#20231: fix: strip untrusted metadata blocks from chat history
size: XS
trusted-contributor
Fixes #20221
## What changed
Extended `stripEnvelopeFromMessages()` to also strip the `Conversation info (untrusted metadata):` block that was introduced in 2026.2.17 for webchat messages.
## AI-assisted contribution
This fix was generated by an AI agent (OpenClaw cron: gh-issues-fix)
- Testing depth: validated with `pnpm build && pnpm check && pnpm test`
- The fix addresses the root cause by extending the existing message stripping logic to handle the new metadata block format.
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
This PR adds regex-based stripping of `"Conversation info (untrusted metadata):"` blocks from chat history messages. While the intent is correct, the implementation has two bugs that prevent it from working in most real-world scenarios:
- **Regex matches only the header line**: The `/m` flag on `UNTRUSTED_METADATA_PATTERN` causes `$` in the lookahead to match end-of-line, so the non-greedy `[\s\S]*?` captures zero characters. The JSON code fence block is left in the output.
- **Early-return prevents combined stripping**: In actual webchat messages, the metadata block appears *after* the envelope header (e.g. `[WebChat 2026-02-17T10:00Z] Conversation info...`). The metadata check runs first but fails because `^` doesn't match mid-line, then the envelope strip returns without ever attempting metadata removal.
- No new tests were added to cover the metadata stripping behavior.
<h3>Confidence Score: 1/5</h3>
- This PR does not achieve its stated goal — the metadata blocks will not be stripped in practice due to two regex/logic bugs.
- Both bugs were confirmed by running the regex against the actual message format produced by buildInboundUserContextPrefix. In the common case (webchat messages with envelope headers), the metadata block is never removed. In the uncommon case (metadata without envelope), only the header line is removed, leaving the JSON code block behind.
- src/shared/chat-envelope.ts requires fixes to both the regex pattern and the control flow in stripEnvelope.
<sub>Last reviewed commit: c8562a7</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
Most Similar PRs
#23271: fix(chat): strip untrusted metadata blocks from Control UI messages
by lbo728 · 2026-02-22
88.4%
#23312: fix(gateway): strip inbound metadata in chat history sanitization
by SidQin-cyber · 2026-02-22
85.4%
#20301: Security: scrub untrusted metadata from user-facing replies
by ashishc2503 · 2026-02-18
81.3%
#23073: fix(ui): strip reply directive tags from assistant messages in WebC...
by x4v13r1120 · 2026-02-22
79.3%
#23370: fix: strip [[reply_to_current]] tags from WebChat + validate invoke...
by alexmelges · 2026-02-22
79.0%
#22832: fix: strip [[reply_to_current]] directive from chat history
by willkriski · 2026-02-21
78.7%
#16733: fix(ui): avoid injected newlines when tool output is hidden
by jp117 · 2026-02-15
78.6%
#20164: fix(webchat): strip reply directive tags before rendering assistant...
by Limitless2023 · 2026-02-18
77.1%
#17244: fix: strip TTS tags from agent replies before delivery (#14652)
by robbyczgw-cla · 2026-02-15
76.6%
#15998: fix: hide metadata block when only conversation_label is present
by netmanyys · 2026-02-14
76.0%