fix: preserve exec event routing and sanitize tool XML

steipete · steipete · commit 9180173f9a79 · 2026-05-02T09:16:11.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -41,6 +41,8 @@ Docs: https://docs.openclaw.ai
 - Telegram/startup: use the existing `getMe` request guard for the gateway bot probe instead of a fixed 2.5-second budget, and honor higher `timeoutSeconds` configs for slow Telegram API paths. Fixes #75783. Thanks @tankotan.
 - Telegram/models: make model picker confirmations say selections are session-scoped and do not change the agent's persistent default. Fixes #75965. Thanks @sd1114820.
 - Control UI/slash commands: keep fallback command metadata on a browser-safe registry path, so provider thinking runtime imports cannot blank the Web UI with `process is not defined`. Fixes #75987. Thanks @novkien.
+- Heartbeat/Discord: keep async exec completion events out of the generic `System (untrusted)` prompt block and let the dedicated exec heartbeat prompt handle them, so Discord no longer receives raw exec failure tails as separate system-style messages. Fixes #66366. Thanks @Promee-ThaBossHoss.
+- Channels: strip plain-text MiniMax and XML tool-call scaffolding from shared user-facing reply sanitization, so messaging channels do not deliver raw model tool syntax when a provider emits it as text instead of structured tool calls. Fixes #62820. Thanks @canh0chua.
 - Infer/media: report missing image-understanding and audio-transcription provider configuration for `image describe`, `image describe-many`, and `audio transcribe` instead of blaming the input path when no provider is available. Fixes #73569 and supersedes #73593, #74288, and #74495. Thanks @bittoby, @tmimmanuel, @Linux2010, and @vyctorbrzezowski.
 - Docs/health: clarify that session listing surfaces stored conversation rows rather than Discord/channel socket liveness, and point connectivity checks at channel status and health probes. Fixes #70420. Thanks @ashersoutherncities-art and @martingarramon.
 - WhatsApp/Cron: keep DM pairing-store approvals out of implicit cron and heartbeat recipient fallback, so scheduled automation only uses explicit targets, active configured recipients, or configured `allowFrom` entries. Fixes #62339. Thanks @kelvinisly-collab.
diff --git a/src/agents/bash-tools.test.ts b/src/agents/bash-tools.test.ts
@@ -766,7 +766,7 @@ describe("exec notifyOnExit", () => {
     expect(finished).toBeTruthy();
     expect(hasEvent).toBe(true);
     expect(queuedEvent).toMatchObject({ trusted: false });
-    expect(formatted).toContain("System (untrusted):");
+    expect(formatted).toBeUndefined();
   });
 
   it("preserves the origin delivery context on background exec completion events", async () => {
diff --git a/src/agents/pi-embedded-helpers.sanitizeuserfacingtext.test.ts b/src/agents/pi-embedded-helpers.sanitizeuserfacingtext.test.ts
@@ -235,6 +235,56 @@ describe("sanitizeUserFacingText", () => {
     expect(sanitizeUserFacingText(input)).toBe("Before\n\nAfter");
   });
 
+  it("strips MiniMax plain-text tool calls before user-facing delivery", () => {
+    const input = [
+      "Let me check that.",
+      '<minimax:tool_call><invoke name="exec">',
+      '<parameter name="cmd">ls</parameter>',
+      "</invoke></minimax:tool_call>",
+      "Done.",
+    ].join("\n");
+
+    expect(sanitizeUserFacingText(input)).toBe("Let me check that.\n\nDone.");
+  });
+
+  it("preserves MiniMax tool-call XML examples in user-facing code spans", () => {
+    const inline = 'Use `<minimax:tool_call><invoke name="exec">x</invoke></minimax:tool_call>`.';
+    const fenced = [
+      "Example:",
+      "```xml",
+      '<minimax:tool_call><invoke name="exec">x</invoke></minimax:tool_call>',
+      "```",
+    ].join("\n");
+
+    expect(sanitizeUserFacingText(inline)).toBe(inline);
+    expect(sanitizeUserFacingText(fenced)).toBe(fenced);
+  });
+
+  it("strips raw XML tool-call blocks before user-facing delivery", () => {
+    const input = [
+      "Before",
+      '<tool_call>{"name":"read","arguments":{"file_path":"secret.md"}}</tool_call>',
+      "After",
+    ].join("\n");
+
+    expect(sanitizeUserFacingText(input)).toBe("Before\n\nAfter");
+  });
+
+  it("strips plural XML function-call wrappers before user-facing delivery", () => {
+    const input = [
+      "Before",
+      '<function_calls><invoke name="find"><parameter name="query">secret</parameter></invoke></function_calls>',
+      "After",
+    ].join("\n");
+
+    expect(sanitizeUserFacingText(input)).toBe("Before\n\nAfter");
+  });
+
+  it("preserves literal tool-call tag examples in user-facing prose", () => {
+    const input = "Use `<tool_call>` to describe the XML tag in docs.";
+    expect(sanitizeUserFacingText(input)).toBe(input);
+  });
+
   it("keeps ordinary inline mentions of the replay placeholder", () => {
     expect(sanitizeUserFacingText("What does [tool calls omitted] mean?")).toBe(
       "What does [tool calls omitted] mean?",
diff --git a/src/agents/pi-embedded-helpers/sanitize-user-facing-text.ts b/src/agents/pi-embedded-helpers/sanitize-user-facing-text.ts
@@ -12,7 +12,11 @@ import {
   normalizeLowercaseStringOrEmpty,
   normalizeOptionalLowercaseString,
 } from "../../shared/string-coerce.js";
-import { stripLegacyBracketToolCallBlocks } from "../../shared/text/assistant-visible-text.js";
+import {
+  stripLegacyBracketToolCallBlocks,
+  stripMinimaxToolCallXml,
+  stripToolCallXmlTags,
+} from "../../shared/text/assistant-visible-text.js";
 import { formatExecDeniedUserMessage } from "../exec-approval-result.js";
 import { stripInternalRuntimeContext } from "../internal-runtime-context.js";
 import { stableStringify } from "../stable-stringify.js";
@@ -401,10 +405,13 @@ export function sanitizeUserFacingText(text: unknown, opts?: { errorContext?: bo
   }
   const errorContext = opts?.errorContext ?? false;
   const stripped = stripInboundMetadata(stripInternalRuntimeContext(stripFinalTagsFromText(raw)));
+  const withoutToolCallXml = stripToolCallXmlTags(stripMinimaxToolCallXml(stripped), {
+    stripFunctionCallsXmlPayloads: true,
+  });
   // Replay repair may synthesize this placeholder to keep provider transcripts valid.
   // It is internal scaffolding, so drop standalone placeholder lines before delivery
   // while preserving ordinary inline mentions a user may be discussing.
-  const withoutPlaceholder = stripToolCallsOmittedPlaceholderLines(stripped);
+  const withoutPlaceholder = stripToolCallsOmittedPlaceholderLines(withoutToolCallXml);
   const withoutToolCallBlocks = stripLegacyBracketToolCallBlocks(withoutPlaceholder);
   const trimmed = withoutToolCallBlocks.trim();
   if (!trimmed) {
diff --git a/src/auto-reply/reply/session-system-events.ts b/src/auto-reply/reply/session-system-events.ts
@@ -6,12 +6,20 @@ import {
   formatZonedTimestamp,
   resolveTimezone,
 } from "../../infra/format-time/format-datetime.ts";
-import { drainSystemEventEntries } from "../../infra/system-events.js";
+import { isExecCompletionEvent } from "../../infra/heartbeat-events-filter.js";
+import {
+  consumeSelectedSystemEventEntries,
+  peekSystemEventEntries,
+  type SystemEvent,
+} from "../../infra/system-events.js";
 import {
   normalizeLowercaseStringOrEmpty,
   normalizeOptionalString,
 } from "../../shared/string-coerce.js";
 
