Skip to content

fix(memory-core): strip dreaming managed blocks from daily memory reads#68408

Closed
jasonmakr wants to merge 3 commits into
openclaw:mainfrom
jasonmakr:fix/strip-dreaming-blocks-on-read
Closed

fix(memory-core): strip dreaming managed blocks from daily memory reads#68408
jasonmakr wants to merge 3 commits into
openclaw:mainfrom
jasonmakr:fix/strip-dreaming-blocks-on-read

Conversation

@jasonmakr

Copy link
Copy Markdown

Problem

Light sleep and REM dreaming phases write managed blocks into daily memory files (memory/YYYY-MM-DD.md) when using inline storage mode. These blocks contain session-agnostic candidate memories that leak cross-session context when other sessions read the same daily file via memory_get.

While the default storage mode was changed to "separate" (writing to memory/dreaming/light/ instead), users who:

  • Explicitly use "inline" or "both" storage mode
  • Switched from "inline" to "separate" but have old blocks in daily files
  • Use any configuration where dreaming blocks end up in daily files

...still experience cross-session contamination when reading daily memory files.

Solution

1. New utility: stripDreamingManagedBlocks() (memory-host-markdown.ts)

Strips all managed dreaming blocks (<!-- openclaw:dreaming:{light,rem}:{start,end} -->) and their optional headings (## Light Sleep, ## REM Sleep) from markdown content. Collapses excessive blank lines after stripping.

This function is in the plugin-sdk so it can be reused by other extensions if needed.

2. Apply stripping in QmdMemoryManager.readFile()

When reading daily memory files (matching memory/YYYY-MM-DD.md pattern), the dreaming blocks are stripped before returning content to the caller. This ensures memory_get results are clean of staging data from other sessions.

Important: The dreaming blocks are preserved on disk — only the read path is filtered. The dreaming subsystem continues to read the raw file content through its own code path.

3. Comprehensive tests

6 test cases covering:

  • No-op on content without dreaming blocks
  • Light sleep block with heading
  • REM sleep block with heading
  • Both blocks in same document
  • Block without heading (marker-only)
  • Blank line collapsing after stripping

Files changed

  • src/plugin-sdk/memory-host-markdown.ts — Added stripDreamingManagedBlocks()
  • src/plugin-sdk/memory-host-markdown.test.ts — Added 6 tests for the new function
  • extensions/memory-core/src/memory/qmd-manager.ts — Applied stripping in readFile() for daily memory paths

Fixes #68367

Light sleep and REM dreaming phases write managed blocks into daily memory
files (memory/YYYY-MM-DD.md) when using inline storage mode.  These blocks
contain session-agnostic candidate memories that leak cross-session context
when other sessions read the same daily file via memory_get.

This commit:

- Adds stripDreamingManagedBlocks() to memory-host-markdown (plugin-sdk)
  which removes <!-- openclaw:dreaming:{light,rem}:{start,end} --> blocks
  and their optional headings from arbitrary markdown content.
- Applies the stripping in QmdMemoryManager.readFile() for daily memory
  file paths (matching memory/YYYY-MM-DD.md pattern), so memory_get
  callers no longer see dreaming staging data from other sessions.
- Adds comprehensive tests for the new stripping function.

The dreaming blocks are preserved on disk for the dreaming subsystem's
own use — only the read path is filtered.

Fixes openclaw#68367
Documents the known limitation that partial reads (with from/lines
params) of daily memory files still expose dreaming blocks, and
outlines potential future approaches.
@greptile-apps

greptile-apps Bot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR strips dreaming managed blocks (Light Sleep / REM Sleep) from daily memory files on the read path to prevent cross-session context leakage. The core logic in stripDreamingManagedBlocks and its tests are correct, but there are two issues that need resolution before merging:

  • The plugin-sdk-api-baseline.sha256 hash was not regenerated after adding stripDreamingManagedBlocks to the public memory-host-markdown subpath — pnpm plugin-sdk:api:check will fail in CI.
  • The partial-read branch in readFile() (triggered when params.from/params.lines are set) bypasses the dreaming block filter entirely, so line-range memory_get calls on daily files still expose raw staging data.

Confidence Score: 3/5

Not safe to merge — two P1 issues: a CI-breaking missing baseline update and an incomplete fix that leaves partial reads unfiltered.

Two P1 findings: (1) the plugin SDK API baseline hash was not updated, causing pnpm plugin-sdk:api:check to fail in CI; (2) the partial-read path in readFile() skips dreaming block stripping, meaning line-range reads on daily memory files still leak cross-session content. Both need to be addressed before landing.

src/plugin-sdk/memory-host-markdown.ts (baseline hash), extensions/memory-core/src/memory/qmd-manager.ts (partial-read branch), and the missing docs/.generated/plugin-sdk-api-baseline.sha256 update.

Comments Outside Diff (1)

  1. extensions/memory-core/src/memory/qmd-manager.ts, line 1210-1226 (link)

    P1 Partial-read path bypasses dreaming block stripping

    The dreaming-block filter is only applied on the full-file read path (line 1235). When params.from or params.lines is set, execution takes this earlier branch and returns partial.selectedLines raw — dreaming block markers and their content pass through unfiltered if they fall within the requested line window. Any memory_get call that specifies a line range on a daily file will still expose cross-session staging data, leaving the fix incomplete.

    The same guard should be applied here, for example:

    const rawLines = partial.selectedLines;
    const selectedLines = isDailyMemoryPath(relPath)
      ? stripDreamingManagedBlocks(rawLines)
      : rawLines;
    return buildMemoryReadResultFromSlice({
      selectedLines,
      ...
    });

    Note that stripping from a mid-file slice can shift reported line numbers, so this may need care; but the current behaviour is the worse trade-off since it silently leaks the data the PR is intended to hide.

    Prompt To Fix With AI
    This is a comment left during a code review.
    Path: extensions/memory-core/src/memory/qmd-manager.ts
    Line: 1210-1226
    
    Comment:
    **Partial-read path bypasses dreaming block stripping**
    
    The dreaming-block filter is only applied on the full-file read path (line 1235). When `params.from` or `params.lines` is set, execution takes this earlier branch and returns `partial.selectedLines` raw — dreaming block markers and their content pass through unfiltered if they fall within the requested line window. Any `memory_get` call that specifies a line range on a daily file will still expose cross-session staging data, leaving the fix incomplete.
    
    The same guard should be applied here, for example:
    
    ```ts
    const rawLines = partial.selectedLines;
    const selectedLines = isDailyMemoryPath(relPath)
      ? stripDreamingManagedBlocks(rawLines)
      : rawLines;
    return buildMemoryReadResultFromSlice({
      selectedLines,
      ...
    });
    ```
    
    Note that stripping from a mid-file slice can shift reported line numbers, so this may need care; but the current behaviour is the worse trade-off since it silently leaks the data the PR is intended to hide.
    
    How can I resolve this? If you propose a fix, please make it concise.
Prompt To Fix All With AI
This is a comment left during a code review.
Path: src/plugin-sdk/memory-host-markdown.ts
Line: 65-77

Comment:
**Plugin SDK API baseline not updated**

`memory-host-markdown` is a published `package.json` export (`./plugin-sdk/memory-host-markdown`) and is listed in `scripts/lib/plugin-sdk-entrypoints.json`. Adding a new export (`stripDreamingManagedBlocks`) to it is a public Plugin SDK surface change, but `pnpm plugin-sdk:api:gen` was not run and `docs/.generated/plugin-sdk-api-baseline.sha256` was not updated — the hash in the file is identical before and after this PR. `pnpm plugin-sdk:api:check` will fail in CI until the hash is regenerated and committed.

Run `pnpm plugin-sdk:api:gen` and commit the updated `.sha256` file alongside this change.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: extensions/memory-core/src/memory/qmd-manager.ts
Line: 1210-1226

Comment:
**Partial-read path bypasses dreaming block stripping**

The dreaming-block filter is only applied on the full-file read path (line 1235). When `params.from` or `params.lines` is set, execution takes this earlier branch and returns `partial.selectedLines` raw — dreaming block markers and their content pass through unfiltered if they fall within the requested line window. Any `memory_get` call that specifies a line range on a daily file will still expose cross-session staging data, leaving the fix incomplete.

The same guard should be applied here, for example:

```ts
const rawLines = partial.selectedLines;
const selectedLines = isDailyMemoryPath(relPath)
  ? stripDreamingManagedBlocks(rawLines)
  : rawLines;
return buildMemoryReadResultFromSlice({
  selectedLines,
  ...
});
```

Note that stripping from a mid-file slice can shift reported line numbers, so this may need care; but the current behaviour is the worse trade-off since it silently leaks the data the PR is intended to hide.

How can I resolve this? If you propose a fix, please make it concise.

Reviews (1): Last reviewed commit: "fix(memory-core): strip dreaming managed..." | Re-trigger Greptile

Comment on lines +65 to +77
export function stripDreamingManagedBlocks(content: string): string {
let result = content;
for (const block of DREAMING_MANAGED_BLOCKS) {
const pattern = new RegExp(
`(?:${escapeRegex(block.heading)}\\n)?${escapeRegex(block.startMarker)}[\\s\\S]*?${escapeRegex(block.endMarker)}\\n?`,
"gm",
);
result = result.replace(pattern, "");
}
// Collapse runs of 3+ blank lines into 2.
result = result.replace(/\n{3,}/g, "\n\n");
return result;
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Plugin SDK API baseline not updated

memory-host-markdown is a published package.json export (./plugin-sdk/memory-host-markdown) and is listed in scripts/lib/plugin-sdk-entrypoints.json. Adding a new export (stripDreamingManagedBlocks) to it is a public Plugin SDK surface change, but pnpm plugin-sdk:api:gen was not run and docs/.generated/plugin-sdk-api-baseline.sha256 was not updated — the hash in the file is identical before and after this PR. pnpm plugin-sdk:api:check will fail in CI until the hash is regenerated and committed.

Run pnpm plugin-sdk:api:gen and commit the updated .sha256 file alongside this change.

Prompt To Fix With AI
This is a comment left during a code review.
Path: src/plugin-sdk/memory-host-markdown.ts
Line: 65-77

Comment:
**Plugin SDK API baseline not updated**

`memory-host-markdown` is a published `package.json` export (`./plugin-sdk/memory-host-markdown`) and is listed in `scripts/lib/plugin-sdk-entrypoints.json`. Adding a new export (`stripDreamingManagedBlocks`) to it is a public Plugin SDK surface change, but `pnpm plugin-sdk:api:gen` was not run and `docs/.generated/plugin-sdk-api-baseline.sha256` was not updated — the hash in the file is identical before and after this PR. `pnpm plugin-sdk:api:check` will fail in CI until the hash is regenerated and committed.

Run `pnpm plugin-sdk:api:gen` and commit the updated `.sha256` file alongside this change.

How can I resolve this? If you propose a fix, please make it concise.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83df36e3c7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

// Strip managed dreaming blocks from daily memory files so that
// light-sleep / REM staging data from other sessions is not leaked
// into memory_get results. See openclaw/openclaw#68367.
const fullText = isDailyMemoryPath(relPath) ? stripDreamingManagedBlocks(full.text) : full.text;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Strip dreaming blocks for paginated daily reads

The new filtering only runs on the full-read path, so requests that set from or lines still return raw daily file content. In practice, memory_get pagination commonly follows nextFrom from an initial truncated result, which takes this partial-read branch and can still surface managed light/REM blocks from other sessions. This leaves the cross-session leakage bug unfixed for continuation reads.

Useful? React with 👍 / 👎.

result = result.replace(pattern, "");
}
// Collapse runs of 3+ blank lines into 2.
result = result.replace(/\n{3,}/g, "\n\n");

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve blank lines when no dreaming block is removed

This helper always rewrites \n{3,} to \n\n, even when no dreaming markers are present, so daily-memory reads are no longer a no-op on ordinary content. That mutates user-authored formatting and can shift line positions in returned excerpts, which breaks the expectation that memory_get returns exact file excerpts unless a managed block was actually stripped.

Useful? React with 👍 / 👎.

…iles

Previously, memory_get calls with from/lines parameters on daily memory
files (memory/YYYY-MM-DD.md) bypassed the dreaming block filter, leaking
cross-session staging data from Light Sleep and REM Sleep phases.

The fix redirects partial reads of daily files through the full-read path:
read the entire file, strip dreaming managed blocks, then slice the
requested line range from the cleaned content.  This ensures line numbers
are consistent with a full read and no staging data is ever exposed.

Non-daily files continue to use the efficient streaming partial read path,
since they never contain dreaming blocks.

Daily memory files are small (a few KB) so the overhead of a full read is
negligible.

Resolves the TODO(openclaw#68367) left in the initial implementation.
Addresses review feedback on openclaw#68408.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b20b72e61d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +93 to +94
function isDailyMemoryPath(relPath: string): boolean {
return DAILY_MEMORY_PATH_RE.test(relPath);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Normalize path before deciding whether to strip dreaming blocks

resolveReadPath() canonicalizes user input, so requests like memory/./2026-04-18.md (or qmd/<collection>/memory/tmp/../2026-04-18.md) still resolve to the same daily file, but isDailyMemoryPath() matches the raw relPath string. Those normalized-equivalent paths fail DAILY_MEMORY_PATH_RE, so the new stripping logic is skipped and memory_get can still expose managed dreaming block content; this keeps the cross-session leakage fix bypassable via path syntax alone.

Useful? React with 👍 / 👎.

@clawsweeper

clawsweeper Bot commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Thanks for the context here. I swept through the related work, and this is now duplicate or superseded.

Keep open. The branch addresses a real memory-core cross-session leakage bug, but it is not merge-ready because the filter can still be bypassed through normalized-equivalent paths, the PR exposes a memory-core-specific helper as public Plugin SDK API without an intentional SDK contract path, and external real behavior proof is still missing.

Canonical path: Close this stale PR. The latest review rated it F, the branch still lacks merge-ready proof, and there has been no human follow-up after the durable review.

So I’m closing this here because the remaining work is already tracked in the canonical issue.

Review details

Best possible solution:

Close this stale PR. The latest review rated it F, the branch still lacks merge-ready proof, and there has been no human follow-up after the durable review.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main can write inline light/REM blocks into memory/YYYY-MM-DD.md and QmdMemoryManager.readFile returns raw full or partial content; the PR's remaining bypass is reproducible in source with a canonical-equivalent path such as memory/./YYYY-MM-DD.md.

Is this the best way to solve the issue?

No. The read-path filtering is a plausible mitigation, but the current implementation checks the wrong path shape and promotes a memory-core-specific helper into public SDK API instead of keeping the ownership boundary narrow.

Security review:

Security review needs attention: The PR targets a sensitive cross-session memory exposure, but the raw-path predicate leaves a concrete bypass in the security-sensitive read path.

  • [high] Daily path bypass leaves cross-session content readable — extensions/memory-core/src/memory/qmd-manager.ts:1216
    Because the filter checks raw relPath instead of the resolved workspace-relative path, canonical-equivalent daily paths can still return managed dreaming candidates from other sessions.
    Confidence: 0.92

AGENTS.md: found and applied where relevant.

What I checked:

  • stale F-rated PR: PR was opened 2026-04-18T04:40:57Z, is older than 30 days, and the latest review rated it F.
  • proof blocker: real behavior proof is missing and proof tier is F, so this branch is not merge-ready without contributor follow-up.
  • no human follow-up: live comments and timeline hydrated by apply contain no non-automation activity after the ClawSweeper review.

Likely related people:

  • Vincent Koc: Local current-main blame in the shallow/grafted checkout attributes QmdMemoryManager.readFile, memory-host-markdown, dreaming-markdown, and the managed dreaming marker helper code to this author. (role: current read-path and marker-code contributor; confidence: medium; commits: ecec1b9a59df; files: extensions/memory-core/src/memory/qmd-manager.ts, src/plugin-sdk/memory-host-markdown.ts, extensions/memory-core/src/dreaming-markdown.ts)
  • Peter Steinberger: Recent commit 3f5e001 refactored memory-core dreams state, touching dreaming-phases, short-term promotion, plugin runtime facades, and related tests near this bug's ownership boundary. (role: recent adjacent dreaming-state contributor; confidence: medium; commits: 3f5e00184431; files: extensions/memory-core/src/dreaming-phases.ts, extensions/memory-core/src/short-term-promotion.ts, src/plugin-sdk/memory-core-bundled-runtime.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1d2bebbb41bf.

@clawsweeper

clawsweeper Bot commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge.

What this changes:

This PR adds a public Plugin SDK markdown helper for stripping managed Light Sleep and REM dreaming blocks, wires it into memory-core QMD daily-memory full and partial reads, and adds focused helper/read-path tests.

Maintainer follow-up before merge:

This is an active contributor implementation PR for a real memory isolation bug, but the remaining work is normal maintainer review/request-changes on the source branch rather than a duplicate automated replacement PR by default.

Review findings:

  • [P1] Normalize paths before daily-memory detection — extensions/memory-core/src/memory/qmd-manager.ts:91
  • [P2] Update the Plugin SDK API baseline — src/plugin-sdk/memory-host-markdown.ts:65
  • [P2] Only collapse blank lines after stripping a block — src/plugin-sdk/memory-host-markdown.ts:75
Review details

Best possible solution:

Land a corrected memory-core read-path filter that classifies daily files from the resolved canonical path, strips only managed Light/REM blocks from both full and paginated memory_get reads, preserves ordinary daily-note text byte-for-byte when no managed block is removed, keeps dreaming internals reading raw files, and updates the Plugin SDK API baseline if the helper remains public.

Full review comments:

  • [P1] Normalize paths before daily-memory detection — extensions/memory-core/src/memory/qmd-manager.ts:91
    resolveReadPath() canonicalizes requests before reading, but the new daily-file check tests the raw relPath string. A request such as memory/./2026-04-18.md can still resolve to the same daily file while skipping the stripping branch, so managed Light/REM blocks remain exposed. Base this decision on the resolved workspace-relative path instead.
    Confidence: 0.91
  • [P2] Update the Plugin SDK API baseline — src/plugin-sdk/memory-host-markdown.ts:65
    memory-host-markdown is a published Plugin SDK entrypoint, and this PR adds a new public export from it. Without regenerating and committing docs/.generated/plugin-sdk-api-baseline.sha256, pnpm plugin-sdk:api:check will fail in CI.
    Confidence: 0.9
  • [P2] Only collapse blank lines after stripping a block — src/plugin-sdk/memory-host-markdown.ts:75
    stripDreamingManagedBlocks() always rewrites runs of blank lines, even when no dreaming markers were removed. Daily memory_get reads should remain exact excerpts for ordinary user-authored notes; this can alter formatting and shift continuation line positions.
    Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.9

Acceptance criteria:

  • pnpm test extensions/memory-core/src/memory/qmd-manager.test.ts src/plugin-sdk/memory-host-markdown.test.ts
  • pnpm plugin-sdk:api:check
  • pnpm check:changed

What I checked:

  • Current main read path is unfiltered: QmdMemoryManager.readFile() resolves the requested path, then partial reads return partial.selectedLines and full reads pass full.text into buildMemoryReadResult; there is no daily-memory dreaming-block stripping in current main. (extensions/memory-core/src/memory/qmd-manager.ts:1310, 3215ab6de5db)
  • Inline dreaming blocks can still exist: writeDailyDreamingPhaseBlock() writes managed Light/REM blocks into memory/YYYY-MM-DD.md when storage mode is inline or both, so legacy files and explicit inline/both configs remain relevant even though the default is separate. (extensions/memory-core/src/dreaming-markdown.ts:50, 3215ab6de5db)
  • Existing sanitizer is not on memory_get reads: Current main has stripManagedDailyDreamingLines(), but it is used while dreaming ingests daily files into recall candidates, not by QmdMemoryManager.readFile() or memory_get. (extensions/memory-core/src/dreaming-phases.ts:318, 3215ab6de5db)
  • PR diff leaves path-normalization bypass: The branch tests isDailyMemoryPath(relPath) against the raw requested relPath after resolveReadPath() has already canonicalized the actual file, so inputs such as memory/./2026-04-18.md can resolve to a daily file while skipping the new filter. (extensions/memory-core/src/memory/qmd-manager.ts:91, b20b72e61d67)
  • Public SDK API baseline is required: memory-host-markdown is a published package export and listed Plugin SDK entrypoint; the PR adds a public export there but changes only four files and does not include docs/.generated/plugin-sdk-api-baseline.sha256. (package.json:1008, 3215ab6de5db)
  • Security review pass: The PR file surface is limited to memory-core read logic, the Plugin SDK markdown helper, and tests; no workflows, dependency sources, lockfiles, package scripts, publishing metadata, or secret handling are mixed in. The security-relevant blocker is incomplete filtering of cross-session memory content if merged as-is. (b20b72e61d67)

Likely related people:

  • steipete: Recent main history shows multiple qmd-manager fixes immediately around the affected QmdMemoryManager.readFile() surface, including qmd boot refresh, vector status parsing, collection grouping, dirty watcher state, and qmd root memory collection scoping. (role: recent maintainer; confidence: high; commits: afc4f06ca3c7, f9946eb06950, 4ebec8b5dc83; files: extensions/memory-core/src/memory/qmd-manager.ts)
  • vincentkoc: History shows memory-host markdown and dreaming markdown work, including adding memory host aliases, restoring the memory wiki stack, and nearby dreaming artifact/event helper changes that this PR extends or depends on. (role: introduced adjacent SDK/dreaming helpers; confidence: medium; commits: b0c7bac9ce60, 5716d83336fd, d1c7d9af800d; files: src/plugin-sdk/memory-host-markdown.ts, extensions/memory-core/src/dreaming-markdown.ts)
  • gumadeiras: The closest existing current-main sanitizer for managed dreaming data is the dreaming self-ingestion blocker, which touched dreaming-phases around managed dreaming lines and tests. (role: adjacent behavior owner; confidence: medium; commits: 0c4e0d703023; files: extensions/memory-core/src/dreaming-phases.ts, extensions/memory-core/src/dreaming-phases.test.ts)
  • mjamiv: The default storage.mode change to separate is directly related to the PR body’s legacy/explicit-inline context, but it does not remove the need for read-path filtering for old or explicit inline/both daily files. (role: adjacent default-storage change author; confidence: medium; commits: 8c392f0019b0; files: src/memory-host-sdk/dreaming.ts)

Remaining risk / open question:

  • I did not run tests or generated API checks because this was a read-only review; the PR still needs targeted tests plus pnpm plugin-sdk:api:check and pnpm check:changed before merge.
  • The related bug report is already closed even though current main lacks this read-path filter; maintainers should confirm whether this PR is still the intended follow-up for legacy and explicit inline/both storage modes.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 3215ab6de5db.

@jasonmakr

Copy link
Copy Markdown
Author

Thanks for the detailed reviews! I understand the three main issues:

P1: Path normalization bypass
The current code checks isDailyMemoryPath(relPath) on the raw request string, but resolveReadPath() has already canonicalized the actual file path. Will fix by checking the resolved canonical path instead.

P2: Plugin SDK API baseline
Will run pnpm plugin-sdk:api:gen and commit the updated docs/.generated/plugin-sdk-api-baseline.sha256.

P2: Blank line preservation
stripDreamingManagedBlocks() currently always collapses \n{3,} even when no dreaming markers were removed. Will add a flag to track whether any blocks were actually stripped, and only collapse blank lines in that case.

Working on fixes now.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 19, 2026
@openclaw-barnacle openclaw-barnacle Bot added the triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. label May 19, 2026
@clawsweeper clawsweeper Bot added P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels May 20, 2026
@clawsweeper

clawsweeper Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?
  • The egg game starts only after the PR passes the real-behavior proof check.
  • Before that, no creature or rarity is rolled. The treat waits for real proof.
  • This is still just collectible flavor: proof affects review readiness, not creature quality.

@openclaw-barnacle

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@openclaw-barnacle openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jun 6, 2026
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 6, 2026
@clawsweeper clawsweeper Bot removed the status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. label Jun 6, 2026
@openclaw-barnacle openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jun 7, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 7, 2026
@clawsweeper

clawsweeper Bot commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper applied the proposed close for this PR.

@clawsweeper clawsweeper Bot closed this Jun 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

extensions: memory-core Extension: memory-core merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P1 High-priority user-facing bug, regression, or broken workflow. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: M status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Light Sleep dreaming phase contaminates unrelated sessions with cross-context memory candidates

1 participant