openclaw - 💡(How to fix) Fix allowUnsafeExternalContent flag ignored in /hooks/agent dispatch path [1 comments, 1 participants]

Summary

When dispatching via POST /hooks/agent with allowUnsafeExternalContent: true in the request body, the flag is silently ignored and the message is still wrapped in the SECURITY NOTICE: The following content is from an EXTERNAL, UNTRUSTED source banner with <<<EXTERNAL_UNTRUSTED_CONTENT>>> markers.

Reproduction

1. Send a POST to /hooks/agent with:

{
  "message": "Execute task #123...",
  "agentId": "my-agent",
  "sessionKey": "hook:atlas:jobrun:123",
  "timeoutSeconds": 900,
  "deliver": false,
  "allowUnsafeExternalContent": true
}

1. The agent receives the prompt wrapped in:

SECURITY NOTICE: The following content is from an EXTERNAL, UNTRUSTED source (e.g., email, webhook).
...
<<<EXTERNAL_UNTRUSTED_CONTENT id="...">
Source: Webhook
---
[original message]
<<<END_EXTERNAL_UNTRUSTED_CONTENT ...>>>

1. Expected: the message should arrive unwrapped because allowUnsafeExternalContent: true was set.

Root cause

In gateway-cli (line ~5003 in the minified dist), the wrapping decision reads allowUnsafeExternalContent from agentPayload:

const agentPayload = params.job.payload.kind === "agentTurn" ? params.job.payload : null;
// ...
const allowUnsafeExternalContent = agentPayload?.allowUnsafeExternalContent === true
    || isGmailHook && params.cfg.hooks?.gmail?.allowUnsafeExternalContent === true;

When the /hooks/agent HTTP request is normalized into an internal job, the payload.kind is not "agentTurn", so agentPayload is null, and the flag from the original POST body is never read.

The flag IS correctly accepted in the Zod schema (allowUnsafeExternalContent: z.boolean().optional()) and flows through copyTopLevelAgentTurnFields / stripLegacyTopLevelFields, but it's lost before reaching the wrapping decision.

Versions affected

• 2026.3.13 (confirmed)
• 2026.4.2 (confirmed, same code path)

Suggested fix

Read allowUnsafeExternalContent from the top-level job fields or from the normalized payload, not only from agentPayload (which is gated on kind === "agentTurn"):

const allowUnsafeExternalContent = 
    agentPayload?.allowUnsafeExternalContent === true
    || params.job?.allowUnsafeExternalContent === true   // ← check top-level
    || (isGmailHook && params.cfg.hooks?.gmail?.allowUnsafeExternalContent === true);

Context

Atlas HQ uses /hooks/agent to dispatch trusted, system-generated task assignments to agents. The external content warning makes agents treat their own task instructions as untrusted, breaking lifecycle callbacks and causing agents to refuse tool execution on their assigned work.