openclaw - 💡(How to fix) Fix [Bug]: Injected conversation context messages render visibly in web gateway Chat UI [1 pull requests]

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

When a message arrives from a Telegram group chat (or potentially other non-web channels), the web gateway Chat UI displays the injected conversation context block — the last ~10 messages selected for conversational continuity — as visible chat entries in the browser. These context messages are internal metadata intended to give the agent conversational history; they should not be rendered as user-visible messages in the web UI.

Steps to reproduce

1. Install OpenClaw 2026.5.12 via npm global on macOS.
2. Configure a Telegram bot with at least one group chat binding in openclaw.json.
3. Start the gateway and open the web gateway Chat UI in a browser.
4. Send a message to the agent from the Telegram group chat.
5. Open (or refresh) the web gateway Chat UI in the browser.
6. Observe: The Chat view displays approximately 10 recent messages from the Telegram group conversation as visible entries — rendered as if they were chat messages in the web UI session. These are the "Conversation context (untrusted, chronological, selected for current message)" lines that OpenClaw injects into the agent's prompt for group chat continuity.

Expected behavior

The injected conversation context should be invisible in the web gateway Chat UI. It is internal metadata — part of the agent's prompt construction, not part of the user-facing chat history. The web UI should only display:

• Messages the user sends via the web UI itself
• The agent's replies

If the session is Telegram-sourced, the web UI should either show nothing (since the conversation lives in Telegram) or clearly indicate it is mirroring a Telegram session — not display raw context injection as if it were web chat history.

Actual behavior

The web gateway Chat view renders the injected conversation context as visible message entries. Each context line (formatted as #XXXX Timestamp Sender: message text) appears as a chat bubble or message row in the browser UI. This creates several problems:

1. User confusion. A user viewing the web UI sees messages they didn't send and the agent didn't generate in the web session. It looks like a corrupted or leaked conversation.
2. Privacy concern. The context block may contain messages from other participants in the Telegram group. These messages are now visible in the web UI, which may be accessed by different users or in different security contexts than the Telegram group.
3. UI clutter. ~10 context messages appear on every inbound Telegram message, making the web Chat view noisy and difficult to follow.

OpenClaw version

2026.5.12 (commit f066dd2)

Operating system

macOS 26.5 (Tahoe), Apple Silicon (arm64), Mac Mini M4

Install method

npm global (npm install -g openclaw)

Model

anthropic/claude-opus-4.6

Provider / routing chain

openclaw (local gateway, loopback) -> anthropic (direct, api_key auth). Telegram provider configured with bot token (api_key auth, no OAuth).

Additional provider/model setup details

• Standard Telegram group chat binding with requireMention: false and dmPolicy: "pairing".
• Web gateway enabled at default settings (gateway.bind: loopback).
• No special web gateway configuration or customization.
• The injected context is the standard "Conversation context (untrusted, chronological, selected for current message)" block that OpenClaw adds to the agent's prompt for group chat sessions to provide conversational continuity.

Logs, screenshots, and evidence

### What appears in the web gateway Chat UI

When a Telegram group message triggers the agent, the web Chat view shows entries like:


#4608 Sun 2026-05-17 10:21 CDT UserA: i think you did a soft restart...
#4610 Sun 2026-05-17 10:36 CDT UserA: i think there may be some tool...
#4612 Sun 2026-05-17 10:46 CDT UserA: your context buffer is at 96%...
[... approximately 10 context messages ...]


These are rendered as visible chat messages in the browser, not as hidden system/internal metadata.

### What should happen

These context lines are part of the agent's prompt — injected by OpenClaw to give the agent awareness of recent conversation history in the group. They should be:
- Invisible in the web UI, or
- Displayed in a clearly separate "debug" or "context" panel if shown at all, not intermixed with actual chat messages

Impact and severity

• Affected: Any user who opens the web gateway Chat UI while the agent is servicing Telegram group chat sessions (and potentially other non-web channel sessions).
• Severity: Medium — does not break functionality, but creates user confusion and a potential privacy concern (group chat messages from other participants rendered in a different UI surface).
• Frequency: 100% reproducible. Every Telegram group message that triggers the agent causes ~10 context messages to appear in the web Chat view.
• Consequence: The web Chat UI becomes cluttered and confusing. Messages from Telegram group participants appear in a context they weren't intended for. Users may mistakenly believe the web session is corrupted or that messages are being duplicated.

Additional information

• Privacy implication: The conversation context block may include messages from multiple participants in the Telegram group. Rendering these in the web UI — which may have different access controls or be viewed by different people — constitutes unintended cross-surface message exposure. While the context is labeled "untrusted" in the agent's prompt, it contains real message content from real users.
• Possible root cause area: The web gateway UI likely treats all messages in the session transcript as displayable chat entries. The injected conversation context lines are stored as user-role messages in the session (since they're part of the prompt), and the web UI does not distinguish between "real" user messages and injected context metadata. A rendering filter or message-type annotation may be needed so the UI can suppress or collapse context-injection messages.
• Relationship to other bugs: This is a separate issue from the Telegram group chat routing bug (where message(action=send) without target routes to the web gateway instead of Telegram). However, the two bugs compound: when the routing bug causes replies to appear in the web UI instead of Telegram, those replies appear alongside the leaked context messages, making the web Chat view even more confusing.