Skip to content

feat: add per-agent compaction overrides (AI-assisted)#83637

Closed
kklouzal wants to merge 102 commits into
openclaw:mainfrom
kklouzal:feat/agent-compaction-overrides
Closed

feat: add per-agent compaction overrides (AI-assisted)#83637
kklouzal wants to merge 102 commits into
openclaw:mainfrom
kklouzal:feat/agent-compaction-overrides

Conversation

@kklouzal

@kklouzal kklouzal commented May 18, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds per-agent compaction and contextPruning overrides so each configured agent can resolve maintenance/runtime behavior from its active agent scope instead of always inheriting every value from agents.defaults.

This is for multi-agent installations where main, channel/proxy, local/self-hosted, and Codex/app-server agents need different compaction, pruning, timeout, thinking-level, and transcript-maintenance behavior.

Linked Issues And Related Work

Closes #52732

Related: #52751, #69988, #19501, #15826, #43834, #6571, #6572, #30452, #57901, #58077, #59863, #60512, #80784, #82008

Problem / Root Cause

Before this change, per-agent compaction settings were either rejected by schema or only partially honored. Several runtime paths still read agents.defaults.compaction / agents.defaults.contextPruning even when the active agents.list[] entry had its own settings.

That weakened these setups:

  • main/default agent compacts with one model/provider while another agent compacts with another
  • local/self-hosted agents use local provider aliases for compaction
  • Codex/app-server agents intentionally omit or ignore OpenClaw model overrides and keep native server-side compaction behavior
  • legacy/non-agent-shaped session keys still need an explicit non-main agentId preserved across queued/direct compaction and maintenance paths
  • queued/CLI/context-engine compaction should use compaction.thinkingLevel, not the active run's normal thinking level

What Changed

  • Adds strict schema/docs support for agents.list[].compaction and per-agent contextPruning.
  • Deep-merges per-agent compaction and contextPruning blocks over agents.defaults, so partial overrides inherit unspecified fields.
  • Resolves compaction model/provider/auth-profile/timeout/cache/pruning/reserve/thinking settings through the active session agent.
  • Threads sessionAgentId through queued/direct compaction, CLI compaction, context-engine maintenance, Codex app-server lifecycle, embedded cache-TTL finalization, memory flush, transcript rotation, and follow-up/notice paths.
  • Keeps explicit OpenClaw compaction.model behavior separate from Codex/app-server native runtime selection.
  • Adds regression coverage for legacy-session/non-main-agent scope in direct, queued, CLI, Codex lifecycle, cache-TTL, memory-flush, empty/partial merge, and compaction thinking-level propagation paths.

Reviewer Notes

The key invariant is:

A compaction run should resolve configuration from the same active agent scope as the session/run that triggered it, even when the session key is legacy-shaped and does not encode agent:<id>:.

That is why this PR explicitly passes agentId into compaction and maintenance params instead of relying only on parsing sessionKey.

Real behavior proof

  • Behavior or issue addressed: refreshed live proof for PR feat: add per-agent compaction overrides (AI-assisted) #83637 at head f723ad186d7879d12c61562dd4c2dab3745b5ed3, covering per-agent compaction override resolution for model/provider, thinking level, timeout, reserve-token floor, small-context reserve-floor capping, clean config validation, focused compaction regression coverage, and actual model/gateway requests after the patch.
  • Real environment tested: Nano-01 / Orion proof host at /home/kklouzal/openclaw-pr-83637, detached checkout f723ad186d7879d12c61562dd4c2dab3745b5ed3, Node v24.15.0, pnpm 11.2.2, model github-copilot/gpt-5-mini, clean proof config at /home/kklouzal/openclaw-pr-83637/.artifacts/proof-refresh-f723ad18-20260527T050453Z/model-home/openclaw.json, redacted artifacts at /home/kklouzal/openclaw-pr-83637/.artifacts/proof-refresh-f723ad18-20260527T050453Z/redacted.
  • Exact steps or command run after this patch: fetched the pushed fork branch, detached the proof checkout to f723ad186d7879d12c61562dd4c2dab3745b5ed3, ran pnpm install --frozen-lockfile, pnpm build:strict-smoke, focused compaction Vitest coverage, tsgo core and core-test typechecks, git diff --check, a source-import compaction config proof, clean openclaw config validate, openclaw models status --probe --json, openclaw infer model run --local --model github-copilot/gpt-5-mini, OPENCLAW_LIVE_MODELS=github-copilot/gpt-5-mini node scripts/test-live.mjs src/agents/models.profiles.live.test.ts, and OPENCLAW_LIVE_GATEWAY_MODELS=github-copilot/gpt-5-mini node scripts/test-live.mjs src/gateway/gateway-models.profiles.live.test.ts.
  • Evidence after fix: focused compaction suite passed 22 files / 779 tests; build:strict-smoke, tsgo core, tsgo core-test, and git diff --check passed; the compaction config proof returned status: pass; clean config validation passed; direct model output returned OPENCLAW_PR83637_F723AD18_OK; live direct model suite passed 17 tests; live gateway suite passed 68 tests.
Redacted command summary and compaction proof
{
  "pr": 83637,
  "head": "f723ad186d7879d12c61562dd4c2dab3745b5ed3",
  "host": "Nano-01",
  "artifact": "/home/kklouzal/openclaw-pr-83637/.artifacts/proof-refresh-f723ad18-20260527T050453Z",
  "commands": {
    "01-install": "0",
    "02-build-strict-smoke": "0",
    "03-config-validate": "1",
    "04-focused-compaction-tests": "0",
    "05-tsgo-core": "0",
    "06-tsgo-core-test": "0",
    "07-diff-check": "0",
    "08-compaction-config-proof": "0",
    "09-clean-config-validate": "0",
    "10-models-status": "0",
    "11-model-run": "0",
    "12-live-models": "0",
    "13-live-gateway-models": "0"
  },
  "markers": {
    "model": true,
    "liveModels": true,
    "liveGateway": true,
    "compactionConfig": true
  }
}
{
  "status": "pass",
  "head": "f723ad186d7879d12c61562dd4c2dab3745b5ed3",
  "default": {
    "timeoutMs": 90000,
    "think": "minimal",
    "target": {
      "provider": "github-copilot",
      "model": "gpt-5-mini"
    },
    "floor": 20000,
    "settings": {
      "applied": {
        "didOverride": true,
        "compaction": {
          "reserveTokens": 20000,
          "keepRecentTokens": 1024
        }
      },
      "reserve": 20000,
      "keep": 1024
    }
  },
  "flat": {
    "timeoutMs": 61000,
    "think": "off",
    "target": {
      "provider": "openai",
      "model": "gpt-5.4-mini"
    },
    "floor": 0,
    "settings": {
      "applied": {
        "didOverride": true,
        "compaction": {
          "reserveTokens": 2048,
          "keepRecentTokens": 512
        }
      },
      "reserve": 2048,
      "keep": 512
    }
  },
  "nested": {
    "timeoutMs": 122000,
    "think": "high",
    "target": {
      "provider": "github-copilot",
      "model": "gpt-5.4-mini",
      "authProfileId": "copilot-auth"
    },
    "floor": 24000,
    "settings": {
      "applied": {
        "didOverride": true,
        "compaction": {
          "reserveTokens": 24000,
          "keepRecentTokens": 2048
        }
      },
      "reserve": 24000,
      "keep": 2048
    }
  },
  "smallWindow": {
    "applied": {
      "didOverride": true,
      "compaction": {
        "reserveTokens": 8384,
        "keepRecentTokens": 512
      }
    },
    "reserve": 8384,
    "keep": 512
  },
  "runtime": {
    "provider": "openai",
    "model": "gpt-5.4-mini",
    "thinkLevel": "off"
  }
}
  • Observed result after fix: per-agent compaction settings resolved independently: defaults produced timeoutMs=90000, think=minimal, and github-copilot/gpt-5-mini; flat-agent overrode to timeoutMs=61000, think=off, provider/model openai/gpt-5.4-mini, and dropped the mismatched auth profile; nested-agent overrode to timeoutMs=122000, think=high, github-copilot/gpt-5.4-mini, and retained the matching auth profile; small-context capping reduced reserve tokens to 8384 for a 16K context budget. Real direct and gateway model requests completed successfully after the patch.
  • What was not tested: this run did not restart the production Dev-01 gateway or mutate the live Discord proof agents. The default host config on Nano-01 still contains newer slot shapes unrelated to feat: add per-agent compaction overrides (AI-assisted) #83637 and failed validation there; the clean proof config passed and was used for model/gateway evidence. Codex app-server native compaction still owns server-side compaction model behavior, so OpenClaw-selected model override usage is proven through source/runtime resolution and focused tests rather than by claiming Codex server-side model selection.

Validation

Acceptance commands requested by ClawSweeper:

node scripts/test-projects.mjs src/agents/agent-scope.test.ts src/agents/pi-settings.test.ts src/agents/pi-embedded-runner/compaction-runtime-context.test.ts src/agents/command/cli-compaction.test.ts src/auto-reply/reply/agent-runner-memory.test.ts

Result:

[test] starting test/vitest/vitest.auto-reply.config.ts
Test Files 1 passed (1)
Tests 25 passed (25)

[test] starting test/vitest/vitest.agents.config.ts
Test Files 4 passed (4)
Tests 115 passed (115)

[test] passed 2 Vitest shards in 19.18s

Schema baseline:

node --import tsx scripts/generate-base-config-schema.ts --check
[base-config-schema] ok

Config docs baseline:

node --import tsx scripts/generate-config-doc-baseline.ts --check
OK docs/.generated/config-baseline.sha256

Note: this docs-baseline check initially caught stale committed hash drift. I regenerated docs/.generated/config-baseline.sha256, committed it as 04170e48eb01fc29f7f3acb1a830c5742b41c3ea, and reran the check successfully.

Additional gate:

git diff --check
passed

Final Merge/Polish Validation

After conflict cleanup, final branch polish, and the latest main merge repair, the PR was pushed at f239d594d22b56837bb371770898c30759e81515. The final name-only diff is scoped to compaction, context-pruning, Codex app-server compaction, memory-flush maintenance, docs, schema baselines, and regression tests; the unrelated memory-slot architecture leak has been removed from this PR surface.

Final local gates on the pushed head:

node scripts/test-projects.mjs src/agents/skills.test.ts src/commands/channel-setup/plugin-install.test.ts src/plugins/plugin-registry.test.ts test/scripts/check-extension-package-tsc-boundary.test.ts test/scripts/docker-all-scheduler.test.ts
Test Files 5 passed; Tests 101 passed

node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check
OK docs/.generated/plugin-sdk-api-baseline.sha256

PATH="/tmp/openclaw-corepack-bin:" pnpm prompt:snapshots:check
Prompt snapshots are current (7 files)

PATH="/tmp/openclaw-corepack-bin:" OPENCLAW_ADDITIONAL_BOUNDARY_SHARD=1/4 OPENCLAW_ADDITIONAL_BOUNDARY_CONCURRENCY=4 node scripts/run-additional-boundary-checks.mjs
6/6 shard checks passed

git diff --check
passed

Current Branch State

  • Base branch: main
  • Head: f239d594d22b56837bb371770898c30759e81515
  • GitHub reports the PR as mergeable and clean with no failed or pending checks after the latest push.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime agents Agent runtime and tooling size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 18, 2026
@clawsweeper

clawsweeper Bot commented May 18, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed May 30, 2026, 9:01 PM ET / 01:01 UTC.

Summary
The branch adds per-agent compaction config and compaction thinking-level propagation across agent, Codex app-server, memory-flush, docs, baselines, and regression tests, while the current PR surface also includes dependency/version/changelog deltas.

Reproducibility: yes. source inspection gives a high-confidence reproduction path: current main has a strict AgentEntrySchema without per-agent compaction/contextPruning and default-only compaction/contextPruning runtime reads. The PR head fixes part of that path for compaction but still leaves per-agent contextPruning rejected or ignored.

Review metrics: 2 noteworthy metrics.

  • Config surfaces: 1 per-agent compaction block added, 1 compaction thinking-level option added, 1 promised contextPruning override missing. These are public config/default semantics, so maintainers need to review both fresh-install and upgrade behavior before merge.
  • Dependency graph guard: 10 dependency-related files flagged by automation. External PR dependency graph changes are a supply-chain and release-management surface that green unit tests do not settle.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦪 silver shellfish
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add schema/runtime/docs/tests for per-agent contextPruning, not only compaction.
  • Remove or get explicit approval for dependency graph, version, lockfile, and changelog changes.
  • Update the PR body with exact-head real behavior proof for the current SHA; after updating, ClawSweeper should re-review automatically, or a maintainer can comment @clawsweeper re-review.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: The PR body contains detailed terminal/live proof for older heads, but the live head is 4c6c786 and still needs exact-head proof after the latest fixes, with private hosts, IPs, tokens, phone numbers, and endpoints redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] The PR changes public config/default behavior for compaction model/provider/auth-profile, thinking-level, memory-flush, transcript-rotation, and context maintenance; maintainers need to explicitly accept the upgrade semantics before merge.
  • [P1] The current head is blocked by dependency graph changes in an external PR, including package manifest, shrinkwrap, lockfile, version, peerDependency, and dependency deltas.
  • [P1] The strongest real-environment proof in the PR body is for older heads, while the live head is 4c6c786 and includes later CI-fallout changes.

Maintainer options:

  1. Fix and narrow before merge (recommended)
    Add the missing contextPruning schema/runtime/docs/tests, remove dependency/version/changelog drift or get explicit approval, rebase to a clean head, and refresh exact-head proof.
  2. Explicitly accept public config semantics
    Maintainers may choose to accept the new per-agent compaction semantics after confirming upgrade behavior for existing configs, provider routing, auth profiles, and session maintenance paths.
  3. Pause for a replacement branch
    If the current branch cannot be reduced to the compaction/context-pruning feature without unrelated dependency and release drift, close or pause it in favor of a narrow replacement PR.

Next step before merge

  • [P1] Manual review is needed because the remaining blockers include public config semantics, dependency/security approval or cleanup, and contributor-provided exact-head real behavior proof rather than a narrow automation-only repair.

Security
Needs attention: The patch needs supply-chain attention because the live dependency guard reports blocked dependency graph changes from an external PR.

Review findings

  • [P1] Accept per-agent contextPruning in the schema — src/config/zod-schema.agent-runtime.ts:1141
  • [P1] Resolve pruning settings from the active agent — src/agents/embedded-agent-runner/extensions.ts:145
  • [P1] Keep dependency graph changes out of this PR — package.json:3
Review details

Best possible solution:

Land a narrowed, clean head that implements both per-agent compaction and per-agent contextPruning end to end, removes release/dependency/changelog drift unless explicitly approved, and includes exact-head real behavior proof for config validation plus direct/gateway compaction resolution.

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection gives a high-confidence reproduction path: current main has a strict AgentEntrySchema without per-agent compaction/contextPruning and default-only compaction/contextPruning runtime reads. The PR head fixes part of that path for compaction but still leaves per-agent contextPruning rejected or ignored.

Is this the best way to solve the issue?

No, not as submitted: resolving compaction through the active agent is the right direction, but the PR still misses the matching contextPruning contract and carries dependency/release drift. The narrower solution is to complete the shared per-agent config resolver for both blocks and keep unrelated package/release changes out of this PR.

Full review comments:

  • [P1] Accept per-agent contextPruning in the schema — src/config/zod-schema.agent-runtime.ts:1141
    This PR still only adds compaction to AgentEntrySchema. Because the schema is strict, the agents.list[].contextPruning block promised by the PR body and linked issue remains an unrecognized key, so the PR would not actually close that half of the request.
    Confidence: 0.96
  • [P1] Resolve pruning settings from the active agent — src/agents/embedded-agent-runner/extensions.ts:145
    The context-pruning factory still reads agents.defaults.contextPruning directly. Even after adding schema support, a non-default agent's pruning TTL or mode would be ignored unless this path resolves the active agent's merged contextPruning settings the same way compaction now does.
    Confidence: 0.94
  • [P1] Keep dependency graph changes out of this PR — package.json:3
    Against current main, this head rolls root/package metadata back to 2026.5.28 and changes package manifests, lockfiles, shrinkwraps, and dependencies; the dependency graph guard already blocks these external PR changes. Rebase or drop the release/dependency deltas unless security explicitly approves the exact head.
    Confidence: 0.9
  • [P2] Remove the release-owned changelog edits — CHANGELOG.md:5
    Normal feature PRs should not rewrite CHANGELOG.md; release notes are generated and owned by the release process. Keep any release-note context in the PR body or squash message and leave the changelog out of this branch.
    Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against e9d01320d7f3.

Label changes

Label justifications:

  • P2: This is a normal-priority feature/config improvement with meaningful but bounded agent-runtime blast radius.
  • merge-risk: 🚨 compatibility: The PR changes public config schema/defaults and current package/dependency metadata in ways that can affect upgrades and existing configs.
  • merge-risk: 🚨 auth-provider: The new compaction paths alter model/provider/auth-profile resolution for maintenance turns and need upgrade proof.
  • merge-risk: 🚨 session-state: Compaction, context pruning, memory flush, transcript rotation, and Codex app-server maintenance all affect retained session context and transcript continuity.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦪 silver shellfish.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body contains detailed terminal/live proof for older heads, but the live head is 4c6c786 and still needs exact-head proof after the latest fixes, with private hosts, IPs, tokens, phone numbers, and endpoints redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

Security concerns:

  • [medium] Dependency graph changes are blocked — package.json:3
    The provided PR comments report changes to root/plugin package manifests, lockfiles, shrinkwraps, versions, peerDependencies, and dependencies; repository policy treats these as security/release surfaces that require maintainer or security handling.
    Confidence: 0.9

What I checked:

  • Root repository policy read: The full root AGENTS.md was read and applied; its compatibility, dependency, changelog, proof, and PR review rules are directly relevant to this config/runtime PR. (AGENTS.md:1, e9d01320d7f3)
  • Scoped policy read: Scoped guides for agents, plugin SDK, plugins, extensions, docs, UI, scripts, gateway, channels, and tests were inspected for the touched surfaces. (src/agents/AGENTS.md:1, e9d01320d7f3)
  • Current main behavior: On current main, AgentEntrySchema is strict and does not allow agents.list[].compaction or agents.list[].contextPruning, while current runtime resolution reads compaction/contextPruning from agents.defaults only. (src/config/zod-schema.agent-runtime.ts:1040, e9d01320d7f3)
  • Missing schema support for contextPruning: The PR head adds agents.list[].compaction to AgentEntrySchema, but there is no matching agents.list[].contextPruning entry, so the linked and PR-body contextPruning config is still rejected by the strict schema. (src/config/zod-schema.agent-runtime.ts:1141, 4c6c78673346)
  • Missing runtime resolution for contextPruning: The PR head still builds context-pruning settings from params.cfg?.agents?.defaults?.contextPruning; the active agent id is not used for this runtime path. (src/agents/embedded-agent-runner/extensions.ts:145, 4c6c78673346)
  • Attempt cache-TTL path still defaults-only: The PR head threads agentId into appendAttemptCacheTtlIfNeeded but shouldAppendAttemptCacheTtl still reads agents.defaults.contextPruning, so cache-TTL behavior would ignore per-agent pruning even after schema support is added. (src/agents/embedded-agent-runner/run/attempt.thread-helpers.ts:53, 4c6c78673346)

Likely related people:

  • steipete: Peter Steinberger is the dominant recent contributor in the affected agents/config/plugin areas and appears in recent history for config/contextPruning-related surfaces, including release-adjacent compaction/config work. (role: recent area contributor; confidence: medium; commits: 00d8d7ead059, e93216080aa1; files: src/agents/agent-scope-config.ts, src/config/zod-schema.agent-runtime.ts, src/agents/embedded-agent-runner/extensions.ts)
  • vincentkoc: Vincent Koc is the current shallow-blame author on the strict AgentEntrySchema and agent-scope config files in this checkout, making him a plausible routing candidate for schema/config review even though older history is shallow. (role: recent adjacent contributor; confidence: medium; commits: 7dde396d4d10; files: src/config/zod-schema.agent-runtime.ts, src/agents/agent-scope-config.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels May 18, 2026
@openclaw-barnacle openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. size: L and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. size: M labels May 18, 2026
@kklouzal
kklouzal force-pushed the feat/agent-compaction-overrides branch from 24b385e to dcd31b8 Compare May 18, 2026 17:57
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 18, 2026
@clawsweeper clawsweeper Bot added merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. and removed merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels May 18, 2026
@openclaw-barnacle openclaw-barnacle Bot added the extensions: memory-core Extension: memory-core label May 18, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 18, 2026
@openclaw-barnacle openclaw-barnacle Bot added triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed proof: supplied External PR includes structured after-fix real behavior proof. labels May 18, 2026
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 19, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/copilot/package.json
  • extensions/feishu/npm-shrinkwrap.json
  • extensions/feishu/package.json
  • extensions/workboard/package.json
  • npm-shrinkwrap.json
  • package.json
  • packages/net-policy/package.json
  • packages/sdk/package.json
  • pnpm-lock.yaml
  • pnpm-workspace.yaml

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions

Copy link
Copy Markdown
Contributor

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

  • extensions/feishu/npm-shrinkwrap.json changed.
  • npm-shrinkwrap.json changed.
  • pnpm-lock.yaml changed.
  • extensions/copilot/package.json changed version.
  • extensions/feishu/package.json changed peerDependencies, version.
  • extensions/workboard/package.json changed peerDependencies, version.
  • package.json changed dependencies, version.
  • packages/net-policy/package.json changed dependencies, name, version.
  • packages/sdk/package.json changed dependencies.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

  • extensions/copilot/package.json changed version.
  • extensions/feishu/package.json changed peerDependencies, version.
  • extensions/workboard/package.json changed peerDependencies, version.
  • package.json changed dependencies, version.
  • packages/net-policy/package.json changed dependencies, name, version.
  • packages/sdk/package.json changed dependencies.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'extensions/feishu/npm-shrinkwrap.json' 'npm-shrinkwrap.json' 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (4c6c786733461e0b268bfad5003dd01a9323b1d5) when it reruns. A later push requires a fresh approval.

@kklouzal

kklouzal commented May 31, 2026

Copy link
Copy Markdown
Contributor Author

Closing this stale release-base PR. The branch is being kept in the fork for local release-line testing, and any upstream work will be reopened later as a fresh, clean PR.

New PR: #88506

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling app: web-ui App: web-ui channel: discord Channel integration: discord channel: feishu Channel integration: feishu channel: imessage Channel integration: imessage channel: msteams Channel integration: msteams channel: telegram Channel integration: telegram channel: whatsapp-web Channel integration: whatsapp-web channel: zalo Channel integration: zalo commands Command implementations dependencies-changed PR changes dependency-related files docker Docker and sandbox tooling docs Improvements or additions to documentation extensions: acpx extensions: codex extensions: codex-supervisor Extension: codex-supervisor extensions: copilot extensions: memory-core Extension: memory-core extensions: qa-lab extensions: xiaomi gateway Gateway runtime merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P2 Normal backlog priority with limited blast radius. plugin: workboard proof: supplied External PR includes structured after-fix real behavior proof. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. scripts Repository scripts size: XL status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. triage: dirty-candidate Candidate: broad unrelated surfaces; may need splitting or cleanup.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Per-agent compaction and contextPruning overrides in agents.list

10 participants