fix(browser): neutralize media directives in browser output [AI] by pgondhi987 · Pull Request #91422 · openclaw/openclaw

pgondhi987 · 2026-06-08T12:58:08Z

Summary

Neutralizes line-start MEDIA: directives before browser-originated snapshot and tabs text is returned to agents.
Applies the same defanging to direct AI snapshot text and browser JSON string fields while preserving structured details for callers.
Adds focused browser tool regression coverage for AI snapshots, ARIA snapshots, and tabs output.
AI-assisted change.

Linked context

Maintainer-requested browser tool hardening.

Real behavior proof (required for external PRs)

Behavior addressed: Browser-controlled text returned by the browser tool can no longer surface line-start MEDIA: directives unchanged in model-facing output.
Real environment tested: Local OpenClaw source checkout with an isolated dev Gateway, managed Playwright Chromium, and a loopback HTTP page exercising the browser tool's live ARIA snapshot path.
Exact steps or command run after this patch: pnpm exec playwright install chromium; pnpm exec playwright install-deps chromium; pnpm openclaw --dev config set browser.noSandbox true; pnpm openclaw --dev config set browser.headless true; pnpm openclaw --dev config set browser.ssrfPolicy.allowedHostnames '["127.0.0.1"]'; pnpm openclaw --dev gateway run --dev --force --auth none --bind loopback --ws-log compact; python3 -m http.server 8765 --bind 127.0.0.1 --directory /tmp/openclaw-browser-proof; OPENCLAW_CONFIG_PATH=/home/ubuntu/.openclaw-dev/openclaw.json pnpm tsx /tmp/openclaw-browser-proof/proof.ts; node scripts/run-vitest.mjs extensions/browser/src/browser-tool.test.ts.
Evidence after fix: The live browser proof opened http://127.0.0.1:8765/ through createBrowserTool, captured an ARIA snapshot from page-controlled text containing a newline followed by MEDIA:/tmp/openclaw-proof.png, and returned ariaWrapped: true, ariaHasNeutralizedDirective: true, ariaHasRawEscapedDirective: false, ariaDetailsKind: "snapshot", and ariaNodeCount: 21. The focused browser tool test shard also passed with 69 tests.
Observed result after fix: Browser snapshot output is wrapped as external content with the page-controlled line-start media directive neutralized before model-facing delivery; structured snapshot details remain available for callers.
What was not tested: Manual channel rendering was not exercised; the live proof targets the browser agent-tool output boundary changed by this PR.
Proof limitations or environment constraints: Runtime proof used a local loopback page and a dev browser profile with loopback explicitly allowlisted.
Before evidence (optional but encouraged): Existing tests covered external wrapping and screenshot vision defanging, but not these browser action output paths.

Tests and validation

node scripts/run-vitest.mjs extensions/browser/src/browser-tool.test.ts
Live browser runtime proof through createBrowserTool against a loopback page with page-controlled newline MEDIA: content.

Regression coverage was added for AI snapshot text, ARIA snapshot JSON string fields, and tabs JSON string fields.

Risk checklist

Did user-visible behavior change? (Yes/No): Yes, browser tool text output now prefixes line-start MEDIA: directives from page-controlled content with [neutralized].
Did config, environment, or migration behavior change? (Yes/No): No.
Did security, auth, secrets, network, or tool execution behavior change? (Yes/No): Yes, this changes browser tool output sanitization only.
What is the highest-risk area? Browser tool consumers that inspect exact returned text.
How is that risk mitigated? Structured details are preserved unchanged, and the text-only change matches the existing screenshot vision sanitization behavior.

Current review state

What is the next action? Await GitHub Actions and reviewer confirmation of the added live browser proof.
What is still waiting on author, maintainer, CI, or external proof? GitHub Actions and maintainer review.
Which bot or reviewer comments were addressed? Added live browser runtime proof requested by the automated review.

clawsweeper · 2026-06-08T13:05:06Z

Codex review: needs changes before merge. Reviewed June 8, 2026, 9:37 AM ET / 13:37 UTC.

Summary
The PR imports the browser media-directive neutralizer into browser tool actions, applies it to AI snapshot text and string values before wrapped browser JSON output, and adds regression tests for ARIA snapshots, AI snapshots, and tabs output.

PR surface: Source +6, Tests +61. Total +67 across 2 files.

Reproducibility: yes. from source inspection: act:evaluate route handlers can return page-controlled strings in result, and the tool action path still serializes those results with raw jsonResult. I did not run a live reproduction because this review was required to keep the checkout read-only.

Review metrics: 1 noteworthy metric.

Browser JSON output coverage: 3 covered, 1 still raw. Snapshots, tabs, and console use the new browser JSON wrapper, but act:evaluate can still return page-controlled strings through jsonResult.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🐚 platinum hermit
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Neutralize normal and retry act JSON result text while preserving raw structured details.
[P2] Add focused browser-tool regression coverage for an act:evaluate result string containing newline MEDIA:/tmp/secret.png.

