fix(imessage): prevent echo loop from leaking internal metadata and amplifying NO_REPLY into queue overflow by joelnishanth · Pull Request #33295 · openclaw/openclaw

joelnishanth · 2026-03-03T17:05:46Z

Summary

Fixes a severe iMessage delivery bug where assistant internal metadata and control outputs were being echoed back as inbound user messages, creating recursive message amplification and queue overflow (#33281).

Outbound sanitization at channel boundary: strips thinking/reasoning tags, relevant-memories tags, model-specific separators (+#+#), and assistant role markers before iMessage delivery — internal metadata never reaches the user channel
Inbound reflection guard: detects and drops inbound messages containing assistant-internal markers, preventing reflected outbound content from re-entering the agent pipeline
Echo cache hardening: increases text TTL from 5s to 30s so delayed reflections are reliably caught
Loop rate limiter: per-conversation rapid-fire detection (5 messages/60s threshold) that suppresses amplification cascades as a safety net
Telemetry: all reflection detections and rate-limit hits produce verbose log entries with specific marker labels

Changes

File	What
`src/imessage/monitor/sanitize-outbound.ts`	New — strips `<thinking>`, `<thought>`, `<final>`, `<relevant_memories>` tags, `+#+#` separators, and `assistant to=…` role markers from outbound text
`src/imessage/monitor/reflection-guard.ts`	New — detects assistant-internal markers in inbound text and returns matched labels for telemetry
`src/imessage/monitor/loop-rate-limiter.ts`	New — per-conversation sliding-window rate limiter
`src/imessage/monitor/deliver.ts`	Applies `sanitizeOutboundText` before iMessage transport
`src/imessage/monitor/inbound-processing.ts`	Adds reflection guard check after echo cache, drops reflected content
`src/imessage/monitor/monitor-provider.ts`	Wires loop rate limiter into dispatch path
`src/imessage/monitor/echo-cache.ts`	Increases text TTL from 5s → 30s

Test plan

26 new unit tests covering sanitize-outbound, reflection-guard, and loop-rate-limiter
All 73 existing iMessage tests pass (including updated echo-cache TTL test)
Lint and format clean (pnpm check)

Risks and Mitigations

Echo cache TTL increase (5s → 30s): slightly higher memory for the text cache, but entries are scoped per conversation and cleaned up on access — negligible in practice
Reflection guard false positives: patterns are specific to assistant-internal markers (thinking tags, +#+# separators, role markers) that would not appear in normal user messages. The guard runs after is_from_me and echo cache checks, so it only fires on messages that already passed those filters
Rate limiter: threshold of 5 messages/60s per conversation is generous for normal use; only triggers during genuine amplification cascades

Closes #33281

— Joel Nishanth · offlyn.AI

Made with Cursor

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1887b199ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

greptile-apps · 2026-03-03T17:11:46Z

Greptile Summary

This PR addresses a real and well-understood iMessage echo-loop bug (#33281) by adding four complementary defences: outbound sanitization of internal metadata, an inbound reflection guard, an extended echo-cache TTL, and a per-conversation sliding-window rate limiter. The overall architecture is sound and the layered approach is a good fit for a messaging channel where timing-dependent reflections can slip past any single guard.

Verified concerns:

Overly broad reflection-guard patterns (reflection-guard.ts, lines 9–11): The FINAL_TAG_RE and THINKING_TAG_RE patterns do not require a closing >, so they will match partial tokens like <final answer> or <thought experiment> in ordinary user messages and silently drop them. The sanitizer in reasoning-tags.ts uses stricter patterns with [^<>]*> suffix for the same tags — the reflection guard should match that specificity to avoid false-positive message drops.
Rate limiter records all dispatched messages, not just anomalous traffic (monitor-provider.ts, lines 265–275): Users who send multiple legitimate messages in quick succession (common in iMessage) will be silently blocked once they exceed the 5-message / 60-second threshold, with no user feedback. The rate limiter should either be reserved for detecting already-confirmed echo/reflection patterns, or should notify the user rather than silently dropping messages.

Confidence Score: 2/5

The PR implements a real echo-loop fix with sound architecture, but two verified issues could cause user-impacting silent failures: false-positive reflection detection that drops legitimate messages, and rate limiting that silently drops normal rapid-fire messages with no feedback.
Functional fix for a real bug, but the reflection guard's broad regex patterns will false-positive on innocent user messages containing phrases like <final answer> or <thought experiment>, silently dropping them. Additionally, the rate limiter applies to all conversation traffic with a 5-message / 60-second window, meaning users sending rapid back-and-forth iMessages will be silently blocked on the 6th message with no acknowledgment. These two issues should be resolved before merge — the reflection guard patterns must be tightened to require closing brackets (matching reasoning-tags.ts), and the rate limiter should either be reserved for confirmed echo/reflection patterns or provide user feedback.
src/imessage/monitor/reflection-guard.ts (overly broad FINAL_TAG_RE / THINKING_TAG_RE patterns) and src/imessage/monitor/monitor-provider.ts (rate-limiter applies to all dispatched messages, not just anomalous traffic)

_{Last reviewed commit: 1887b19}

greptile-apps

_{11 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74a242d31f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

vincentkoc · 2026-03-06T06:12:55Z

Keeping this as the canonical PR for the metadata-leak and NO_REPLY amplification incident.

This is related to the wider echo family, but it stays separate from the self-chat and camelCase branches because the root cause here is reflected assistant-internal output re-entering inbound processing and snowballing into a flood. The sanitization and reflection-guard work belongs on this track.

From the current cluster pass, this is the cleanest merge candidate in the set.

…mplifying NO_REPLY into queue overflow - Add outbound sanitization at channel boundary (sanitize-outbound.ts): strips thinking/reasoning tags, relevant-memories tags, model-specific separators (+#+#), and assistant role markers before iMessage delivery - Add inbound reflection guard (reflection-guard.ts): detects and drops messages containing assistant-internal markers that indicate a reflected outbound message, preventing recursive echo amplification - Harden echo cache: increase text TTL from 5s to 30s to catch delayed reflections that previously expired before the echo could be detected - Add loop rate limiter (loop-rate-limiter.ts): per-conversation rapid-fire detection that suppresses conversations exceeding threshold within a time window, acting as a safety net against amplification Closes openclaw#33281

… rate limiter - Reflection guard: require closing > bracket on thinking/final/memory tag patterns to prevent false-positives on user phrases like '<final answer>' or '<thought experiment>' (openclaw#33295 review) - Rate limiter: only record echo/reflection/from-me drops instead of all dispatches, so the limiter acts as a loop-specific escalation mechanism rather than a general throttle on normal conversation velocity (openclaw#33295 review)

vincentkoc · 2026-03-06T14:03:36Z

Rebased this PR onto current main and pushed the updated branch.

What changed in this pass:

added the missing 2026.3.3 changelog entry for the iMessage echo-loop hardening work, with contributor credit
reran local verification on top of the rebased branch

Local verification completed:

pnpm check
pnpm exec vitest run src/imessage/monitor/sanitize-outbound.test.ts src/imessage/monitor/reflection-guard.test.ts src/imessage/monitor/loop-rate-limiter.test.ts src/imessage/monitor/monitor-provider.echo-cache.test.ts src/imessage/monitor/inbound-processing.test.ts

The earlier automated review concerns are already addressed in the branch, so the remaining step is just letting GitHub CI re-run on the rebased head.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acb3b21458

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

vincentkoc · 2026-03-07T00:16:25Z

Follow-up pushed for the two remaining review points:

Restored the short text fallback TTL in src/imessage/monitor/echo-cache.ts and kept the longer message-id TTL as the delayed-reflection backstop.
Updated src/imessage/monitor/reflection-guard.ts to ignore reflection markers that only appear inside inline or fenced code, with regression coverage for both cases.

Local verification:

pnpm exec vitest run src/imessage/monitor/monitor-provider.echo-cache.test.ts src/imessage/monitor/reflection-guard.test.ts src/imessage/monitor/sanitize-outbound.test.ts src/imessage/monitor/loop-rate-limiter.test.ts src/imessage/monitor/inbound-processing.test.ts
pnpm check

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e89e1c34b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-07T00:25:24Z

+ */
+const INTERNAL_SEPARATOR_RE = /(?:#\+){2,}#?/g;
+const ASSISTANT_ROLE_MARKER_RE = /\bassistant\s+to\s*=\s*\w+/gi;
+const ROLE_TURN_MARKER_RE = /\b(?:user|system|assistant)\s*:\s*$/gm;


Limit role-turn stripping to trailing scaffold artifacts

The global ROLE_TURN_MARKER_RE cleanup removes any line that ends with user:, system:, or assistant:, which means legitimate outbound content (for example YAML/chat-transcript snippets, including code-fenced examples) is silently deleted before sending. This introduces user-visible content corruption in normal iMessage conversations; the stripping should be constrained to actual leaked trailer scaffolding (or skip code regions) instead of applying to every line.

Useful? React with 👍 / 👎.

…mplifying NO_REPLY into queue overflow (openclaw#33295) * fix(imessage): prevent echo loop from leaking internal metadata and amplifying NO_REPLY into queue overflow - Add outbound sanitization at channel boundary (sanitize-outbound.ts): strips thinking/reasoning tags, relevant-memories tags, model-specific separators (+#+#), and assistant role markers before iMessage delivery - Add inbound reflection guard (reflection-guard.ts): detects and drops messages containing assistant-internal markers that indicate a reflected outbound message, preventing recursive echo amplification - Harden echo cache: increase text TTL from 5s to 30s to catch delayed reflections that previously expired before the echo could be detected - Add loop rate limiter (loop-rate-limiter.ts): per-conversation rapid-fire detection that suppresses conversations exceeding threshold within a time window, acting as a safety net against amplification Closes openclaw#33281 * fix(imessage): address review — stricter reflection regex, loop-aware rate limiter - Reflection guard: require closing > bracket on thinking/final/memory tag patterns to prevent false-positives on user phrases like '<final answer>' or '<thought experiment>' (openclaw#33295 review) - Rate limiter: only record echo/reflection/from-me drops instead of all dispatches, so the limiter acts as a loop-specific escalation mechanism rather than a general throttle on normal conversation velocity (openclaw#33295 review) * Changelog: add iMessage echo-loop hardening entry * iMessage: restore short echo-text TTL * iMessage: ignore reflection markers in code --------- Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

…mplifying NO_REPLY into queue overflow (openclaw#33295) * fix(imessage): prevent echo loop from leaking internal metadata and amplifying NO_REPLY into queue overflow - Add outbound sanitization at channel boundary (sanitize-outbound.ts): strips thinking/reasoning tags, relevant-memories tags, model-specific separators (+#+#), and assistant role markers before iMessage delivery - Add inbound reflection guard (reflection-guard.ts): detects and drops messages containing assistant-internal markers that indicate a reflected outbound message, preventing recursive echo amplification - Harden echo cache: increase text TTL from 5s to 30s to catch delayed reflections that previously expired before the echo could be detected - Add loop rate limiter (loop-rate-limiter.ts): per-conversation rapid-fire detection that suppresses conversations exceeding threshold within a time window, acting as a safety net against amplification Closes openclaw#33281 * fix(imessage): address review — stricter reflection regex, loop-aware rate limiter - Reflection guard: require closing > bracket on thinking/final/memory tag patterns to prevent false-positives on user phrases like '<final answer>' or '<thought experiment>' (openclaw#33295 review) - Rate limiter: only record echo/reflection/from-me drops instead of all dispatches, so the limiter acts as a loop-specific escalation mechanism rather than a general throttle on normal conversation velocity (openclaw#33295 review) * Changelog: add iMessage echo-loop hardening entry * iMessage: restore short echo-text TTL * iMessage: ignore reflection markers in code --------- Co-authored-by: Vincent Koc <vincentkoc@ieee.org> (cherry picked from commit adb9234)

…mplifying NO_REPLY into queue overflow (openclaw#33295) * fix(imessage): prevent echo loop from leaking internal metadata and amplifying NO_REPLY into queue overflow - Add outbound sanitization at channel boundary (sanitize-outbound.ts): strips thinking/reasoning tags, relevant-memories tags, model-specific separators (+#+#), and assistant role markers before iMessage delivery - Add inbound reflection guard (reflection-guard.ts): detects and drops messages containing assistant-internal markers that indicate a reflected outbound message, preventing recursive echo amplification - Harden echo cache: increase text TTL from 5s to 30s to catch delayed reflections that previously expired before the echo could be detected - Add loop rate limiter (loop-rate-limiter.ts): per-conversation rapid-fire detection that suppresses conversations exceeding threshold within a time window, acting as a safety net against amplification Closes openclaw#33281 * fix(imessage): address review — stricter reflection regex, loop-aware rate limiter - Reflection guard: require closing > bracket on thinking/final/memory tag patterns to prevent false-positives on user phrases like '<final answer>' or '<thought experiment>' (openclaw#33295 review) - Rate limiter: only record echo/reflection/from-me drops instead of all dispatches, so the limiter acts as a loop-specific escalation mechanism rather than a general throttle on normal conversation velocity (openclaw#33295 review) * Changelog: add iMessage echo-loop hardening entry * iMessage: restore short echo-text TTL * iMessage: ignore reflection markers in code --------- Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

openclaw-barnacle Bot added channel: imessage Channel integration: imessage size: M labels Mar 3, 2026

chatgpt-codex-connector Bot reviewed Mar 3, 2026

View reviewed changes

Comment thread src/imessage/monitor/monitor-provider.ts Outdated

Comment thread src/imessage/monitor/reflection-guard.ts Outdated

greptile-apps Bot reviewed Mar 3, 2026

View reviewed changes

Comment thread src/imessage/monitor/reflection-guard.ts Outdated

Comment thread src/imessage/monitor/monitor-provider.ts Outdated

chatgpt-codex-connector Bot reviewed Mar 3, 2026

View reviewed changes

Comment thread src/imessage/monitor/sanitize-outbound.ts

Comment thread src/imessage/monitor/monitor-provider.ts

vincentkoc self-assigned this Mar 6, 2026

joelnishanth and others added 3 commits March 6, 2026 08:59

Changelog: add iMessage echo-loop hardening entry

acb3b21

vincentkoc force-pushed the fix/imessage-echo-loop-overflow branch from 74a242d to acb3b21 Compare March 6, 2026 14:03

chatgpt-codex-connector Bot reviewed Mar 6, 2026

View reviewed changes

Comment thread src/imessage/monitor/echo-cache.ts

Comment thread src/imessage/monitor/reflection-guard.ts Outdated

vincentkoc added 2 commits March 6, 2026 19:15

iMessage: restore short echo-text TTL

380d83b

iMessage: ignore reflection markers in code

6be804f

Merge branch 'main' into fix/imessage-echo-loop-overflow

e89e1c3

vincentkoc merged commit adb9234 into openclaw:main Mar 7, 2026
5 checks passed

chatgpt-codex-connector Bot reviewed Mar 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Mar 7, 2026

📡 Upstream Digest — 2026-03-07 01:15 UTC curtismercier/openclaw-mods#196

Open

alexyyyander mentioned this pull request Mar 7, 2026

fix/gateway token mismatch 38617 #38676

Closed

p3nchan mentioned this pull request Mar 9, 2026

Discord: ThreadStarterBody re-injected on every turn (echo contamination) #41355

Closed

powermaster888 mentioned this pull request Mar 9, 2026

fix(discord): guard ThreadStarterBody to first turn only #41430

Closed

2 tasks

Orionation mentioned this pull request Apr 3, 2026

iMessage DM echo: corrupted prefix breaks text-based dedup (v2026.3.31+) #59973

Closed

clawsweeper Bot mentioned this pull request Apr 29, 2026

fix(imessage): normalize leading echo-cache corruption bytes #73985

Closed

Uh oh!

Conversation

joelnishanth commented Mar 3, 2026

Summary

Changes

Test plan

Risks and Mitigations

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Mar 3, 2026

Greptile Summary

Confidence Score: 2/5

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

vincentkoc commented Mar 6, 2026

Uh oh!

vincentkoc commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

vincentkoc commented Mar 7, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants