From 21aa8faf8a875bcc089bbd924e18d8b4ee8b69a7 Mon Sep 17 00:00:00 2001
From: zhangqueping <zhang.queping@xydigit.com>
Date: Sat, 13 Jun 2026 15:59:28 +0800
Subject: [PATCH] #92589: fix(internal-runtime-context): wrap prompt-preface
 runtime context body in delimiters (#92593)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters

When buildRuntimeContextMessageContent constructs the hidden
runtime context prompt block, the body (which may contain
sensitive metadata like relevant-memories, sender info, and
conversation metadata) was not wrapped in the standard
INTERNAL_RUNTIME_CONTEXT_BEGIN/END delimiters.  If the model
echoed this context back in its reply, stripInternalRuntimeContext
could only remove the header and notice lines — the sensitive
body leaked through to user-visible surfaces like Feishu
streaming cards.

Wrap the runtime context body in BEGIN/END delimiters so the
existing stripInternalRuntimeContext (which handles delimited
blocks first) can fully remove the entire block.

Closes #92589

* chore: retrigger CI for proof check

* chore: retrigger CI with corrected proof format

* chore: retrigger CI with corrected proof field format
---
 .../run/runtime-context-prompt.test.ts                     | 6 ++++++
 .../embedded-agent-runner/run/runtime-context-prompt.ts    | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/src/agents/embedded-agent-runner/run/runtime-context-prompt.test.ts b/src/agents/embedded-agent-runner/run/runtime-context-prompt.test.ts
index f892ec432409..b80509f9839a 100644
--- a/src/agents/embedded-agent-runner/run/runtime-context-prompt.test.ts
+++ b/src/agents/embedded-agent-runner/run/runtime-context-prompt.test.ts
@@ -219,7 +219,9 @@ describe("runtime context prompt submission", () => {
         "OpenClaw runtime event.",
         "This context is runtime-generated, not user-authored. Keep internal details private.",
         "",
+        "<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>",
         "internal event",
+        "<<<END_OPENCLAW_INTERNAL_CONTEXT>>>",
       ].join("\n"),
     });
   });
@@ -242,7 +244,9 @@ describe("runtime context prompt submission", () => {
         "OpenClaw runtime event.",
         "This context is runtime-generated, not user-authored. Keep internal details private.",
         "",
+        "<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>",
         "internal event",
+        "<<<END_OPENCLAW_INTERNAL_CONTEXT>>>",
       ].join("\n"),
     });
   });
@@ -339,7 +343,9 @@ describe("runtime context prompt submission", () => {
         "OpenClaw runtime context for the immediately preceding user message.",
         "This context is runtime-generated, not user-authored. Keep internal details private.",
         "",
+        "<<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>>",
         "secret runtime context",
+        "<<<END_OPENCLAW_INTERNAL_CONTEXT>>>",
       ].join("\n"),
       display: false,
       details: { source: "openclaw-runtime-context" },
diff --git a/src/agents/embedded-agent-runner/run/runtime-context-prompt.ts b/src/agents/embedded-agent-runner/run/runtime-context-prompt.ts
index 76ba70319e80..57d00d9c04f6 100644
--- a/src/agents/embedded-agent-runner/run/runtime-context-prompt.ts
+++ b/src/agents/embedded-agent-runner/run/runtime-context-prompt.ts
@@ -3,6 +3,8 @@
  */
 import {
   extractInternalRuntimeContext,
+  INTERNAL_RUNTIME_CONTEXT_BEGIN,
+  INTERNAL_RUNTIME_CONTEXT_END,
   OPENCLAW_NEXT_TURN_RUNTIME_CONTEXT_HEADER,
   OPENCLAW_RUNTIME_CONTEXT_CUSTOM_TYPE,
   OPENCLAW_RUNTIME_CONTEXT_NOTICE,
@@ -153,13 +155,18 @@ function buildRuntimeContextMessageContent(params: {
   runtimeContext: string;
   kind: "next-turn" | "runtime-event";
 }): string {
+  // Wrap the runtime context body in delimited internal-context markers so
+  // stripInternalRuntimeContext can fully remove the block when it leaks
+  // into user-visible surfaces (e.g. Feishu streaming cards, #92589).
   return [
     params.kind === "runtime-event"
       ? OPENCLAW_RUNTIME_EVENT_HEADER
       : OPENCLAW_NEXT_TURN_RUNTIME_CONTEXT_HEADER,
     OPENCLAW_RUNTIME_CONTEXT_NOTICE,
     "",
+    INTERNAL_RUNTIME_CONTEXT_BEGIN,
     params.runtimeContext,
+    INTERNAL_RUNTIME_CONTEXT_END,
   ].join("\n");
 }