Risk before merge

[P1] The claimed browser-output hardening remains incomplete: maintainers could merge it thinking browser-controlled JSON string fields are covered while act:evaluate still returns page-controlled strings through raw jsonResult text.

Maintainer options:

Decide the mitigation before merge
Route every browser-originated JSON text result covered by the browser tool boundary, including act normal and retry results, through one neutralizing wrapper while preserving structured details unchanged.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P2] There is a narrow mechanical repair: use the same browser neutralizing text wrapper for executeActAction JSON results and add one focused regression test.

Security
Needs attention: The diff uses the existing sanitizer, but leaves a concrete browser-output security gap for page-returned act:evaluate strings.

Review findings

[P1] Route act results through the browser neutralizer — extensions/browser/src/browser-tool.actions.ts:208-213

Review details

Best possible solution:

Route every browser-originated JSON text result covered by the browser tool boundary, including act normal and retry results, through one neutralizing wrapper while preserving structured details unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: act:evaluate route handlers can return page-controlled strings in result, and the tool action path still serializes those results with raw jsonResult. I did not run a live reproduction because this review was required to keep the checkout read-only.

Is this the best way to solve the issue?

No as written: the patch is an acceptable partial mitigation for snapshot/tabs/console text, but the best fix is to make the browser output neutralization boundary cover act JSON results too. The structured details can still preserve raw values for callers.

Full review comments:

[P1] Route act results through the browser neutralizer — extensions/browser/src/browser-tool.actions.ts:208-213
wrapBrowserExternalJson now neutralizes browser JSON strings, but the act path still returns jsonResult(result) for both normal and retry results. The /act route can put page-controlled evaluate output in result, so () => document.body.innerText on a page containing a line-start MEDIA:/tmp/secret.png still reaches the agent as raw JSON text. Please reuse the browser neutralizing wrapper for act results while preserving structured details.
Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9a82b60024b5.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The updated PR body includes live dev Gateway and managed Chromium loopback proof showing an ARIA snapshot with page-controlled line-start MEDIA: text was neutralized after the patch.
add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The updated PR body includes live dev Gateway and managed Chromium loopback proof showing an ARIA snapshot with page-controlled line-start MEDIA: text was neutralized after the patch.
remove status: 📣 needs proof: Current PR status label is status: ⏳ waiting on author.

Label justifications:

P2: This is a normal-priority browser plugin security hardening PR with a concrete merge blocker but no evidence of a release-wide outage, data loss, or crash loop.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🐚 platinum hermit and patch quality is 🧂 unranked krab.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The updated PR body includes live dev Gateway and managed Chromium loopback proof showing an ARIA snapshot with page-controlled line-start MEDIA: text was neutralized after the patch.
proof: sufficient: Contributor real behavior proof is sufficient. The updated PR body includes live dev Gateway and managed Chromium loopback proof showing an ARIA snapshot with page-controlled line-start MEDIA: text was neutralized after the patch.

Evidence reviewed

PR surface:

Source +6, Tests +61. Total +67 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	8	2	+6
Tests	1	61	0	+61
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	69	2	+67

Security concerns:

[medium] act:evaluate output can still carry raw MEDIA directives — extensions/browser/src/browser-tool.actions.ts:598
Browser action results still go through jsonResult, while the route can return page-controlled evaluate strings in result; this leaves a model-facing browser output path outside the new media-directive neutralizer.
Confidence: 0.84

Acceptance criteria:

[P1] node scripts/run-vitest.mjs extensions/browser/src/browser-tool.test.ts.
[P1] git diff --check.

What I checked:

Proposed sanitizer coverage: The PR changes wrapBrowserExternalJson to neutralize string values before JSON stringification and changes direct AI snapshot text to call neutralizeMediaDirectives before wrapping. (extensions/browser/src/browser-tool.actions.ts:208, 734eca7359b0)
Regression coverage added: The PR adds focused tests for ARIA snapshot, AI snapshot, and tabs output containing line-start MEDIA: text while preserving raw structured details for tabs. (extensions/browser/src/browser-tool.test.ts:1621, 734eca7359b0)
Remaining unneutralized browser JSON path: After the proposed patch, executeActAction still returns normal and retry action results with jsonResult, not the browser neutralizing JSON wrapper. (extensions/browser/src/browser-tool.actions.ts:598, 734eca7359b0)
Page-controlled evaluate result source: The browser /act route places both existing-session and managed-browser evaluate results in a JSON result field returned to the tool caller. (extensions/browser/src/browser/routes/agent.act.ts:641, 9a82b60024b5)
Raw JSON result contract: jsonResult stringifies payloads directly into model-facing text and keeps the original payload as details, so it does not apply browser-specific media directive neutralization. (src/agents/tools/common.ts:417, 9a82b60024b5)
Real behavior proof update: The PR body/comment reports a live dev Gateway plus managed Chromium loopback proof where an ARIA snapshot containing newline MEDIA:/tmp/openclaw-proof.png returned ariaHasNeutralizedDirective: true and ariaHasRawEscapedDirective: false, plus the focused browser tool shard passed. (734eca7359b0)

Likely related people:

vincentkoc: Authored the current split-out browser action formatting file and the existing neutralizeMediaDirectives helper now reused by this PR. (role: recent area contributor; confidence: high; commits: 2b43315933d4, 2e08f0f4221f; files: extensions/browser/src/browser-tool.actions.ts, extensions/browser/src/browser/vision.ts, extensions/browser/src/browser-tool.test.ts)
steipete: Authored the browser plugin runtime/test extraction and several browser tool refactors that precede the current browser action boundary. (role: feature-history owner; confidence: medium; commits: 197510f69302, 9a7ceceffaa8, 4dbe8f9f665c; files: extensions/browser/src/browser-tool.ts, extensions/browser/src/browser-tool.test.ts)
pgondhi987: Besides authoring this PR, this contributor has prior merged browser route hardening work in the same plugin area. (role: recent adjacent contributor; confidence: medium; commits: b75ad800a590; files: extensions/browser/src/browser/routes/agent.act.ts, extensions/browser/src/browser/pw-tools-core.interactions.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

pgondhi987 · 2026-06-08T13:29:31Z

Updated the PR body with live browser runtime proof.

Proof exercised createBrowserTool against a loopback page through the dev Gateway and managed Chromium. The page-controlled ARIA snapshot content included a newline followed by MEDIA:/tmp/openclaw-proof.png; the observed result was ariaWrapped: true, ariaHasNeutralizedDirective: true, ariaHasRawEscapedDirective: false, ariaDetailsKind: "snapshot", and ariaNodeCount: 21.

Focused validation still passes: node scripts/run-vitest.mjs extensions/browser/src/browser-tool.test.ts.

@clawsweeper review

clawsweeper · 2026-06-08T13:29:34Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27141088715
Updated: 2026-06-08T13:38:35.562Z

pgondhi987 · 2026-06-08T13:37:50Z

Verification update for head 734eca7359b0fa385d3493a7bed7ba62eee76b6c:

Security gate dry-run: PASS, scope HARDEN, fix verdict SOLVES, backward compatibility PASS.
Security gate real run: PASS, scope HARDEN, fix verdict SOLVES, backward compatibility PASS, actionable automated-review comments 0.
Review-pr: PASS in review-only mode with artifacts under the canonical .worktrees/pr-91422 location; recommendation ready with 0 findings.
Autoreview: PASS via timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main; clean result, no accepted/actionable findings.
Local validation: PASS via node scripts/run-vitest.mjs extensions/browser/src/browser-tool.test.ts with 69 tests.
Real behavior proof: PASS through createBrowserTool against a loopback page in an isolated dev Gateway + managed Chromium run. The ARIA snapshot output had ariaWrapped: true, ariaHasNeutralizedDirective: true, ariaHasRawEscapedDirective: false, ariaDetailsKind: "snapshot", and ariaNodeCount: 21.

CI note: the PR CI rerun still fails in unchanged src/commands/agent-via-gateway.test.ts SIGTERM/local-agent assertions. This PR diff is limited to extensions/browser/src/browser-tool.actions.ts and extensions/browser/src/browser-tool.test.ts, so I treated that shard as unrelated to this browser output hardening change. Routine cancelled automation/proof checks were ignored.

No config, environment, migration, auth, provider, plugin contract, storage, or channel-delivery behavior changed. Structured browser details are preserved; the intentional behavior change is limited to model-visible browser text that contains line-start MEDIA: directives.

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix: neutralize browser media directives

734eca7

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Jun 8, 2026

Merge remote-tracking branch 'origin/main' into fix/fix-724

68e8d41

pgondhi987 merged commit 53357e8 into openclaw:main Jun 8, 2026

github-actions Bot mentioned this pull request Jun 8, 2026

📡 Upstream Digest — 2026-06-08 17:25 UTC curtismercier/openclaw-mods#1039

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 9, 2026

fix: neutralize browser media directives (openclaw#91422)

ec7b1a8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(browser): neutralize media directives in browser output [AI]#91422

fix(browser): neutralize media directives in browser output [AI]#91422
pgondhi987 merged 2 commits into
openclaw:mainfrom
pgondhi987:fix/fix-724

pgondhi987 commented Jun 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pgondhi987 commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pgondhi987 commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading