Skip to content

Sessions: consolidate path hardening and fallback resilience#24657

Merged
vincentkoc merged 6 commits intomainfrom
vincentkoc-code/session-path-rollup-proper
Feb 23, 2026
Merged

Sessions: consolidate path hardening and fallback resilience#24657
vincentkoc merged 6 commits intomainfrom
vincentkoc-code/session-path-rollup-proper

Conversation

@vincentkoc
Copy link
Member

@vincentkoc vincentkoc commented Feb 23, 2026 •
edited by greptile-apps bot
Loading

Summary

  • consolidate the session-path hardening work into one merge-ready branch
  • resolve symlinked state-dir alias paths safely during session-file containment checks
  • preserve cross-agent/state-root compatibility while keeping agents/<id>/sessions/** bounds
  • make resolveSessionFilePath resilient to stale/corrupt persisted sessionFile metadata by falling back to derived safe transcript paths
  • add focused regression coverage for invalid absolute paths and symlink-alias paths
  • include changelog credit lines with contributor handles (@haoyifan, @EpaL, @vincentkoc)

Files

  • src/config/sessions/paths.ts
  • src/config/sessions/sessions.test.ts
  • src/config/sessions.test.ts
  • CHANGELOG.md

Validation

  • pnpm vitest run src/config/sessions/sessions.test.ts src/config/sessions.test.ts

Credit / lineage

Greptile Summary

This PR consolidates session path hardening by resolving symlinks during containment checks and adding fallback resilience for stale/corrupt sessionFile metadata. The changes prevent session handler failures when persisted paths become invalid while maintaining cross-agent compatibility.

Key Changes:

  • Added safeRealpathSync helper to resolve symlinks safely with fallback to original path on failure
  • Updated resolvePathFromAgentSessionsDir and resolvePathWithinSessionsDir to resolve symlinks before performing containment checks
  • Wrapped resolveSessionFilePath logic in try-catch to gracefully fall back to derived transcript paths when sessionFile metadata is invalid
  • Added comprehensive test coverage for symlink aliases, symlink escape scenarios, and invalid absolute paths
  • Updated CHANGELOG with proper credit attribution

Confidence Score: 5/5

  • This PR is safe to merge with minimal risk
  • The implementation correctly handles symlink resolution and adds proper fallback mechanisms without introducing security vulnerabilities. The symlink resolution is done safely with proper containment checks, the try-catch wrapper prevents handler crashes from stale metadata, and comprehensive test coverage validates all edge cases including symlink escapes and cross-agent scenarios. The code follows established patterns and maintains backward compatibility.
  • No files require special attention

Last reviewed commit: 67656f4

@openclaw-barnacle openclaw-barnacle bot added size: S maintainer Maintainer-authored PR labels Feb 23, 2026
@vincentkoc
Copy link
Member Author

vincentkoc commented Feb 23, 2026

Added an extra hardening regression test for symlink escape paths.

What it covers:

  • sessionFile points to a symlink under agents/<id>/sessions that resolves outside that directory.
  • Expected behavior: resolution fails closed to the derived safe path (sess-1.jsonl under the agent sessions dir), not the escaped target.

Validation rerun:

  • pnpm vitest run src/config/sessions/sessions.test.ts src/config/sessions.test.ts
  • Result: 44/44 tests passing.

@vincentkoc vincentkoc marked this pull request as ready for review February 23, 2026 17:33
@vincentkoc vincentkoc merged commit 6a0fcf6 into main Feb 23, 2026
22 checks passed
@vincentkoc vincentkoc deleted the vincentkoc-code/session-path-rollup-proper branch February 23, 2026 17:36
This was referenced Feb 23, 2026
Closed
Closed
Closed
@vincentkoc vincentkoc added the dedupe:parent Primary canonical item in dedupe cluster label Feb 23, 2026
@vabole vabole mentioned this pull request Feb 23, 2026
Merged
3 tasks
@github-actions github-actions bot mentioned this pull request Feb 23, 2026
Open
carlosrivera pushed a commit to myascendai/meshiclaw that referenced this pull request Feb 23, 2026
@vincentkoc @carlosrivera
Sessions: consolidate path hardening and fallback resilience (opencla…
0945ece 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
@steipete steipete mentioned this pull request Feb 24, 2026
Closed
3 tasks
mreedr pushed a commit to mreedr/openclaw-custom that referenced this pull request Feb 24, 2026
@vincentkoc
Sessions: consolidate path hardening and fallback resilience (opencla…
6ead36e 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
xianfeng92 pushed a commit to xianfeng92/openclaw that referenced this pull request Feb 24, 2026
@vincentkoc @xianfeng92
Sessions: consolidate path hardening and fallback resilience (opencla…
55eb5cd 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
plgs2005 pushed a commit to plgs2005/openclaw that referenced this pull request Feb 24, 2026
@vincentkoc @plgs2005
Sessions: consolidate path hardening and fallback resilience (opencla…
0de4cfc 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
margulans pushed a commit to margulans/Neiron-AI-assistant that referenced this pull request Feb 25, 2026
@vincentkoc @margulans
Sessions: consolidate path hardening and fallback resilience (opencla…
0b2b51d 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
brianleach pushed a commit to brianleach/openclaw that referenced this pull request Feb 26, 2026
@vincentkoc @brianleach
Sessions: consolidate path hardening and fallback resilience (opencla…
c31c1d9 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
@arjunaskykok arjunaskykok mentioned this pull request Feb 26, 2026
Open
2 tasks
mylukin pushed a commit to mylukin/openclaw that referenced this pull request Feb 26, 2026
@vincentkoc @mylukin
Sessions: consolidate path hardening and fallback resilience (opencla…
19e6dfd 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
r4jiv007 pushed a commit to r4jiv007/openclaw that referenced this pull request Feb 28, 2026
@vincentkoc @r4jiv007
Sessions: consolidate path hardening and fallback resilience (opencla…
5e9ff4f 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
zooqueen pushed a commit to hanzoai/bot that referenced this pull request Mar 6, 2026
@vincentkoc
Sessions: consolidate path hardening and fallback resilience (opencla…
ef7678e 
…w#24657)

* Changelog: credit session path fixes

* Sessions: harden path resolution for symlink and stale metadata

* Tests: cover fallback for invalid absolute sessionFile

* Tests: add symlink alias session path coverage

* Tests: guard symlink escape in sessionFile resolution
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dedupe:parent Primary canonical item in dedupe cluster maintainer Maintainer-authored PR size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc