fix(sessions): derive channel from direct-chat session keys in send-policy#92022
Conversation
…olicy deriveChannelFromKey returned undefined for direct/dm keys, so channel-scoped send rules never fired for direct chats. Treat parts[0] as the channel for direct/dm keys too, matching deriveChatTypeFromKey.
openclaw-barnacle
Bot
added
size: XS
triage: mock-only-proof
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f54ae20d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| parts.length >= 3 && | ||
| (parts[1] === "group" || parts[1] === "channel" || parts[1] === "direct" || parts[1] === "dm") |
There was a problem hiding this comment.
When session.dmScope is per-account-channel-peer, buildAgentPeerSessionKey produces agent:<agent>:<channel>:<account>:direct:<peer> (src/routing/session-key.ts:239), so after stripping the agent prefix parts[1] is the account rather than direct. Consequently, a channel-scoped deny still fails whenever the caller has no session entry/channel metadata—the exact fallback scenario this change is intended to secure. Recognize the canonical account-scoped shape as well and add a regression case for it.
Useful? React with 👍 / 👎.
|
Maintainer verification complete.
|
…olicy (openclaw#92022) deriveChannelFromKey returned undefined for direct/dm keys, so channel-scoped send rules never fired for direct chats. Treat parts[0] as the channel for direct/dm keys too, matching deriveChatTypeFromKey.
…olicy (openclaw#92022) deriveChannelFromKey returned undefined for direct/dm keys, so channel-scoped send rules never fired for direct chats. Treat parts[0] as the channel for direct/dm keys too, matching deriveChatTypeFromKey.
2 participants
Summary
deriveChannelFromKeyreturned undefined fordirect/dmsession keys, so channel-scoped send rules silently never fired for direct chats. Treatparts[0]as the channel for direct/dm keys too (canonical<channel>:<peerKind>:<peerId>), matching the siblingderiveChatTypeFromKey.CHANGELOG.mdedit (release-only perAGENTS.md).Why core (not ClawHub)
Core correctness fix touching
src/sessions/send-policy.ts— perAGENTS.mdthese stay in core (security/core hardening, bundled regressions, missing core APIs), not optional skill bundles routed to ClawHub.Verification
node scripts/run-vitest.mjs run src/sessions/send-policy.test.ts=> 7 passedpnpm tsgo:core(tsconfig.core.json) => cleanoxfmt --check+oxlinton touched files => cleanReal behavior proof
node scripts/run-vitest.mjs run src/sessions/send-policy.test.tsdemo-channel:direct:user-1resolves channeldemo-channel; 2-token keys still fall through to prefix matching (unchanged).🤖 Generated with Claude Code