Skip to content

fix(gateway): hide assistant NO_REPLY token in chat.history#27668

Closed
theotarr wants to merge 3 commits intoopenclaw:mainfrom
theotarr:fix/issue-27238
Closed

fix(gateway): hide assistant NO_REPLY token in chat.history#27668
theotarr wants to merge 3 commits intoopenclaw:mainfrom
theotarr:fix/issue-27238

Conversation

@theotarr
Copy link
Contributor

@theotarr theotarr commented Feb 26, 2026

Summary

  • sanitize chat.history assistant text fields to strip silent-token-only NO_REPLY content
  • apply the same filtering to string, text, and text content-block forms after directive stripping
  • add gateway history coverage to ensure assistant NO_REPLY is hidden while user NO_REPLY remains unchanged

Testing

  • pnpm vitest run --config vitest.gateway.config.ts src/gateway/server.chat.gateway-server-chat-b.test.ts src/gateway/server-chat.agent-events.test.ts
  • pnpm vitest run --config vitest.gateway.config.ts src/gateway/server.chat.gateway-server-chat.test.ts

Fixes #27238

@openclaw-barnacle openclaw-barnacle bot added app: web-ui App: web-ui gateway Gateway runtime size: S labels Feb 26, 2026
@greptile-apps
Copy link
Contributor

greptile-apps bot commented Feb 26, 2026

Greptile Summary

Sanitized assistant NO_REPLY silent tokens from chat history responses to hide internal control messages from users.

  • Added sanitizeSilentReplyTextForHistory function that detects and strips NO_REPLY tokens exclusively from assistant messages
  • Applied filtering consistently across three message formats: string content, text fields, and content block arrays
  • Sanitization occurs after directive stripping and truncation in the chat history pipeline
  • User messages containing "NO_REPLY" are explicitly preserved unchanged
  • Added comprehensive test coverage verifying all three message formats and role-based filtering

Confidence Score: 5/5

  • This PR is safe to merge with minimal risk
  • The implementation is straightforward, well-structured, and follows existing codebase patterns. The logic correctly differentiates between assistant and user messages, handles all content formats, and includes thorough test coverage with multiple edge cases (whitespace variations, different content structures). The regex patterns in isSilentReplyText are properly designed to avoid false positives. The sanitization order (directive stripping → truncation → silent token removal) is logical and preserves data integrity.
  • No files require special attention

Last reviewed commit: e223ad2

@theotarr
Copy link
Contributor Author

Investigated the Windows shard failure and pushed a narrow fix to this PR branch.\n\nRoot cause: mutates ; on CI this can race under concurrent test execution and occasionally make undiscoverable in .\n\nFix: run this test suite sequentially () so env-mutating plugin-loader tests do not interleave.\n\nCommit: 9554dfd\n\nCould you re-run the failed Windows checks?

@theotarr
Copy link
Contributor Author

Correction with full details:\n\nInvestigated the Windows shard failure and pushed a narrow fix to this PR branch.\n\nRoot cause: src/plugins/loader.test.ts mutates OPENCLAW_BUNDLED_PLUGINS_DIR; on CI this can race under concurrent test execution and occasionally make memory-core undiscoverable in preserves package.json metadata for bundled memory plugins.\n\nFix: run this test suite sequentially (describe.sequential) so env-mutating plugin-loader tests do not interleave.\n\nCommit: 9554dfd\n\nPlease re-run the failed Windows checks.

@steipete
Copy link
Contributor

steipete commented Mar 3, 2026

Thanks for the PR! Multiple PRs address issue #27238. Keeping #27258 as the earliest submission. Closing to reduce noise. This is an AI-assisted triage review. If we got this wrong, feel free to reopen — happy to revisit.

@steipete steipete closed this Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app: web-ui App: web-ui gateway Gateway runtime size: S

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: NO_REPLY tokens leak in chat history endpoint (PR #16286 incomplete fix)

2 participants