imessage: strip NUL bytes from echo-cache text normalization by drvoss · Pull Request #63581 · openclaw/openclaw

drvoss · 2026-04-09T06:04:09Z

Summary

Problem: iMessage sometimes echoes outbound messages back from chat.db with leading NUL corruption markers, so the echo-cache text key does not match the cached outbound entry.
Why it matters: the reflected echo can be forwarded as a new inbound message instead of being recognized as the already-sent outbound message.
What changed: echo-cache normalization now strips only leading corruption markers, including leading NUL bytes, and keeps interior NUL bytes distinct; regression coverage and changelog were updated.
What did NOT change (scope boundary): this does not change message-id matching, TTL behavior, or general whitespace normalization beyond the existing trim and CRLF handling.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes iMessage echo detection fails when echoed message has NUL (\0) prefix #63544
Related imessage: strip NUL bytes from echo-cache text normalization #63581
This PR fixes a bug or regression

Real behavior proof (required for external PRs)

Behavior or issue addressed: leading NUL corruption markers on iMessage echoed text prevented echo-cache matching.
Real environment tested: local OpenClaw checkout on Windows with Node 22, running the real echo-cache module through tsx against the current branch code.
Exact steps or command run after this patch: pnpm exec tsx --eval "import { createSentMessageCache } from './extensions/imessage/src/monitor/echo-cache.ts'; const cache = createSentMessageCache(); cache.remember('acct:imessage:+1555', { text: 'Delayed echo reply' }); console.log(JSON.stringify({ leadingSingle: cache.has('acct:imessage:+1555', { text: '\0Delayed echo reply' }), leadingDouble: cache.has('acct:imessage:+1555', { text: '\0\0Delayed echo reply' }), interior: cache.has('acct:imessage:+1555', { text: 'Delayed\0echo reply' }) }, null, 2));"
Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): terminal output

{
  "leadingSingle": true,
  "leadingDouble": true,
  "interior": false
}

Observed result after fix: leading echoed NUL markers normalize to the cached outbound key, while interior NUL bytes still remain distinct and do not collide.
What was not tested: a live macOS Messages chat.db capture on this machine.
Before evidence (optional but encouraged): before this fix shape, the PR implementation stripped NUL bytes everywhere; that could collapse Delayed\0echo reply into the same key as Delayed echo reply.

Root Cause (if applicable)

Root cause: extensions/imessage/src/monitor/echo-cache.ts normalized text with trim and CRLF cleanup, but leading NUL corruption markers from iMessage attributedBody echoes were still left in the key.
Missing detection / guardrail: there was no regression coverage distinguishing leading corruption cleanup from interior-NUL preservation.
Contributing context (if known): current main already treated other leading attributedBody corruption markers as leading-only cleanup, so NUL needed to follow the same rule.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: extensions/imessage/src/monitor/monitor-provider.echo-cache.test.ts
Scenario the test should lock in: leading NUL-prefixed echoes match the sent cache entry, but interior NUL text does not.
Why this is the smallest reliable guardrail: the bug is isolated to echo-cache key normalization and can be reproduced directly through the sent-message cache contract.
Existing test that already covers this (if any): the file already covered leading attributedBody corruption markers for other Unicode corruption bytes.
If no new test is added, why not: N/A

User-visible / Behavior Changes

Reflected iMessage echoes with leading NUL corruption markers are now deduplicated correctly without collapsing distinct interior-NUL text into the same echo key.

Diagram (if applicable)

N/A

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

OS: Windows 11
Runtime/container: Node 22 local checkout
Model/provider: N/A
Integration/channel (if any): iMessage
Relevant config (redacted): default test/local checkout setup

Steps

Remember a sent iMessage echo-cache entry with text Delayed echo reply.
Query the cache with leading-NUL, double-leading-NUL, and interior-NUL variants.
Run pnpm test -- extensions/imessage/src/monitor/monitor-provider.echo-cache.test.ts.

Expected

Leading NUL corruption markers should still match the cached outbound entry.
Interior NUL bytes should remain distinct.

Actual

Leading single and double NUL variants matched.
Interior NUL did not match.
The regression test file passed on this branch.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios: direct live command output for leading-single, leading-double, and interior-NUL cases; targeted regression test pass.
Edge cases checked: multiple leading NUL markers and interior NUL preservation.
What you did not verify: a real macOS Messages database capture in this environment.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps: N/A

Risks and Mitigations

Risk: stripping all NUL bytes would have merged distinct interior-NUL text into the same key.
- Mitigation: cleanup stays leading-only and regression coverage asserts the interior-NUL non-match.

