fix(agents): prevent reverse sessions_send on A2A target turns by dankarization · Pull Request #112326 · openclaw/openclaw

dankarization · 2026-07-21T15:15:43Z

Summary

omit sessions_send only while an agent processes a target turn that came from sessions_send
keep sessions_list, sessions_history, sessions_search, and conversation tools available
restore sessions_send automatically on ordinary turns and other inter-session handoffs
refresh the Plugin SDK API baseline for the new turn-context field

Supersedes PR #91161, whose implementation and tests this replacement preserves and adapts to current main. The original external branch had drifted too far to update from this account.

What Problem This Solves

When Agent A calls sessions_send to Agent B, B's response already returns through the original tool result. The routed target turn still exposed sessions_send, so B could reverse-call A and create a second requester-visible delivery of the same logical result.

Why This Change Was Made

The target turn carries trusted input provenance: kind: "inter_session" with sourceTool: "sessions_send". This change derives a per-turn guard from that provenance and removes only the reverse-call vector from the constructed tool surface.

Current main groups conversation tools next to sessions_send. The implementation filters only sessions_send; it preserves the newer conversation tools and all read-only session tools. Other inter-session sources such as subagent_announce are unaffected.

User Impact

A delegated agent can no longer send the same result back through a second reverse sessions_send path. The requester still receives the target result through the original A2A return, while the target retains its inspection tools.

Evidence

Exact current head: db09420334, rebased onto current main.
provenance, attempt-context, and exact tool-surface suites — 270 passed across 5 files.
pnpm tsgo:core — passed.
pnpm plugin-sdk:api:check — passed with the refreshed baseline.
git diff --check — passed.

Original implementation: PR #91161 by sumitaich1998. Current-main adaptation and validation: Codex-assisted.

dankarization · 2026-07-21T15:16:11Z

Current-main replacement for PR #91161, preserving and crediting the original implementation while adapting the guard to the newer conversation-tool layout.

Exact-head validation: 270 focused tests, core typecheck, targeted lint/format, and diff check are green.

@codex review
@clawsweeper re-review

clawsweeper · 2026-07-21T15:16:14Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Review in progress
Detail: The exact-review queue leased this run; Codex is reviewing the item.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29845477466
Updated: 2026-07-21T15:46:41.025Z

chatgpt-codex-connector · 2026-07-21T15:21:19Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 1edf3daeb5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

dankarization · 2026-07-21T15:49:23Z

Rebased onto current main at db09420334 and fixed the only exact-head CI issue by refreshing the Plugin SDK API baseline for interAgentSendTurn.

Validation after rebase: 270 focused tests, core typecheck, Plugin SDK API check, and diff check all pass.

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db09420334

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-21T16:00:58Z

    options?.recordToolPrepStage?.("openclaw-tools:plugin-tools");
  }

+  allTools = allTools.filter((t) => !options?.interAgentSendTurn || t.name !== "sessions_send");


Carry the A2A send guard into CLI tool scopes

When the target session resolves to a CLI-backed runtime, the same sessions_send provenance goes through runCliAgent; its bundled MCP surface is built by prepareCliRunContext -> resolveMcpLoopbackScopedTools -> resolveGatewayScopedTools, which calls createOpenClawTools without any interAgentSendTurn/input-provenance field. In that environment this new filter is never activated, so the target still sees sessions_send and can reverse-call the requester, leaving the duplicate-delivery bug unfixed for CLI-backed agents.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-21T16:00:58Z

+    ...(isAgentToAgentSendInputProvenance(params.inputProvenance)
+      ? { interAgentSendTurn: true }
+      : {}),


Apply the guard to compaction tool builds

When a long sessions_send target turn compacts before answering, compactEmbeddedAgentSessionDirect builds a separate createOpenClawCodingTools surface from the same inputProvenance instead of going through this attempt-context helper, so interAgentSendTurn is never set for the compaction model. That leaves sessions_send available during overflow/pre-run compaction and preserves the reverse-call duplicate path for A2A turns that hit compaction.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-21T16:00:59Z

+  if (provenance?.kind !== "inter_session") {
+    return false;
+  }
+  return provenance.sourceTool === "sessions_send";


Preserve sessions_send on delivery-failure retry turns

When async A2A delivery fails after being accepted, runSessionsSendA2AFlow notifies the requester with runAgentStep and explicitly asks it to retry or report the failure (src/agents/tools/sessions-send-tool.a2a.ts:126-137), but that recovery step also uses sourceTool: "sessions_send". Classifying every inter-session sessions_send provenance as a target A2A turn removes sessions_send from the requester’s recovery tool surface, so an embedded requester cannot perform the retry path the prompt asks it to consider.

Useful? React with 👍 / 👎.

clawsweeper · 2026-07-21T16:29:28Z

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(agents): prevent reverse sessions_send on A2A target turns This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

openclaw-barnacle Bot added agents Agent runtime and tooling size: S labels Jul 21, 2026

dankarization mentioned this pull request Jul 21, 2026

fix: prevent A2A target from reverse-calling sessions_send to requester (#39476) #91161

Closed

dankarization added 2 commits July 21, 2026 19:41

fix(agents): prevent A2A reverse sessions_send

44cb88b

chore(plugin-sdk): refresh api baseline

db09420

dankarization force-pushed the fix/a2a-reverse-send-current branch from 1edf3da to db09420 Compare July 21, 2026 15:45

openclaw-barnacle Bot added the docs Improvements or additions to documentation label Jul 21, 2026

chatgpt-codex-connector Bot reviewed Jul 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(agents): prevent reverse sessions_send on A2A target turns#112326

fix(agents): prevent reverse sessions_send on A2A target turns#112326
dankarization wants to merge 2 commits into
openclaw:mainfrom
dankarization:fix/a2a-reverse-send-current

dankarization commented Jul 21, 2026 •

edited

Loading

Uh oh!

dankarization commented Jul 21, 2026

Uh oh!

clawsweeper Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jul 21, 2026

Uh oh!

dankarization commented Jul 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Uh oh!

clawsweeper Bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dankarization commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

dankarization commented Jul 21, 2026

Uh oh!

clawsweeper Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Jul 21, 2026

Uh oh!

dankarization commented Jul 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

clawsweeper Bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dankarization commented Jul 21, 2026 •

edited

Loading

clawsweeper Bot commented Jul 21, 2026 •

edited

Loading