hook on the failing trace pattern and ordinary text.
add mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The PR changes user-visible Telegram reply text, which can be demonstrated in a short Telegram proof recording.

Label justifications:

P1: The PR fixes a user-visible Telegram leak of internal tool failure scaffolding in channel replies.
merge-risk: 🚨 message-delivery: The diff changes Telegram outbound reply text before delivery, so the key merge risk is suppressing or altering visible message content.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from importing the production Telegram outbound adapter and exercising the sanitizer hook on the failing trace pattern and ordinary text.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from importing the production Telegram outbound adapter and exercising the sanitizer hook on the failing trace pattern and ordinary text.
mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The PR changes user-visible Telegram reply text, which can be demonstrated in a short Telegram proof recording.

Evidence reviewed

PR surface:

Source +3, Tests +13. Total +16 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	3	0	+3
Tests	1	14	1	+13
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	17	1	+16

What I checked:

Current Telegram adapter lacks hook: Current main declares the Telegram outbound adapter with chunking and delivery capabilities but no sanitizeText hook, so the PR is not already implemented on main. (extensions/telegram/src/outbound-adapter.ts:195, e856a24754c3)
Current test expects no hook: Current main explicitly expects telegramOutbound.sanitizeText to be undefined, confirming this PR changes missing current behavior. (extensions/telegram/src/telegram-outbound.test.ts:32, e856a24754c3)
Shared delivery caller: The shared outbound delivery path wraps adapter sanitizeText and applies it before payload normalization and empty-payload handling. (src/infra/outbound/deliver.ts:390, e856a24754c3)
SDK contract: The channel outbound adapter contract includes sanitizeText, and the plugin SDK exports sanitizeForPlainText for plugin use. (src/channels/plugins/outbound.types.ts:157, e856a24754c3)
Canonical sanitizer behavior: sanitizeAssistantVisibleText strips internal tool-trace warning lines on the delivery profile, and existing tests cover the same failed-tool trace shape. (src/shared/text/assistant-visible-text.ts:888, e856a24754c3)
Sibling channel precedent: Google Chat, Discord, WhatsApp, and QQBot sibling outbound paths already use sanitizeAssistantVisibleText or the same sanitizeForPlainText(sanitizeAssistantVisibleText(text)) composition for user-visible outbound text. (extensions/googlechat/src/channel.adapters.ts:201, e856a24754c3)

Likely related people:

tangtaizong666: Current-main blame points to this contributor for the present Telegram outbound adapter, shared delivery sanitizeText hook plumbing, and canonical assistant-visible sanitizer snapshot. (role: recent area contributor; confidence: high; commits: 43890ebc3b25; files: extensions/telegram/src/outbound-adapter.ts, src/infra/outbound/deliver.ts, src/shared/text/assistant-visible-text.ts)
vincentkoc: The commit introducing the current Telegram adapter and shared sanitizer plumbing lists vincentkoc as co-author and reviewer, making them a useful routing candidate for this boundary. (role: reviewer / adjacent owner; confidence: medium; commits: 43890ebc3b25; files: extensions/telegram/src/outbound-adapter.ts, src/infra/outbound/deliver.ts, src/shared/text/assistant-visible-text.ts)
jailbirt: Authored the merged Google Chat sibling fix that uses the same sanitizer composition for the same internal tool-trace leak pattern. (role: adjacent sanitizer contributor; confidence: medium; commits: 696c62400803; files: extensions/googlechat/src/channel.adapters.ts, extensions/googlechat/src/channel.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

openclaw-mantis · 2026-06-23T12:11:51Z

Mantis Telegram Desktop Proof

Summary: Mantis captured Telegram Desktop before/after GIFs: Main shows the tool failure line, and this PR shows only the final answer.

