Skip to content

fix(cli): hide synthetic Claude reseed prompts#99653

Merged
vincentkoc merged 1 commit into
openclaw:mainfrom
ZOOWH:fix/99646-cli-reseed-wrapper-leak
Jul 4, 2026
Merged

fix(cli): hide synthetic Claude reseed prompts#99653
vincentkoc merged 1 commit into
openclaw:mainfrom
ZOOWH:fix/99646-cli-reseed-wrapper-leak

Conversation

@ZOOWH

@ZOOWH ZOOWH commented Jul 3, 2026 •
edited by vincentkoc
Loading

Copy link
Copy Markdown
Contributor

Fixes #99646

What Problem This Solves

Claude CLI reseeds can write OpenClaw's internal history wrapper into the native CLI transcript. The gateway later imported that synthetic row as an ordinary user message, exposing internal context in chat history.

An importer-only regex fix is unsafe: it cannot prove that the canonical user turn was persisted, and prompt transforms, retries, fallback, images, or session resets can change the row shape.

Why This Change Was Made

The repair carries durable proof across the full CLI lifecycle:

  • direct and cron CLI paths share one user-turn transcript recorder;
  • retries and fallback retain a closed persisted or omitted disposition;
  • CLI session bindings store a versioned receipt with the prompt hash and local session owner;
  • Claude history import suppresses only the first eligible exact receipt match;
  • malformed, mismatched, ambiguous, or stale receipts fail open;
  • mixed text/image rows remove only the proven synthetic text block;
  • reset logic rebinds only omitted receipts, preserving archived transcript ownership for persisted turns.

Legacy reseed envelopes remain parser-only migration input. Normal runtime paths use the receipt.

User Impact

Users keep the authoritative OpenClaw user turn, while the internal Claude CLI reseed copy no longer appears in visible history or fallback context. Images and unrelated native content remain intact.

Evidence

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: S labels Jul 3, 2026
@clawsweeper

clawsweeper Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 1:53 AM ET / 05:53 UTC.

Summary
Adds versioned CLI reseed receipts and shared user-turn transcript recording so Claude CLI reseed wrapper rows can be suppressed or legacy-recovered during history import without duplicating canonical user turns.

PR surface: Source +406, Tests +1516. Total +1922 across 34 files.

Reproducibility: yes. at source level: current main imports Claude CLI user transcript rows unchanged, and the linked issue shows the exact wrapper row plus screenshot evidence. I did not run a live Claude CLI/iOS reload path in this read-only review.

Review metrics: 1 noteworthy metric.

  • Stored session binding surface: 1 optional receipt field added. The PR persists reseedReceipt in CLI session bindings, so upgrade and fail-open behavior matter before merge.

Stored data model
Persistent data-model change detected: serialized state: src/agents/cli-runner.ts, serialized state: src/agents/cli-session.test.ts, serialized state: src/agents/command/attempt-execution.cli.test.ts, serialized state: src/agents/session-tool-result-guard-wrapper.ts, serialized state: src/agents/session-tool-result-guard.test.ts, serialized state: src/agents/session-tool-result-guard.ts, and 9 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #99646
Summary: this PR is the active fix candidate for the #99646 Claude CLI reseed-wrapper history leak; nearby synthetic-placeholder items share Claude CLI symptoms but not the same history-import root cause.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] The PR adds a persisted reseed receipt to CLI session bindings and uses it to suppress imported transcript rows; maintainers should explicitly accept that session-state contract and finish exact-head CI before merge.

Maintainer options:

  1. Accept receipt-backed history suppression (recommended)
    Merge after exact-head checks if maintainers agree the optional reseed receipt is the right session-state marker for distinguishing internal reseed prompts from real user rows.
  2. Request broader upgrade proof first
    Ask for one more before/after upgrade proof showing an existing binding without a receipt still legacy-recovers the wrapper while new receipt-backed sessions suppress duplicate visible rows.
  3. Pause for a narrower importer-only fix
    Close or pause this expanded branch only if maintainers decide the receipt contract is too much state surface and prefer a narrow parser filter like the superseded PR fix(gateway): hide CLI reseed wrappers in history #99651.

Next step before merge

  • [P2] Maintainers need to finish exact-head CI and accept the new receipt-backed session-state contract; there is no concrete automated repair finding.

Security
Cleared: The diff adds local parsing, session metadata, and tests; it does not change dependencies, workflows, secrets handling, install scripts, or package resolution.

Review details

Best possible solution:

Land the receipt-backed importer fix after exact-head checks and maintainer acceptance of the session-state receipt behavior; keep adjacent Claude synthetic-placeholder lifecycle work separate.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main imports Claude CLI user transcript rows unchanged, and the linked issue shows the exact wrapper row plus screenshot evidence. I did not run a live Claude CLI/iOS reload path in this read-only review.

Is this the best way to solve the issue?

Yes, with maintainer acceptance of the new receipt contract: the importer boundary fixes all history clients, while the receipt avoids hiding arbitrary transformed user rows without proof. A regex-only importer filter would be narrower but less safe for transformed prompts, images, retries, and reset ownership.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1b84316a91dc.

Label changes

Label changes:

  • add merge-risk: 🚨 session-state: The diff adds and consumes persisted CLI session reseed receipt metadata to decide which imported transcript rows become visible.

Label justifications:

  • P2: The PR fixes a normal-priority visible history bug with privacy-adjacent prompt leakage but does not block install, auth, or core runtime startup.
  • merge-risk: 🚨 session-state: The diff adds and consumes persisted CLI session reseed receipt metadata to decide which imported transcript rows become visible.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body and maintainer comment include after-fix terminal/live-output proof for importer behavior plus Testbox checks; no contributor proof action is needed.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body and maintainer comment include after-fix terminal/live-output proof for importer behavior plus Testbox checks; no contributor proof action is needed.
Evidence reviewed

PR surface:

Source +406, Tests +1516. Total +1922 across 34 files.

View PR surface stats
Area Files Added Removed Net
Source 20 441 35 +406
Tests 14 1572 56 +1516
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 34 2013 91 +1922

What I checked:

Likely related people:

What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jul 3, 2026
@harjothkhara

harjothkhara commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

I did an extra non-maintainer source review of this as the current #99646 candidate.

Best-fix read: this is the right boundary. buildCliSessionHistoryPrompt still emits the exact internal wrapper in src/agents/cli-runner/session-history.ts, and chat.history imports Claude CLI rows through augmentChatHistoryWithCliSessionImports before display projection. Filtering in parseClaudeCliHistoryEntry fixes all history clients without changing the model-facing reseed behavior.

I also checked the duplicate/adjacent set: #99651 is closed and superseded; #90789 and #99131 are adjacent Claude placeholder lifecycle issues, not required for this narrow wrapper leak. The PR preserves imported external id/session metadata via attachOpenClawTranscriptMeta, so cli-session-history.merge.ts can still dedupe by identity before falling back to text/timestamp.

Focused proof on head 9def3a6f82a6d8e2e8089229d90aecb40f63ba84:

node scripts/run-vitest.mjs src/gateway/cli-session-history.test.ts
Test Files  4 passed (4)
Tests       88 passed (88)

No additional blocker found. Minor optional hardening: one regression could construct the wrapper with buildCliSessionHistoryPrompt instead of hand-writing the fixture, but current source bytes match the regex and I would not block on that.

CI note: I also checked the current failing required check after posting. checks-node-compact-large-whole-1 is failing in src/agents/embedded-agent-runner/run/attempt.session-lock.test.ts with EmbeddedAttemptSessionTakeoverError, outside this PR's diff. I did not review that unrelated shard failure here; the focused PR proof above remains green.

@vincentkoc vincentkoc self-assigned this Jul 3, 2026
@vincentkoc
vincentkoc requested a review from a team as a code owner July 4, 2026 02:20
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation channel: discord Channel integration: discord channel: imessage Channel integration: imessage channel: signal Channel integration: signal channel: slack Channel integration: slack app: android App: android app: ios App: ios app: macos App: macos app: web-ui App: web-ui extensions: memory-core Extension: memory-core cli CLI command changes scripts Repository scripts commands Command implementations docker Docker and sandbox tooling agents Agent runtime and tooling channel: feishu Channel integration: feishu extensions: openai extensions: minimax extensions: byteplus extensions: together labels Jul 4, 2026
@github-actions github-actions Bot removed the dependencies-changed PR changes dependency-related files label Jul 4, 2026
@vincentkoc

vincentkoc commented Jul 4, 2026

Copy link
Copy Markdown
Member

Merged via squash.

This was referenced Jul 4, 2026
Merged
Merged
@github-actions github-actions Bot mentioned this pull request Jul 4, 2026
Open
@clawsweeper clawsweeper Bot mentioned this pull request Jul 4, 2026
Closed
@clawsweeper clawsweeper Bot mentioned this pull request Jul 14, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

agents Agent runtime and tooling gateway Gateway runtime merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: CLI-runner session-resume wrapper ("Continue this conversation using the OpenClaw transcript…") rendered as a user chat bubble

3 participants

@ZOOWH @harjothkhara @vincentkoc