fix: media replies fail after prompt lock release#100033
Conversation
|
Codex review: needs real behavior proof before merge. Reviewed July 5, 2026, 7:02 PM ET / 23:02 UTC. Summary Reproducibility: yes. source-level: current main rejects normal prompt-released side leaf controls, and the PR body provides live logs showing the fixed gateway merged media-delivery side branches without a takeover error. Review metrics: 3 noteworthy metrics.
Stored data model Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review findings
Review detailsBest possible solution: Rebase and narrow the branch to the session-lock classifier, SessionManager guard, and focused tests, then rerun the relevant session-state and dependency-guard checks. Do we have a high-confidence way to reproduce the issue? Yes, source-level: current main rejects normal prompt-released side leaf controls, and the PR body provides live logs showing the fixed gateway merged media-delivery side branches without a takeover error. Is this the best way to solve the issue? Partly: the central classifier plus SessionManager guard is the right narrow layer, but the current broad/conflicting head is not the best merge vehicle until it is rebased and narrowed. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against a905eb42acda. Label changesLabel changes:
Label justifications:
Evidence reviewedSecurity concerns:
Acceptance criteria:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (9 earlier review cycles; latest 8 shown)
|
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
@clawsweeper review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
proof: sufficient
5c30bcf to
fea5972
Compare
fea5972 to
8f19101
Compare
openclaw-barnacle
Bot
added
docs
openclaw-barnacle
Bot
added
app: macos
github-actions
Bot
added
the
dependencies-changed
Dependency GuardThis PR changes dependency-related files. Maintainers should confirm these changes are intentional. Changed files:
Maintainer follow-up:
|
Dependency graph changes are blockedOpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph. Detected dependency graph changes:
Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:
Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed. To remove lockfile changes, restore them from the target branch: git fetch origin
git checkout 'origin/main' -- 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git pushIf this PR intentionally needs a dependency graph change, ask a repository admin or member of The action will approve the current head SHA ( |
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
Landed the corrected implementation through #100490 as The replacement was necessary because the original fork/current ancestry could not be updated safely after the deeper refactor. It preserves @scotthuang's contribution with Thank you @scotthuang for the report, implementation, and live proof. |
2 participants
What Problem This Solves
Fixes an issue where users sending multiple visible message-tool media replies could see the embedded agent fail with
session file changed while embedded prompt lock was releasedafter the media had already been delivered.The affected workflow is embedded agent delivery through channel message tools, especially batched image/media sends that mirror visible deliveries into the session transcript while the prompt lock is released.
Why This Change Was Made
Prompt-lock recovery already preserves delivery mirror transcript appends, but the recovery classifier did not recognize side-append
leafcontrols written with those mirrors. This change treats only structurally validappendMode: "side"leaf controls as prompt-released opaque entries so SessionManager can merge the delivery side branch, while active leaf controls remain takeover-triggering edits.User Impact
Users can receive batched media replies without the agent falsely reporting a session takeover during cleanup. The session takeover fence still rejects prompt-affecting branch changes and malformed leaf controls.
Evidence
node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/attempt.session-lock.test.ts -- --reporter=verbosepassed, 110 tests.pnpm buildpassed after adding the redacted prompt-release proof logs.git diff --checkpassed..agents/skills/autoreview/scripts/autoreview --mode localpassed with no accepted/actionable findings after the active-leaf guard was tightened.2026.7.1-beta.1 (5c30bcf), 2026-07-05 02:14 Asia/Shanghai, redacted Weixin direct chat:messagetool started batched visible media sends at 02:14:20.hilton-*images and 6yatu-*images.sendImageMessageWeixin: successentries were logged between 02:14:21 and 02:14:27.prompt-released session change mergedwas logged repeatedly during those media deliveries, showing prompt-released transcript changes were merged instead of treated as takeover.embedded run agent end ... isError=falseandmessage processed ... outcome=completedwere logged at 02:14:30-02:14:31.session file changed while embedded prompt lock was releasedorEmbeddedAttemptSessionTakeoverErrorentries appeared during the fixed-gateway test window; the only matching entries in the same local log were from the pre-fix npm-global run at 01:03.