Summary

Adds an optional originAgent field to ChatInjectParamsSchema and persists it as a separate, dedicated attribution field on the injected assistant transcript entry. The pre-existing (provider: "openclaw", model: "gateway-injected") sentinel pair is preserved unchanged, so the runtime replay filter at src/agents/pi-embedded-runner/replay-history.ts:271 continues to correctly drop these rows from being replayed back to the next model call.

UI avatar/handle resolvers can key off the new persisted originAgent field to render the true source of a cross-agent inject (e.g. Hermes, Codex) instead of always showing the OpenClaw avatar.

Why

chat.inject is the canonical RPC for cross-agent transcript writes. Today the persisted entry has provider: "openclaw" hard-coded, with additionalProperties: false on the schema closing the door on any caller-supplied attribution. When external agents (Hermes, Codex, Claude Code, etc.) inject via this RPC, the message renders with OpenClaw's avatar and the only visible attribution is whatever the caller embeds in body text. This breaks the "who said what" guarantee in long transcripts.

Discovered in production by an external agent (Hermes) attempting a cross-agent verify ping into a webchat session. The body-tag workaround ("FROM: Hermes —") works at-a-glance but degrades attribution clarity over time and across many entries.

Behavior

• With originAgent set: persisted entry gets a new originAgent: "<value>" field. provider and model are unchanged.
• Without originAgent: behavior is byte-identical to current main. No new field is written. Fully backward compatible.
• Empty / whitespace-only input: schema rejects literal "" (minLength: 1); persistence helper additionally trims whitespace and treats blanks as absent, so a malformed value never lands on disk even if a future schema change loosens validation.

Why a separate field, not provider override

The Codex review on the prior commit caught a real correctness defect: provider is part of the runtime replay contract, not just display. normalizeAssistantReplayContent (src/agents/pi-embedded-runner/replay-history.ts:271) drops gateway-injected rows from model replay only when provider === "openclaw" and the model is one of { "delivery-mirror", "gateway-injected" }. Overwriting provider would have caused transcript-only injects to leak into model context, duplicating content and risking provider ordering rejections.

The redesigned patch keeps the sentinel pair untouched and adds attribution as a dedicated parallel field. UI consumers read the new field; the replay filter is unaffected.

Security

chat.inject is already gated at operator-privilege scope (src/gateway/method-scopes.ts). Anyone who can call it can already write arbitrary assistant content into a session transcript. originAgent is purely presentational and introduces no new impersonation surface beyond what current authorized callers already possess. Because the sentinel pair is preserved, the previously-flagged security risk (UI-only injects entering model replay) does not apply to this revision.

Files

• src/gateway/protocol/schema/logs-chat.ts — schema field with minLength: 1, maxLength: 100
• src/gateway/server-methods/chat.ts — handler param + helper threading
• src/gateway/server-methods/chat-transcript-inject.ts — new persisted field, sentinel preserved, trim+empty normalization
• apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift — regenerated via pnpm protocol:gen:swift

Real behavior proof

Behavior or issue addressed: Cross-agent chat.inject calls render with the OpenClaw avatar in the operator's webchat UI because the persisted assistant entry has no caller-controlled attribution field. External agents currently have no way to mark the inject as their own without putting "FROM: Hermes —" inline in body text, which degrades transcript clarity. This patch adds a dedicated originAgent persisted field while preserving the (provider: "openclaw", model: "gateway-injected") sentinel that the replay-history filter relies on.

Real environment tested: Sandboxed checkout of openclaw main at /tmp/openclaw-pr/openclaw-fresh with the patched files and the regenerated protocol bindings. Used the actual openclaw runtime — appendInjectedAssistantMessageToTranscript and validateChatInjectParams are invoked via node through tsx against synthetic transcript fixtures created with the project's own createTranscriptFixtureSync helper. No mocks, no stubs, no real session keys, no production data.

Exact steps or command run after this patch:

node node_modules/.bin/tsx scripts/proof-chat-inject-origin-agent.mts
node node_modules/.bin/tsx scripts/proof-chat-inject-schema.mts

Both scripts are committed under scripts/ in this PR so a maintainer can rerun them.

Evidence after fix: Live stdout captured from the runtime invocations above. Persistence-layer output shows the actual provider, model, and originAgent fields read back from the jsonl transcript file on disk after the patched code wrote to it. Schema-layer output is the AJV validator's verdict on real input shapes.

Persistence-layer terminal output (live runtime, the patched code path actually executed):

OpenClaw chat.inject originAgent attribution — real-behavior proof
Patched modules under test:
  src/gateway/server-methods/chat-transcript-inject.ts
  src/gateway/protocol/schema/logs-chat.ts (schema field)
  src/gateway/server-methods/chat.ts (handler threading)

Design:
  provider stays 'openclaw' (replay-filter sentinel preserved)
  originAgent is a NEW persisted field for display-only attribution
  empty/whitespace originAgent is normalized to absent

=================================================
CASE                  : baseline-no-origin
input.originAgent     : <unset>
append.ok             : true
messageId             : 09641925-2611-4401-86c6-d369a045b518
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : <absent>
expected.originAgent  : absent
result                : PASS

=================================================
CASE                  : hermes
input.originAgent     : "hermes"
append.ok             : true
messageId             : fcd260be-a790-489b-82e5-f393d136e321
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : hermes
expected.originAgent  : hermes
result                : PASS

=================================================
CASE                  : codex
input.originAgent     : "codex"
append.ok             : true
messageId             : ef02a786-0e71-48d3-aafb-b861049d8301
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : codex
expected.originAgent  : codex
result                : PASS

=================================================
CASE                  : blank-empty-string
input.originAgent     : ""
append.ok             : true
messageId             : 9943b96b-9bfc-4050-a997-b362c10e2422
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : <absent>
expected.originAgent  : absent
result                : PASS

=================================================
CASE                  : whitespace-only
input.originAgent     : "   "
append.ok             : true
messageId             : 2aa2899d-a2f7-4679-a404-4236009f8c79
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : <absent>
expected.originAgent  : absent
result                : PASS

=================================================
CASE                  : trim-surrounding-whitespace
input.originAgent     : "  hermes  "
append.ok             : true
messageId             : 4b1f86b7-060d-4cce-a81a-0cfcfb70ddca
stamped.provider      : openclaw
stamped.model         : gateway-injected
stamped.originAgent   : hermes
expected.originAgent  : hermes
result                : PASS

Schema-layer terminal output (live AJV validator on patched schema):

ChatInjectParamsSchema validator behavior:

---
CASE     : legacy params (sessionKey + message + label)
accepted : true
---
CASE     : patched params (with non-empty originAgent)
accepted : true
---
CASE     : rejects empty-string originAgent (minLength:1)
accepted : false
errors   : [{"instancePath":"/originAgent","schemaPath":"#/properties/originAgent/minLength","keyword":"minLength","params":{"limit":1},"message":"must NOT have fewer than 1 characters"}]
---
CASE     : rejects unknown extra fields (additionalProperties:false preserved)
accepted : false
errors   : [{"instancePath":"","schemaPath":"#/additionalProperties","keyword":"additionalProperties","params":{"additionalProperty":"somethingMadeUp"},"message":"must NOT have additional properties"}]

Observed result after fix:

• Baseline call (no originAgent) → persisted entry has provider: "openclaw", model: "gateway-injected", no originAgent field. Byte-identical to current-main behavior; replay filter still matches.
• Patched call (originAgent: "hermes") → persisted entry has provider: "openclaw", model: "gateway-injected", and a new originAgent: "hermes" field. Replay filter still matches the sentinel pair and drops the row; UI consumers can attribute it to Hermes via the new field.
• Patched call (originAgent: "codex") → same as above with originAgent: "codex". Confirms the field is not Hermes-specific.
• Blank input ("" or whitespace-only) → persisted entry has no originAgent field. The persistence helper trims and normalizes, so malformed input cannot land on disk.
• Trimmed input (" hermes ") → persisted entry has originAgent: "hermes" (whitespace-stripped).
• Schema validator accepts non-empty originAgent, rejects literal "" via the new minLength: 1, and continues to reject unknown extra fields via the unchanged additionalProperties: false.

What was not tested: End-to-end UI render in the actual webchat surface (visually confirming a Hermes avatar/handle in the live React UI keyed off the new originAgent field) is intentionally out of scope for this PR — the patch only adds the persisted attribution field; UI consumption is a follow-up that will pick up the field from the transcript. The replay-filter regression that the prior PR revision would have introduced is now structurally impossible because the sentinel pair is unchanged; no run-time replay test was added because the contract being preserved already has coverage in src/agents/pi-embedded-runner/replay-history.test.ts.

🤖 Generated with Claude Code