fix(sessions): let a2a policy gate cross-agent sends independently of visibility#1665
Open
BingqingLyu wants to merge 2 commits into
Open
fix(sessions): let a2a policy gate cross-agent sends independently of visibility#1665BingqingLyu wants to merge 2 commits into
BingqingLyu wants to merge 2 commits into
Conversation
… visibility (openclaw#57447) The visibility guard blocked all cross-agent access when visibility != "all", including sessions_send, even when agentToAgent policy explicitly allowed it. This forced users into an all-or-nothing choice between data isolation and cross-agent messaging. Now the "send" action bypasses the visibility check for cross-agent targets and is gated solely by the a2a policy. Read operations (list, history, status) still respect the visibility setting. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The "send" action now bypasses the visibility gate entirely, so the "send" case in crossVisibilityMessage is unreachable dead code. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes openclaw#57447
createSessionVisibilityGuard()blocked all cross-agent access whenvisibility !== "all", includingsessions_send, even whenagentToAgentpolicy explicitly allowed itvisibility=allexposes all sessions,visibility=treeblocks legitimate cross-agent messaging"send"action on cross-agent targets, letting a2a policy be the sole authorization gateRationale
Changes
src/agents/tools/sessions-access.ts: Addparams.action !== "send"to the cross-agent visibility checksrc/agents/tools/sessions-access.test.ts: Add 2 tests — send allowed with tree+a2a, history still blocked with tree+a2aTest plan
sessions-access.test.ts)visibility=tree+agentToAgent.enabled=true, verify cross-agentsessions_sendworks whilesessions_historyremains blocked🤖 Generated with Claude Code