fix(telegram): filter gateway startup logs from Telegram replies by codeyogi911 · Pull Request #883 · NVIDIA/NemoClaw

codeyogi911 · 2026-03-25T13:45:22Z

Summary

The [gateway] Running as non-root (uid=998) — privilege separation disabled log line from nemoclaw-start was leaking into every Telegram reply because the response filter in telegram-bridge.js did not cover [gateway]-prefixed lines.
Added two filter conditions: !l.startsWith("[gateway]") and !l.includes("privilege separation") to strip these internal startup messages before sending the agent response back to the user.

Test plan

Send a message to the Telegram bot and verify the reply no longer contains gateway Running as non-root (uid=998) — privilege separation disabled
Verify normal agent responses are unaffected (no content accidentally stripped)

Made with Cursor

Summary by CodeRabbit

Bug Fixes
- Telegram bot responses now exclude startup/gateway noise (lines beginning with "[gateway]") and other extraneous log markers, yielding cleaner, more focused messages for users.
Tests
- Added a regression test to ensure gateway startup noise remains filtered from responses and continues to be blocked in future changes.

coderabbitai · 2026-03-25T13:45:36Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b9bc3df0-60d3-438a-bc1d-b0592b4b4b61

📥 Commits

Reviewing files that changed from the base of the PR and between b12ca67 and 1185c4b.

📒 Files selected for processing (2)

scripts/telegram-bridge.js
test/runner.test.js

🚧 Files skipped from review as they are similar to previous changes (2)

test/runner.test.js
scripts/telegram-bridge.js

📝 Walkthrough

Walkthrough

The Telegram bridge's runAgentInSandbox() now filters additional agent output: it excludes lines beginning with [gateway] when assembling the response sent to Telegram, in addition to the existing exclusions.

Changes

Cohort / File(s)	Summary
Output filtering `scripts/telegram-bridge.js`	Added a filter predicate in `runAgentInSandbox()` to omit lines that start with `"[gateway]"` from the response text returned to Telegram.
Tests / Regression `test/runner.test.js`	Added a regression test asserting the presence of the `[gateway]` filter predicate in `scripts/telegram-bridge.js` and validating example gateway-noise lines against that predicate.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~7 minutes

Poem

I nibble noisy gateway hay,
I hush the lines that stray your way,
Clean replies hop out to play,
Telegram listens, bright as day. 🐇✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding gateway startup log filtering to Telegram replies, which matches the core implementation in telegram-bridge.js.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

scripts/telegram-bridge.js (1)

126-136: ⚠️ Potential issue | 🟠 Major

Over-broad filters can remove legitimate agent content

Line 130 and Line 135 are too generic for the stated goal. They can drop valid answers (e.g., when the model discusses “privilege separation” or emits lines beginning with [gateway]). Match the specific startup line instead of broad substrings/prefixes.

Suggested narrowing

       const responseLines = lines.filter(
         (l) =>
           !l.startsWith("Setting up NemoClaw") &&
           !l.startsWith("[plugins]") &&
-          !l.startsWith("[gateway]") &&
+          !/^\[gateway\]\s+Running as non-root \(uid=\d+\)\s+[—-]\s+privilege separation disabled$/.test(l) &&
           !l.startsWith("(node:") &&
           !l.includes("NemoClaw ready") &&
           !l.includes("NemoClaw registered") &&
           !l.includes("openclaw agent") &&
-          !l.includes("privilege separation") &&
           !l.includes("┌─") &&
           !l.includes("│ ") &&
           !l.includes("└─") &&
           l.trim() !== "",
       );

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/telegram-bridge.js` around lines 126 - 136, The filter applied in
responseLines (lines.filter using l.startsWith and l.includes) is too broad and
may remove valid agent output; update the predicate in the lines.filter inside
scripts/telegram-bridge.js to match only the exact startup/log lines you want to
exclude (use exact equality or anchored regexes) instead of generic substrings —
specifically tighten checks that use l.startsWith("Setting up NemoClaw"),
l.startsWith("[gateway]"), and l.includes("privilege separation") by matching
the full startup text or a precise regex anchored to line start (keep using the
same responseLines and lines.filter symbols and the l variable) so legitimate
content is not dropped.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@scripts/telegram-bridge.js`:
- Around line 126-136: The filter applied in responseLines (lines.filter using
l.startsWith and l.includes) is too broad and may remove valid agent output;
update the predicate in the lines.filter inside scripts/telegram-bridge.js to
match only the exact startup/log lines you want to exclude (use exact equality
or anchored regexes) instead of generic substrings — specifically tighten checks
that use l.startsWith("Setting up NemoClaw"), l.startsWith("[gateway]"), and
l.includes("privilege separation") by matching the full startup text or a
precise regex anchored to line start (keep using the same responseLines and
lines.filter symbols and the l variable) so legitimate content is not dropped.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5fbc5336-4e5d-4a66-ba98-e3eac61fb43f

📥 Commits

Reviewing files that changed from the base of the PR and between 289a4b7 and b87306c.

📒 Files selected for processing (1)

scripts/telegram-bridge.js

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/telegram-bridge.js`:
- Line 135: The current filter unconditionally excludes any line containing
l.includes("privilege separation"), which can remove valid agent responses;
change the predicate so the exclusion is applied only when the line is gateway
startup noise—e.g., replace the unconditional check with a scoped check that
matches both the gateway prefix and the phrase (use a combined condition like
/\[gateway\].*privilege separation/.test(l) or l.includes('[gateway]') &&
l.includes('privilege separation')) so only gateway startup lines are dropped;
update the filter where l.includes("privilege separation") is used to use this
scoped condition (refer to the filter callback containing l.includes("privilege
separation")).

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f6681beb-0743-48b9-bb19-f3b764d71994

📥 Commits

Reviewing files that changed from the base of the PR and between b87306c and b12ca67.

📒 Files selected for processing (2)

scripts/telegram-bridge.js
test/runner.test.js

coderabbitai · 2026-03-25T13:53:48Z

scripts/telegram-bridge.js

          !l.includes("NemoClaw ready") &&
          !l.includes("NemoClaw registered") &&
          !l.includes("openclaw agent") &&
+          !l.includes("privilege separation") &&


⚠️ Potential issue | 🟡 Minor

Narrow the privilege separation exclusion to avoid stripping valid user-facing answers.

At Line 135, filtering any line containing "privilege separation" can remove legitimate agent output (e.g., security explanations). The [gateway] prefix filter at Line 130 already handles the reported startup-noise case.

Proposed fix

- !l.includes("privilege separation") &&

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@scripts/telegram-bridge.js` at line 135, The current filter unconditionally excludes any line containing l.includes("privilege separation"), which can remove valid agent responses; change the predicate so the exclusion is applied only when the line is gateway startup noise—e.g., replace the unconditional check with a scoped check that matches both the gateway prefix and the phrase (use a combined condition like /\[gateway\].*privilege separation/.test(l) or l.includes('[gateway]') && l.includes('privilege separation')) so only gateway startup lines are dropped; update the filter where l.includes("privilege separation") is used to use this scoped condition (refer to the filter callback containing l.includes("privilege separation")).

The non-root privilege separation log line from nemoclaw-start leaked into every Telegram reply because the response filter did not cover `[gateway]`-prefixed lines. Add a filter for `[gateway]`-prefixed lines to strip these internal startup messages before sending the agent response back to the user. Made-with: Cursor

coderabbitai bot reviewed Mar 25, 2026

View reviewed changes

codeyogi911 force-pushed the fix/telegram-bridge-filter-gateway-logs branch from b87306c to b12ca67 Compare March 25, 2026 13:49

coderabbitai bot reviewed Mar 25, 2026

View reviewed changes

codeyogi911 force-pushed the fix/telegram-bridge-filter-gateway-logs branch from b12ca67 to 1185c4b Compare March 25, 2026 13:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(telegram): filter gateway startup logs from Telegram replies#883

fix(telegram): filter gateway startup logs from Telegram replies#883
codeyogi911 wants to merge 1 commit intoNVIDIA:mainfrom
codeyogi911:fix/telegram-bridge-filter-gateway-logs

codeyogi911 commented Mar 25, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Mar 25, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot left a comment

Uh oh!

coderabbitai bot Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

codeyogi911 commented Mar 25, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codeyogi911 commented Mar 25, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Mar 25, 2026 •

edited

Loading