Greptile Summary

This PR fixes session routing for configured non-main default agents: new --to sessions are now keyed and stored under the default agent's namespace, while a backward-compatibility shim (resolveLegacyMainStoreSessionForDefaultAgent) resumes pre-existing agent:main:<mainKey> rows from the main store so no prior session is silently forked. The Slack fallback path and resolveSessionKey signature receive the matching agentId propagation.

Confidence Score: 4/5

Safe to merge; logic is sound and well-tested. One minor test-mock fidelity concern noted.

No P0 or P1 issues found. The session-key routing logic, the legacy fallback, and the shared-store deduplication are all correctly implemented and covered by focused tests. A single P2 observation about the resolveDefaultAgentId mock in session.test.ts not applying normalizeAgentId keeps the score at 4.

No files require special attention. src/agents/command/session.ts carries the most logic and is well-covered by the accompanying tests.

This is a comment left during a code review.
Path: src/commands/agent/session.test.ts
Line: 30-38

Comment:
**Test mock omits `normalizeAgentId` on the return value**

The inline mock for `resolveDefaultAgentId` returns the raw `.id` string directly, while the real `resolveDefaultAgentId` in `agent-scope-config.ts` always passes the chosen id through `normalizeAgentId(chosen || DEFAULT_AGENT_ID)` before returning. The divergence means tests won't catch bugs triggered by an unnormalized agent id in config (e.g. `{ id: "MyBot" }` → mock returns `"MyBot"`, real function returns `"mybot"`).

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(clownfish): address review for ghcra..." | Re-trigger Greptile}

ProjectClownfish follow-up pushed: 5c81bf6

Fix:

• rebased onto current main
• resolved Slack SDK import drift from the rebase
• addressed Greptile's test mock finding by normalizing the mocked default-agent id like production
• addressed Aisle's cross-agent fallback concern by migrating legacy agent:main:<mainKey> entries into the configured default-agent store instead of returning the legacy main store

Blacksmith validation:

• pnpm test:serial src/commands/agent/session.test.ts src/agents/command/session.resolve-session-key.test.ts src/config/sessions/session-key.test.ts extensions/slack/src/monitor/monitor.test.ts
• pnpm check:changed

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

​// Copies full legacy entry into a different agent's session key
opts.sessionStore[opts.sessionKey] = { ...legacyEntry };

const { sessionId, updatedAt } = legacyEntry;
opts.sessionStore[opts.sessionKey] = { sessionId, updatedAt: Date.now() };
​// do NOT carry over auth/acp/exec overrides, delivery context, plugin owner, etc.

Analyzed PR: #72414 at commit 9e1db57

_{Last updated on: 2026-04-27T22:04:56Z}

ProjectClownfish follow-up on latest head a4a9185122:

• fixed the touched Slack monitor import to use the narrow openclaw/plugin-sdk/agent-runtime surface instead of deprecated config-runtime
• Blacksmith: pnpm lint:plugins:no-monolithic-plugin-sdk-entry-imports passed
• Blacksmith: pnpm test:serial src/commands/agent/session.test.ts src/agents/command/session.resolve-session-key.test.ts src/config/sessions/session-key.test.ts extensions/slack/src/monitor/monitor.test.ts passed
• Blacksmith: pnpm check:changed passed

ProjectClownfish rebased follow-up on latest head 9e1db57:

• rebased onto current origin/main
• preserved the Slack narrow openclaw/plugin-sdk/agent-runtime import fix
• confirmed current base already fixes the Telegram route test helper to use runtime-config-snapshot, removing the stale merge-ref config-runtime failure
• Blacksmith: pnpm lint:plugins:no-monolithic-plugin-sdk-entry-imports && pnpm check:deprecated-internal-config-api passed
• Blacksmith: pnpm test:serial src/commands/agent/session.test.ts src/agents/command/session.resolve-session-key.test.ts src/config/sessions/session-key.test.ts extensions/slack/src/monitor/monitor.test.ts passed
• Blacksmith: pnpm check:changed passed