Fix transcript image redaction by joshavant · Pull Request #91529 · openclaw/openclaw

joshavant · 2026-06-09T00:25:22Z

Summary

preserve validated opaque image payloads during transcript redaction so default secret patterns cannot rewrite base64 bytes with a Unicode ellipsis
keep redaction active for adjacent text and fake image-shaped secret payloads
repair already-poisoned session image blocks by replacing unrecoverable corrupted image payloads with replayable fallback text
keep transcript storage and provider transport boundaries separate: storage can preserve validated image formats such as BMP/HEIC/HEIF, while transport sanitizer remains limited to provider-safe browser image data URLs

Security Boundary

This intentionally treats validated image bytes as opaque media data, not text to run through secret-pattern substitution. The exemption is bounded by image field shape, strict base64 validation, bounded prefix decoding, and magic-byte/signature sniffing. Adjacent text still goes through normal redaction, and fake image-shaped payloads containing secret-looking strings are still redacted or repaired.

The PR avoids a MIME-only bypass: image claims are accepted only when bytes match a supported image signature. It also avoids widening provider transport behavior by using a separate storage sanitizer from the existing transport sanitizer.

Verification

.agents/skills/autoreview/scripts/autoreview --mode local
- clean: no accepted/actionable findings
AWS Crabbox fix/regression proof after the clean autoreview: provider aws, run run_2da949704798, lease cbx_f1c73cdaa4d8, machine c7a.8xlarge, exit 0
- node scripts/run-vitest.mjs packages/media-core/src/inline-image-data-url.test.ts src/agents/transcript-redact.test.ts src/config/sessions/transcript-append-redact.test.ts src/agents/session-file-repair.test.ts src/agents/responses-image-payload-sanitizer.test.ts
- passed 3 Vitest shards: 85 tests
- explicit proof script confirmed valid image payload preservation, adjacent secret redaction, storage-vs-transport data URL boundary, and corrupted replay repair
Earlier AWS Crabbox live behavior proof: provider aws, run run_46fd11090674, lease cbx_a2733bb606fb, exit 0
- redaction-trigger image persisted with persistedIncludesEllipsis:false, nonAsciiCount:0
- valid image replay through live Anthropic transport returned stopReason:"stop"
- corrupted transcript repair removed 1 image block
- repaired transcript replay through live Anthropic transport returned stopReason:"stop"

clawsweeper · 2026-06-09T00:27:36Z

Codex review: needs maintainer review before merge. Reviewed June 8, 2026, 10:08 PM ET / 02:08 UTC.

Summary
The branch updates media-core image validation, transcript redaction, session-file repair, and regression tests so validated image payloads survive redaction and already-corrupted image blocks can be replaced for replay.

PR surface: Source +339, Tests +420. Total +759 across 8 files.

Reproducibility: yes. source-level reproduction is high confidence: current main recursively redacts all transcript strings and the default AKID-style pattern can match normal image base64 bytes. I did not run tests because this review was required to keep the checkout read-only.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Get explicit maintainer/security acceptance of the validated-image redaction boundary before merge.

Risk before merge

[P1] Merging this PR intentionally treats validated image bytes and image data URLs as opaque transcript data that bypasses text secret-pattern substitution, so maintainers need to accept media validation as the storage redaction boundary.

Maintainer options:

Approve the validation boundary (recommended)
A maintainer/security reviewer can accept validated image bytes as opaque transcript data because adjacent text, fake payloads, transport filtering, and repair behavior are covered.
Tighten before merge
If the boundary is too broad, require narrower shape constraints or additional validation tests before allowing image payloads to bypass text substitution.
Pause for image-safe scanning
If opaque media must still be inspected for embedded secrets, pause this branch and design a non-corrupting scanner instead of substituting inside base64 bytes.

Next step before merge

[P2] The protected maintainer label and security-boundary change require human maintainer/security approval; there is no narrow automated repair to queue.

Security
Needs attention: No supply-chain issue was found, but the redaction-boundary change needs maintainer/security acceptance before merge.

Review details

Best possible solution:

Land this focused fix after a maintainer/security reviewer explicitly accepts the validated opaque-image redaction boundary and the storage-vs-transport split.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level reproduction is high confidence: current main recursively redacts all transcript strings and the default AKID-style pattern can match normal image base64 bytes. I did not run tests because this review was required to keep the checkout read-only.

Is this the best way to solve the issue?

Yes, with maintainer/security approval. Validating opaque image payloads in media-core before skipping text substitution is narrower than a MIME-only skip, and repair-only would not prevent future poisoned transcripts.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 5097749de32c.

Label changes

Label justifications:

P1: The linked issue describes a real session-poisoning failure where subsequent agent turns can fail until the corrupted image block is removed.
merge-risk: 🚨 security-boundary: The PR deliberately changes which transcript fields are exempt from text secret redaction and relies on validated image payload detection as the boundary.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body includes after-fix AWS Crabbox live output showing valid image replay and repaired corrupted-transcript replay through live Anthropic transport, plus a focused regression run.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix AWS Crabbox live output showing valid image replay and repaired corrupted-transcript replay through live Anthropic transport, plus a focused regression run.

Evidence reviewed

PR surface:

Source +339, Tests +420. Total +759 across 8 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	357	18	+339
Tests	5	424	4	+420
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	8	781	22	+759

Security concerns:

[medium] Approve the opaque image redaction boundary — src/agents/transcript-redact.ts:253
Validated image payloads and image data URLs now bypass text secret replacement, which appears necessary to avoid corrupting media bytes but should be an explicit security decision.
Confidence: 0.84

Acceptance criteria:

[P1] node scripts/run-vitest.mjs packages/media-core/src/inline-image-data-url.test.ts src/agents/transcript-redact.test.ts src/config/sessions/transcript-append-redact.test.ts src/agents/session-file-repair.test.ts src/agents/responses-image-payload-sanitizer.test.ts.

What I checked:

Root policy applied: The full root policy was read and applied; it treats session state, message delivery, and security-sensitive redaction boundaries as maintainer-review surfaces. (AGENTS.md:1, 5097749de32c)
Scoped agents policy checked: The scoped agents guide was read; it did not add a contradictory rule for this PR, but it reinforced reading the runtime path rather than diff-only review. (src/agents/AGENTS.md:1, 5097749de32c)
Current main source-repro path: Current main recursively redacts every string field in transcript payloads, so image data fields can be sent through the same string redactor before transcript persistence. (src/agents/transcript-redact.ts:57, 5097749de32c)
Default pattern can hit base64-looking bytes: The default redaction patterns include token-like prefixes such as AKID, matching the linked report's base64 substring corruption mode. (src/logging/redact.ts:53, 5097749de32c)
PR redaction boundary: The PR validates image base64/data URLs through media-core before preserving opaque image payload fields, while adjacent fields still recurse through redaction. (src/agents/transcript-redact.ts:81, 8734194d23ea)
PR repair path: The PR detects corrupted persisted image blocks and rewrites them to a text fallback so transcript replay can continue. (src/agents/session-file-repair.ts:121, 8734194d23ea)

Likely related people:

hxy91819: The inline transcript redaction behavior this PR refines was introduced in commit faaa7ef with hxy91819 credited as reviewer/co-author, and hxy91819 also commented that the bug appears to trace to that merged PR. (role: prior redaction reviewer and co-author; confidence: high; commits: faaa7efef050; files: src/agents/transcript-redact.ts, src/config/sessions/transcript-append.ts)
joshavant: Beyond authoring this PR, prior merged history shows repeated work on secrets, SecretRef, runtime config, and session-adjacent safety paths. (role: recent secrets/session contributor; confidence: medium; commits: 1769fb2aa1d6, 788f56f30fd9, 59bc3c66300b; files: src/agents, src/config/sessions, packages/media-core)
Vincent Koc: History around the inline image sanitizer and Anthropic transport surfaces includes Vincent Koc commits, which makes this relevant for the storage-vs-transport validation boundary. (role: media-core and provider-runtime adjacent contributor; confidence: medium; commits: 067496b12934, ea4265a82063, 2e08f0f4221f; files: packages/media-core/src/inline-image-data-url.ts, src/agents/anthropic-transport-stream.ts)
Justin: Commit 0da6de6 introduced the malformed tool-call/session-file repair area that this PR extends for corrupted image blocks. (role: session repair introducer; confidence: medium; commits: 0da6de6624a9; files: src/agents/session-file-repair.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

joshavant · 2026-06-09T01:58:41Z

@clawsweeper re-review

clawsweeper · 2026-06-09T01:58:44Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27179048641
Updated: 2026-06-09T02:08:31.154Z

hxy91819 · 2026-06-09T02:05:57Z

Looks like this bug was introduced by my merged PR. Did a quick sanity check and everything seems fine.

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary (cherry picked from commit aef1fad)

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary

fix transcript image redaction

d2c3680

openclaw-barnacle Bot added agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels Jun 9, 2026

fix image redaction type predicate

6bb4f02

clawsweeper Bot added status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 9, 2026

tighten transcript image redaction boundary

8734194

openclaw-barnacle Bot added size: L and removed size: M labels Jun 9, 2026

joshavant merged commit aef1fad into main Jun 9, 2026
174 of 176 checks passed

joshavant deleted the fix/90760-transcript-image-redaction branch June 9, 2026 02:23

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 02:26 UTC curtismercier/openclaw-mods#1042

Open

This was referenced Jun 9, 2026

Secret/credential masking corrupts image base64 with ellipsis marker (U+2026), permanently poisoning the session #90760

Closed

fix(agents): preserve ImageContent.data from transcript redaction #90856

Closed

This was referenced Jun 9, 2026

🦞 OpenClaw 生态日报 2026-06-09 jasonalang/big_model_radar#62

Open

🦞 OpenClaw 生态日报 2026-06-09 litang9/big_model_radar#37

Open

vincentkoc pushed a commit that referenced this pull request Jun 9, 2026

Fix transcript image redaction (#91529)

55e4c0f

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary (cherry picked from commit aef1fad)

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 9, 2026

Fix transcript image redaction (openclaw#91529)

ab4c34f

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary

badgerbees pushed a commit to badgerbees/openclaw that referenced this pull request Jul 8, 2026

Fix transcript image redaction (openclaw#91529)

e98f201

* fix transcript image redaction * fix image redaction type predicate * tighten transcript image redaction boundary

clawsweeper Bot mentioned this pull request Jul 8, 2026

Transcript redaction corrupts Anthropic/Bedrock reasoning signatures (AIza/LTAI false positive), causing persistent replay_invalid #102244

Closed

clawsweeper Bot mentioned this pull request Jul 16, 2026

[Bug]: image_generate completion persists generated media as Base64 and causes severe session replay latency #108071

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fix transcript image redaction#91529

Fix transcript image redaction#91529
joshavant merged 3 commits into
mainfrom
fix/90760-transcript-image-redaction

joshavant commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

joshavant commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

hxy91819 commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

joshavant commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Boundary

Verification

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joshavant commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hxy91819 commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joshavant commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading