This PR restores the visible WebChat reply for Codex same-session message(action="send") calls by carrying the sanitized tool-result text into the Codex telemetry/rendering path. The safety boundary is that WebChat displays the sanitized result detail, not the raw tool arguments that may include markdown or same-session routing internals.

Summary

This is the option-2 alternative for #81109, alongside #81110. It keeps the Codex message tool path available for WebChat so the model can deliberately send the visible reply after a tool-heavy turn, but now renders only the sanitized same-session message text. That preserves the personality-restoring message tool behavior without leaking raw reasoning-tag content from original tool arguments.

• Problem: same-session WebChat message(action="send") calls could be treated as external delivery or suppressed, and the first renderer version could have reused raw telemetry text.
• Why it matters: the message tool is the mechanism that lets Codex recover a warm, user-facing reply after tool execution instead of ending with a sterile final answer or Sent..
• What changed: same-session WebChat sends return status: "ok", keep semantic deliveryStatus: "sent", feed sanitized result text into Codex telemetry, and render that text through source-suppression-safe reply payloads.
• What did NOT change (scope boundary): no duplicate Codex-native workspace tools, no Codex app-server filtering change, and no external channel delivery behavior change.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Related Codex harness default can suppress direct WebChat final replies #81109
• Alternative to fix: keep codex webchat replies automatic #81110
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

• Behavior or issue addressed: WebChat turns configured for message_tool_only can use the message tool for the visible reply without routing through an external channel, without being suppressed by final source-reply suppression, and without rendering unsanitized reasoning-tag text.
• Real environment tested: local OpenClaw checkout at /Volumes/LEXAR/repos/openclaw-webchat-message-renderer, branch fix/webchat-message-tool-renderer, latest patch 45e0d6de92a, using real source modules and focused Vitest coverage. This is not a full browser WebChat E2E run.
• Exact steps or command run after this patch:

OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test src/agents/tools/message-tool.test.ts extensions/codex/src/app-server/dynamic-tools.test.ts src/agents/pi-embedded-runner/run/payloads.test.ts src/agents/pi-embedded-runner/run/tool-media-payloads.test.ts
pnpm exec oxfmt --check --threads=1 src/agents/tools/message-tool.ts src/agents/tools/message-tool.test.ts extensions/codex/src/app-server/dynamic-tools.ts extensions/codex/src/app-server/dynamic-tools.test.ts
git diff --check

• Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output):

[test] passed 3 Vitest shards in 9.61s
Test Files  2 passed (2), 1 passed (1), 1 passed (1)
Tests  29 passed (29), 50 passed (50), 25 passed (25)

oxfmt: All matched files use the correct format.
git diff --check: passed

Focused regressions now assert:

same-session WebChat result.details.message === "Actual visible reply after tools."
Codex bridge telemetry.messagingToolSentTexts === ["Visible reply from Codex."]
Codex bridge telemetry target text === "Visible reply from Codex."

• Observed result after fix: same-session WebChat message sends are bridge-successful (status: "ok", deliveryStatus: "sent"), the renderer receives source-suppression-safe payload metadata, and Codex telemetry prefers sanitized tool-result details over raw original args.
• What was not tested: full browser WebChat DOM rendering and broad repo type/lint. Those should remain GitHub CI/Testbox work per local-resource policy.
• Before evidence (optional but encouraged): ClawSweeper identified that raw attempt.messagingToolSentTexts could render <think>hidden</think>Visible reply even though createMessageTool sanitized its copied params. The new test locks the sanitized result path.

Root Cause (if applicable)

• Root cause: the first renderer consumed Codex bridge messaging telemetry collected from original tool args, while createMessageTool strips reasoning tags on a copied params object before returning same-session result details.
• Missing detection / guardrail: coverage proved the WebChat message-tool payload existed, but did not assert reasoning-tag sanitization at the Codex bridge telemetry boundary.
• Contributing context (if known): WebChat same-session delivery is intentionally not an outbound channel send, so the safe display text must come from the sanitized tool result, not raw transport args.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/agents/tools/message-tool.test.ts, extensions/codex/src/app-server/dynamic-tools.test.ts
• Scenario the test should lock in: same-session WebChat message sends sanitize reasoning tags before display, and Codex dynamic bridge telemetry records sanitized result text.
• Why this is the smallest reliable guardrail: it covers both the source sanitizer and the bridge telemetry seam without requiring a browser WebChat E2E.
• Existing test that already covers this (if any): none before the sanitizer follow-up.
• If no new test is added, why not: N/A, new regressions are included.

User-visible / Behavior Changes

WebChat users can receive a real visible assistant reply from the message tool path in message_tool_only mode. The rendered text is sanitized and can pass through source-reply suppression intentionally.

Diagram (if applicable)

flowchart LR
  call["message(action=send)"] --> sanitize["Message tool sanitizes visible text"]
  sanitize --> result["Tool result detail text"]
  result --> telemetry["Codex dynamic-tool telemetry"]
  telemetry --> payload["Embedded-run payload"]
  payload --> webchat["WebChat visible reply"]
  raw["Raw original args"] -. "not used for visible text" .-> telemetry

Before:
[Codex calls message tool] -> [message tool sanitizes copied params]
  -> [Codex telemetry stores raw original args]
  -> [WebChat renderer could display raw telemetry]

After:
[Codex calls message tool] -> [message tool returns sanitized same-session result]
  -> [Codex telemetry prefers sanitized result.details.message]
  -> [WebChat renderer displays sanitized visible reply]

Security Impact (required)

• New permissions/capabilities? (Yes/No): No
• Secrets/tokens handling changed? (Yes/No): No
• New/changed network calls? (Yes/No): No
• Command/tool execution surface changed? (Yes/No): No
• Data access scope changed? (Yes/No): No
• If any Yes, explain risk + mitigation: N/A. The security-sensitive review finding was about reasoning-tag text disclosure; the patch mitigates it by rendering sanitized result text.

Repro + Verification

Environment

• OS: macOS local development host
• Runtime/container: local Lexar-backed OpenClaw checkout
• Model/provider: not model-provider dependent
• Integration/channel (if any): WebChat same-session message tool path and Codex dynamic bridge
• Relevant config (redacted): sourceReplyDeliveryMode: "message_tool_only", current channel webchat

Steps

1. Run the focused message tool and Codex bridge tests.
2. Verify same-session result details contain sanitized message text.
3. Verify bridge telemetry records sanitized result text and classifies status: "ok" as success.

Expected

• Same-session WebChat message send returns success semantics.
• Renderable telemetry contains sanitized visible text only.
• Source-suppression payload metadata survives.

Actual

• Focused tests passed, 104 total checks across 3 Vitest shards.
• Formatter and whitespace checks passed.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios: same-session WebChat message result, Codex bridge success classification, sanitized telemetry, payload metadata preservation.
• Edge cases checked: reasoning-tag message args, status: "ok" plus deliveryStatus: "sent", external sends remain outside this same-session path.
• What you did not verify: browser DOM rendering and full GitHub CI matrix.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

ClawSweeper P2 addressed by 45e0d6de92a: render sanitized WebChat message-tool text.

Compatibility / Migration

• Backward compatible? (Yes/No): Yes
• Config/env changes? (Yes/No): No
• Migration needed? (Yes/No): No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: maintainers may prefer fix: keep codex webchat replies automatic #81110's automatic-delivery product shape instead of this message-tool renderer.
  • Mitigation: this remains explicitly framed as the option-2 alternative, with fix: keep codex webchat replies automatic #81110 available as the narrower automatic-delivery path.