fix: rotate sessionFile after daily reset#78618
Conversation
|
Codex review: needs real behavior proof before merge. Summary Reproducibility: yes. A high-confidence source reproduction is to seed Real behavior proof Next step before merge Security Review detailsBest possible solution: Land the narrow gateway write-path rotation after redacted real behavior proof is added and normal CI completes. Do we have a high-confidence way to reproduce the issue? Yes. A high-confidence source reproduction is to seed Is this the best way to solve the issue? Yes for the code direction. Rotating generated transcript filenames in the gateway rollover write path while preserving custom names is narrower than globally rejecting persisted paths, but the PR is not merge-ready without real behavior proof and completed checks. What I checked:
Likely related people:
Remaining risk / open question:
Codex review notes: model gpt-5.5, reasoning high; reviewed against d3fc1985feba. |
byungskers
left a comment
There was a problem hiding this comment.
This is a solid defensive fix. Reusing a stale sessionFile after daily reset could definitely lead to transcript pollution or confusing audit trails.
The isSessionFileCompatibleWithSessionId helper is well-scoped, and keeping the topic-transcript path intact (sess-1-topic-456.jsonl) shows good attention to the edge cases. Tests cover both the rejection and the preservation cases nicely. LGTM!
3479799 to
f3cc43a
Compare
Signed-off-by: sallyom <somalley@redhat.com>
Summary
sessionFilewhen its basename no longer matches the currentsessionIdTesting
node scripts/test-projects.mjs --maxWorkers=1 src/config/sessions/sessions.test.ts src/auto-reply/reply/session.test.ts src/gateway/server-methods/agent.test.ts src/gateway/server.sessions.reset-models.test.tspnpm exec oxfmt --check --threads=1 CHANGELOG.md src/auto-reply/reply/session.test.ts src/config/sessions/paths.ts src/config/sessions/sessions.test.ts src/gateway/server-methods/agent.ts src/gateway/server-methods/agent.test.tsgit diff --check origin/main...HEADReal behavior proof
sessionFilepoints at a different UUID than the current session. This covers [Bug]: Daily session reset regresses #57020 — sessionFile not rotated #78607’s stale generated transcript state.a95a37499706ea703e0895063600861de2244c65. IsolatedHOME,OPENCLAW_STATE_DIR, andOPENCLAW_CONFIG_PATH; plugins disabled; loopback token auth; no mocked session store or mocked Gateway handler./tmp/openclaw-proof-78607/state/agents/main/sessions/sessions.jsonwith a 26-hour-oldagent:main:mainentry whosesessionIdwas63b16647-ea0c-4a22-808b-ce616326b445but whose generatedsessionFilebasename was685a51f7-7adf-48b1-89ca-d3ab86dd6e0f.jsonl; startedpnpm openclaw gateway run --port 19107 --bind loopback --auth token --token proof-token --allow-unconfigured --ws-log compact; called the live Gatewayhealthandagentmethods throughsrc/gateway/call.jsusing backendgateway-clienttoken auth; then reread the persisted sessions store from disk.agentrequest crossed the daily rollover path, generated a new session id, and persistedsessionFileto the matching generated<new-sessionId>.jsonlpath before provider execution failed due the intentionally credential-free disposable environment.Fixes #78607