Skip to content

fix(sessions): persist sender metadata in user turn transcript JSONL#90552

Merged
steipete merged 19 commits into
openclaw:mainfrom
Pick-cat:fix/90531-group-session-sender-metadata
Jul 6, 2026
Merged

fix(sessions): persist sender metadata in user turn transcript JSONL#90552
steipete merged 19 commits into
openclaw:mainfrom
Pick-cat:fix/90531-group-session-sender-metadata

Conversation

@Pick-cat

@Pick-cat Pick-cat commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Telegram group and channel conversations can share one OpenClaw session, but their durable user-turn transcript rows did not retain which participant sent each message. That made later transcript reads lose participant attribution even though the inbound channel context had it.

Fixes #90531.

Why This Change Was Made

  • Resolve the effective reply route before preparing the durable user turn, then include sender identity only for group and channel routes.
  • Persist senderId, senderName, and senderUsername in the existing message.__openclaw envelope; intentionally exclude phone-number identity.
  • Carry the prepared transcript row through active-run steering queues and reply-run fallback paths without changing model-visible prompt content.
  • Let write hooks redact sender identity while restoring only the trusted senderIsOwner authorization bit.
  • Keep transcript redaction after metadata merging so configured sensitive-value redaction still applies.
  • Leave direct-message transcript behavior unchanged.

User Impact

Shared group/channel transcripts now retain participant attribution for every committed user turn, including turns queued behind an active run. Direct chats do not gain new persisted sender identity, and hook/redaction behavior remains intact.

Evidence

  • Immediate pre-rebase head 97cd10e0eef686cd09b2158cbe539e3d74c8ad13 passed a full build on isolated AWS Crabbox lease cbx_4f878654a015, run run_0503a3f8d022.
  • The same run passed pnpm check:changed for core and coreTests with zero warnings and zero runtime import cycles.
  • Focused Vitest proof: 4 shards, 292 tests passed across transcript writing, hooks, queued steering, reply fallback, session SDK, transcript rewriting, and E2E agent-runner coverage.
  • Final exact head 4d8648ea9131dd6d86ead4e7d4da6eaf1e6ff94a passed all 69 applicable hosted checks, including build, both whole-suite shards, and QA smoke (run 28767468051).
  • Before the final merge-policy-only rebase, 97 auto-reply tests and 14 guard/transcript-rewrite tests passed locally against the combined product tree at ae72ccaee550a301baa8756f7763f9aad368802b.
  • The contributor's earlier live Telegram proof confirmed a group message round trip produced a JSONL row containing all three sender fields; the lease and credentials were released afterward.
  • Fresh full-branch Codex autoreview returned no accepted/actionable findings.

@openclaw-barnacle openclaw-barnacle Bot added size: S proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 5, 2026
@clawsweeper

clawsweeper Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 12:23 AM ET / 04:23 UTC.

Summary
The branch persists senderId, senderName, and senderUsername for group/channel user-turn transcript JSONL rows and threads prepared transcript context through active-run and queued-run persistence without changing direct-message behavior.

PR surface: Source +226, Tests +380. Total +606 across 18 files.

Reproducibility: yes. source-level: current main prepares and writes user-turn transcript rows without any sender identity field, while the linked issue shows the group transcript attribution gap. I did not rerun a live Telegram group message in this read-only review.

Review metrics: 2 noteworthy metrics.

  • Persisted sender fields: 3 added, 1 excluded. The PR makes senderId, senderName, and senderUsername durable while keeping phone-number identity out of the JSONL envelope.
  • Agent-session steering surface: 1 optional parameter added. AgentSession is exported through the agent-sessions plugin SDK subpath, so the recorder handoff is compatibility-visible even though it is optional.

Stored data model
Persistent data-model change detected: serialized state: src/agents/session-tool-result-guard-wrapper.ts, serialized state: src/agents/sessions/agent-session.ts, serialized state: src/agents/sessions/sdk.test.ts, serialized state: src/sessions/user-turn-transcript-runtime-context.ts, serialized state: src/sessions/user-turn-transcript.test.ts, serialized state: src/sessions/user-turn-transcript.ts, and 7 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #90531
Summary: This PR is the active candidate fix for the canonical group-chat JSONL sender metadata issue; sibling items either attempted the same fix earlier or consume the metadata in adjacent surfaces.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Wait for required checks on head 4d8648e to finish green before merge.

Risk before merge

  • [P1] Merging intentionally makes senderId, senderName, and senderUsername durable local transcript metadata for group/channel turns, so the accepted boundary should remain limited to non-phone identity and hook redaction must stay authoritative.
  • [P1] The optional recorder argument on AgentSession.steer is still visible through the exported agent-sessions surface, so maintainers should treat that compatibility/API shape as intentional before landing.
  • [P1] The current head was pushed after the PR body's prior exact-head CI proof, so landing should wait for green exact-head checks even though this is not a code-review finding.

Maintainer options:

  1. Land Accepted Boundary After Gates (recommended)
    Maintain the current non-phone sender metadata design and land once the latest head has green required checks.
  2. Internalize Recorder API First
    If maintainers do not want AgentSession.steer to expose the recorder argument, move that handoff behind an internal seam before merge.
  3. Pause Privacy Boundary
    Leave the PR open if maintainers want to revisit which sender fields may become durable transcript state.

Next step before merge

  • No ClawSweeper repair is needed; the branch has no blocking code findings and should proceed through maintainer landing once exact-head checks finish.

Security
Needs attention: The diff has no supply-chain concern, but it intentionally changes the privacy boundary by persisting non-phone sender identity in durable JSONL.

Review details

Best possible solution:

Land this focused transcript fix after exact-head checks finish green, preserving the non-phone sender metadata boundary, direct-chat negative behavior, and hook redaction coverage.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level: current main prepares and writes user-turn transcript rows without any sender identity field, while the linked issue shows the group transcript attribution gap. I did not rerun a live Telegram group message in this read-only review.

Is this the best way to solve the issue?

Yes, with accepted merge-risk boundaries: the shared user-turn transcript writer is the right owner, the PR scopes persistence to group/channel routes, excludes phone identity, and covers hook redaction plus queued writes. The remaining non-code requirement is green exact-head validation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 785f197de600.

Label changes

Label justifications:

  • P2: This is a normal-priority session transcript correctness fix with limited blast radius to group/channel participant attribution.
  • merge-risk: 🚨 compatibility: The PR adds an optional UserTurnTranscriptRecorder path through AgentSession.steer, which is part of the exported agent-sessions surface.
  • merge-risk: 🚨 security-boundary: The PR intentionally persists non-phone participant identity in durable session JSONL state for group/channel turns.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body and discussion report after-fix live Telegram group proof plus maintainer Crabbox/build/check evidence; the latest small refactor still needs normal exact-head CI completion before merge.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body and discussion report after-fix live Telegram group proof plus maintainer Crabbox/build/check evidence; the latest small refactor still needs normal exact-head CI completion before merge.
Evidence reviewed

PR surface:

Source +226, Tests +380. Total +606 across 18 files.

View PR surface stats
Area Files Added Removed Net
Source 11 280 54 +226
Tests 7 388 8 +380
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 18 668 62 +606

Security concerns:

  • [medium] Approve durable sender identity metadata — src/sessions/user-turn-transcript.ts:273
    The PR stores senderId, senderName, and senderUsername under __openclaw in persisted transcript JSONL for group/channel turns, so maintainers should keep the accepted boundary explicit and preserve phone-number exclusion.
    Confidence: 0.9

What I checked:

  • Current main transcript input has no sender identity: Current main's UserTurnInput includes text, media, timestamp, idempotencyKey, senderIsOwner, provenance, and mediaOnlyText, but no senderId/name/username field for durable transcript attribution. (src/sessions/user-turn-transcript.types.ts:21, 785f197de600)
  • Current main writer omits participant attribution: Current main's buildPersistedUserTurnMessage writes role, content, timestamp, idempotency, optional senderIsOwner, and media fields, but no senderId, senderName, or senderUsername envelope. (src/sessions/user-turn-transcript.ts:243, 785f197de600)
  • PR head adds bounded sender metadata input: The PR head adds a sender object to UserTurnInput and builds __openclaw senderId, senderName, and senderUsername only when provided. (src/sessions/user-turn-transcript.types.ts:29, 4d8648ea9131)
  • PR head scopes persistence to group/channel routes: The reply path resolves the effective route before creating the recorder and only passes sender metadata when chatType is group or channel, leaving direct transcripts at the old identity-storage boundary. (src/auto-reply/reply/get-reply-run.ts:1308, 4d8648ea9131)
  • Privacy and queued persistence coverage exists: Tests cover group/channel positive cases, direct negative cases, hook redaction removing sender identity while preserving senderIsOwner, and queued group sender metadata committing to JSONL. (src/agents/embedded-agent-runner.guard.test.ts:161, 4d8648ea9131)
  • Maintainer proof and decision signal: The live PR discussion includes a steipete comment with land-ready proof, privacy-boundary review, repair summary, Crabbox build/check proof, focused Vitest coverage, hosted CI proof for the prior exact head, and a known gap that live Telegram was not repeated after maintainer repairs. (4d8648ea9131)

Likely related people:

  • steipete: Current-main blame and shortlog for the central transcript and agent-session surfaces point to Peter Steinberger, and the PR branch includes steipete commits refining sender persistence, hook privacy, queued provenance, and the runtime-context split. (role: recent area contributor and likely decision owner; confidence: high; commits: f12312d69b13, 054afdf0a48a, 4d8648ea9131; files: src/sessions/user-turn-transcript.ts, src/sessions/user-turn-transcript.types.ts, src/auto-reply/reply/get-reply-run.ts)
  • Vincent Koc: Available main history shows Vincent Koc on the latest release baseline that still lacks this fix and as a recurring contributor in the sampled session/transcript paths. (role: release/current-history contributor; confidence: medium; commits: e085fa1a3ffd, c109a7623b13; files: src/sessions/user-turn-transcript.ts, src/sessions/user-turn-transcript.types.ts, src/auto-reply/reply/get-reply-run.ts)
  • Tak Hoffman: Path history for the queue/session runtime surfaces includes Tak Hoffman on context-window and memory-bound work adjacent to the queued transcript persistence path. (role: adjacent session/runtime contributor; confidence: medium; commits: 4f00b769251d; files: src/agents/session-tool-result-guard-wrapper.ts, src/agents/sessions/agent-session.ts, src/auto-reply/reply/agent-runner.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (2 earlier review cycles)
  • reviewed 2026-06-27T04:07:53.209Z sha 5c00ba9 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-06T03:48:46.594Z sha 190ecda :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 5, 2026
@Pick-cat
Pick-cat force-pushed the fix/90531-group-session-sender-metadata branch from 3a0b07d to 7f539c6 Compare June 6, 2026 06:05
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 6, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 6, 2026
@Pick-cat
Pick-cat force-pushed the fix/90531-group-session-sender-metadata branch from 7f539c6 to 5a66108 Compare June 9, 2026 02:58
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 9, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 9, 2026
@Pick-cat

Copy link
Copy Markdown
Contributor Author

Removed senderE164 from the persisted __openclaw envelope per ClawSweeper feedback. Only senderId/senderName/senderUsername are persisted now — phone metadata excluded for privacy. Tests pass (27/27). @clawsweeper re-review

@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 11, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 11, 2026
@Pick-cat
Pick-cat force-pushed the fix/90531-group-session-sender-metadata branch from cef3699 to 8ba0295 Compare June 12, 2026 00:35
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 12, 2026
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 12, 2026
@Pick-cat

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Refreshed PR body with security-boundary risk checklist:

  • senderE164 excluded from persisted envelope (privacy)
  • only public channel identifiers persisted
  • omit __openclaw when sender fields empty

Proof: production appendUserTurnTranscriptMessage + 27/27 tests pass.

@clawsweeper

clawsweeper Bot commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 14, 2026
@steipete
steipete force-pushed the fix/90531-group-session-sender-metadata branch from 97cd10e to ae72cca Compare July 6, 2026 04:04
Pick-cat and others added 19 commits July 6, 2026 00:18
Thread senderId/senderName/senderUsername/senderE164 from the channel
inbound context into the persisted user-turn transcript message so that
group chat session JSONL records include __openclaw sender identity.

Ref openclaw#90531
Remove phone-number field from the persisted __openclaw sender envelope,
keeping only senderId, senderName, and senderUsername. Privacy-sensitive
E.164 metadata can be added back by maintainers if needed.

Ref openclaw#90531
The `as TBase & ExecPolicyLayer` casts failed because the returned
objects did not spread `...base`, losing generic TBase fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>
The baseWithoutMode destructuring produces Omit<TBase, "mode"> which is
not assignable to TBase & ExecPolicyLayer when the as-cast is removed.

Co-Authored-By: Claude Opus 4.7 <[email protected]>
…ranch

The second branch (security/ask override without a mode change) must
exclude base.mode from the spread so that mode is not leaked into results
when only security or ask fields are being overridden.

Without this fix, the spread ...base carries mode through to the returned
object, breaking callers that expect applyExecPolicyLayer to clear stale
mode when applying explicit security/ask policy fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>
@steipete
steipete force-pushed the fix/90531-group-session-sender-metadata branch from ae72cca to 4d8648e Compare July 6, 2026 04:18
@steipete
steipete merged commit f296dc4 into openclaw:main Jul 6, 2026
103 of 104 checks passed
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

SunnyShu0925 added a commit to SunnyShu0925/openclaw that referenced this pull request Jul 6, 2026
…enclaw#98336)

Use __openclaw.senderId as the per-participant discriminator in the
compaction dedup key, so two different group participants who happen to
send the same text within the dedup window are both preserved.

Requires openclaw#90552 which persists senderId/senderName/senderUsername in
the __openclaw envelope on user-turn transcript messages.

Key change:
- Read __openclaw.senderId (string) instead of senderIsOwner (boolean)
- Same sender, same text, inside window → still deduped
- Different sender, same text, inside window → both kept (bug fixed)
- Fall back to empty prefix when no senderId is available

Ref openclaw#98310
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 6, 2026
…penclaw#90552)

* fix(sessions): persist sender metadata in user turn transcript JSONL

Thread senderId/senderName/senderUsername/senderE164 from the channel
inbound context into the persisted user-turn transcript message so that
group chat session JSONL records include __openclaw sender identity.

Ref openclaw#90531

* fix(sessions): exclude senderE164 from persisted transcript for privacy

Remove phone-number field from the persisted __openclaw sender envelope,
keeping only senderId, senderName, and senderUsername. Privacy-sensitive
E.164 metadata can be added back by maintainers if needed.

Ref openclaw#90531

* fix(infra): spread base fields in applyExecPolicyLayer return values

The `as TBase & ExecPolicyLayer` casts failed because the returned
objects did not spread `...base`, losing generic TBase fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(infra): use ...base spread instead of ...baseWithoutMode

The baseWithoutMode destructuring produces Omit<TBase, "mode"> which is
not assignable to TBase & ExecPolicyLayer when the as-cast is removed.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(infra): preserve baseWithoutMode in second applyExecPolicyLayer branch

The second branch (security/ask override without a mode change) must
exclude base.mode from the spread so that mode is not leaked into results
when only security or ask fields are being overridden.

Without this fix, the spread ...base carries mode through to the returned
object, breaking callers that expect applyExecPolicyLayer to clear stale
mode when applying explicit security/ask policy fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(sessions): scope persisted sender attribution

* fix(sessions): preserve sender metadata through hooks

* refactor(sessions): keep sender metadata path lean

* fix(sessions): preserve sender metadata in runtime writes

* fix(sessions): preserve queued sender attribution

* test(sessions): use complete message fixtures

* refactor(sessions): rely on narrowed user message type

* test(sessions): use shared temp directory helper

* test(sessions): align sender metadata assertions

* fix(sessions): honor sender metadata redaction hooks

* test(agents): use automatic temp cleanup

* test(sessions): cover queued turn provenance

* test(auto-reply): expect room sender metadata

* refactor(sessions): isolate queued transcript context

---------

Co-authored-by: Claude Opus 4.7 <[email protected]>
Co-authored-by: Peter Steinberger <[email protected]>
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
…penclaw#90552)

* fix(sessions): persist sender metadata in user turn transcript JSONL

Thread senderId/senderName/senderUsername/senderE164 from the channel
inbound context into the persisted user-turn transcript message so that
group chat session JSONL records include __openclaw sender identity.

Ref openclaw#90531

* fix(sessions): exclude senderE164 from persisted transcript for privacy

Remove phone-number field from the persisted __openclaw sender envelope,
keeping only senderId, senderName, and senderUsername. Privacy-sensitive
E.164 metadata can be added back by maintainers if needed.

Ref openclaw#90531

* fix(infra): spread base fields in applyExecPolicyLayer return values

The `as TBase & ExecPolicyLayer` casts failed because the returned
objects did not spread `...base`, losing generic TBase fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(infra): use ...base spread instead of ...baseWithoutMode

The baseWithoutMode destructuring produces Omit<TBase, "mode"> which is
not assignable to TBase & ExecPolicyLayer when the as-cast is removed.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(infra): preserve baseWithoutMode in second applyExecPolicyLayer branch

The second branch (security/ask override without a mode change) must
exclude base.mode from the spread so that mode is not leaked into results
when only security or ask fields are being overridden.

Without this fix, the spread ...base carries mode through to the returned
object, breaking callers that expect applyExecPolicyLayer to clear stale
mode when applying explicit security/ask policy fields.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

* fix(sessions): scope persisted sender attribution

* fix(sessions): preserve sender metadata through hooks

* refactor(sessions): keep sender metadata path lean

* fix(sessions): preserve sender metadata in runtime writes

* fix(sessions): preserve queued sender attribution

* test(sessions): use complete message fixtures

* refactor(sessions): rely on narrowed user message type

* test(sessions): use shared temp directory helper

* test(sessions): align sender metadata assertions

* fix(sessions): honor sender metadata redaction hooks

* test(agents): use automatic temp cleanup

* test(sessions): cover queued turn provenance

* test(auto-reply): expect room sender metadata

* refactor(sessions): isolate queued transcript context

---------

Co-authored-by: Claude Opus 4.7 <[email protected]>
Co-authored-by: Peter Steinberger <[email protected]>
SunnyShu0925 added a commit to SunnyShu0925/openclaw that referenced this pull request Jul 17, 2026
…re test comments

Codex review feedback:
- Remove top-level sender field precedence — only canonical __openclaw
  envelope is the trusted source for durable sender metadata (openclaw#90552)
- Restore unintentionally dropped security/lifecycle test comments from
  the rebase merge
- Consolidate sender-label tests to keep file under max-lines limit
- Remove 'prefers top-level over envelope' test (no longer applicable)
SunnyShu0925 added a commit to SunnyShu0925/openclaw that referenced this pull request Jul 17, 2026
ClawSweeper review: openclaw#90552 only establishes senderName, senderUsername,
senderId in the __openclaw envelope. senderLabel has no producer contract
as a persisted identity field. Remove it from HistoryMessage type and the
renderer fallback chain. Update tests to use contracted senderName.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Group chat session JSONL missing sender metadata (__openclaw / senderId)

3 participants