fix: strip repeated internal metadata leaks

Author: waydelyle

README.md

@@ -407,6 +407,15 @@ Operational docs: https://swarmclaw.ai/docs/observability
 
 ## Releases
 
+### v1.9.19 Highlights
+
+Output hygiene release: final assistant responses now use the shared internal metadata scrubber before persistence, UI reset, connector delivery, and completion hooks.
+
+- **Multi-block scrubbing.** Repeated internal metadata payloads are stripped in one pass instead of stopping after the first block.
+- **Malformed prelude cleanup.** When a validated internal block is followed by a malformed internal fragment, the leftover prelude is removed before user-facing text is delivered.
+- **Shared finalizer path.** Post-stream finalization now uses the same metadata scrubber as the chat UI, keeping stored, streamed, and connector-visible output aligned.
+- **Regression coverage.** Tests cover repeated classifier-shape blocks, malformed follow-on fragments, and false-positive protection for malformed text without a prior validated strip.
+
 ### v1.9.18 Highlights
 
 Schedule preflight release: schedules now show server-backed timing forecasts before save, with timezone-aware cron previews and warnings for risky drafts.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "1.9.18",
+  "version": "1.9.19",
   "description": "Build and run autonomous AI agents with OpenClaw, Hermes, multiple model providers, orchestration, delegation, memory, skills, schedules, and chat connectors.",
   "main": "electron-dist/main.js",
   "license": "MIT",

package.json

@@ -33,6 +33,28 @@ describe('stripLeakedClassificationJson', () => {
     assert.equal(cleaned.includes('taskIntent'), false)
   })
 
+  it('strips multiple leaked classification JSON blocks', () => {
+    const input = `${VALID_LEAK}\n${VALID_LEAK}\nTask created and delegated.`
+    const { cleaned, stripped } = stripLeakedClassificationJson(input)
+    assert.equal(stripped, true)
+    assert.equal(cleaned, 'Task created and delegated.')
+  })
+
+  it('strips a malformed internal prelude after a validated leaked block', () => {
+    const malformedPrelude = [
+      '{',
+      '  "taskIntent": "research",',
+      '  "isBroadGoal":{',
+      '  false,',
+      '  "isLightweightDirectChat": false,',
+      '}',
+    ].join('\n')
+    const input = `${VALID_LEAK}\n${malformedPrelude}\nAll five research bundles reviewed.`
+    const { cleaned, stripped } = stripLeakedClassificationJson(input)
+    assert.equal(stripped, true)
+    assert.equal(cleaned, 'All five research bundles reviewed.')
+  })
+
   it('leaves normal assistant text untouched', () => {
     const input = 'Your favorite color is blue.'
     const { cleaned, stripped } = stripLeakedClassificationJson(input)

src/lib/server/chat-execution/post-stream-finalization.test.ts

@@ -8,6 +8,7 @@
 import type { KnowledgeRetrievalTrace, Session, UsageRecord } from '@/types'
 import { log } from '@/lib/server/logger'
 import type { ChatTurnState } from '@/lib/server/chat-execution/chat-turn-state'
+import { stripAllInternalMetadata } from '@/lib/strip-internal-metadata'
 
 const TAG = 'post-stream'
 import { extractSuggestions } from '@/lib/server/suggestions'
@@ -20,56 +21,16 @@ import {
   shouldForceExternalServiceSummary,
 } from '@/lib/server/chat-execution/chat-streaming-utils'
 import {
-  MessageClassificationSchema,
   type MessageClassification,
 } from '@/lib/server/chat-execution/message-classifier'
 import {
   resolveFinalStreamResponseText,
 } from '@/lib/server/chat-execution/stream-continuation'
 import { buildForcedExternalServiceSummary } from '@/lib/server/chat-execution/prompt-builder'
 
-// ---------------------------------------------------------------------------
-// Classification JSON leak detection — strips MessageClassification objects
-// that some models echo verbatim into their response text. Candidate JSON
-// substrings are found by brace-matching, then validated against the actual
-// MessageClassificationSchema — the single source of truth for what a
-// classifier object looks like.
-// ---------------------------------------------------------------------------
-
-/** Returns the index just past the balanced `}` for the `{` at `start`, or -1. */
-function findBalancedObjectEnd(text: string, start: number): number {
-  let depth = 0
-  let inString = false
-  let escape = false
-  for (let i = start; i < text.length; i++) {
-    const ch = text[i]
-    if (escape) { escape = false; continue }
-    if (inString) {
-      if (ch === '\\') escape = true
-      else if (ch === '"') inString = false
-      continue
-    }
-    if (ch === '"') inString = true
-    else if (ch === '{') depth += 1
-    else if (ch === '}') {
-      depth -= 1
-      if (depth === 0) return i + 1
-    }
-  }
-  return -1
-}
-
 export function stripLeakedClassificationJson(text: string): { cleaned: string; stripped: boolean } {
-  for (let i = text.indexOf('{'); i !== -1; i = text.indexOf('{', i + 1)) {
-    const end = findBalancedObjectEnd(text, i)
-    if (end === -1) break
-    let parsed: unknown
-    try { parsed = JSON.parse(text.slice(i, end)) } catch { continue }
-    if (!MessageClassificationSchema.safeParse(parsed).success) continue
-    log.warn(TAG, 'Stripped leaked classification JSON from model output')
-    return { cleaned: (text.slice(0, i) + text.slice(end)).trimStart(), stripped: true }
-  }
-  return { cleaned: text, stripped: false }
+  const cleaned = stripAllInternalMetadata(text)
+  return { cleaned, stripped: cleaned !== text }
 }
 
 // StreamAgentChatResult is defined inline to avoid circular dependency with stream-agent-chat.ts
@@ -174,9 +135,10 @@ export async function finalizeStreamResult(opts: FinalizeStreamResultOpts): Prom
     }
   }
 
-  // Strip leaked classification JSON from model output (e.g. `{ "isDeliverableTask": true, ... }`)
+  // Strip leaked internal metadata from model output (e.g. `{ "isDeliverableTask": true, ... }`)
   const leakResult = stripLeakedClassificationJson(state.fullText)
   if (leakResult.stripped) {
+    log.warn(TAG, 'Stripped leaked internal metadata from model output')
     state.fullText = leakResult.cleaned
     // Emit a reset so the frontend re-renders with the cleaned text
     write(`data: ${JSON.stringify({ t: 'reset', text: leakResult.cleaned })}\n\n`)

src/lib/server/chat-execution/post-stream-finalization.ts

@@ -64,6 +64,41 @@ describe('stripInternalJson', () => {
     assert.doesNotMatch(result, /isDeliverableTask/)
     assert.match(result, /\{ "foo": "bar" \}/)
   })
+
+  it('removes multiple leading internal JSON blocks', () => {
+    const input = [
+      '{ "isDeliverableTask": true, "confidence": 0.9 }',
+      '{ "factsUpsert": [], "questionsUpsert": [] }',
+      'All queued work is complete.',
+    ].join('\n')
+    assert.equal(stripInternalJson(input), 'All queued work is complete.')
+  })
+
+  it('removes a malformed internal prelude only after a strict leading strip', () => {
+    const input = [
+      '{ "isDeliverableTask": true, "confidence": 0.9 }',
+      '{',
+      '  "taskIntent": "research",',
+      '  "isBroadGoal":{',
+      '  false,',
+      '  "isLightweightDirectChat": false,',
+      '}',
+      'All queued work is complete.',
+    ].join('\n')
+    assert.equal(stripInternalJson(input), 'All queued work is complete.')
+  })
+
+  it('preserves malformed internal-looking text without a strict leading strip', () => {
+    const input = [
+      '{',
+      '  "taskIntent": "research",',
+      '  "isBroadGoal":{',
+      '  false,',
+      '}',
+      'Visible answer.',
+    ].join('\n')
+    assert.equal(stripInternalJson(input), input)
+  })
 })
 
 // ---------------------------------------------------------------------------

src/lib/strip-internal-metadata.test.ts

@@ -25,6 +25,9 @@ const INTERNAL_JSON_KEYS = [
 
 export const INTERNAL_KEY_RE = new RegExp(`"(?:${INTERNAL_JSON_KEYS.join('|')})"`)
 
+const TaskIntentLikeSchema = z.enum(['coding', 'research', 'browsing', 'outreach', 'scheduling', 'general']).optional()
+const WorkTypeLikeSchema = z.enum(['coding', 'research', 'writing', 'review', 'operations', 'general']).optional()
+
 const WorkingStatePatchLikeSchema = z.object({
   factsUpsert: z.array(z.unknown()).optional(),
   artifactsUpsert: z.array(z.unknown()).optional(),
@@ -37,13 +40,15 @@ const WorkingStatePatchLikeSchema = z.object({
 }).passthrough()
 
 const MessageClassificationLikeSchema = z.object({
-  taskIntent: z.string().optional(),
+  taskIntent: TaskIntentLikeSchema,
   isLightweightDirectChat: z.boolean().optional(),
   isDeliverableTask: z.boolean().optional(),
   isBroadGoal: z.boolean().optional(),
   hasHumanSignals: z.boolean().optional(),
+  hasSignificantEvent: z.boolean().optional(),
   explicitToolRequests: z.array(z.unknown()).optional(),
   isResearchSynthesis: z.boolean().optional(),
+  workType: WorkTypeLikeSchema,
   confidence: z.number().optional(),
 }).passthrough()
 
@@ -104,6 +109,13 @@ function objectIsInternalMetadata(obj: Record<string, unknown>): boolean {
   return false
 }
 
+function isDistinctiveInternalKey(key: string): boolean {
+  for (const { distinctiveKeys } of INTERNAL_PAYLOAD_RULES) {
+    if (distinctiveKeys.includes(key)) return true
+  }
+  return false
+}
+
 function findBalancedJsonObjectEnd(text: string, start: number): number {
   if (text.charAt(start) !== '{') return -1
   let depth = 0
@@ -130,13 +142,117 @@ function findBalancedJsonObjectEnd(text: string, start: number): number {
   return -1
 }
 
