fix(openclaw): skip conversational opt-out directives and inline secrets in shouldCapture - #1355

[P2] Keep ordinary do-not-save phrases in the opt-out filter

The new object whitelist after save/store excludes common explicit instructions such as “Please don’t save any of this: I prefer working from Tokyo next month” and “Do not save or remember this: my temporary medical appointment is at 3 PM.” Both now return hasCaptureOptOut=false and shouldCapture=true in this exact module, whereas the previous broader pattern rejected them. Because the hook uses the same predicate to suppress trailing assistant replies, the opted-out content and its echoes can reach analyze(). Extend the imperative grammar to cover these forms and add hook-level regression tests while retaining the ordinary developer-prose cases.

Extended the opt-out grammar to support compound verbs like save or remember and any-of targets like don't save any of this. Added unit and hook-level regression tests in commit 6d0049e.

[P2] Preserve explicit remember opt-outs with other objects

Combining remember/memorize with the save/store object whitelist makes ordinary opt-outs such as “Do not remember the following: I prefer working from Tokyo next month.” and “Please don't remember where I live: 123 Example Street.” return hasCaptureOptOut=false and shouldCapture=true. Both were rejected at the previous head. The hook therefore leaves optOutActive false and forwards both the user content and the trailing assistant acknowledgement to analyze(); the offline hook probe produced one request containing both messages. Keep the broader object handling for explicit remember/memorize imperatives, or cover these forms without weakening the developer-prose exclusions, and add a hook regression.

[P2] Preserve coordinated first-person developer statements

The shared prefix accepts and/but, so broadening remember to any object now treats ordinary statements such as “I prefer Rust but don't remember when we adopted it.” and “We use Postgres and don't remember why we picked that version.” as instructions not to save the turn. Both return hasCaptureOptOut=true and shouldCapture=false here, while the previous head captured them. The hook also suppresses the trailing assistant response; an offline hook probe made zero analyze calls for the Rust preference plus its acknowledgement. Distinguish coordinated first-person prose from an imperative before marking the whole turn opted out, and add a regression alongside the standalone “I don't remember” case.

Fixed in 84bffe3. Broadened remember/memorize opt-out matching now requires a clause-initial or polite imperative boundary (CLAUSE_IMPERATIVE_PREFIX), while coordinated conjunctions (and, but, ,) only trigger when paired with an explicit persistence verb or deictic turn target (this, that, it, anything, the following, the conversation). Added unit and hook-level regressions for coordinated first-person statements like "I prefer Rust but don't remember when we adopted it." and "We use Postgres and don't remember why we picked that version.".

[P2] Preserve explicit remember opt-outs after a comma

Removing the comma boundary from broad remember matching means “For privacy, don't remember my home address: 123 Example Street.” and “For privacy, do not remember where I live: 123 Example Street.” now return hasCaptureOptOut=false and shouldCapture=true. The fallback pattern also excludes my and where I, so neither explicit instruction is recognized, although both were excluded at the previous head. A hook probe for the first example now makes one analyze() call containing both the address and the assistant's acknowledgement, versus zero previously. Preserve unambiguous privacy-directed imperatives after a comma while retaining the coordinated-prose exclusions, and add a hook regression for this form.

[P2] Preserve explicit opt-outs after conjunctions

Aliasing this prefix removes the previous and/but boundaries from the narrow fallback patterns. Consequently, My temporary medical appointment is at 3 PM and do not remember this. and My home address is 123 Example Street but do not save this in memory. now return hasCaptureOptOut=false and shouldCapture=true; both were excluded at the previous head. A focused hook probe makes one analyze() call containing the user message and the trailing assistant acknowledgement. Retain conjunction handling for explicit persistence verbs/deictic opt-out targets while preserving the coordinated first-person developer-prose exclusions, and add hook-level regressions for these forms.

[P2] Suppress assistant echoes of secret-bearing user turns

The new turn-level prefilter suppresses assistant replies only when the user has an opt-out directive. A user message detected by looksLikeSecret is instead dropped later by the individual-message filter, while a paraphrased assistant echo remains capturable. On this head, Staging test account uses password: hunter2 for integration runs is rejected, but the reply For integration testing, your staging database password is hunter2. passes shouldCapture; an offline call through the actual registerCaptureHook sends that reply, including hunter2, to analyze(). This defeats the added inline-secret exclusion whenever the assistant repeats a credential without its assignment syntax. Use the same turn suppression for a detected-secret user message until the next normal user turn, and cover the assistant-echo path in the hook test.

[P1] Detect session-cookie headers as secret-bearing turns

The header rule covers Authorization/Bearer but no Cookie or Set-Cookie form. For staging, send Cookie: sid=synthetic-session-cookie-value when reproducing dashboard login. therefore returns looksLikeSecret=false; an actual registerCaptureHook probe forwards that header and the assistant's paraphrased session value to analyze(). Set-Cookie: sid=synthetic-set-cookie-value; HttpOnly; Secure has the same result. Because the new turn suppression relies on this predicate, it cannot protect either the original cookie or its echo. Recognize Cookie/Set-Cookie headers before turn filtering and cover both outgoing hook payloads, while retaining ordinary cookie-related prose without credential values.

[P1] Detect labelled private keys across Markdown line breaks

The labelled-hex rules exclude newlines. Both # Delegate private key\n + 64 synthetic a characters and My delegate private key is\n + that value return looksLikeSecret=false and shouldCapture=true on this head. They therefore bypass the new secret-bearing-turn suppression and remain eligible for analyze(). This is a normal Markdown key layout. Match labels across line breaks before capture, and add a regression for the complete user/assistant turn; ordinary unlabelled public identifiers can stay capturable.

[P3] Remove the nested answer marker from the folded summary

This answer: >- is already inside the top-level folded answer value, so YAML treats it as literal summary text. Parsing the frontmatter produces a summary beginning with answer: >- rather than the version description. Remove this redundant marker and keep the summary indented directly under the original field.