fix(matrix): sanitize internal tool-trace lines from outbound text by masatohoshino · Pull Request #97372 · openclaw/openclaw

masatohoshino · 2026-06-28T05:24:23Z

Related: #90684

What Problem This Solves

Fixes an issue where OpenClaw's internal tool-execution traces could leak into Matrix outbound messages. When a tool run fails, the runtime injects a status banner such as ⚠️ 🛠️ `…(agent)` failed into the assistant's outbound text. Matrix's outbound adapter defined no sanitizeText hook, so the only sanitization that ran was core's central stripInternalRuntimeScaffoldingFromPayload — which removes runtime-injected context wrappers (<system-reminder>, etc.) but not these tool-trace lines. The banner was therefore delivered verbatim.

Why This Change Was Made

The merged Telegram (PR #95774), Google Chat (PR #95084), and IRC (PR #97214) changes already wrap their outbound text with sanitizeAssistantVisibleText — the existing shared assistant-visible sanitizer that removes tool-trace banners and other internal scaffolding (reasoning tags, tool-call XML) while preserving ordinary prose and formatting. Matrix was a missed sibling of that same fix, tracked under #90684. This change adds the same hook to the Matrix outbound adapter (one import plus sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text)), reusing the existing SDK sanitizer rather than adding a helper. It applies sanitizeAssistantVisibleText directly (not the IRC-style sanitizeForPlainText wrap) because Matrix text is markdown destined for the markdown→HTML renderer; the hook runs before that render, so the outgoing message is built from already-sanitized text. The change touches only extensions/matrix/src/channel.ts (the outbound adapter) plus a focused test; other channels are tracked separately under #90684.

User Impact

Matrix outbound messages no longer include internal tool-trace banners; the shared sanitizer also strips its other inherited internal scaffolding (reasoning tags, tool-call XML). Ordinary assistant prose is unaffected.

Evidence

Focused unit tests — extensions/matrix/src/outbound-tool-trace-sanitize.test.ts adds 2 cases (tool-trace banner stripped; ordinary prose preserved):

$ node scripts/run-vitest.mjs extensions/matrix/src/outbound-tool-trace-sanitize.test.ts
 Test Files  1 passed (1)
      Tests  2 passed (2)

Real-behavior proof — the patched matrixPlugin.outbound.sanitizeText, run directly against the real plugin code path. No live Matrix roundtrip is included: this PR only wires the existing outbound sanitizer hook, and the command below exercises that changed code path directly:

$ node --import tsx -e '
import { matrixPlugin } from "./extensions/matrix/src/channel.ts";
const f = matrixPlugin.outbound.sanitizeText;
console.log("after :", JSON.stringify(f({ text: "Done.\n⚠️ 🛠️ `search repos (agent)` failed" })));
console.log("prose :", JSON.stringify(f({ text: "The pipeline has 3 open deals." })));
'
after : "Done."
prose : "The pipeline has 3 open deals."

Matrix previously had no sanitizeText hook in extensions/matrix/src/channel.ts, so the banner reached users verbatim.

Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

clawsweeper · 2026-06-28T05:27:40Z

Codex review: needs maintainer review before merge. Reviewed June 28, 2026, 1:34 AM ET / 05:34 UTC.

Summary
The PR adds Matrix outbound sanitizeText wiring with sanitizeAssistantVisibleText and a focused regression test for stripping internal tool-trace banners while preserving ordinary prose.

PR surface: Source +4, Tests +20. Total +24 across 2 files.

Reproducibility: yes. source-reproducible: current main’s Matrix outbound adapter lacks sanitizeText, while shared delivery only runs the channel sanitizer when that hook exists. I did not run a live Matrix round trip in this read-only review.

Review metrics: 1 noteworthy metric.

Matrix sanitizer surface: 1 hook added. The single added outbound hook changes which Matrix text reaches users before markdown-to-HTML rendering, so it deserves maintainer attention despite the small diff.

Root-cause cluster
Relationship: partial_overlap
Canonical: #90684
Summary: The broader issue tracks assistant-visible sanitizer coverage across non-Discord channels; this PR is the Matrix slice, with merged sibling PRs for Google Chat, Telegram, and IRC.

Members:

canonical: Feishu (and non-Discord channels) should apply sanitizeAssistantVisibleText() on outbound text #90684 - The issue is the open umbrella for non-Discord channel sanitizer coverage and is explicitly linked by this PR.
same_root_cause: fix(googlechat): sanitize internal tool-trace lines from outbound text (#90684) #95084 - Merged Google Chat sibling fix for the same internal tool-trace outbound leak pattern.
same_root_cause: fix(telegram): sanitize outbound tool traces #95774 - Merged Telegram sibling fix for the same missing outbound sanitizer hook class.
same_root_cause: fix(irc): sanitize internal tool-trace lines from outbound text #97214 - Merged IRC sibling fix for the same internal tool-trace outbound leak pattern.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] This changes Matrix message-delivery text before render/send; the canonical sanitizer is appropriate, but any sanitizer can suppress user prose that exactly matches internal trace/scaffolding patterns.

Maintainer options:

Land the scoped hook after required checks (recommended)
Accept the small message-delivery risk because the PR uses the canonical sanitizer at the shared adapter boundary and includes direct after-fix proof for trace stripping and prose preservation.
Ask for a live Matrix send proof
Maintainers can require a real Matrix room round trip before merge if they want client-visible confirmation beyond the adapter-level terminal proof.

Next step before merge

[P2] No repair lane is needed; the branch has no concrete review finding for ClawSweeper to fix.

Security
Cleared: The diff adds no dependency, workflow, secret, permission, or supply-chain surface and narrows leakage of internal tool traces in Matrix outbound text.

Review details

Best possible solution:

Land this Matrix adapter-level sanitizer hook with the focused regression test, while keeping the broader cross-channel sanitizer tracker open for any channels still missing equivalent coverage.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main’s Matrix outbound adapter lacks sanitizeText, while shared delivery only runs the channel sanitizer when that hook exists. I did not run a live Matrix round trip in this read-only review.

Is this the best way to solve the issue?

Yes, this is the best narrow Matrix fix: it wires the existing canonical sanitizer at the channel adapter contract that shared delivery already consumes. A downstream Matrix send-path regex or new config option would be a less maintainable duplicate path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 69af58ba2613.

Label changes

Label changes:

add P1: The PR addresses internal tool/runtime trace leakage into an external channel, an urgent user-facing channel workflow and privacy problem.
add merge-risk: 🚨 message-delivery: Merging changes Matrix outbound text sanitization before delivery, which can intentionally suppress internal-looking lines from user-visible messages.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output that imports the real Matrix plugin code path and shows the new sanitizer stripping the trace banner while preserving ordinary prose.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output that imports the real Matrix plugin code path and shows the new sanitizer stripping the trace banner while preserving ordinary prose.

Label justifications:

P1: The PR addresses internal tool/runtime trace leakage into an external channel, an urgent user-facing channel workflow and privacy problem.
merge-risk: 🚨 message-delivery: Merging changes Matrix outbound text sanitization before delivery, which can intentionally suppress internal-looking lines from user-visible messages.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output that imports the real Matrix plugin code path and shows the new sanitizer stripping the trace banner while preserving ordinary prose.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output that imports the real Matrix plugin code path and shows the new sanitizer stripping the trace banner while preserving ordinary prose.

Evidence reviewed

PR surface:

Source +4, Tests +20. Total +24 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	5	1	+4
Tests	1	20	0	+20
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	25	1	+24

What I checked:

Root policy read and applied: Root review policy requires reading the whole touched function/module, callers, sibling surfaces, tests, and scoped guides before verdict; that shaped the review scope. (AGENTS.md:7, 69af58ba2613)
Scoped extension boundary read: The scoped extensions guide says bundled plugin production code should import through openclaw/plugin-sdk/*, which the PR does by using the SDK text-chunking export. (extensions/AGENTS.md:13, 69af58ba2613)
Current Matrix adapter lacks sanitizer hook: Current main declares the Matrix outbound adapter with chunking, markdown mode, and delivery capabilities, but no sanitizeText hook before the PR. (extensions/matrix/src/channel.ts:334, 69af58ba2613)
PR adds the intended hook: The PR diff adds sanitizeAssistantVisibleText from the SDK and wires sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) on the Matrix outbound adapter. (extensions/matrix/src/channel.ts:339, cbb8ca55a7ba)
Shared delivery consumes adapter sanitizer: The shared outbound path wraps outbound.sanitizeText into the channel handler and applies it to text payloads before channel payload normalization and send. (src/infra/outbound/deliver.ts:390, 69af58ba2613)
Canonical sanitizer covers trace lines: sanitizeAssistantVisibleText uses the delivery profile, which includes internal trace-line stripping and other assistant-visible scaffolding removal. (src/shared/text/assistant-visible-text.ts:924, 69af58ba2613)

Likely related people:

mushuiyu886: Current-main blame for the Matrix outbound adapter, shared delivery sanitizer hook plumbing, and assistant-visible sanitizer lines points to commit a7bfc06. (role: recent area contributor; confidence: high; commits: a7bfc06f4597; files: extensions/matrix/src/channel.ts, extensions/matrix/src/outbound.ts, src/infra/outbound/deliver.ts)
masatohoshino: Authored the merged IRC tool-trace sanitizer fix that uses the same shared sanitizer pattern and is directly cited by this PR as precedent. (role: sibling sanitizer contributor; confidence: medium; commits: ddedf13190c1; files: extensions/irc/src/outbound-base.ts, extensions/irc/src/channel.test.ts)
jailbirt: Authored the merged Google Chat sanitizer fix for the same umbrella issue and same outbound trace-leak pattern. (role: sibling sanitizer contributor; confidence: medium; commits: 696c62400803; files: extensions/googlechat/src/channel.adapters.ts, extensions/googlechat/src/channel.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit 25490d4)

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214).

…text The Nextcloud Talk outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered chat messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (mattermost openclaw#98693, feishu openclaw#98705, twitch openclaw#103109, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound base adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

The Zalo outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Zalo messages. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text) to the outbound adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

…penclaw#97372) Wrap the matrix outbound sanitizeText hook with sanitizeAssistantVisibleText so assistant internal tool-trace scaffolding is stripped before delivery, matching the sibling channel fixes under openclaw#90684 (Telegram openclaw#95774, Google Chat openclaw#95084, IRC openclaw#97214). (cherry picked from commit 25490d4)

The Nostr outbound adapter had no sanitizeText hook, so internal assistant tool-trace scaffolding (e.g. "⚠️ 🛠️ `exec (agent)` failed", raw <tool_call>/<function_response> XML) leaked verbatim into delivered Nostr DMs. The same one-line sanitizeText hook was already shipped to 13 sibling channels (twitch openclaw#103109, mattermost openclaw#98693, feishu openclaw#98705, signal openclaw#97360, slack openclaw#97367, matrix openclaw#97372, irc openclaw#97214, telegram, googlechat openclaw#90684, qqbot openclaw#90132, discord, whatsapp openclaw#71830, sms). Add sanitizeText to the NostrOutboundAdapter type and adapter, matching those precedents. Co-Authored-By: Claude <[email protected]>

openclaw-barnacle Bot added channel: matrix Channel integration: matrix size: XS labels Jun 28, 2026

vincentkoc merged commit 25490d4 into openclaw:main Jun 28, 2026
140 of 152 checks passed

github-actions Bot mentioned this pull request Jun 28, 2026

📡 Upstream Digest — 2026-06-28 19:05 UTC curtismercier/openclaw-mods#1168

Open

This was referenced Jun 29, 2026

Chat gateways leak internal tool-trace banners in outbound text NousResearch/hermes-agent#54957

Open

fix(gateway): strip internal tool-trace banners from chat output NousResearch/hermes-agent#54959

Open

masatohoshino deleted the fix/matrix-outbound-tool-trace-sanitize branch July 1, 2026 14:53

clawsweeper Bot mentioned this pull request Jul 1, 2026

fix(mattermost): strip internal tool-trace banners from outbound text #98693

Merged

This was referenced Jul 10, 2026

fix(nextcloud-talk): strip internal tool-trace banners from outbound text #103355

Closed

fix(nostr): strip internal tool-trace banners from outbound text #103361

Open

fix(zalo): strip internal tool-trace banners from outbound text #103377

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(matrix): sanitize internal tool-trace lines from outbound text#97372

fix(matrix): sanitize internal tool-trace lines from outbound text#97372
vincentkoc merged 1 commit into
openclaw:mainfrom
masatohoshino:fix/matrix-outbound-tool-trace-sanitize

masatohoshino commented Jun 28, 2026

Uh oh!

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

masatohoshino commented Jun 28, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 28, 2026 •

edited

Loading