Scenario: telegram-desktop-proof
Trigger: pull_request_target
Run: https://github.com/openclaw/openclaw/actions/runs/28023500627
Artifact: https://github.com/openclaw/openclaw/actions/runs/28023500627/artifacts/7820376252
Baseline: pass at 73930764e642a545f688b891d46443e5ae19d5d7, expected baseline visual proof captured
Candidate: pass at f85bb708b66e0aeefd634de8296b73410244638f, expected candidate visual proof captured
Overall: true

Main screenshot	This PR screenshot

Main	This PR

Motion-trimmed clips:

Raw QA files: https://artifacts.openclaw.ai/mantis/telegram-desktop/pr-95774/run-28023500627-1/index.json

obviyus · 2026-06-24T14:13:52Z

Landed via rebase onto main.

Scoped tests: node scripts/run-vitest.mjs extensions/telegram/src/telegram-outbound.test.ts (12 tests passed)
Behavior proof: Telegram outbound sanitizer returned Done. for the internal tool-trace failure case and preserved ordinary text
Changelog: not updated; release notes are not maintained through CHANGELOG.md for normal PR landings
Land commit: f3c1115
Merge commit: 242fbf1

Thanks @mushuiyu886!

…97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under #90684 (Telegram #95774, Google Chat #95084, IRC #97214).

…7367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under #90684 (Telegram #95774, Google Chat #95084, IRC #97214).

…97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under #90684 (Telegram #95774, Google Chat #95084, IRC #97214).

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit 25490d4)

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit cd6d0f9)

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit c026546)

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit cd6d0f9)

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit c026546)

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit 25490d4)

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit cd6d0f9)

openclaw-barnacle Bot added channel: telegram Channel integration: telegram size: XS labels Jun 22, 2026

clawsweeper Bot temporarily deployed to qa-live-shared June 23, 2026 11:41 Inactive

obviyus self-assigned this Jun 24, 2026

mushuiyu886 added 2 commits June 24, 2026 07:10

fix(telegram): sanitize outbound tool traces

df97e59

test(telegram): pass outbound sanitizer payload

f3c1115

obviyus force-pushed the fix/followup-95084 branch from f85bb70 to f3c1115 Compare June 24, 2026 14:11

obviyus merged commit 242fbf1 into openclaw:main Jun 24, 2026
84 checks passed

clawsweeper Bot mentioned this pull request Jun 24, 2026

fix(telegram): keep draft preview chunks surrogate-safe #96504

Merged

This was referenced Jun 30, 2026

fix(sms): stop internal tool-trace banners from reaching SMS replies #97989

Merged

fix(outbound): sanitize assistant reasoning before delivery #84441

Closed

clawsweeper Bot mentioned this pull request Jul 9, 2026

fix(imessage): apply canonical outbound sanitizer #101430

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(telegram): sanitize outbound tool traces#95774

fix(telegram): sanitize outbound tool traces#95774
obviyus merged 2 commits into
openclaw:mainfrom
mushuiyu886:fix/followup-95084

mushuiyu886 commented Jun 22, 2026 •

edited

Loading

Uh oh!

mushuiyu886 commented Jun 22, 2026

Uh oh!

clawsweeper Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

mushuiyu886 commented Jun 23, 2026

Uh oh!

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

openclaw-mantis Bot commented Jun 23, 2026

Uh oh!

Uh oh!

obviyus commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

mushuiyu886 commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Origin / follow-up

Competition / linked PR analysis

Real behavior proof

Regression Test Plan

CI failure attribution

Additional validation

Merge risk

Root Cause

Uh oh!

mushuiyu886 commented Jun 22, 2026

Uh oh!

clawsweeper Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mushuiyu886 commented Jun 23, 2026

Uh oh!

clawsweeper Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openclaw-mantis Bot commented Jun 23, 2026

Mantis Telegram Desktop Proof

Uh oh!

Uh oh!

obviyus commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mushuiyu886 commented Jun 22, 2026 •

edited

Loading

clawsweeper Bot commented Jun 22, 2026 •

edited

Loading

clawsweeper Bot commented Jun 23, 2026 •

edited

Loading