fix(signal): sanitize internal tool-trace lines from outbound text by masatohoshino · Pull Request #97360 · openclaw/openclaw

masatohoshino · 2026-06-28T04:27:44Z

Related: #90684

What Problem This Solves

Fixes an issue where Signal users would see OpenClaw's internal tool-execution traces leak into delivered messages. When a tool run fails, the runtime injects a status banner such as ⚠️ 🛠️ `…(agent)` failed into the assistant's outbound text. Signal's outbound adapter defined no sanitizeText hook, so the only sanitization that ran was core's central stripInternalRuntimeScaffoldingFromPayload — which removes runtime-injected context wrappers (<system-reminder>, etc.) but not these tool-trace lines. The banner was therefore delivered verbatim.

Why This Change Was Made

The merged Telegram (PR #95774), Google Chat (PR #95084), and IRC (PR #97214) changes already wrap their outbound text with sanitizeAssistantVisibleText — the existing shared assistant-visible sanitizer that removes tool-trace banners and other internal scaffolding (reasoning tags, tool-call XML) while preserving ordinary prose and formatting. Signal was a missed sibling of that same fix, tracked under #90684. This change adds the same hook to the Signal outbound adapter (one import plus sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text)), reusing the existing SDK sanitizer rather than adding a helper. The wrap is plain sanitizeAssistantVisibleText (not the IRC-style sanitizeForPlainText wrap) so Signal's existing markdown rendering is untouched. The change is limited to the Signal adapter; other channels are tracked separately under #90684.

User Impact

Signal users no longer see internal tool-trace banners — or the other assistant-internal scaffolding the shared sanitizer already removes (reasoning tags, tool-call XML) — in delivered messages. Ordinary assistant prose is unaffected.

Evidence

Focused unit tests — extensions/signal/src/outbound-tool-trace-sanitize.test.ts adds 2 cases (tool-trace banner stripped; ordinary prose preserved):

$ node scripts/run-vitest.mjs extensions/signal/src/outbound-tool-trace-sanitize.test.ts
 Test Files  1 passed (1)
      Tests  2 passed (2)

Real-behavior proof — the patched signalPlugin.outbound.sanitizeText, run directly against the real plugin code path. No live Signal roundtrip is included: this PR only wires the existing outbound sanitizer hook, and the command below exercises that changed code path directly:

$ node --import tsx -e '
import { signalPlugin } from "./extensions/signal/src/channel.ts";
const trace = "Done.\n⚠️ 🛠️ `search repos (agent)` failed";
const f = signalPlugin.outbound.sanitizeText;
console.log("after :", JSON.stringify(f({ text: trace })));
console.log("prose :", JSON.stringify(f({ text: "The pipeline has 3 open deals." })));
'
after : "Done."
prose : "The pipeline has 3 open deals."

Before this change Signal defined no sanitizeText hook, so the banner reached users verbatim.

Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

clawsweeper · 2026-06-28T04:29:00Z

Codex review: needs maintainer review before merge. Reviewed June 28, 2026, 12:42 AM ET / 04:42 UTC.

Summary
The PR adds Signal outbound sanitizeText via sanitizeAssistantVisibleText and a focused regression test for stripping internal tool-trace banners while preserving ordinary prose.

PR surface: Source +2, Tests +19. Total +21 across 2 files.

Reproducibility: yes. source-reproducible: current main and v2026.6.10 lack Signal's sanitizeText hook, while shared delivery only calls assistant-visible sanitization when a channel supplies that hook. I did not run a live Signal roundtrip in this read-only review.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #90684
Summary: This PR is the Signal-specific candidate fix for the open cross-channel sanitizer issue; merged Google Chat, Telegram, and IRC PRs are sibling fixes for the same missing outbound sanitizer invariant.

Members:

canonical: Feishu (and non-Discord channels) should apply sanitizeAssistantVisibleText() on outbound text #90684 - Open umbrella issue tracks non-Discord channels applying sanitizeAssistantVisibleText() to outbound text.
same_root_cause: fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084 - Merged Google Chat PR fixed the same missing assistant-visible sanitizer hook pattern for that channel.
same_root_cause: fix(telegram): sanitize outbound tool traces #95774 - Merged Telegram PR fixed the same missing outbound sanitizer hook pattern for Telegram.
same_root_cause: fix(irc): sanitize internal tool-trace lines from outbound text #97214 - Merged IRC PR fixed the same internal tool-trace leak pattern for IRC.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Signal outbound delivery will now suppress text matching the shared internal-trace patterns before send; maintainers should accept that message-delivery tradeoff for Signal as they did for Google Chat, Telegram, and IRC.

Maintainer options:

Land the Signal sanitizer slice (recommended)
After normal required checks, maintainers can accept the same assistant-visible sanitizer semantics already merged for sibling channels.
Require live Signal transport proof
If adapter-level terminal proof is not enough, ask for a redacted Signal send/receive proof before merge.

Next step before merge

No automated repair is needed; maintainer action is to accept or reject the Signal message-delivery sanitizer tradeoff and let normal checks gate merge.

Security
Cleared: The diff only imports an existing plugin-SDK sanitizer, adds one outbound adapter hook, and adds a test; it does not touch dependencies, workflows, secrets, auth, permissions, or package resolution.

Review details

Best possible solution:

Land the focused Signal outbound hook after required CI if maintainers accept Signal sharing the canonical sanitizer semantics, while keeping broader uncovered-channel work tracked by #90684.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main and v2026.6.10 lack Signal's sanitizeText hook, while shared delivery only calls assistant-visible sanitization when a channel supplies that hook. I did not run a live Signal roundtrip in this read-only review.

Is this the best way to solve the issue?

Yes, this is the best bounded fix for the Signal slice because it wires the existing SDK sanitizer at the Signal outbound adapter boundary rather than adding a new regex or downstream send-path special case. A future shared global sanitizer remains a broader maintainer choice for the umbrella issue.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c6ade83a5ccb.

Label changes

Label justifications:

P1: The PR addresses a user-visible internal tool-trace leak in Signal, which is a broken channel delivery workflow tied to the open cross-channel sanitizer issue.
merge-risk: 🚨 message-delivery: The diff changes Signal outbound text before delivery, so an over-broad sanitizer pattern could suppress user-visible message lines despite green CI.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from importing the patched Signal plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from importing the patched Signal plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.

Evidence reviewed

PR surface:

Source +2, Tests +19. Total +21 across 2 files.

View PR surface stats

Area	Files	Added	Net
Source	1	2	+2
Tests	1	19	+19
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	2	21	+21

What I checked:

Repository policy applied: Read the full root AGENTS.md and the scoped extensions/AGENTS.md; the extension boundary guidance supports using public openclaw/plugin-sdk/* imports and keeping the fix in the owning Signal plugin adapter. (extensions/AGENTS.md:1, c6ade83a5ccb)
Current main Signal gap: Current main's Signal outbound base has delivery, chunking, and suppression hooks but no sanitizeText, so the shared delivery sanitizer has no Signal-specific hook to call. (extensions/signal/src/channel.ts:458, c6ade83a5ccb)
PR wires the intended hook: The PR head imports sanitizeAssistantVisibleText and adds sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the Signal outbound adapter. (extensions/signal/src/channel.ts:465, 3f1bf5680337)
PR adds focused regression coverage: The added test calls the Signal plugin's runtime-facing outbound sanitizer hook for a failed-tool banner and ordinary prose. (extensions/signal/src/outbound-tool-trace-sanitize.test.ts:7, 3f1bf5680337)
Shared delivery consumes channel sanitizer hooks: The shared outbound builder maps a plugin outbound.sanitizeText hook into the channel handler, and normalized delivery applies it before payload normalization when present. (src/infra/outbound/deliver.ts:390, c6ade83a5ccb)
Sanitizer contract covers this trace shape: sanitizeAssistantVisibleText() uses the delivery profile, which strips assistant internal trace lines outside code blocks; the adjacent tests include failed-tool banner coverage. (src/shared/text/assistant-visible-text.ts:774, c6ade83a5ccb)

Likely related people:

kevinslin: Blame for the current Signal outbound block, shared outbound sanitizer hook mapping, and assistant-visible trace-line sanitizer points to the current-main history carried by commit c5d34c8 and PR feat(codex): add always plugin approval mode #97123. (role: recent area contributor; confidence: high; commits: c5d34c8376f8; files: extensions/signal/src/channel.ts, src/infra/outbound/deliver.ts, src/shared/text/assistant-visible-text.ts)
masatohoshino: Authored the merged IRC sanitizer slice for the same internal tool-trace leak pattern and also authored this Signal proposal, so they are connected to the shared channel-sanitizer cleanup beyond only opening this PR. (role: recent sibling-surface contributor; confidence: medium; commits: ddedf13190c1, 3f1bf5680337; files: extensions/irc/src/outbound-base.ts, extensions/irc/src/channel.test.ts, extensions/signal/src/channel.ts)
vincentkoc: Merged the Google Chat and IRC sibling sanitizer PRs that established the current channel-by-channel pattern for the same sanitizer invariant. (role: recent merger / adjacent owner; confidence: medium; commits: 696c62400803, ddedf13190c1; files: extensions/googlechat/src/channel.adapters.ts, extensions/irc/src/outbound-base.ts)
mushuiyu886: Authored the merged Telegram outbound sanitizer PR for the same missing-hook pattern, which is direct precedent for the Signal adapter change. (role: recent sibling-surface contributor; confidence: medium; commits: 242fbf1a678b; files: extensions/telegram/src/outbound-adapter.ts, extensions/telegram/src/telegram-outbound.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97360) Wrap the signal outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit c026546)

…text The Nextcloud Talk outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered chat messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (mattermost openclaw#98693, feishu openclaw#98705, twitch openclaw#103109, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound base adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

openclaw-barnacle Bot added channel: signal Channel integration: signal size: XS labels Jun 28, 2026

clawsweeper Bot mentioned this pull request Jun 28, 2026

fix(slack): sanitize internal tool-trace lines from outbound text #97367

Merged

vincentkoc merged commit c026546 into openclaw:main Jun 28, 2026
139 of 147 checks passed

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 20:53 UTC curtismercier/openclaw-mods#1169

Open

masatohoshino deleted the fix/signal-outbound-tool-trace-sanitize branch July 1, 2026 14:53

This was referenced Jul 10, 2026

fix(nextcloud-talk): strip internal tool-trace banners from outbound text #103355

Closed

fix(nostr): strip internal tool-trace banners from outbound text #103361

Open

fix(zalo): strip internal tool-trace banners from outbound text #103377

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(signal): sanitize internal tool-trace lines from outbound text#97360

fix(signal): sanitize internal tool-trace lines from outbound text#97360
vincentkoc merged 1 commit into
openclaw:mainfrom
masatohoshino:fix/signal-outbound-tool-trace-sanitize

masatohoshino commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

masatohoshino commented Jun 28, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading