fix: invalidate orphaned sessions on agent deletion by bittoby · Pull Request #65986 · openclaw/openclaw

bittoby · 2026-04-13T14:34:47Z

Summary

Purge session store entries belonging to a deleted agent during
agents delete, so orphaned sessions cannot be targeted by
sessions_send after the agent is removed.
Add runtime validation in resolveSessionKeyFromResolveParams that
rejects session keys whose agent no longer exists in config, covering
manual config edits and partial cleanup failures.

Closes #65524

Test plan

pnpm test src/gateway/sessions-resolve.test.ts - 3 passed
pnpm tsgo - no type errors
pnpm check - no lint/format/import errors
Manual: create agent, seed sessions, delete agent, verify sessions.json is empty

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62ee5e1244

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62ee5e1244

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

greptile-apps · 2026-04-13T14:40:02Z

Greptile Summary

This PR adds two layers of defense against orphaned sessions after agent deletion: a proactive purge of sessions.json entries during agents delete, and a runtime guard in resolveSessionKeyFromResolveParams that rejects resolved keys whose owning agent is absent from config. The implementation is well-structured — the primary path (purge on delete) covers the common case while the secondary validation handles partial cleanup failures and manual config edits.

Confidence Score: 5/5

Safe to merge — the two-layer defence is logically correct, error handling is adequate, and no correctness issues were found.

All findings are P2 or lower. The prior review concerns (silent catch, limited test coverage) were already addressed in the current revision. No data-loss, security, or correctness defects were identified in the changed paths.

No files require special attention.

_{Reviews (2): Last reviewed commit: "fix: invalidate orphaned sessions on age..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 53cd16e883

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

bittoby · 2026-04-13T18:49:22Z

@greptileai pls review again

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62bf3e8426

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cdc0c7de4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 313d62103c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83b41f940b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49723d5435

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c54062acbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd8464e0c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…penclaw#65524)

gumadeiras · 2026-04-19T22:47:56Z

Merged via squash.

Prepared head SHA: bc7c167dd946fd9b2e76fc3022c60e655e01f1cd
Merge commit: d41c9860d79d816034bfa79a21c7f64b99f29c05

Thanks @bittoby!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc7c167dd9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After #65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected.

…and #65986 (#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in #68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since #68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After #65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

@gumadeiras

Merged via squash. Prepared head SHA: bc7c167 Co-authored-by: bittoby <218712309+bittoby@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

…law#68726 and openclaw#65986 (openclaw#69173) * test(agents): expect timing fields in killed-run outcome Aligns the steer-restart killed-run test with the timing fields added to subagent run outcomes in openclaw#68726. The production code now returns startedAt/endedAt/elapsedMs alongside status and error on the error outcome, but this test's toEqual still asserted only status+error, so it has been failing on main since openclaw#68726 landed. Uses the same expect.any(Number) matcher already in use a few lines below for the ended hook payload. * test(gateway): register ops agent in sessions.create task-start test The "sessions.create can start the first agent turn from an initial task" test triggers the auto chat.send path by passing `task:`. After openclaw#65986 added a deleted-agent guard to chat.send, an unregistered `ops` agent triggers the reject path and the auto-started run never happens, so runStarted comes back false. Register `ops` via testState.agentsConfig (matching the pattern already used by other ops-agent tests in this file) so the guard lets chat.send through and the first turn starts as expected. --------- Co-authored-by: Omar Shahine <10343873+omarshahine@users.noreply.github.com>

openclaw-barnacle Bot added gateway Gateway runtime commands Command implementations size: S labels Apr 13, 2026

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/gateway/sessions-resolve.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/gateway/sessions-resolve.ts Outdated

greptile-apps Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/commands/agents.commands.delete.ts Outdated

Comment thread src/gateway/sessions-resolve.test.ts

bittoby force-pushed the fix/orphaned-agent-sessions-65524 branch from 53cd16e to 62bf3e8 Compare April 13, 2026 18:46

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/gateway/sessions-resolve.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/commands/agents.commands.delete.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread src/commands/agents.commands.delete.ts Outdated

bittoby force-pushed the fix/orphaned-agent-sessions-65524 branch from 9cdc0c7 to 313d621 Compare April 16, 2026 13:15

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread src/commands/agents.commands.delete.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread src/gateway/sessions-resolve.ts

openclaw-barnacle Bot added size: M and removed size: S labels Apr 17, 2026

gumadeiras self-assigned this Apr 19, 2026

gumadeiras force-pushed the fix/orphaned-agent-sessions-65524 branch from a6d20c6 to 49723d5 Compare April 19, 2026 21:33

chatgpt-codex-connector Bot reviewed Apr 19, 2026

View reviewed changes

Comment thread src/commands/agents.command-shared.ts Outdated

Comment thread src/gateway/sessions-resolve.ts

gumadeiras force-pushed the fix/orphaned-agent-sessions-65524 branch from b7fa665 to 4abd237 Compare April 19, 2026 21:39

openclaw-barnacle Bot added size: L and removed size: M labels Apr 19, 2026

chatgpt-codex-connector Bot reviewed Apr 19, 2026

View reviewed changes

Comment thread src/commands/agents.command-shared.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 19, 2026

View reviewed changes

Comment thread src/gateway/server-methods/sessions.ts

openclaw-barnacle Bot added the app: web-ui App: web-ui label Apr 19, 2026

bittoby added 4 commits April 19, 2026 18:44

fix: invalidate orphaned sessions on agent deletion (openclaw#65524)

945259c

update

0d473e8

test: cover deleted-agent guard on sessionId and label resolve paths

ae17248

fix: share session purge across CLI and gateway agent delete paths (o…

b87d619

…penclaw#65524)

gumadeiras added 7 commits April 19, 2026 18:44

refactor: clarify main session alias handling

d51b697

test: cover agent delete session purge

1a98cc0

fix: canonicalize legacy main session aliases

c79a5f3

fix: preserve deleted main-store ownership

8e8d5ce

fix: preserve shared-store sessions on agent delete

2291def

fix: guard chat sends for deleted agents

569816f

docs: move session changelog entry

bc7c167

gumadeiras force-pushed the fix/orphaned-agent-sessions-65524 branch from 07e1218 to bc7c167 Compare April 19, 2026 22:47

gumadeiras merged commit d41c986 into openclaw:main Apr 19, 2026
11 checks passed

chatgpt-codex-connector Bot reviewed Apr 19, 2026

View reviewed changes

Comment thread src/gateway/session-store-key.ts

omarshahine mentioned this pull request Apr 20, 2026

test(agents,gateway): fix two main-baseline test breakages from #68726 and #65986 #69173

Merged

3 tasks

clawsweeper Bot mentioned this pull request Apr 29, 2026

[Bug]: Control UI displays sessions from unregistered agents #41685

Closed

clawsweeper Bot mentioned this pull request May 13, 2026

Agent session corruption persists across agent deletion due to multi-location state persistence #66377

Closed

Uh oh!

Conversation

bittoby commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

bittoby commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

gumadeiras commented Apr 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

bittoby commented Apr 13, 2026 •

edited

Loading

greptile-apps Bot commented Apr 13, 2026 •

edited

Loading

bittoby commented Apr 13, 2026 •

edited

Loading