feat: add /tools runtime availability view by Takhoffman · Pull Request #54088 · openclaw/openclaw

Takhoffman · 2026-03-24T23:40:00Z

Summary

Problem: /tools could mislead users by reflecting catalog/config guesses instead of the tools the active agent could actually use in the current session, and native command surfaces did not expose the same useful modes as text chat.
Why it matters: users need a truthful, fast answer to “what can I use right now?” before they decide how to ask the agent for help.
What changed: added a runtime-effective tool inventory path, switched /tools and the Control UI runtime section to that live inventory, made /tools compact by default with a more detailed mode, and added a native mode argument so Discord/native surfaces can access the same behavior.
What did NOT change (scope boundary): the catalog-backed tools config/editor flow remains separate and still serves profile/config semantics rather than session-runtime truth.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related #
This PR fixes a bug or regression

Root Cause / Regression History (if applicable)

Root cause: user-facing tool inventories were derived from catalog/config state instead of runtime-effective availability, so they could drift from what an agent could really call in the current session.
Missing detection / guardrail: there was no shared runtime-effective inventory resolver and no focused test coverage asserting that /tools and UI runtime surfaces must be session-backed rather than catalog-backed.
Prior context (git blame, prior PR, issue, or refactor if known): /tools already flowed through the info-command path, but it intersected config/catalog semantics rather than a server-derived runtime snapshot.
Why this regressed now: as wrappers/plugins/channel-owned tools became more dynamic, catalog truth stopped being a reliable proxy for runtime truth.
If unknown, what was ruled out: N/A

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: src/agents/tools-effective-inventory.test.ts, src/gateway/server-methods/tools-effective.test.ts, src/auto-reply/reply/commands-info.tools.test.ts, src/auto-reply/status.tools.test.ts, ui/src/ui/controllers/agents.test.ts, ui/src/ui/views/agents-panels-tools-skills.browser.test.ts
Scenario the test should lock in: /tools and the Control UI runtime section should reflect the tools available to the active agent in the active session, preserve plugin/channel ownership metadata, and keep compact vs detailed rendering stable across command surfaces.
Why this is the smallest reliable guardrail: the bug spans runtime resolution, gateway derivation, command formatting, and UI rendering, so unit plus seam coverage is the smallest combination that proves the live chain.
Existing test that already covers this (if any): N/A
If no new test is added, why not: N/A

User-visible / Behavior Changes

/tools now answers “what can this agent use right now in this conversation?” instead of showing a config-derived guess.
/tools defaults to a compact inventory and supports a more detailed mode.
Native command surfaces can request /tools detail via a structured mode argument.
The Control UI agent Tools panel now shows a session-backed “Available Right Now” section that updates with the active session.

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

OS: macOS
Runtime/container: local dev gateway
Model/provider: mixed during manual checks; feature is provider-agnostic
Integration/channel (if any): Control UI, Telegram, Discord
Relevant config (redacted): dev profile with native commands enabled; stale plugin warnings removed; temporary owner-only command gate removed for native testing

Steps

Start the dev gateway from this checkout and open a session in the Control UI.
Invoke /tools and verify the response matches the tools available to the active agent in that session.
Switch sessions/agents and verify the runtime tools section reloads appropriately.
Invoke native /tools on Discord/Telegram and verify compact vs detailed behavior.

Expected

/tools and the Control UI runtime section show the tools the current agent can actually use in the active session.
Native command surfaces expose the same useful /tools modes as text surfaces.

Actual

Verified: session-backed /tools output and Control UI runtime inventory.
Verified: Discord and Telegram registered native /tools, and auth/config gating issues were resolved in the dev profile used for manual checks.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios: Control UI /tools output reflects runtime-effective inventory; Control UI “Available Right Now” section renders session-backed tools; native /tools registration appears on Telegram/Discord after running this checkout and removing local auth/config blockers.
Edge cases checked: plugin/channel-owned tools remain classified through wrapper stages; compact vs detailed output stays readable; native detailed mode is available via a structured argument.
What you did not verify: a full repo tsc --noEmit remains blocked by unrelated pre-existing fetch-mock typing failures outside this PR; I did not run a full end-to-end multi-provider regression suite.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps: N/A

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert this PR to restore the previous catalog-backed /tools behavior and runtime tools panel behavior.
Files/config to restore: /Users/thoffman/openclaw2/src/agents/tools-effective-inventory.ts, /Users/thoffman/openclaw2/src/gateway/server-methods/tools-effective.ts, /Users/thoffman/openclaw2/src/auto-reply/reply/commands-info.ts, /Users/thoffman/openclaw2/src/auto-reply/status.ts, /Users/thoffman/openclaw2/ui/src/ui/views/agents-panels-tools-skills.ts
Known bad symptoms reviewers should watch for: /tools showing stale or empty inventories, Control UI runtime tools not updating on session change, native /tools mode handling diverging from text behavior.

Risks and Mitigations

Risk: runtime-effective inventory could miss a wrapped/plugin/channel-owned tool and under-report availability.
- Mitigation: shared resolver coverage includes wrapper propagation and plugin/channel ownership classification.
Risk: user-facing formatting could drift again if it depends on model-facing tool descriptions.
- Mitigation: added displaySummary plus safe fallback handling, and kept detailed rendering separate from raw tool docs.

aisle-research-bot · 2026-03-24T23:40:07Z

🔒 Aisle Security Analysis

We found 2 potential security issue(s) in this PR:

#	Severity	Title
1	🟡 Medium	IDOR / information disclosure in `tools.effective` via caller-supplied `sessionKey`
2	🟡 Medium	Denial-of-service/side-effects: tools inventory computation loads plugins and executes tool factories

Vulnerabilities

1. 🟡 IDOR / information disclosure in `tools.effective` via caller-supplied `sessionKey`

Property	Value
Severity	Medium
CWE	CWE-639
Location	`src/gateway/server-methods/tools-effective.ts:32-44`

Description

The new Gateway RPC method tools.effective authorizes requests only by operator scope (it is placed under operator.read) and then returns the runtime-effective tool inventory for whatever session is identified by the caller-supplied sessionKey.

There is no check that the RPC caller is allowed to access that session (no ownership/binding to the websocket connection/client identity). As a result:

Any client with access to the operator.read scope can query tools.effective for any valid sessionKey.
The response reveals operational capabilities for that session (tool list grouped by core/plugin/channel, plus pluginId / channelId identifiers and the effective profile).
The handler returns a distinct error for missing vs existing keys (unknown session key "..."), which makes sessionKey probing/enumeration easier.

Vulnerable code:

const loaded = loadSessionEntry(params.sessionKey);
if (!loaded.entry) {
  params.respond(
    false,
    undefined,
    errorShape(ErrorCodes.INVALID_REQUEST, `unknown session key "${params.sessionKey}"`),
  );
  return null;
}
...
resolveEffectiveToolInventory({ sessionKey: params.sessionKey, ... })

Recommendation

Bind session access to the authenticated caller, and avoid using a bare sessionKey as the sole authorization factor.

Suggested fixes (choose one or combine):

Enforce session authorization: require that the caller is subscribed/authorized for that session, or that the session belongs to the caller’s identity.
Tighten scope: move tools.effective to an admin-only scope (e.g. operator.admin) if it is intended for privileged diagnostics.
Harden error handling: return a generic not-found/unauthorized message for invalid or unauthorized keys to reduce enumeration signal.

Example (sketch):

// After loading session entry:
if (!loaded.entry) {
  respond(false, undefined, errorShape(ErrorCodes.NOT_FOUND, "session not found"));
  return;
}

// Authorization check (pseudo):
if (!context.sessionAcl.canRead(client, loaded.canonicalKey ?? params.sessionKey)) {
  respond(false, undefined, errorShape(ErrorCodes.UNAUTHORIZED, "not authorized"));
  return;
}

2. 🟡 Denial-of-service/side-effects: tools inventory computation loads plugins and executes tool factories

Property	Value
Severity	Medium
CWE	CWE-400
Location	`src/agents/tools-effective-inventory.ts:157-184`

Description

resolveEffectiveToolInventory builds the “effective” tools list by calling createOpenClawCodingTools(...). This call constructs all tools including plugin tools, which triggers plugin discovery/module loading and runs each plugin tool factory.

Impact:

A caller can repeatedly invoke /tools (chat command) or the gateway method tools.effective to force:
- filesystem scanning + dynamic module loading (jiti) during plugin loading
- execution of plugin tool factory(context) functions (which may perform arbitrary I/O during construction)
This is a classic expensive introspection endpoint that can be abused for resource exhaustion (CPU/IO/memory) or unintended side effects, even though no tool is being executed.
The inventory path also sets allowGatewaySubagentBinding: true, meaning plugin runtime is initialized in a more permissive mode than necessary for a read-only inventory operation.

Vulnerable code:

const effectiveTools = createOpenClawCodingTools({
  ...,
  allowGatewaySubagentBinding: true,
});

Why this is grounded:

createOpenClawCodingTools includes plugin tools via resolvePluginTools, which calls loadOpenClawPlugins(...) and then runs entry.factory(context) for each plugin tool.
loadOpenClawPlugins uses fs and jiti (dynamic module loading), which are expensive and potentially unbounded operations to expose in an on-demand inventory endpoint.

Attack surface:

Gateway: tools.effective endpoint.
Chat: /tools command (authorized senders).

Even if access is limited to “authorized senders”, this still creates a DoS vector from any authorized user/session and makes overall system robustness depend on plugin factory behavior.

Recommendation

Make inventory resolution side-effect free and inexpensive:

Do not instantiate tools to list inventory. Instead:
- return a static/core catalog + plugin manifests metadata (names/labels/descriptions) without running factories
- or add a createOpenClawCodingTools({ mode: 'inventory' }) that prevents plugin tool factories from executing and skips heavy initialization.
If plugin metadata must be computed dynamically, add:
- caching of the computed inventory per (agentId, sessionKey, modelProvider, modelId, groupId, accountId, …) with a short TTL
- rate limiting / request budgeting on tools.effective and /tools
For inventory calls, set least privilege:
- avoid allowGatewaySubagentBinding: true unless strictly required.

Example approach (sketch):

// inventory-only: never call plugin factories
const tools = listCoreToolDescriptors();
const pluginTools = listPluginToolDescriptorsFromRegistry({ load: 'metadata_only' });
return merge(tools, pluginTools);

Analyzed PR: #54088 at commit 38632e7

_{Last updated on: 2026-03-25T02:16:09Z}

greptile-apps · 2026-03-24T23:44:19Z

Greptile Summary

This PR replaces the catalog-backed /tools command with a session-backed runtime inventory and wires the same live data into the Control UI "Available Right Now" panel. The architecture — a shared resolveEffectiveToolInventory resolver, a new tools.effective gateway endpoint, metadata propagation through tool-wrapping stages, and compact/verbose text formatting — is well-structured and thoroughly tested.

Issues found:

senderIsOwner not propagated in tools-effective.ts (P1): The gateway handler never derives or forwards senderIsOwner to resolveEffectiveToolInventory. Any ownerOnly: true tool (e.g. cron) will be excluded from the UI's runtime panel even when the operator is the owner — directly contradicting the PR's goal of showing an accurate inventory.
rawDescription missing from ToolsEffectiveEntrySchema (P2): The runtime type includes rawDescription on every entry; the gateway sends it over the wire, but the protocol schema (with additionalProperties: false) and client TypeScript types don't declare it, leaving an undocumented field in the API response.
Doc-block sentinel strings duplicated (P2): isDocBlockStart in tools-effective-inventory.ts and stripVerboseToolDocTail in status.ts define the same hardcoded sentinel set independently; a sentinel added to one will silently diverge from the other.

Confidence Score: 4/5

Safe to merge after addressing the senderIsOwner propagation gap in the gateway handler.
The overall design is solid and well-tested. The one P1 (owner-only tools hidden from the UI panel because senderIsOwner is never derived in resolveTrustedToolsEffectiveContext) is a targeted, low-risk fix. The two P2s (rawDescription schema mismatch, duplicated sentinel strings) are non-blocking. All other surfaces — text command, metadata propagation through wrappers, UI rendering — are correct.
src/gateway/server-methods/tools-effective.ts — senderIsOwner not propagated to resolveEffectiveToolInventory.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: src/gateway/server-methods/tools-effective.ts
Line: 41-82

Comment:
**`senderIsOwner` not propagated — owner-only tools silently hidden**

`resolveTrustedToolsEffectiveContext` extracts model, channel, and threading context from the session, but never derives `senderIsOwner`. Because `resolveEffectiveToolInventory` receives `senderIsOwner: undefined` (which is treated as falsy), any tools guarded by `ownerOnly: true` (e.g. the `cron` tool) will be excluded from the "Available Right Now" inventory, even though the operator viewing the Control UI panel is the owner. This directly undermines the PR's goal of showing an accurate runtime inventory.

The gateway context is already trusted (gated on `operator_read` scope), so it is safe to derive owner status here. A simple fix is to propagate it from session metadata or default to `true` for operator-authenticated gateway requests:

```ts
return {
  cfg: loaded.cfg,
  agentId: sessionAgentId,
  senderIsOwner: loaded.entry.senderIsOwner ?? true,  // operator gateway is owner-trusted
  // ... rest of fields
};
```

And then pass it into the `resolveEffectiveToolInventory` call:

```ts
resolveEffectiveToolInventory({
  // ... existing fields
  senderIsOwner: trustedContext.senderIsOwner,
})
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/gateway/protocol/schema/agents-models-skills.ts
Line: 299-313

Comment:
**`rawDescription` missing from `ToolsEffectiveEntrySchema`**

`EffectiveToolInventoryEntry` (the runtime type) includes a `rawDescription` field, and `resolveEffectiveToolInventory` populates it on every entry. The gateway handler responds with the raw return value of that function, so `rawDescription` is present in the wire payload even though it is absent from `ToolsEffectiveEntrySchema` (which declares `additionalProperties: false`).

The inconsistency means: the schema does not describe the actual response shape, the UI TypeScript type (`ToolsEffectiveEntry`) does not expose `rawDescription`, and any future client that wants verbose descriptions via the gateway would need to rely on an undocumented field.

Either add `rawDescription` to the schema (since clients could use it for verbose modes) or strip it from the gateway response before sending. Leaking internal fields through a schema that declares `additionalProperties: false` is confusing for consumers.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/agents/tools-effective-inventory.ts
Line: 86-107

Comment:
**Doc-block sentinel strings duplicated across files**

The hardcoded sentinel set (`"ACTIONS:"`, `"JOB SCHEMA (FOR ADD ACTION):"`, `"JOB SCHEMA:"`, `"SESSION TARGET OPTIONS:"`, etc.) is defined twice — once here in `isDocBlockStart` and again in `stripVerboseToolDocTail` inside `src/auto-reply/status.ts`. If a new sentinel is added to one place it is easy to miss the other, which would cause the compact summary to strip sections that the verbose formatter still exposes (or vice versa).

Consider extracting both the sentinel set and the detection logic into a shared utility (e.g. `src/agents/tool-description-utils.ts`) and importing it in both locations.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "feat: make /tools show what the agent ca..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88649340ff

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2587c2cc70

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2da6c5b43b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac778cfa1f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38632e7c4e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-25T02:16:44Z

+                        const toolsRequestKey = `${resolvedAgentId}:${state.sessionKey}`;
+                        if (
+                          state.toolsEffectiveResultKey !== toolsRequestKey ||
+                          state.toolsEffectiveError


Invalidate effective-tools cache when model changes

The refresh guard keys tools.effective only by agentId + sessionKey, so opening the Tools panel after a model switch in the same session can reuse stale availability data and skip reloading. tools.effective resolves modelProvider/modelId from session state (resolveSessionModelRef) and downstream filtering depends on model compatibility (for example native web-search models change which tools are exposed), so model changes can legitimately change the inventory without changing the session key.

Useful? React with 👍 / 👎.

…nto add-json-schema-to-cli * 'add-json-schema-to-cli' of github.com:kvokka/openclaw: (58 commits) test: make vitest config tests platform-aware fix: refresh available tools when the session model changes (openclaw#54184) fix: prefer freshest transcript session owners test: disable Vitest fs cache on Windows fix: prefer deterministic transcript session keys fix: prefer deterministic session usage targets fix: prefer deterministic session id resume targets feat: add /tools runtime availability view (openclaw#54088) fix: enforce sandbox visibility for session_status ids fix: drop spawned visibility list caps fix: verify exact spawned session visibility fix: enforce spawned session visibility in key resolve fix: resolve exact session ids without fuzzy limits Discord: resolve /think autocomplete from session model (openclaw#49176) chore(agents): normalize pi embedded runner imports feat(gateway): make openai compatibility agent-first test(parallel): force unit-fast batch planning test(browser): stabilize default browser detection mocks fix: prefer current parents in session rows fix: prefer current subagent owners in session rows ...

* test(memory): lock qmd status counts regression * feat: make /tools show what the agent can use right now * fix: sync web ui slash commands with the shared registry * feat: add profile and unavailable counts to /tools * refine: keep /tools focused on available tools * fix: resolve /tools review regressions * fix: honor model compat in /tools inventory * fix: sync generated protocol models for /tools * fix: restore canonical slash command names * fix: avoid ci lint drift in google helper exports * perf: stop computing unused /tools unavailable counts * docs: clarify /tools runtime behavior

openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime agents Agent runtime and tooling size: XL maintainer Maintainer-authored PR labels Mar 24, 2026

Takhoffman changed the title ~~Make /tools show what the agent can use right now~~ feat: add /tools runtime availability view Mar 24, 2026

greptile-apps Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread src/gateway/server-methods/tools-effective.ts

Comment thread src/gateway/protocol/schema/agents-models-skills.ts

Comment thread src/agents/tools-effective-inventory.ts Outdated

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread src/gateway/server-methods/tools-effective.ts

Comment thread src/agents/tools-effective-inventory.ts

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread src/agents/tools-effective-inventory.ts

Comment thread ui/src/ui/chat/slash-commands.ts Outdated

Comment thread ui/src/ui/chat/slash-commands.ts

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread ui/src/ui/app-render.ts Outdated

Comment thread src/auto-reply/reply/commands-info.ts Outdated

Takhoffman force-pushed the codex/tools-command-copy branch 2 times, most recently from ce43992 to 88c9044 Compare March 25, 2026 01:04

openclaw-barnacle Bot added the app: macos App: macos label Mar 25, 2026

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread ui/src/ui/chat/slash-commands.ts

openclaw-barnacle Bot added the docs Improvements or additions to documentation label Mar 25, 2026

Takhoffman added 12 commits March 24, 2026 21:03

test(memory): lock qmd status counts regression

e9c882c

feat: make /tools show what the agent can use right now

0df71c1

fix: sync web ui slash commands with the shared registry

1a72eec

feat: add profile and unavailable counts to /tools

882cc34

refine: keep /tools focused on available tools

00744f9

fix: resolve /tools review regressions

322032c

fix: honor model compat in /tools inventory

9a7d7f1

fix: sync generated protocol models for /tools

07f33bd

fix: restore canonical slash command names

d5c6899

fix: avoid ci lint drift in google helper exports

9d37d02

perf: stop computing unused /tools unavailable counts

fa00039

docs: clarify /tools runtime behavior

38632e7

Takhoffman force-pushed the codex/tools-command-copy branch from 02e93ec to 38632e7 Compare March 25, 2026 02:03

Takhoffman merged commit 9c78233 into main Mar 25, 2026
43 of 44 checks passed

Takhoffman deleted the codex/tools-command-copy branch March 25, 2026 02:09

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

github-actions Bot mentioned this pull request Mar 25, 2026

📡 Upstream Digest — 2026-03-25 04:12 UTC curtismercier/openclaw-mods#356

Open

clawsweeper Bot mentioned this pull request May 18, 2026

[Feature]: Add optional capability descriptors to tool definitions #48510

Open

This was referenced Jun 15, 2026

fix(tui): keep local slash commands out of model prompts #89183

Closed

fix: correct tautological uppercase check in tool description summarizer #93753

Merged

fix: include MCP server tools in /tools inventory #70876

Closed

This was referenced Jun 19, 2026

fix(auto-reply): guard tools status inventory reads #89747

Closed

fix(sdk): require session key for effective tools #95169

Merged

This was referenced Jun 28, 2026

fix(gateway): tools.effective fails for global sessions on non-default agents #97265

Merged

fix: tool summaries preserve emoji truncation boundaries #98644

Merged

This was referenced Jul 9, 2026

Feature: Agent 动态切换命令（不重启 Gateway） #43976

Open

feat: add exact-turn capability projection reports #105588

Open

Uh oh!

Uh oh!

Conversation

Takhoffman commented Mar 24, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause / Regression History (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

aisle-research-bot Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

1. 🟡 IDOR / information disclosure in tools.effective via caller-supplied sessionKey

Description

Recommendation

2. 🟡 Denial-of-service/side-effects: tools inventory computation loads plugins and executes tool factories

Description

Recommendation

Uh oh!

greptile-apps Bot commented Mar 24, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

aisle-research-bot Bot commented Mar 24, 2026 •

edited

Loading

1. 🟡 IDOR / information disclosure in `tools.effective` via caller-supplied `sessionKey`