fix(slack): sanitize internal tool-trace lines from outbound text by masatohoshino · Pull Request #97367 · openclaw/openclaw

masatohoshino · 2026-06-28T05:16:13Z

Related: #90684

What Problem This Solves

Fixes an issue where OpenClaw's internal tool-execution traces could leak into Slack outbound messages. When a tool run fails, the runtime injects a status banner such as ⚠️ 🛠️ `…(agent)` failed into the assistant's outbound text. Slack's outbound adapter defined no sanitizeText hook, so the only sanitization that ran was core's central stripInternalRuntimeScaffoldingFromPayload — which removes runtime-injected context wrappers (<system-reminder>, etc.) but not these tool-trace lines. The banner was therefore delivered verbatim.

Why This Change Was Made

The merged Telegram (PR #95774), Google Chat (PR #95084), and IRC (PR #97214) changes already wrap their outbound text with sanitizeAssistantVisibleText — the existing shared assistant-visible sanitizer that removes tool-trace banners and other internal scaffolding (reasoning tags, tool-call XML) while preserving ordinary prose and formatting. Slack was a missed sibling of that same fix, tracked under #90684. This change adds the same hook to the Slack outbound adapter (one import plus sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text)), reusing the existing SDK sanitizer rather than adding a helper. It applies sanitizeAssistantVisibleText directly (not the IRC-style sanitizeForPlainText wrap) so Slack's mrkdwn rendering is untouched. The hook sanitizes the assistant reply text (payload.text), which is the leak surface. The change touches only extensions/slack/src/channel.ts (the outbound adapter) plus a focused test; other channels are tracked separately under #90684.

User Impact

Slack outbound messages no longer include internal tool-trace banners; the shared sanitizer also strips its other inherited internal scaffolding (reasoning tags, tool-call XML). Ordinary assistant prose is unaffected.

Evidence

Focused unit tests — extensions/slack/src/outbound-tool-trace-sanitize.test.ts adds 2 cases (tool-trace banner stripped; ordinary prose preserved):

$ node scripts/run-vitest.mjs extensions/slack/src/outbound-tool-trace-sanitize.test.ts
 Test Files  1 passed (1)
      Tests  2 passed (2)

Real-behavior proof — the patched slackPlugin.outbound.sanitizeText, run directly against the real plugin code path. No live Slack roundtrip is included: this PR only wires the existing outbound sanitizer hook, and the command below exercises that changed code path directly:

$ node --import tsx -e '
import { slackPlugin } from "./extensions/slack/src/channel.ts";
const f = slackPlugin.outbound.sanitizeText;
console.log("after :", JSON.stringify(f({ text: "Done.\n⚠️ 🛠️ `search repos (agent)` failed" })));
console.log("prose :", JSON.stringify(f({ text: "The pipeline has 3 open deals." })));
'
after : "Done."
prose : "The pipeline has 3 open deals."

Before this change Slack defined no sanitizeText hook, so the banner reached users verbatim.

Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

clawsweeper · 2026-06-28T05:18:29Z

Codex review: needs maintainer review before merge. Reviewed June 28, 2026, 1:22 AM ET / 05:22 UTC.

Summary
The PR adds a Slack outbound sanitizeText hook using sanitizeAssistantVisibleText and a focused regression test for stripping internal tool-trace banners while preserving normal prose.

PR surface: Source +2, Tests +19. Total +21 across 2 files.

Reproducibility: yes. source-reproducible: current main and v2026.6.10 lack Slack's sanitizeText hook, while shared delivery only calls assistant-visible sanitization when a channel supplies that hook. I did not run a live Slack roundtrip in this read-only review.

Review metrics: 1 noteworthy metric.

Channel-wide sanitizer hook: 1 added. The new hook runs before Slack outbound text delivery, so maintainers should notice the channel-wide message-content behavior change before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #90684
Summary: This PR is the Slack-specific candidate fix for the open cross-channel sanitizer issue; merged Google Chat, Telegram, and IRC PRs are sibling fixes for the same missing outbound sanitizer invariant.

Members:

canonical: Feishu (and non-Discord channels) should apply sanitizeAssistantVisibleText() on outbound text #90684 - The open umbrella issue tracks non-Discord channels applying sanitizeAssistantVisibleText to outbound text, and the PR body explicitly relates this Slack slice to it.
same_root_cause: fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084 - The merged Google Chat PR fixed the same missing assistant-visible sanitizer hook pattern for that channel.
same_root_cause: fix(telegram): sanitize outbound tool traces #95774 - The merged Telegram PR fixed the same missing outbound sanitizer hook pattern for Telegram.
same_root_cause: fix(irc): sanitize internal tool-trace lines from outbound text #97214 - The merged IRC PR fixed the same internal tool-trace leak pattern for IRC.
same_root_cause: fix(signal): sanitize internal tool-trace lines from outbound text #97360 - The open Signal PR applies the same channel-specific sanitizer hook pattern to another uncovered channel.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Mantis proof suggestion
A short Slack desktop or gateway-visible proof would add useful confirmation for this visible Slack message-delivery change, even though the adapter proof is sufficient. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis slack desktop smoke: verify a patched Slack outbound reply removes an internal `⚠️ 🛠️ ... (agent) failed` line while preserving ordinary assistant prose.

Risk before merge

[P1] Slack outbound delivery will now suppress text matching the shared internal-trace sanitizer patterns before send, so maintainers should accept the same message-delivery tradeoff already used for sibling channels.
[P1] The contributor proof exercises the patched Slack plugin hook directly, but it does not include a live Slack client roundtrip.

Maintainer options:

Land the Slack sanitizer slice (recommended)
After normal required checks, maintainers can accept the same assistant-visible sanitizer semantics already merged for Google Chat, Telegram, and IRC.
Require live Slack proof first
If direct adapter proof is not enough for this visible channel change, ask for a redacted Slack desktop or gateway proof before merge.

Next step before merge

No automated repair is needed; maintainer action is to accept or reject the Slack message-delivery sanitizer tradeoff and let normal checks gate merge.

Security
Cleared: The diff only imports an existing plugin-SDK sanitizer, adds one outbound adapter hook, and adds a focused test; it does not touch dependencies, workflows, secrets, auth, permissions, or package resolution.

Review details

Best possible solution:

Land the focused Slack outbound hook after required checks if maintainers accept the canonical sanitizer semantics, while keeping remaining uncovered channels tracked by #90684.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main and v2026.6.10 lack Slack's sanitizeText hook, while shared delivery only calls assistant-visible sanitization when a channel supplies that hook. I did not run a live Slack roundtrip in this read-only review.

Is this the best way to solve the issue?

Yes, this is the best bounded fix for the Slack slice because it wires the existing SDK sanitizer at the Slack plugin outbound boundary instead of adding new regexes or downstream send-path special cases. A future shared global sanitizer remains a broader maintainer choice for the umbrella issue.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 69af58ba2613.

Label changes

Label changes:

add P1: The PR addresses a user-visible internal tool-trace leak in Slack, a broken channel delivery workflow tied to the open cross-channel sanitizer issue.
add merge-risk: 🚨 message-delivery: The diff changes Slack outbound text before delivery, so an over-broad sanitizer pattern could suppress user-visible message lines despite green CI.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from importing the patched Slack plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from importing the patched Slack plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.

Label justifications:

P1: The PR addresses a user-visible internal tool-trace leak in Slack, a broken channel delivery workflow tied to the open cross-channel sanitizer issue.
merge-risk: 🚨 message-delivery: The diff changes Slack outbound text before delivery, so an over-broad sanitizer pattern could suppress user-visible message lines despite green CI.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes terminal output from importing the patched Slack plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes terminal output from importing the patched Slack plugin and calling the real outbound sanitizer hook after the change, showing the banner stripped and ordinary prose preserved.

Evidence reviewed

PR surface:

Source +2, Tests +19. Total +21 across 2 files.

View PR surface stats

Area	Files	Added	Net
Source	1	2	+2
Tests	1	19	+19
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	2	21	+21

What I checked:

Current main Slack gap: Current main defines slackChannelOutbound with deliveryMode, chunker, textChunkLimit, and normalizePayload, but no sanitizeText hook for shared delivery to call. (extensions/slack/src/channel.ts:422, 69af58ba2613)
PR hook: PR head imports sanitizeAssistantVisibleText from the plugin SDK and adds sanitizeText to slackChannelOutbound before normalizePayload. (extensions/slack/src/channel.ts:427, e04020a9ae09)
PR regression test: The added test exercises slackPlugin.outbound.sanitizeText on a failed-tool trace line and on ordinary prose. (extensions/slack/src/outbound-tool-trace-sanitize.test.ts:7, e04020a9ae09)
Shared delivery hook contract: Shared outbound delivery maps a plugin outbound.sanitizeText hook into the channel handler and applies it before payload normalization. (src/infra/outbound/deliver.ts:390, 69af58ba2613)
Sanitizer behavior: sanitizeAssistantVisibleText uses the delivery profile, which strips assistant internal trace lines outside code regions, including compact failed-tool banners. (src/shared/text/assistant-visible-text.ts:774, 69af58ba2613)
Sibling channel precedent: Merged Google Chat, Telegram, and IRC PRs use the same sanitizer pattern for the same outbound tool-trace leak class.

Likely related people:

mushuiyu886: Current blame for the Slack outbound block, shared delivery sanitizer hook mapping, and assistant-visible trace-line sanitizer points to a7bfc06, and they authored the merged Telegram sibling sanitizer PR. (role: recent area contributor; confidence: high; commits: a7bfc06f4597, 242fbf1a678b; files: extensions/slack/src/channel.ts, src/infra/outbound/deliver.ts, src/shared/text/assistant-visible-text.ts)
masatohoshino: They authored the merged IRC sanitizer slice for the same internal tool-trace leak pattern and this Slack proposal, so they are connected to the current channel-by-channel cleanup pattern beyond only opening this PR. (role: recent sibling-surface contributor; confidence: medium; commits: ddedf13190c1, e04020a9ae09; files: extensions/irc/src/outbound-base.ts, extensions/irc/src/channel.test.ts, extensions/slack/src/channel.ts)
vincentkoc: They merged the Google Chat and IRC sibling sanitizer PRs and have substantial recent Slack channel history around native Slack behavior and plugin seams. (role: recent merger / adjacent owner; confidence: medium; commits: 696c62400803, ddedf13190c1, 5ec362fe0b09; files: extensions/googlechat/src/channel.adapters.ts, extensions/irc/src/outbound-base.ts, extensions/slack/src/channel.ts)
steipete: Slack/plugin history shows repeated plugin-boundary and outbound adapter refactors by Peter Steinberger on the files and seams this PR uses. (role: adjacent owner; confidence: medium; commits: 8bfa06e992be, ab96520bbad5, 7cdd8a84a67b; files: extensions/slack/src/channel.ts, extensions/slack/src/outbound-adapter.ts, src/channels/plugins/outbound/load.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit cd6d0f9)

…text The Nextcloud Talk outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered chat messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (mattermost openclaw#98693, feishu openclaw#98705, twitch openclaw#103109, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound base adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

…enclaw#97367) Wrap the slack outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit cd6d0f9)

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

openclaw-barnacle Bot added channel: slack Channel integration: slack size: XS labels Jun 28, 2026

vincentkoc merged commit cd6d0f9 into openclaw:main Jun 28, 2026
138 of 142 checks passed

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 20:53 UTC curtismercier/openclaw-mods#1169

Open

This was referenced Jun 29, 2026

Chat gateways leak internal tool-trace banners in outbound text NousResearch/hermes-agent#54957

Open

fix(gateway): strip internal tool-trace banners from chat output NousResearch/hermes-agent#54959

Open

masatohoshino deleted the fix/slack-outbound-tool-trace-sanitize branch July 1, 2026 14:53

clawsweeper Bot mentioned this pull request Jul 1, 2026

fix(mattermost): strip internal tool-trace banners from outbound text #98693

Merged

clawsweeper Bot mentioned this pull request Jul 8, 2026

fix(imessage): apply canonical outbound sanitizer #101430

Open

clawsweeper Bot mentioned this pull request Jul 8, 2026

fix(tlon): strip internal tool-trace banners from outbound text #102211

Closed

This was referenced Jul 10, 2026

fix(nextcloud-talk): strip internal tool-trace banners from outbound text #103355

Closed

fix(nostr): strip internal tool-trace banners from outbound text #103361

Open

fix(zalo): strip internal tool-trace banners from outbound text #103377

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(slack): sanitize internal tool-trace lines from outbound text#97367

fix(slack): sanitize internal tool-trace lines from outbound text#97367
vincentkoc merged 1 commit into
openclaw:mainfrom
masatohoshino:fix/slack-outbound-tool-trace-sanitize

masatohoshino commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

masatohoshino commented Jun 28, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading