Skip to content

fix(agents): drop stale internal orphan prompts#96533

Open
outdog-hwh wants to merge 3 commits into
openclaw:mainfrom
outdog-hwh:fix/orphaned-user-stale-reply-76888
Open

fix(agents): drop stale internal orphan prompts#96533
outdog-hwh wants to merge 3 commits into
openclaw:mainfrom
outdog-hwh:fix/orphaned-user-stale-reply-76888

Conversation

@outdog-hwh

@outdog-hwh outdog-hwh commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Fixes #76888.

When transcript repair found a trailing orphaned user message from an internal inter-session event, it could prepend that stale content to the next fresh user prompt. For events like subagent announcements or completion markers, that meant the model could answer stale internal text instead of the user's current message.

Why This Change Was Made

The repair path already needed to preserve user-directed queued messages, including sessions_send inter-session input. The bug was that internal session-state events used the same orphaned-user leaf shape, so the merge step treated them as user content.

This change classifies provenance before merging:

  • user-facing queued/inter-session input is still merged into the repaired prompt;
  • internal session-state-preserving inter-session leaves are removed when a fresh prompt is present;
  • empty orphan leaves continue to be removed without changing prompt text.

User Impact

Users should no longer get a response to stale internal transcript content after a queued/orphaned user-message repair. Legitimate queued user messages remain preserved, so no user-authored follow-up is lost.

Evidence

Local validation on the PR branch:

  • node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/attempt.test.ts src/agents/embedded-agent-runner/run/transcript-repair-runtime-contract.test.ts passed, 126 tests.
  • node scripts/run-vitest.mjs src/sessions/input-provenance.test.ts passed, 19 tests.
  • node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/message-merge-strategy.test.ts passed, 2 tests.
  • node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/attempt.test.ts src/agents/embedded-agent-runner/run/transcript-repair-runtime-contract.test.ts src/agents/embedded-agent-runner/run/message-merge-strategy.test.ts src/sessions/input-provenance.test.ts passed, 147 tests.
  • pnpm tsgo:core:test passed.
  • pnpm check:test-types passed.
  • node_modules\.bin\oxfmt.cmd --check --threads=1 src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts src/agents/embedded-agent-runner/run/attempt.test.ts src/agents/embedded-agent-runner/run/attempt.ts src/agents/embedded-agent-runner/run/message-merge-strategy.ts src/agents/embedded-agent-runner/run/transcript-repair-runtime-contract.test.ts passed.
  • node_modules\.bin\oxfmt.cmd --check --threads=1 src/agents/embedded-agent-runner/run/transcript-repair-runtime-contract.test.ts passed after the test type follow-up.
  • git diff --check passed.

CI on PR head e684ac2cb8b0bac7189459a75daf5b0ef0487dfc is green, including check-test-types, check-prod-types, check-lint, check-guards, build-artifacts, QA Smoke CI, and Real behavior proof.

Regression proof:

Before the production fix, the new stale-internal-leaf tests failed because the repaired prompt included NO_REPLY stale subagent completion before the fresh inbound message. After the fix, those tests pass while the user-directed sessions_send case is still preserved.

Maintainer validation requested:

I do not have access to a live OpenClaw session setup that can reproduce #76888 end to end. To complete the remaining proof gate, please validate in a real embedded-agent session that:

  • a trailing orphaned user leaf with provenance.kind=inter_session and sourceTool=subagent_announce is removed and does not prepend stale NO_REPLY/completion text before the fresh prompt;
  • a trailing orphaned user leaf with sourceTool=sessions_send is still preserved in the repaired prompt.

Duplicate check:

Before opening this PR I rechecked open PRs/issues for #76888, stale inter-session/orphan prompt wording, and the touched merge helpers. The prior direct attempts (#78094 and #90759) were closed unmerged, and I did not find an active PR covering this exact root cause.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@openclaw-barnacle openclaw-barnacle Bot added agents Agent runtime and tooling size: S triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jun 24, 2026
@clawsweeper

clawsweeper Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 9:32 PM ET / 01:32 UTC.

Summary
This PR makes orphaned trailing user-prompt repair provenance-aware so selected internal inter-session leaves are removed before a fresh prompt while sessions_send user-facing input is still merged.

PR surface: Source +22, Tests +94. Total +116 across 5 files.

Reproducibility: yes. at source level: current main prepends non-duplicate orphan user text before the fresh prompt, and the linked issue supplies sanitized logs from that repair path. I did not establish a live current-main channel reproduction in this read-only review.

Review metrics: 1 noteworthy metric.

  • Internal handoff drop scope: 6 source tools covered. The changed predicate affects all session-state-preserving internal handoff tools, so maintainers should review the semantic scope before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted real embedded-agent terminal output, logs, or a recording showing stale internal completion text no longer shadows the fresh prompt and sessions_send content is still preserved.
  • [P1] Coordinate with maintainers on whether this narrow drop rule or fix(agent): stale replies after queued user turns #90759 is the canonical repair path.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body and author comment provide tests and CI only, and explicitly say no live embedded-agent setup was run; a contributor or maintainer should add redacted runtime logs, terminal output, or a recording before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] The contributor has not supplied real embedded-agent runtime proof for the new drop/preserve split; tests and CI do not prove the observed session behavior after the fix.
  • [P1] The six-tool predicate changes whether internal handoff text remains model-visible during orphan repair, so an overbroad scope could remove useful session-state context from the next run.
  • [P1] fix(agent): stale replies after queued user turns #90759 targets the same canonical issue with broader session-repair semantics and stronger proof, so maintainers need to choose the landing strategy rather than let two competing repairs drift.

Maintainer options:

  1. Block on runtime proof (recommended)
    Require redacted embedded-agent proof that internal completion text is dropped while user-directed sessions_send text is preserved before merge.
  2. Accept the six-tool scope
    Maintainers may intentionally accept the session-state risk if they have equivalent private proof and agree all six internal source tools should be removed from repaired prompts when a fresh prompt exists.
  3. Pause behind the broader repair
    If fix(agent): stale replies after queued user turns #90759 is selected as the canonical strategy, pause or close this branch after preserving any useful narrow test ideas there.

Next step before merge

  • [P1] Manual review is needed because the remaining blockers are real behavior proof and maintainer acceptance of the session-state semantics versus the overlapping broader repair, not a mechanical code repair.

Maintainer decision needed

  • Question: Should this PR remain blocked until real embedded-agent proof demonstrates both stale internal handoff removal and sessions_send preservation, or should maintainers choose the proof-sufficient broader repair at fix(agent): stale replies after queued user turns #90759 instead?
  • Rationale: The branch changes session-state prompt semantics for six internal handoff tools, and the author explicitly lacks live runtime proof while another open PR overlaps the same issue with stronger proof but different semantics.
  • Likely owner: vincentkoc — The decision is closest to the queued-user prompt preservation invariant introduced by PR 65478.
  • Options:
    • Require proof on this branch (recommended): Keep this PR open but blocked until redacted embedded-agent logs, terminal output, or a recording show the stale-internal drop and sessions_send preservation cases on the patched branch.
    • Select the broader repair: If maintainers prefer fix(agent): stale replies after queued user turns #90759 as the canonical fix, mark this PR superseded only after that direction is explicit or the broader PR lands.
    • Narrow the predicate first: If the six internal source tools are too broad, ask for a smaller predicate and new focused proof before either repair strategy lands.

Security
Cleared: No dependency, workflow, secret, permission, package, or external code execution surface is changed by this PR.

Review details

Best possible solution:

Pick one canonical embedded-runner/session repair for #76888, require real runtime proof for this branch if it remains the candidate, and then close or supersede the other overlapping PR after a maintainer-selected fix lands.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main prepends non-duplicate orphan user text before the fresh prompt, and the linked issue supplies sanitized logs from that repair path. I did not establish a live current-main channel reproduction in this read-only review.

Is this the best way to solve the issue?

Unclear as the final landing strategy: the helper boundary is plausible for this narrow stale-internal orphan shape, but #90759 overlaps the same canonical issue with broader session-repair semantics and stronger proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 349d3547ccd1.

Label changes

Label justifications:

  • P2: This is a focused embedded-agent bug-fix PR with limited code scope, but it still needs real runtime proof and session-state review before merge.
  • merge-risk: 🚨 session-state: The diff changes whether selected inter-session user leaves are removed from the model-visible prompt and active transcript repair path.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body and author comment provide tests and CI only, and explicitly say no live embedded-agent setup was run; a contributor or maintainer should add redacted runtime logs, terminal output, or a recording before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +22, Tests +94. Total +116 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 3 25 3 +22
Tests 2 94 0 +94
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 5 119 3 +116

What I checked:

  • Root and scoped policy read: Root AGENTS.md and the scoped agent runner AGENTS.md files require whole-path PR review, best-fix judgment, and proof-sensitive handling for agent/session changes. (AGENTS.md:7, 349d3547ccd1)
  • Current main still has the old merge behavior: Current main extracts orphan user text and prepends the queued-user marker, orphan text, a blank line, and the fresh prompt; there is no provenance-aware internal drop branch in the helper. (src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts:504, 349d3547ccd1)
  • Runtime caller uses the helper for provider-bound prompt state: The embedded runner calls the merge strategy with the active leaf message for effective, runtime-context, and transcript prompts, then branches away from the leaf when the merge result says to remove it. (src/agents/embedded-agent-runner/run/attempt.ts:4161, 349d3547ccd1)
  • Existing provenance predicate covers six internal handoff tools: The reused predicate classifies agent/media generation handoffs plus subagent announce and interrupted resume as session-state-preserving inter-session source tools, while sessions_send remains outside that set. (src/sessions/input-provenance.ts:90, 349d3547ccd1)
  • PR diff targets the narrow stale-internal orphan shape: The branch adds shouldDropStaleInternalOrphanedUserPrompt, threads provenance through the merge API, changes the removal log wording, and adds regression coverage for six internal tools plus sessions_send preservation. (src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts:485, 3d38ccdcd218)
  • Real behavior proof is still missing: The PR body and author comment provide tests and CI but explicitly say no live embedded-agent setup was run for the required stale-internal drop and sessions_send preservation cases; ClawSweeper also posted a proof nudge on 2026-07-06. (3d38ccdcd218)

Likely related people:

  • vincentkoc: Authored and merged PR 65478, which introduced the active-turn queued user prompt preservation invariant now being narrowed by this PR. (role: introduced behavior and likely follow-up owner; confidence: high; commits: fcae3bf9433b; files: src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts, src/agents/embedded-agent-runner/run/attempt.ts)
  • jalehman: Recently merged embedded-runner/context-engine session work touching attempt.ts, so they are a current adjacent owner for session repair behavior. (role: recent adjacent area contributor; confidence: medium; commits: d5e9b4d1a32f; files: src/agents/embedded-agent-runner/run/attempt.ts)
  • ZacharyYW: Authored the recent PR whose merge commit currently blames the helper and caller lines in this checkout, so they are relevant for recent area context even if the deeper origin predates that merge. (role: recent current-main carrier; confidence: medium; commits: 01f0b2340f64; files: src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts, src/agents/embedded-agent-runner/run/attempt.ts, src/sessions/input-provenance.ts)
  • steipete: Merged the recent current-main carrier PR and is listed in CONTRIBUTING.md as repository maintainer, making them a plausible decision route if the competing repair strategy needs final arbitration. (role: recent merger and official maintainer; confidence: medium; commits: 01f0b2340f64; files: src/agents/embedded-agent-runner/run/attempt.prompt-helpers.ts, src/agents/embedded-agent-runner/run/attempt.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (3 earlier review cycles)
  • reviewed 2026-06-25T02:35:23.495Z sha 3d38ccd :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-06T14:55:53.310Z sha 3d38ccd :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-06T15:34:34.594Z sha 3d38ccd :: needs real behavior proof before merge. :: none

@openclaw-barnacle openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jun 24, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. labels Jun 24, 2026
@outdog-hwh

outdog-hwh commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

I fixed the test-type blocker from the previous review and the PR head is now CI-clean (check-test-types, prod types, lint, guards, build artifacts, QA smoke, and Real behavior proof are passing on e684ac2).

I do not have access to a live OpenClaw session setup that can reproduce #76888 end to end. For the remaining proof gate, could someone with a real embedded-agent session validate these two cases?

  • inter_session orphaned user leaf from subagent_announce: stale NO_REPLY/completion text is removed and does not shadow the fresh prompt.
  • inter_session orphaned user leaf from sessions_send: forwarded user text is still preserved in the repaired prompt.

This was referenced Jun 26, 2026
Closed
Closed
@zhangguiping-xydt zhangguiping-xydt mentioned this pull request Jul 1, 2026
Merged
@clawsweeper

clawsweeper Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

@outdog-hwh thanks for the PR. ClawSweeper is still waiting on real behavior proof before this can move forward.

Useful proof can be a screenshot, short video, terminal output, copied live output, linked artifact, or redacted logs that show the changed behavior after the fix. Please redact private tokens, phone numbers, private endpoints, customer data, and anything else sensitive.

Once proof is added to the PR body or a comment, ClawSweeper or a maintainer can re-check it.

@barnacle-openclaw

barnacle-openclaw Bot commented Jul 22, 2026

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@barnacle-openclaw barnacle-openclaw Bot added the stale Marked as stale due to inactivity label Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: S stale Marked as stale due to inactivity status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Queued/orphaned user-message merge can produce stale reply

1 participant

@outdog-hwh