Made with Copilot

greptile-apps · 2026-04-09T06:05:16Z

Greptile Summary

Strips NUL bytes (\0) from the echo-cache text normalization key in the iMessage monitor. iMessage can prefix echoed outbound messages with NUL bytes in chat.db, causing normalizeEchoTextKey() to produce a different key than what was cached — leading to echo messages being forwarded as new inbound messages. Two test cases are added to cover single and multiple leading NUL byte prefixes.

Confidence Score: 5/5

Safe to merge — targeted one-line fix with appropriate test coverage and correct symmetric normalization.

The change is minimal and correct: both remember() and has() call normalizeEchoTextKey(), so NUL-stripping is symmetric and cache key matching is preserved. No regressions are plausible. All remaining considerations are P2 or lower.

No files require special attention.

Vulnerabilities

No security concerns identified.

_{Reviews (1): Last reviewed commit: "imessage: strip NUL bytes in echo cache ..." | Re-trigger Greptile}

drvoss · 2026-04-27T07:17:13Z

Rebased this branch onto current origin/main (090063bd43e) and force-pushed the refreshed head (fc70152ff6d).

Validation on the refreshed branch:

pnpm test extensions/imessage/src/monitor/monitor-provider.echo-cache.test.ts
pnpm check:changed

This keeps the diff as the same narrow NUL-byte echo-cache normalization fix, just refreshed onto current main so CI can rerun on a current base.

clawsweeper · 2026-04-27T07:36:27Z

Codex review: needs maintainer review before merge.

Summary
The PR updates iMessage echo-cache text normalization to strip leading NUL corruption markers while preserving interior NUL bytes, with focused tests and a changelog entry.

Reproducibility: yes. at source level. Current main remembers clean outbound text and later checks the reflected body through the same normalization path, but U+0000 is absent from the current leading-marker regex, so a NUL-prefixed body misses the text cache key.

Real behavior proof
Sufficient (terminal): The PR body includes copied terminal output from the real echo-cache module showing after-fix leading-NUL matches and interior-NUL non-match behavior.

Next step before merge
No ClawSweeper repair lane is needed because the open PR already contains the focused code change, regression coverage, changelog entry, and sufficient proof.

Security
Cleared: The diff is limited to iMessage text normalization, tests, and changelog text, with no dependency, CI, secret, network, permission, or execution-surface change.

Review details

Best possible solution:

Land the narrow PR after normal merge gates, keeping cleanup limited to known leading corruption markers and preserving interior-text distinctions.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main remembers clean outbound text and later checks the reflected body through the same normalization path, but U+0000 is absent from the current leading-marker regex, so a NUL-prefixed body misses the text cache key.

Is this the best way to solve the issue?

Yes. Adding U+0000 to the existing leading-only attributedBody corruption cleanup is the narrowest maintainable fix and avoids broader control-character or whitespace normalization changes.

What I checked:

current_main_omits_nul_marker: Current main normalizes CRLF, trims, then strips FEFF/FFFD/FFFE/FFFF leading markers, but U+0000 is not in the marker regex, so a NUL-prefixed reflected echo remains a different cache key. (extensions/imessage/src/monitor/echo-cache.ts:27, 3426b09591bb)
runtime_echo_path_uses_text_cache: Inbound iMessage processing passes body text into hasIMessageEchoMatch and drops the message only when the sent-message cache matches, so text-key normalization directly controls this echo suppression path. (extensions/imessage/src/monitor/inbound-processing.ts:690, 3426b09591bb)
outbound_populates_same_cache: Successful iMessage sends remember sent text and message ID in the same sent-message cache that inbound echo detection consults. (extensions/imessage/src/monitor/deliver.ts:61, 3426b09591bb)
pr_adds_leading_only_nul_cleanup: The PR head changes the marker representation to include U+0000 and strips only leading known markers before the final trim, preserving interior NUL distinctions. (extensions/imessage/src/monitor/echo-cache.ts:25, 86b845a1d73a)
pr_tests_cover_boundary: The PR adds assertions that one or two leading NUL bytes match the cached outbound text and that an interior NUL does not match. (extensions/imessage/src/monitor/monitor-provider.echo-cache.test.ts:32, 86b845a1d73a)
real_behavior_proof_supplied: The PR body supplies terminal output from running the real echo-cache module through tsx, showing leadingSingle=true, leadingDouble=true, and interior=false after the fix. (86b845a1d73a)

Likely related people:

vincentkoc: The merged leading attributedBody corruption-marker normalization that this PR extends landed via the replacement PR for U+FFFD-style corruption, with commit history pointing to this author on the central echo-cache and regression-test files. (role: introduced current leading-marker cleanup; confidence: high; commits: 11895810d60b, be445dd1c128; files: extensions/imessage/src/monitor/echo-cache.ts, extensions/imessage/src/monitor/monitor-provider.echo-cache.test.ts)
rmarr: The sent-message cache TTL, post-send remember semantics, message-id short-circuiting, and self-chat false-positive behavior trace through the merged self-chat dedupe work. (role: introduced adjacent echo-cache behavior; confidence: medium; commits: b29e180ef407; files: extensions/imessage/src/monitor/echo-cache.ts, extensions/imessage/src/monitor/deliver.ts, extensions/imessage/src/monitor/inbound-processing.ts)
steipete: Recent iMessage and plugin-runtime refactors touched the helper export surface, delivery path, config threading, and adjacent bundled-plugin lifecycle around the affected cache consumers. (role: recent area contributor; confidence: medium; commits: 235d06bff13d, 4336a7f3a9c6, 95331e5cc52d; files: extensions/imessage/src/monitor/echo-cache.ts, extensions/imessage/src/monitor/deliver.ts, extensions/imessage/src/monitor/inbound-processing.ts)
obviyus: Recent iMessage inbound and self-chat changes touched the reflected-echo routing area that consumes sent-message cache lookups. (role: adjacent echo-routing contributor; confidence: medium; commits: e3e2a19ab7f1, 4a5885df3a36, 1ee4a1606e9a; files: extensions/imessage/src/monitor/inbound-processing.ts, extensions/imessage/src/monitor/echo-cache.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 3426b09591bb.

drvoss · 2026-05-05T11:39:21Z

Updated this branch on current main.

This now keeps the existing leading corruption-marker cleanup shape and extends it to strip only leading NUL markers, so interior NUL bytes still stay distinct. I also kept the regression coverage for leading NUL matches vs interior-NUL non-matches and added the changelog entry requested in review.

Co-authored-by: Copilot <[email protected]>

omarshahine · 2026-05-12T23:50:19Z

Thanks for this! Closing as obsolete — the wrapped imsg-rpc text strip in #64000 (782b5622b6) happens before echo-cache.ts sees the value, so the NUL bytes this PR handled never reach the cache anymore.

…26.6.8) (#1144) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.6` → `2026.6.8` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.8`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202668) [Compare Source](openclaw/openclaw@v2026.6.6...v2026.6.8) ##### Highlights - Telegram and WhatsApp channel delivery are richer and less brittle: Telegram can send structured rich text with tables, lists, expandable blockquotes, prompt-preserving CLI backend delivery, retired native draft migration, and safer rich-media boundaries, while WhatsApp now honors configured ACP bindings. ([#92679](openclaw/openclaw#92679), [#84082](openclaw/openclaw#84082), [#89421](openclaw/openclaw#89421), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus), [@jzakirov](https://github.com/jzakirov), [@spacegeologist](https://github.com/spacegeologist), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent and Gateway recovery is sharper across account-scoped DM sends, generated media completions, restart shutdown aborts, yielded subagent pauses, yielded cron media, heartbeat dedupe, session identity prompts, and unknown OpenAI agent selector rejection. ([#92788](openclaw/openclaw#92788), [#91246](openclaw/openclaw#91246), [#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510)) Thanks [@yetval](https://github.com/yetval), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), and [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Provider/model handling expands and tightens with GLM-5.2, Claude Haiku 4.5 catalog rows, OpenRouter and Google Vertex provider-prefix normalization, managed SecretRef auth, bounded model browse discovery, storeless OpenAI Responses replay gating, and Claude 4.5 Copilot tool-streaming safety. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@snowzlm](https://github.com/snowzlm), and [@Kailigithub](https://github.com/Kailigithub). - `/usage` and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - UI and mobile flows are steadier: workspace files can collapse and start collapsed, WebChat backscroll survives streaming, the sidebar session picker remains interactive above the desktop workbench, reset soft args survive UI dispatch, stale dashboard session parent lineage is preserved, and iOS reconnects stale foreground gateways. ([#92779](openclaw/openclaw#92779), [#92622](openclaw/openclaw#92622), [#92705](openclaw/openclaw#92705), [#91353](openclaw/openclaw#91353), [#90658](openclaw/openclaw#90658), [#92552](openclaw/openclaw#92552)) Thanks [@shakkernerd](https://github.com/shakkernerd), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@NianJiuZst](https://github.com/NianJiuZst), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@luoyanglang](https://github.com/luoyanglang), and [@Solvely-Colin](https://github.com/Solvely-Colin). - Memory, state, and diagnostics recover cleaner: oversized OpenAI embedding batches split before 431s, QMD memory search stays available in transient mode, SQLite avoids WAL on NFS state volumes, stuck-session recovery scheduling no longer resets warning backoff, and Infinity chunk limits stay genuinely unbounded. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752), [#92735](openclaw/openclaw#92735)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), [@gnanam1990](https://github.com/gnanam1990), and [@yhterrance](https://github.com/yhterrance). ##### Changes - Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), and [@bymle](https://github.com/bymle). - Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including rich prompt handoff to CLI backends and transport fixtures for richer drafts. ([#92679](openclaw/openclaw#92679), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus) and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent commands: support `/btw` in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. ([#92669](openclaw/openclaw#92669), [#92162](openclaw/openclaw#92162)) Thanks [@joshavant](https://github.com/joshavant) and [@Pandah97](https://github.com/Pandah97). - Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - Docs and operator guidance: document node config examples, clarify before-install hook scope, correct agent default concurrency comments, refresh ZAI provider docs, and update channel/group docs for current Telegram and WhatsApp behavior. ([#92677](openclaw/openclaw#92677), [#92766](openclaw/openclaw#92766), [#92695](openclaw/openclaw#92695)) Thanks [@liuhao1024](https://github.com/liuhao1024), [@sallyom](https://github.com/sallyom), and [@ArielSmoliar](https://github.com/ArielSmoliar). ##### Fixes - Onboarding/skills: show the Homebrew install recommendation only on macOS and Linux, so FreeBSD and other unsupported platforms no longer get a misleading brew prompt. Fixes [#68893](openclaw/openclaw#68893); carries forward [#68894](openclaw/openclaw#68894), [#68910](openclaw/openclaw#68910), [#68941](openclaw/openclaw#68941), [#68943](openclaw/openclaw#68943), [#69002](openclaw/openclaw#69002), and [#69545](openclaw/openclaw#69545). Thanks [@yurivict](https://github.com/yurivict), [@Sanjays2402](https://github.com/Sanjays2402), [@Eruditi](https://github.com/Eruditi), [@JustInCache](https://github.com/JustInCache), [@nnish16](https://github.com/nnish16), and [@Mlightsnow](https://github.com/Mlightsnow). - Channels and delivery: preserve account-scoped DM channel send policy, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Slack outbound `message_sent` hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. ([#92788](openclaw/openclaw#92788), [#92679](openclaw/openclaw#92679), [#89421](openclaw/openclaw#89421), [#89943](openclaw/openclaw#89943), [#91137](openclaw/openclaw#91137), [#91246](openclaw/openclaw#91246), [#92735](openclaw/openclaw#92735)) Thanks [@yetval](https://github.com/yetval), [@obviyus](https://github.com/obviyus), [@spacegeologist](https://github.com/spacegeologist), [@rishitamrakar](https://github.com/rishitamrakar), [@lundog](https://github.com/lundog), [@TurboTheTurtle](https://github.com/TurboTheTurtle), and [@yhterrance](https://github.com/yhterrance). - Auto-reply/groups: keep ordinary group text replies on automatic final-reply delivery while allowing `message(action=send)` for files, images, and other attachments to the same group or topic. Carries forward [#43276](openclaw/openclaw#43276); refs [#48004](openclaw/openclaw#48004). Thanks [@NayukiChiba](https://github.com/NayukiChiba) and [@ShakaRover](https://github.com/ShakaRover). - Auto-reply/skills: preserve multiline payloads for `/skill` and direct skill slash commands while keeping command-head normalization for aliases, colon syntax, and bot mentions. Fixes [#79155](openclaw/openclaw#79155); carries forward [#81305](openclaw/openclaw#81305). Thanks [@web3blind](https://github.com/web3blind). - iMessage: normalize leading NUL sent-message echo prefixes while preserving interior NUL bytes and the leading attributedBody marker handling from [#73942](openclaw/openclaw#73942). Carries forward [#63581](openclaw/openclaw#63581). Thanks [@drvoss](https://github.com/drvoss). - Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. ([#64734](openclaw/openclaw#64734)) Thanks [@hanamizuki](https://github.com/hanamizuki). - Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, preserve yielded media completions, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions and slash-command block replies in WebChat, preserve fresh post-compaction usage while clearing stale usage snapshots, and require admin privileges for HTTP session/model override surfaces. ([#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510), [#91246](openclaw/openclaw#91246), [#50795](openclaw/openclaw#50795), [#50845](openclaw/openclaw#50845), [#82874](openclaw/openclaw#82874), [#92651](openclaw/openclaw#92651), [#92646](openclaw/openclaw#92646)) Thanks [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@Hollychou924](https://github.com/Hollychou924), [@leno23](https://github.com/leno23), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agents/exec: default empty-success background completion notices on only for real chat channels, preserving explicit opt-outs and keeping generic providers silent while carrying forward the narrow UX intent from [#39726](openclaw/openclaw#39726) and [#46926](openclaw/openclaw#46926). Thanks [@Sapientropic](https://github.com/Sapientropic) and [@wenkang-xie](https://github.com/wenkang-xie). - Providers and model replay: preserve storeless OpenAI Responses replay compatibility, avoid eager tool streaming for Claude 4.5 in Copilot, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. ([#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#92628](openclaw/openclaw#92628)) Thanks [@snowzlm](https://github.com/snowzlm), [@Kailigithub](https://github.com/Kailigithub), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), and [@mushuiyu886](https://github.com/mushuiyu886). - Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, and keep shell environment fallbacks contained in config write tests. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), and [@gnanam1990](https://github.com/gnanam1990). - Workspace setup state: store setup completion outside the workspace dot directory using an OpenClaw-named root file, migrate valid legacy state forward, and avoid clobbering generic root `workspace-state.json` files for TigerFS-style dot-path compatibility. This Clownfish replacement carries forward the focused [#53326](openclaw/openclaw#53326) fix idea because the original branch was closed and uneditable. ([#53326](openclaw/openclaw#53326), [#44783](openclaw/openclaw#44783), [#39446](openclaw/openclaw#39446)) Thanks [@1qh](https://github.com/1qh). - UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved `/model` confirmation refs, and stale foreground iOS Gateway reconnects. ([#90658](openclaw/openclaw#90658), [#92622](openclaw/openclaw#92622), [#91353](openclaw/openclaw#91353), [#92705](openclaw/openclaw#92705), [#92779](openclaw/openclaw#92779), [#92773](openclaw/openclaw#92773), [#92552](openclaw/openclaw#92552)) Thanks [@luoyanglang](https://github.com/luoyanglang), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@NianJiuZst](https://github.com/NianJiuZst), [@shakkernerd](https://github.com/shakkernerd), [@NarahariRaghava](https://github.com/NarahariRaghava), and [@Solvely-Colin](https://github.com/Solvely-Colin). - TUI: reload the active session after external `/new` or `/reset` session-change events so stale transcript and stream state clear promptly. Fixes [#38966](openclaw/openclaw#38966); carries forward [#40472](openclaw/openclaw#40472). Thanks [@yizhanzjz](https://github.com/yizhanzjz) and [@wsyjh8](https://github.com/wsyjh8). - Control UI: preserve Gateway Access tokens during same-normalized WebSocket URL edits and reload gateway-scoped tokens when switching endpoints. Fixes [#41545](openclaw/openclaw#41545); repairs [#42001](openclaw/openclaw#42001) with additional source PRs [#41546](openclaw/openclaw#41546), [#41552](openclaw/openclaw#41552), and [#41718](openclaw/openclaw#41718). Thanks [@wsyjh8](https://github.com/wsyjh8), [@llagy0020](https://github.com/llagy0020), [@llagy007](https://github.com/llagy007), [@pingfanfan](https://github.com/pingfanfan), and [@zheliu2](https://github.com/zheliu2). - Gateway CLI: tolerate a single transient clean WebSocket close before `hello-ok` so one-shot RPC calls reconnect instead of failing noisily, while repeated clean pre-hello closes still surface. Carries forward source PRs [#54475](openclaw/openclaw#54475) and [#54774](openclaw/openclaw#54774); [#85253](openclaw/openclaw#85253) covered adjacent connect assembly diagnostics. Thanks [@ruanrrn](https://github.com/ruanrrn). - Gateway/Linux: keep root-owned systemd user service lifecycle commands on root's user manager when a stale `SUDO_USER` remains in a root shell with root's user bus environment. Fixes [#81410](openclaw/openclaw#81410). Thanks [@Ericksza](https://github.com/Ericksza) and [@ChuckClose-tech](https://github.com/ChuckClose-tech). - Release and test reliability: extend slow Gateway/full-suite watchdogs, split local full-suite shards when throttled, stabilize plugin auth marker fixtures, avoid brittle provider-ref error text, and keep QA Lab bootstrap selection assertions aligned with flow-only scenarios. ([#92652](openclaw/openclaw#92652)) - macOS Peekaboo bridge: update the embedded Peekaboo package to 3.5.2 and route bundled-skill CLI commands through the OpenClaw app bridge so they inherit its Screen Recording and Accessibility grants. - Agent routing: route subagent RPC callbacks addressed to an agent-shaped `--to` target to the correct session key instead of falling back to the main session, so WeChat (and other channel) session-key callbacks reach the intended subagent session. ([#90231](openclaw/openclaw#90231)) Thanks [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Cron: preserve model, fallback, thinking, timeout, light-context, unsafe-content, and tool allow-list overrides on implicit text payloads by promoting them to agent turns, while explicit system events still prune those fields. Fixes [#28905](openclaw/openclaw#28905); carries forward [#64060](openclaw/openclaw#64060) and [#73946](openclaw/openclaw#73946). Thanks [@liaoandi](https://github.com/liaoandi). - QQBot delivery: keep markdown table chunks self-contained across message boundaries by preserving table state across block deliveries, flushing unfinished table-row fragments as plain text, and detecting short pipe-terminated rows by column count so split rows are not sent as malformed markdown. ([#92428](openclaw/openclaw#92428)) Thanks [@sliverp](https://github.com/sliverp). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1144

openclaw-barnacle Bot added channel: imessage Channel integration: imessage size: XS labels Apr 9, 2026

drvoss force-pushed the fix/imessage-echo-nul-prefix branch 3 times, most recently from c7b6eb3 to a2aa298 Compare April 10, 2026 00:39

This was referenced Apr 26, 2026

iMessage echo detection fails when echoed message has NUL (\0) prefix #63544

Closed

iMessage: harden echo detection against control-char prefixes #59386

Closed

drvoss force-pushed the fix/imessage-echo-nul-prefix branch from a2aa298 to fc70152 Compare April 27, 2026 07:17

This was referenced Apr 28, 2026

fix(imessage): strip U+FFFD garbage chars from echo text key normalization #62191

Closed

fix(imessage): normalize leading echo-cache corruption bytes #73891

Closed

openclaw-clownfish Bot mentioned this pull request Apr 29, 2026

fix(imessage): normalize leading echoed text corruption #73942

Merged

drvoss force-pushed the fix/imessage-echo-nul-prefix branch from fc70152 to 3c60d53 Compare May 5, 2026 11:38

openclaw-barnacle Bot added the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label May 5, 2026

openclaw-barnacle Bot removed the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label May 5, 2026

drvoss and others added 2 commits May 6, 2026 11:26

imessage: strip NUL bytes in echo cache text normalization

d95479c

Co-authored-by: Copilot <[email protected]>

imessage keep leading nul cleanup

86b845a

Co-authored-by: Copilot <[email protected]>

drvoss force-pushed the fix/imessage-echo-nul-prefix branch from 3c60d53 to 86b845a Compare May 6, 2026 02:41

openclaw-barnacle Bot added the proof: supplied External PR includes structured after-fix real behavior proof. label May 6, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 6, 2026

omarshahine closed this May 12, 2026

vincentkoc mentioned this pull request Jun 16, 2026

fix(imessage): normalize leading NUL echo-cache prefixes #93511

Merged

clawsweeper Bot mentioned this pull request Jun 19, 2026

fix(imessage): strip leading echo corruption markers in the persisted echo cache #94442

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

imessage: strip NUL bytes from echo-cache text normalization#63581

imessage: strip NUL bytes from echo-cache text normalization#63581
drvoss wants to merge 2 commits into
openclaw:mainfrom
drvoss:fix/imessage-echo-nul-prefix

drvoss commented Apr 9, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 9, 2026

Vulnerabilities

Uh oh!

drvoss commented Apr 27, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

drvoss commented May 5, 2026

Uh oh!

omarshahine commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

drvoss commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Real behavior proof (required for external PRs)

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

Uh oh!

greptile-apps Bot commented Apr 9, 2026

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Uh oh!

drvoss commented Apr 27, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

drvoss commented May 5, 2026

Uh oh!

omarshahine commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

drvoss commented Apr 9, 2026 •

edited

Loading

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading