…inst self-append loops

Addresses three reviewer comments on PR openclaw#38162:

1. Aisle security analysis (CWE-834): Unbounded postHookActions drain
   allowed self-appending action loops because the for..of iterated a
   live array. A buggy/malicious post-hook action could push another
   action onto event.postHookActions during drain and cause the loop
   to run indefinitely. Switch the post-listener drain to the same
   snapshot+clear pattern already used in the no-listener branch:

     const pending = [...(event.postHookActions ?? [])];
     event.postHookActions.length = 0;
     for (const action of pending) { ... }

   Newly pushed actions are queued for a subsequent triggerInternalHook
   call but cannot extend this drain cycle.

2. Greptile P2 (Math.random fallback can produce trailing-dash slug):
   The pre-existing fallback used Math.random().toString(36).slice(2, 6)
   which can return '' at the exact value 0. Replace with
   crypto.randomUUID().replace(/-/g, '').slice(0, 4) to match the
   approach already standardized in the block-content branch and
   eliminate the edge case. Also unify so the random suffix is appended
   to filenames on ALL paths (LLM slug AND fallback) — the previous
   code only applied it to the fallback path, leaving LLM-slug
   collisions possible for two same-day similar sessions.

3. New test coverage:
   - 'prevents self-appending action loops by snapshotting before
     draining (CWE-834 guard)' — pushes a self-appending action and
     verifies the drain terminates after exactly one execution.
   - 'snapshots actions registered after the drain begins
     (multi-handler stacking)' — verifies actions added by an action
     during drain are queued for a future cycle, not extended into
     the current one.

Plus: the existing 'uses local timezone date and fallback time' test
updated to match the new filename format that includes the 4-char
suffix on all paths.

transcript.ts is intentionally NOT deleted: the test file imports
findPreviousSessionFile / getRecentSessionContent / etc. from it. The
in-handler private copies have diverged slightly from transcript.ts's
exports (different content extraction strategies); reconciling those
into a single canonical implementation is a separate cleanup task and
out of scope for this PR.

…e docs

Address remaining clawsweeper concerns on PR openclaw#38162:

1. **Public hook-runtime surface (postHookActions on InternalHookEvent).**
   The PR adds postHookActions to InternalHookEvent which is re-exported
   through src/plugin-sdk/hook-runtime.ts. clawsweeper flagged that
   bounded drain behavior + compatibility for manually-constructed
   events need to be settled. The drainer already does ??= [] before
   iteration (so manually-constructed legacy events without the field
   work fine), but lacked an explicit regression test. Added:

   - 'tolerates manually-constructed events that omit postHookActions
     (SDK compat)' — builds a hand-rolled event without the
     postHookActions field and triggers it. Verifies the drain
     doesn't throw, the registered handler runs, and no crash.

   Plus replaced the previous one-line JSDoc on InternalHookEvent's
   postHookActions field with comprehensive docs covering when to use
   it, snapshot+clear drain semantics with explicit CWE-834 callout,
   per-action error isolation, optional/additive nature, and the
   contract that actions pushed during drain are queued for the next
   cycle (not extended into the current one). Plugin authors and
   maintainers reviewing API compatibility now have the full contract
   in one place.

2. **Late-blockSessionSave privacy semantics.** Mirror the privacy
   warning improvement from openclaw#38161 onto this branch: when a late hook
   sets blockSessionSave AND the transcript was already loaded for
   slug generation, emit a WARN-level log with PRIVACY: prefix that
   includes the transcript byte count, the file path being retracted,
   and explicit acknowledgement that retraction does NOT un-send the
   data from the slug-generation provider's logs / training pipeline.

3. **Premature save logging.** Renamed inline log lines to make
   staging vs final disposition explicit:
     - debug: 'Memory file written inline (pre-post-hook, may be
       retracted/replaced)'
     - info:  'Session context staged at <path> (final disposition
       decided by post-hook drain)'
   Both redirect and non-redirect paths get the same treatment so
   operators grepping for save success filter on post-drain lines.

Tests: 76/76 pass (was 75; +1 for SDK compat).

The user asked me to revisit items I had marked as 'follow-up' or
'could be added if you want' on PR openclaw#38162 and address them inline
rather than carry them as future work. Three items qualified.