+const selectGenericSystemEvents = (events: readonly SystemEvent[]): SystemEvent[] =>
+  events.filter((event) => !isExecCompletionEvent(event.text));
+
 /** Drain queued system events, format as `System:` lines, return the block (or undefined). */
 export async function drainFormattedSystemEvents(params: {
   cfg: OpenClawConfig;
@@ -83,7 +91,12 @@ export async function drainFormattedSystemEvents(params: {
   };
 
   const systemLines: string[] = [];
-  const queued = drainSystemEventEntries(params.sessionKey);
+  // Exec completions have a dedicated heartbeat prompt; leave those entries queued
+  // so the heartbeat path can consume and deliver them.
+  const queued = consumeSelectedSystemEventEntries(
+    params.sessionKey,
+    selectGenericSystemEvents(peekSystemEventEntries(params.sessionKey)),
+  );
   systemLines.push(
     ...queued.flatMap((event) => {
       const compacted = compactSystemEvent(event.text);
diff --git a/src/infra/heartbeat-runner.ghost-reminder.test.ts b/src/infra/heartbeat-runner.ghost-reminder.test.ts
@@ -8,7 +8,7 @@ import {
   setupTelegramHeartbeatPluginRuntimeForTests,
   withTempHeartbeatSandbox,
 } from "./heartbeat-runner.test-utils.js";
-import { enqueueSystemEvent, resetSystemEventsForTest } from "./system-events.js";
+import { enqueueSystemEvent, peekSystemEvents, resetSystemEventsForTest } from "./system-events.js";
 
 beforeEach(() => {
   setupTelegramHeartbeatPluginRuntimeForTests();
@@ -143,6 +143,7 @@ describe("Ghost reminder bug (issue #13317)", () => {
       SessionKey?: string;
       ForceSenderIsOwnerFalse?: boolean;
     } | null;
+    sessionKey: string;
     replyCallCount: number;
   }> => {
     return withTempHeartbeatSandbox(
@@ -174,6 +175,7 @@ describe("Ghost reminder bug (issue #13317)", () => {
           result,
           sendTelegram,
           calledCtx,
+          sessionKey,
           replyCallCount: getReplySpy.mock.calls.length,
         };
       },
@@ -375,6 +377,26 @@ describe("Ghost reminder bug (issue #13317)", () => {
     expect(sendTelegram).toHaveBeenCalled();
   });
 
+  it("consumes exec completion entries without dropping later generic events", async () => {
+    const { result, calledCtx, sessionKey } = await runHeartbeatCase({
+      tmpPrefix: "openclaw-exec-preserve-generic-",
+      replyText: "Deploy succeeded",
+      reason: "exec-event",
+      enqueue: (key) => {
+        enqueueSystemEvent("Exec finished (gateway id=abc12345, code 0)\ndeploy succeeded", {
+          sessionKey: key,
+        });
+        enqueueSystemEvent("Node connected", { sessionKey: key });
+      },
+    });
+
+    expect(result.status).toBe("ran");
+    expect(calledCtx?.Provider).toBe("exec-event");
+    expect(calledCtx?.Body).toContain("deploy succeeded");
+    expect(calledCtx?.Body).not.toContain("Node connected");
+    expect(peekSystemEvents(sessionKey)).toEqual(["Node connected"]);
+  });
+
   it("classifies hook:wake exec completions as exec-event prompts", async () => {
     const { result, sendTelegram, calledCtx } = await runHeartbeatCase({
       tmpPrefix: "openclaw-hook-exec-",
diff --git a/src/infra/heartbeat-runner.ts b/src/infra/heartbeat-runner.ts
@@ -131,9 +131,10 @@ import {
   resolveHeartbeatSenderContext,
 } from "./outbound/targets.js";
 import {
-  consumeSystemEventEntries,
+  consumeSelectedSystemEventEntries,
   peekSystemEventEntries,
   resolveSystemEventDeliveryContext,
+  type SystemEvent,
 } from "./system-events.js";
 
 export type HeartbeatDeps = OutboundSendDeps &
@@ -950,6 +951,28 @@ After completing all due tasks, reply HEARTBEAT_OK.`;
   };
 }
 
+function selectSystemEventsConsumedByHeartbeat(params: {
+  preflight: HeartbeatPreflight;
+  hasExecCompletion: boolean;
+  hasCronEvents: boolean;
+}): SystemEvent[] {
+  const { preflight } = params;
+  if (!preflight.shouldInspectPendingEvents || preflight.pendingEventEntries.length === 0) {
+    return [];
+  }
+  if (params.hasExecCompletion) {
+    return preflight.pendingEventEntries.filter((event) => isExecCompletionEvent(event.text));
+  }
+  if (params.hasCronEvents) {
+    return preflight.pendingEventEntries.filter(
+      (event) =>
+        (preflight.isCronEventReason || event.contextKey?.startsWith("cron:")) &&
+        isCronSystemEvent(event.text),
+    );
+  }
+  return preflight.pendingEventEntries;
+}
+
 export async function runHeartbeatOnce(opts: {
   cfg?: OpenClawConfig;
   agentId?: string;
@@ -1127,15 +1150,20 @@ export async function runHeartbeatOnce(opts: {
   const dueCommitmentIds = hasDueCommitments
     ? preflight.dueCommitments.map((commitment) => commitment.id)
     : [];
+  const inspectedSystemEventsToConsume = selectSystemEventsConsumedByHeartbeat({
+    preflight,
+    hasExecCompletion,
+    hasCronEvents,
+  });
 
   // If no tasks are due, skip heartbeat entirely
   if (prompt === null) {
     // Wake-triggered events should stay queued when the run short-circuits:
     // no reply turn ran, so there is nothing that actually consumed that wake payload.
     const shouldConsumeInspectedEvents =
       !preflight.isWakeReason && preflight.shouldInspectPendingEvents;
-    if (shouldConsumeInspectedEvents && preflight.pendingEventEntries.length > 0) {
-      consumeSystemEventEntries(sessionKey, preflight.pendingEventEntries);
+    if (shouldConsumeInspectedEvents && inspectedSystemEventsToConsume.length > 0) {
+      consumeSelectedSystemEventEntries(sessionKey, inspectedSystemEventsToConsume);
     }
     return { status: "skipped", reason: "no-tasks-due" };
   }
@@ -1240,10 +1268,10 @@ export async function runHeartbeatOnce(opts: {
   };
 
   const consumeInspectedSystemEvents = () => {
-    if (!preflight.shouldInspectPendingEvents || preflight.pendingEventEntries.length === 0) {
+    if (!preflight.shouldInspectPendingEvents || inspectedSystemEventsToConsume.length === 0) {
       return;
     }
-    consumeSystemEventEntries(sessionKey, preflight.pendingEventEntries);
+    consumeSelectedSystemEventEntries(sessionKey, inspectedSystemEventsToConsume);
   };
 
   const promptWithHeartbeatTool = appendHeartbeatResponseToolPrompt(prompt);
diff --git a/src/infra/system-events.test.ts b/src/infra/system-events.test.ts
@@ -4,6 +4,7 @@ import type { OpenClawConfig } from "../config/config.js";
 import { resolveMainSessionKey } from "../config/sessions/main-session.js";
 import { isCronSystemEvent } from "./heartbeat-events-filter.js";
 import {
+  consumeSelectedSystemEventEntries,
   consumeSystemEventEntries,
   drainSystemEventEntries,
   enqueueSystemEvent,
@@ -120,6 +121,20 @@ describe("system events (session routing)", () => {
     expect(peekSystemEvents(key)).toEqual(["second"]);
   });
 
+  it("consumes selected inspected entries and preserves unselected queued events", () => {
+    const key = "agent:main:test-consume-selected";
+    enqueueSystemEvent("first", { sessionKey: key, contextKey: "event:first" });
+    enqueueSystemEvent("second", { sessionKey: key, contextKey: "event:second" });
+    enqueueSystemEvent("third", { sessionKey: key, contextKey: "event:third" });
+    const selected = peekSystemEventEntries(key).filter((event) => event.text !== "second");
+
+    expect(consumeSelectedSystemEventEntries(key, selected).map((entry) => entry.text)).toEqual([
+      "first",
+      "third",
+    ]);
+    expect(peekSystemEvents(key)).toEqual(["second"]);
+  });
+
   it("matches consumed delivery contexts through normalized route identity", () => {
     const key = "agent:main:test-consume-route-context";
     enqueueSystemEvent("first", {
@@ -211,6 +226,32 @@ describe("system events (session routing)", () => {
     expect(peekSystemEvents(key)).toEqual([]);
   });
 
+  it("leaves exec completion events queued for the dedicated heartbeat", async () => {
+    const key = "agent:main:test-exec-completion-filter";
+    enqueueSystemEvent("Exec failed (abc12345, signal SIGTERM) :: browser auth timed out", {
+      sessionKey: key,
+      trusted: false,
+    });
+
+    const result = await drainFormattedEvents(key);
+    expect(result).toBeUndefined();
+    expect(peekSystemEvents(key)).toEqual([
+      "Exec failed (abc12345, signal SIGTERM) :: browser auth timed out",
+    ]);
+  });
+
+  it("drains generic events without consuming pending exec completions", async () => {
+    const key = "agent:main:test-exec-completion-prefix";
+    enqueueSystemEvent("Model switched to gpt-5.5", { sessionKey: key });
+    enqueueSystemEvent("Exec finished (gateway id=abc12345, code 0)", { sessionKey: key });
+    enqueueSystemEvent("Node connected", { sessionKey: key });
+
+    const result = await drainFormattedEvents(key);
+    expect(result).toContain("Model switched to gpt-5.5");
+    expect(result).toContain("Node connected");
+    expect(peekSystemEvents(key)).toEqual(["Exec finished (gateway id=abc12345, code 0)"]);
+  });
+
   it("prefixes every line of a multi-line event", async () => {
     const key = "agent:main:test-multiline";
     enqueueSystemEvent("Post-compaction context:\nline one\nline two", { sessionKey: key });
diff --git a/src/infra/system-events.ts b/src/infra/system-events.ts
@@ -149,6 +149,18 @@ function areSystemEventsEqual(left: SystemEvent, right: SystemEvent): boolean {
   );
 }
 
+function resetQueueState(key: string, entry: SessionQueue) {
+  if (entry.queue.length === 0) {
+    entry.lastText = null;
+    entry.lastContextKey = null;
+    queues.delete(key);
+    return;
+  }
+  const newest = entry.queue[entry.queue.length - 1];
+  entry.lastText = newest.text;
+  entry.lastContextKey = newest.contextKey ?? null;
+}
+
 export function consumeSystemEventEntries(
   sessionKey: string,
   consumedEntries: readonly SystemEvent[],
@@ -165,15 +177,31 @@ export function consumeSystemEventEntries(
     return [];
   }
   const removed = entry.queue.splice(0, consumedEntries.length).map(cloneSystemEvent);
-  if (entry.queue.length === 0) {
-    entry.lastText = null;
-    entry.lastContextKey = null;
-    queues.delete(key);
-  } else {
-    const newest = entry.queue[entry.queue.length - 1];
-    entry.lastText = newest.text;
-    entry.lastContextKey = newest.contextKey ?? null;
+  resetQueueState(key, entry);
+  return removed;
+}
+
+export function consumeSelectedSystemEventEntries(
+  sessionKey: string,
+  consumedEntries: readonly SystemEvent[],
+): SystemEvent[] {
+  const key = requireSessionKey(sessionKey);
+  const entry = getSessionQueue(key);
+  if (!entry || entry.queue.length === 0 || consumedEntries.length === 0) {
+    return [];
+  }
+  const removed: SystemEvent[] = [];
+  for (const consumed of consumedEntries) {
+    const index = entry.queue.findIndex((event) => areSystemEventsEqual(event, consumed));
+    if (index === -1) {
+      continue;
+    }
+    const [event] = entry.queue.splice(index, 1);
+    if (event) {
+      removed.push(cloneSystemEvent(event));
+    }
   }
+  resetQueueState(key, entry);
   return removed;
 }
 
diff --git a/src/shared/text/assistant-visible-text.test.ts b/src/shared/text/assistant-visible-text.test.ts
diff --git a/src/shared/text/assistant-visible-text.ts b/src/shared/text/assistant-visible-text.ts