+function parseQuotedKeyAt(text: string, start: number): { key: string; end: number } | null {
+  if (text.charAt(start) !== '"') return null
+  let key = ''
+  let escaped = false
+  for (let i = start + 1; i < text.length; i += 1) {
+    const c = text.charAt(i)
+    if (escaped) {
+      key += c
+      escaped = false
+      continue
+    }
+    if (c === '\\') {
+      escaped = true
+      continue
+    }
+    if (c !== '"') {
+      key += c
+      continue
+    }
+    let cursor = i + 1
+    while (cursor < text.length && /\s/.test(text.charAt(cursor))) cursor += 1
+    if (text.charAt(cursor) !== ':') return null
+    return { key, end: cursor + 1 }
+  }
+  return null
+}
+
+function lineHasDistinctiveInternalKey(line: string): boolean {
+  for (let i = 0; i < line.length; i += 1) {
+    const parsed = parseQuotedKeyAt(line, i)
+    if (!parsed) continue
+    if (isDistinctiveInternalKey(parsed.key)) return true
+    i = parsed.end - 1
+  }
+  return false
+}
+
+function startsWithJsonLiteral(text: string, value: string): boolean {
+  if (!text.startsWith(value)) return false
+  const next = text.charAt(value.length)
+  return next === '' || next === ',' || next === '}' || next === ']' || /\s/.test(next)
+}
+
+function isMalformedJsonFragmentLine(line: string): boolean {
+  const trimmed = line.trim()
+  if (!trimmed) return true
+  const first = trimmed.charAt(0)
+  if (first === '{' || first === '}' || first === '[' || first === ']' || first === '"' || first === ',' || first === ':') {
+    return true
+  }
+  if (startsWithJsonLiteral(trimmed, 'true')) return true
+  if (startsWithJsonLiteral(trimmed, 'false')) return true
+  if (startsWithJsonLiteral(trimmed, 'null')) return true
+  if (trimmed.startsWith('...')) return true
+  return false
+}
+
+function findInlineVisibleTextAfterClosingBrace(line: string): number {
+  for (let i = 0; i < line.length; i += 1) {
+    if (line.charAt(i) !== '}') continue
+    let cursor = i + 1
+    while (cursor < line.length && /\s/.test(line.charAt(cursor))) cursor += 1
+    const next = line.charAt(cursor)
+    if (!next || next === ',' || next === '}' || next === ']') continue
+    return i + 1
+  }
+  return -1
+}
+
+function findMalformedInternalPreludeEnd(text: string): number {
+  let leading = 0
+  while (leading < text.length && /\s/.test(text.charAt(leading))) leading += 1
+  if (text.charAt(leading) !== '{') return -1
+
+  let cursor = leading
+  let sawDistinctiveKey = false
+  let consumedEnd = -1
+  while (cursor < text.length) {
+    const newlineAt = text.indexOf('\n', cursor)
+    const lineEnd = newlineAt === -1 ? text.length : newlineAt
+    const line = text.slice(cursor, lineEnd)
+    if (lineHasDistinctiveInternalKey(line)) sawDistinctiveKey = true
+
+    if (!isMalformedJsonFragmentLine(line)) {
+      return sawDistinctiveKey && consumedEnd > leading ? consumedEnd : -1
+    }
+
+    const inlineEnd = sawDistinctiveKey ? findInlineVisibleTextAfterClosingBrace(line) : -1
+    if (inlineEnd >= 0) return cursor + inlineEnd
+
+    consumedEnd = newlineAt === -1 ? lineEnd : lineEnd + 1
+    cursor = consumedEnd
+  }
+
+  return -1
+}
+
+function stripMalformedInternalPreludeAfterStrictStrip(text: string): string {
+  const end = findMalformedInternalPreludeEnd(text)
+  if (end < 0) return text
+  return text.slice(end).trimStart()
+}
+
 /**
  * Remove top-level `{ ... }` blocks that contain known internal classification keys.
  * Handles nested and multi-line JSON. Only strips blocks where at least one
  * distinctive internal key is present and the payload passes schema validation.
  */
 export function stripInternalJson(text: string): string {
   let out = text || ''
+  let removedLeadingInternalJson = false
   for (let guard = 0; guard < 32; guard += 1) {
     let removed = false
     for (let i = 0; i < out.length; i += 1) {
@@ -152,12 +268,16 @@ export function stripInternalJson(text: string): string {
       }
       if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) continue
       if (!objectIsInternalMetadata(parsed as Record<string, unknown>)) continue
+      if (!out.slice(0, i).trim()) removedLeadingInternalJson = true
       out = (out.slice(0, i).replace(/\s+$/, '') + ' ' + out.slice(end).replace(/^\s+/, '')).trim()
       removed = true
       break
     }
     if (!removed) break
   }
+  if (removedLeadingInternalJson) {
+    out = stripMalformedInternalPreludeAfterStrictStrip(out)
+  }
   return out
 }