1) Aisle medium #2 — Unbounded transcript read for slug generation.
   getRecentSessionContent() called fs.readFile() on the entire
   session JSONL file. Long-running sessions can produce multi-hundred-MB
   transcripts (verbose tool I/O, base64 image content, etc.) and
   reading them whole into memory is a real OOM / DoS surface.

   Fix: cap the read at MAX_SESSION_FILE_TAIL_BYTES (8 MiB) using
   fs.open + fs.read with a trailing-window offset. Drop the (likely
   partial) first line after slicing so JSON.parse only sees whole
   records. The handler still produces correct slug input because we
   only use the last 15 user/assistant messages anyway.

   Test: synthesises a 12 MiB JSONL file with tail markers and
   verifies (a) no OOM, (b) the markers reach the resulting memory
   file (proving we read the END, not the beginning).

2) Aisle low #3 — Cross-platform path traversal hardening.
   The pre-flight guard rejected '..' and '../' and ,
   but on POSIX hosts path.sep === '/' so backslash-style traversal
   ('..\') from a redirect path that originated on a Windows client
   slipped through. Same gap for UNC paths ('\\server\share',
   '\\?\C:\...') and Windows-style absolute paths ('C:\...').
   These don't escape on Linux, but they create unpredictable
   cross-platform behavior and the snapshot-vs-realtime check is the
   classic Windows snapshot-bypass pattern.

   Fix: extended the pre-flight guard with explicit checks for
   backslash traversal, drive-letter prefixes, and UNC patterns. All
   are rejected with a structured log line that callouts the new
   reasons (windowsTraversal, unc) for diagnostics.

   Test: 3 candidates ('..\..\Windows\System32\stolen.md',
   '\\evil-server\share\stolen.md', '\\?\C:\Windows\stolen.md')
   all fail closed with no memory file produced.

3) Symlink rollback contract test (deferred when darfaz raised it).
   The retraction path resolves writtenFilePath via fs.realpath before
   touching the file, but there was no test that exercised this code
   path through a symlink. Added a test that:
   - Creates an in-workspace symlink (quarantine/redirected.md ->
     real/redirected.md)
   - Pre-populates the canonical target with 'pre-existing'
   - Drives the handler with a late blockSessionSave
   - Verifies the canonical target's pre-existing content is restored
     (not deleted, not clobbered, not escaped) and the workspace tree
     stays self-contained
   The test gracefully skips on filesystems that refuse fs.symlink so
   CI runners without symlink support don't block the PR.

Tests: 39/39 pass on session-memory handler.test.ts (4 new tests).

Net diff: +66/-9 handler.ts, +154/-1 handler.test.ts.

gpt-5.5 second-pass review on PR openclaw#38162 surfaced one real DoS vector
plus a handful of operability gaps. All actionable items addressed:

P0-1 — Failing symlink-rollback test
  Already fixed in a6458dd (the previous push). The reviewer was
  looking at a pre-fix snapshot; current branch is green.

P1-1 + P2-2 — Pre-existing content snapshot was unbounded and followed
  symlinks. A hook could point sessionSaveRedirectPath at a multi-GB
  log inside the workspace and force the retraction-snapshot read to
  OOM the gateway. Even worse, an in-workspace symlink to a large
  external file would let fs.readFile follow the link before
  writeFileWithinRoot validates the write target.

  Fix: snapshot via fs.lstat first to (a) skip symlinks entirely
  (no link-following read), (b) skip non-regular files (directories,
  sockets, devices), (c) cap regular-file snapshots at
  MAX_PRE_EXISTING_SNAPSHOT_BYTES = 4 MiB. When the file is too large
  to snapshot, log at debug level and fall back to unlink-on-retraction
  rather than crashing.

P2-1 — Log paths leaked workspace structure
  Three log.warn sites (resolves-outside-workspace, redirect-rejected,
  privacy-egress) embedded raw absolute paths into logs. Aggregated log
  streams from multi-tenant deployments could reveal home directory
  structure to operators outside the host.

  Fix: added sanitizePathForLog() that replaces os.homedir() with '~'
  (idempotent, safe on non-string inputs). Applied at all three sites.

P2-3 — Late-set sessionSaveRedirectPath was undocumented in code
  Unlike blockSessionSave / sessionSaveContent (which support
  postHookActions late-set), sessionSaveRedirectPath is read once at
  handler entry. Plugin authors had no way to discover this from the
  code. Added a long comment block at the read site explaining the
  design constraint and the two supported workarounds (FIFO ordering
  via internal hooks, priority < 0 via typed plugin hooks).

P2-5 — Privacy warning improved with concrete remediation
  The PRIVACY: late-block warning explained the data-egress problem
  but didn't tell operators how to avoid it in the future. Added the
  two recommended patterns (typed plugin hook priority < 0 / earlier
  internal hook) so the warning is self-contained.

P3-5 — isRedirected accepted whitespace-only strings
  '   ' would pass length > 0 and resolve as a relative path. Changed
  to .trim().length > 0 so whitespace strings short-circuit cleanly.

Skipped from the report: P2-4 (Windows real-environment test —
infrastructure work, separate PR), P3-1 (test helper drain semantics —
cosmetic), P3-2 (canonicalizeViaAncestor extraction — refactor),
P3-3 (transcript.ts inline duplication — explicit design choice),
P3-4 (redirect-to-directory test — overlaps with existing coverage).

Tests: 39/39 session-memory + 40/40 internal-hooks pass.

Net diff handler.ts: +71/-12. No test changes needed (existing tests
exercise all changed paths; the lstat path falls back to readFile for
the common case).

CI lint failed with 4 oxlint errors after the recent hardening
commits. All four are mine, all in code I added in this PR series:

1. eslint(curly) at handler.ts:170 — single-line if without braces in
   the new sanitizePathForLog() helper. Wrapped in { }.

2. typescript-eslint(no-unnecessary-type-assertion) at handler.ts:597
   and 760 — 'redirectPath as string' casts. The type-aware analysis
   correctly narrows redirectPath to string here (control flow inside
   the isRedirected branch), so the cast is redundant. Removed both.

3. Unused eslint-disable directive at handler.test.ts:1100 — left over
   from a draft of the symlink-rollback test. The no-console rule
   isn't active in this scope, so the disable comment is dead code.
   Removed.

These don't surface on local 'pnpm lint' because the local script
fails fast on pre-existing pi-ai dts boundary errors before the core
oxlint shard runs. CI runs the shards independently. Reproduced
locally with the exact CI flags:

  npx oxlint --type-aware \
    --tsconfig tsconfig.oxlint.core.json \
    --report-unused-disable-directives-severity error \
    --threads=8 src ui packages

Tests still 40/40 pass. Lint now reports 'Found 0 warnings and 0 errors.'

… P1)

When sessionSaveRedirectPath points at a symlinked file and the link
gets retargeted, removed, or replaced between the inline write and
the post-hook drain, the rollback restoration was writing
preExistingContent through writeRelativePath (the lexical redirect
path) instead of writtenFilePath (the realpath captured immediately
after the inline write).

That meant a late blockSessionSave could:
- Restore old content via the now-retargeted symlink to a DIFFERENT
  file than the one we actually overwrote
- Leave the original target with the redirected transcript still on
  disk

Net result: the handler's documented "no persistence anywhere"
guarantee for blockSessionSave silently broke for symlink-backed
redirects.

Fix: when isRedirected, compute the restore relativePath from the
realpath we captured at write time (writtenFilePath), not the
lexical writeRelativePath. The realpath was in-workspace by
construction (writeFileWithinRoot validated containment for the
original write), so writeFileWithinRoot's containment check still
applies. Non-redirected writes are unaffected (still use the original
filename relative to memoryDir).

Regression test:
* Initial state: linkPath -> realA/redirected.md ("original-A")
* realB/redirected.md exists with "original-B-untouched"
* Post-hook retargets linkPath -> realB, then sets blockSessionSave
* With the fix: rollback writes through realA (realpath at write time),
  restoring "original-A"; realB is never touched.
* Without the fix: rollback writes through the now-retargeted symlink,
  clobbering realB with the wrong content.

Tests: 41/41 (one new). Lint clean.

Codex P1 ref: PR openclaw#38162 review comments r2971126306 + r3104652193
(both filed the same issue; one was originally filed against the
March-22 snapshot, the other against April-18). Both now closed.

…ory-redirect

…ory-redirect