fix(security): remove post-compaction audit injection message by fuller-stack-dev · Pull Request #28507 · openclaw/openclaw

fuller-stack-dev · 2026-02-27T08:38:47Z

Summary

Remove the post-compaction read audit (Layer 3) that injects fake system messages into conversations after context compaction. This is a security fix.

The Problem

After every context compaction, post-compaction-audit.ts checks whether the agent read specific hardcoded files and, if not, injects a user-role message via enqueueSystemEvent:

⚠️ Post-Compaction Audit: The following required startup files were not read after context reset:
  - WORKFLOW_AUTO.md
  - memory\/\d{4}-\d{2}-\d{2}\.md

Please read them now using the Read tool before continuing.
This ensures your operating protocols are restored after memory compaction.

This is problematic because:

WORKFLOW_AUTO.md doesn't exist in standard workspaces — it's a hardcoded reference to a file from a previous version that was never documented or shipped
Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing text
Creates a prompt injection vector — agents treat these system-injected messages as authoritative and attempt to read files they shouldn't (see [Security] post-compaction-audit.ts hardcodes WORKFLOW_AUTO.md — viable attack vector for persistent prompt injection #27697 for full attack flow analysis)
Appears as user-role messages in chat UIs ([Bug]: Gateway Chat UI displays system-injected messages (Post-Compaction Audit, Heartbeat) as "You" #26461), confusing both users and agents

What's Removed

src/auto-reply/reply/post-compaction-audit.ts — the audit logic, hardcoded file list, and warning formatter
src/auto-reply/reply/post-compaction-audit.test.ts — associated tests
All references in agent-runner.ts: imports, pendingPostCompactionAudits map, flag setting, and the Layer 3 audit execution block

What's Preserved

Layer 1 (compaction summary) — unchanged
Layer 2 (post-compaction-context.ts) — workspace context refresh from AGENTS.md sections, still injected as a system event after compaction. This is the legitimate mechanism for post-compaction recovery.
Compaction safeguard extension (compaction-safeguard.ts) — imports extractSections from post-compaction-context.ts only, unaffected

Fixes

Fixes #27697 — [Security] post-compaction-audit.ts hardcodes WORKFLOW_AUTO.md — viable attack vector for persistent prompt injection
mRelates to #26851 — Prompt injection via fake system message during context compaction
mRelates to #20484 — Post-compaction audit warning triggers prompt injection detection by AI agent
mRelates to #22339 — RegExp .source leaks raw regex syntax in audit warning
mRelates to #25600 — Post-compaction audit requires reading WORKFLOW_AUTO.md even when the file does not exist
Relates to #26461 — Gateway Chat UI displays system-injected messages as "You"

greptile-apps · 2026-02-27T08:42:15Z

Greptile Summary

Removed the Layer 3 post-compaction audit system (post-compaction-audit.ts) that was injecting fake system messages after context compaction. The audit hardcoded references to non-existent files (WORKFLOW_AUTO.md), leaked raw regex syntax to users, and created a prompt injection vector by appearing as user-role messages.

Deleted post-compaction-audit.ts (111 lines) and its test file (197 lines)
Removed all imports and references from agent-runner.ts
Removed the pendingPostCompactionAudits Map tracking mechanism
Removed the Layer 3 audit execution block that checked and injected warning messages
Preserved Layer 2 (post-compaction-context.ts) which legitimately extracts AGENTS.md sections
Verified compaction-safeguard.ts extension is unaffected (only imports extractSections from Layer 2)

The removal is complete, with no remaining references to the deleted audit functionality anywhere in the codebase.

Confidence Score: 5/5

This PR is safe to merge with minimal risk - it's a clean security fix that removes problematic code without affecting legitimate functionality
The removal is thorough and complete with no remaining references to deleted code. All imports removed, tracking mechanisms deleted, and Layer 2 functionality preserved. The change addresses legitimate security concerns (prompt injection, hardcoded non-existent files, regex syntax leaks) while maintaining the correct post-compaction recovery mechanism.
No files require special attention - the changes are straightforward deletions with clean integration

_{Last reviewed commit: f719326}

Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461

vincentkoc · 2026-02-28T01:12:03Z

Rebased this branch onto current main and added a regression test to lock in the security behavior from this PR.

What changed:

Added test coverage in src/auto-reply/reply/agent-runner.misc.runreplyagent.test.ts proving no legacy Post-Compaction Audit/WORKFLOW_AUTO.md warning is enqueued after compaction.
Kept the removal scope intact (Layer 3 audit removed, Layer 2 context refresh unchanged).
Updated the PR body link semantics so only [Security] post-compaction-audit.ts hardcodes WORKFLOW_AUTO.md — viable attack vector for persistent prompt injection #27697 is Fixes; related issues are listed as Relates to.

Validation run locally:

pnpm vitest run src/auto-reply/reply/agent-runner.misc.runreplyagent.test.ts
pnpm check

* Changelog: add LanceDB custom baseUrl + dimensions entry (#17874) * Changelog: add Ollama autodiscovery hardening entry (#29201) * Changelog: add Ollama context-window unification entry (#29205) * Changelog: add compaction audit injection removal entry (#28507) * Changelog: add browser url alias entry (#29260) * Changelog: add codex weekly usage label entry (#26267)

…aw#28507) * fix: remove post-compaction audit injection (Layer 3) Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461 * fix: resolve lint failures from post-compaction audit removal * Tests: add regression for removed post-compaction audit warnings --------- Co-authored-by: Wilfred (OpenClaw Agent) <jay@openclaw.dev> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

* Changelog: add LanceDB custom baseUrl + dimensions entry (openclaw#17874) * Changelog: add Ollama autodiscovery hardening entry (openclaw#29201) * Changelog: add Ollama context-window unification entry (openclaw#29205) * Changelog: add compaction audit injection removal entry (openclaw#28507) * Changelog: add browser url alias entry (openclaw#29260) * Changelog: add codex weekly usage label entry (openclaw#26267)

…aw#28507) * fix: remove post-compaction audit injection (Layer 3) Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461 * fix: resolve lint failures from post-compaction audit removal * Tests: add regression for removed post-compaction audit warnings --------- Co-authored-by: Wilfred (OpenClaw Agent) <jay@openclaw.dev> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

* Changelog: add LanceDB custom baseUrl + dimensions entry (openclaw#17874) * Changelog: add Ollama autodiscovery hardening entry (openclaw#29201) * Changelog: add Ollama context-window unification entry (openclaw#29205) * Changelog: add compaction audit injection removal entry (openclaw#28507) * Changelog: add browser url alias entry (openclaw#29260) * Changelog: add codex weekly usage label entry (openclaw#26267)

…aw#28507) * fix: remove post-compaction audit injection (Layer 3) Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461 * fix: resolve lint failures from post-compaction audit removal * Tests: add regression for removed post-compaction audit warnings --------- Co-authored-by: Wilfred (OpenClaw Agent) <jay@openclaw.dev> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

* Changelog: add LanceDB custom baseUrl + dimensions entry (openclaw#17874) * Changelog: add Ollama autodiscovery hardening entry (openclaw#29201) * Changelog: add Ollama context-window unification entry (openclaw#29205) * Changelog: add compaction audit injection removal entry (openclaw#28507) * Changelog: add browser url alias entry (openclaw#29260) * Changelog: add codex weekly usage label entry (openclaw#26267)

…aw#28507) * fix: remove post-compaction audit injection (Layer 3) Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461 * fix: resolve lint failures from post-compaction audit removal * Tests: add regression for removed post-compaction audit warnings --------- Co-authored-by: Wilfred (OpenClaw Agent) <jay@openclaw.dev> Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

* Changelog: add LanceDB custom baseUrl + dimensions entry (openclaw#17874) * Changelog: add Ollama autodiscovery hardening entry (openclaw#29201) * Changelog: add Ollama context-window unification entry (openclaw#29205) * Changelog: add compaction audit injection removal entry (openclaw#28507) * Changelog: add browser url alias entry (openclaw#29260) * Changelog: add codex weekly usage label entry (openclaw#26267)

…aw#28507) * fix: remove post-compaction audit injection (Layer 3) Remove the post-compaction read audit that injects fake system messages into conversations after context compaction. This audit: - Hardcodes WORKFLOW_AUTO.md (a file that doesn't exist in standard workspaces) as a required read after every compaction - Leaks raw regex syntax (memory\/\d{4}-\d{2}-\d{2}\.md) in user-facing warning messages - Injects messages via enqueueSystemEvent that appear as user-role messages, tricking agents into reading attacker-controlled files - Creates a persistent prompt injection vector (see openclaw#27697) Layer 1 (compaction summary) and Layer 2 (workspace context refresh from AGENTS.md via post-compaction-context.ts) remain intact and are sufficient for post-compaction context recovery. Deleted files: - src/auto-reply/reply/post-compaction-audit.ts - src/auto-reply/reply/post-compaction-audit.test.ts Modified files: - src/auto-reply/reply/agent-runner.ts (removed imports, audit map, flag setting, and Layer 3 audit block) Fixes openclaw#27697, fixes openclaw#26851, fixes openclaw#20484, fixes openclaw#22339, fixes openclaw#25600 Relates to openclaw#26461 * fix: resolve lint failures from post-compaction audit removal * Tests: add regression for removed post-compaction audit warnings --------- Co-authored-by: Wilfred (OpenClaw Agent) <jay@openclaw.dev> Co-authored-by: Vincent Koc <vincentkoc@ieee.org> (cherry picked from commit a65b0fa)

* Changelog: add LanceDB custom baseUrl + dimensions entry (openclaw#17874) * Changelog: add Ollama autodiscovery hardening entry (openclaw#29201) * Changelog: add Ollama context-window unification entry (openclaw#29205) * Changelog: add compaction audit injection removal entry (openclaw#28507) * Changelog: add browser url alias entry (openclaw#29260) * Changelog: add codex weekly usage label entry (openclaw#26267) (cherry picked from commit 20263d0)