fix(gateway): skip deleted-agent guard for ACP harness session keys by scotthuang · Pull Request #91219 · openclaw/openclaw

scotthuang · 2026-06-07T17:46:05Z

Summary

What problem does this PR solve?

The deleted-agent guard added in [Bug]: Deleted agent's sessions remain accessible and executable #65524 treats ACP harness session keys like normal agent session keys.
ACP keys use agent:<harnessId>:acp:<uuid> (for example agent:claude:acp:...), but <harnessId> is not an agents.list entry.
That causes sessions.resolve, sessions_send, and other deleted-agent-guarded paths to reject valid ACP workers with Agent "claude" no longer exists in configuration.

Why does this matter now?

ACP persistent/background workers are increasingly used from hub surfaces; a false deleted-agent rejection breaks follow-up routing by key or label.
The guard is correct for real orphaned agent sessions, but it must not classify harness ids as deleted agents.

What is the intended outcome?

resolveDeletedAgentIdFromSessionKey returns null for ACP harness session keys, so existing ACP sessions keep working while true deleted-agent protection remains for normal agent keys.
The exemption lives in the shared helper so all deleted-agent guard callers benefit consistently (sessions.resolve key/sessionId/label paths, direct sessions.send / chat.send guards).

What is intentionally out of scope?

No change to deleted-agent cleanup when an agent is actually removed from config.
No ACP spawn/delegate lifecycle, label routing, protocol schema, config, or migration changes.
No per-caller bypasses in sessions.resolve, sessions.send, or chat.send; no parseAgentSessionKey special-casing; no ACP metadata hydration gate.

What does success look like?

sessions.resolve({ key: "agent:claude:acp:<uuid>" }) succeeds when the session exists, even if claude is not in agents.list.
Real deleted-agent sessions such as agent:deleted-agent:main are still rejected.

What should reviewers focus on?

The early isAcpSessionKey(sessionKey) bypass in resolveDeletedAgentIdFromSessionKey (src/gateway/session-utils.ts) — shared owner boundary, not a single-entry workaround.
That normal deleted-agent behavior for non-ACP keys is unchanged.
Why alternatives were rejected: resolver-only bypass (too narrow), parseAgentSessionKey ACP special-case (too wide), metadata-hydration gate (heavier than needed for guard-layer false positives).

Linked context

Which issue does this close?

Closes #

Which issues, PRs, or discussions are related?

Related [Bug]: Deleted agent's sessions remain accessible and executable #65524 — deleted-agent guard / orphaned session rejection. This PR narrows that guard so ACP harness keys are not misclassified as deleted agents.

Was this requested by a maintainer or owner?

Local dogfood while testing ACP worker follow-up after the deleted-agent guard landed on main.

Real behavior proof (required for external PRs)

Behavior or issue addressed: valid ACP harness session keys are no longer rejected by the deleted-agent guard when the harness id (for example claude, codex) is absent from agents.list.
Real environment tested: local OpenClaw install on macOS; gateway on ws://127.0.0.1:18789; config at ~/.openclaw/openclaw.json with agents.list ids main and cursor only (no claude).
Exact steps or command run after this patch:

pnpm openclaw config get agents.list --json | rg '"id"'
pnpm openclaw gateway call sessions.resolve \
  --params '{"key":"agent:claude:acp:48a22c29-5e40-474d-85a5-46234fd7d1ce"}' \
  --json

Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output):

Copied live terminal output from the local gateway RPC:

$ pnpm openclaw gateway call sessions.resolve --params '{"key":"agent:claude:acp:48a22c29-5e40-474d-85a5-46234fd7d1ce"}' --json
{
  "ok": true,
  "key": "agent:claude:acp:48a22c29-5e40-474d-85a5-46234fd7d1ce"
}

Observed result after fix: live sessions.resolve accepts the existing ACP harness session key even though claude is not configured in agents.list; no deleted-agent error is returned for this key.
What was not tested:
- Full OPENCLAW_LIVE_ACP_BIND suite.
- Broad CI / Crabbox / cross-channel proof.
Proof limitations or environment constraints: live proof uses an existing local ACP session store entry under ~/.openclaw/agents/claude/sessions/sessions.json.
Before evidence (optional but encouraged): prior dogfood observed ACP follow-up/resolution failing with deleted-agent errors when harness ids were not present in agents.list.

Tests and validation

Which commands did you run?

pnpm test src/gateway/sessions-resolve-store.test.ts -t "resolves ACP harness session keys from real stores"
pnpm test src/gateway/sessions-resolve-store.test.ts
pnpm test src/gateway/session-utils.test.ts -t "resolveDeletedAgentIdFromSessionKey ignores ACP harness session keys"
pnpm test src/gateway/sessions-resolve.test.ts -t "resolves ACP harness session keys even when harness id is not in agents.list"
pnpm test src/gateway/sessions-resolve.test.ts -t "rejects sessions belonging to a deleted agent"
pnpm openclaw gateway call sessions.resolve --params '{"key":"agent:claude:acp:48a22c29-5e40-474d-85a5-46234fd7d1ce"}' --json

What regression coverage was added or updated?

src/gateway/session-utils.test.ts — ACP harness keys bypass deleted-agent detection.
src/gateway/sessions-resolve.test.ts — key-based sessions.resolve succeeds for ACP harness keys when harness id is not in agents.list.
src/gateway/sessions-resolve-store.test.ts — real store integration for ACP key/sessionId/label resolve without mocking the deleted-agent guard.

What failed before this fix, if known?

ACP session keys such as agent:claude:acp:<uuid> could be treated as belonging to deleted agent claude, causing resolver/send paths to fail even though the ACP session store entry existed.

If no test was added, why not?

N/A — regression tests were added for helper, resolver path, and store integration.

Risk checklist

Did user-visible behavior change? (Yes)

Yes. ACP sessions that were incorrectly blocked by the deleted-agent guard can be resolved/sent again.

Did config, environment, or migration behavior change? (No)

No.

Did security, auth, secrets, network, or tool execution behavior change? (No)

No new surfaces. This removes a false positive from an existing guard; true deleted-agent rejection for normal agent session keys remains.

What is the highest-risk area?

Accidentally exempting too many session-key shapes from deleted-agent checks.

How is that risk mitigated?

Exemption is limited to isAcpSessionKey(sessionKey) only — an existing session-key class; the guard should not reinterpret agent:<harnessId>:acp:*'s second segment as an agents.list owner.
Existing deleted-agent tests for real orphaned agent keys remain in place and still pass.
New tests assert ACP harness keys are ignored while deleted-agent keys are still rejected.
Fix is centralized in the shared helper used by resolver and direct send guards, avoiding drift across entry points.

Current review state

What is the next action?

Refresh PR #91219 with store integration test + updated Real behavior proof.

What is still waiting on author, maintainer, CI, or external proof?

CI on updated head after store test commit.
Maintainer review.

Which bot or reviewer comments were addressed?

Autoreview / code-read pass: no blocking findings.
Verdict: best minimal fix — shared resolveDeletedAgentIdFromSessionKey bypass for ACP keys is the correct owner boundary; covers sessions.resolve (key/sessionId/label) via validateSessionAgentExists and direct sessions.send / chat.send guards.
Evidence reviewed: session-utils.ts, sessions-resolve.ts, server-methods/sessions.ts, server-methods/chat.ts, session-key-utils.ts, adjacent tests.

clawsweeper · 2026-06-07T17:48:49Z

Codex review: needs maintainer review before merge. Reviewed June 7, 2026, 2:21 PM ET / 18:21 UTC.

Summary
The PR adds an ACP session-key exemption to the shared deleted-agent guard and adds helper, resolver, and real-store regression coverage.

PR surface: Source +4, Tests +79. Total +83 across 4 files.

Reproducibility: yes. source-reproducible: current main parses agent:claude:acp:* as agent claude and the resolver/send paths call the deleted-agent helper. I did not run local tests because this review was required to keep the checkout read-only.

Review metrics: 1 noteworthy metric.

Deleted-agent guard exemptions: 1 added. The only runtime behavior change is a new ACP-shaped key bypass in a security-sensitive guard, so maintainers should focus review on that invariant.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Let required CI complete on fed9faa before merge.
Have a maintainer confirm the ACP session-key ownership invariant before landing.

Risk before merge

[P1] The PR intentionally exempts all ACP-shaped agent::acp:* keys from deleted-agent rejection, so maintainers should confirm those keys are always harness identities rather than deleted OpenClaw agent ownership.

Maintainer options:

Accept the ACP harness identity boundary (recommended)
If maintainers agree ACP-shaped keys identify harness sessions rather than OpenClaw agent ownership, merge after required CI because the fix is centralized and keeps non-ACP deleted-agent rejection intact.
Require metadata-backed narrowing
If the ACP identity invariant is not guaranteed, require the bypass to check ACP session metadata or configured ACP runtime ownership before skipping deleted-agent rejection.
Pause for ACP owner review
Pause the PR if ACP owners need to define how deleted configured ACP agents should behave before this guard can be narrowed safely.

Next step before merge

[P2] Human review is the next action: there is no narrow repair finding, but maintainers need to accept the ACP security-boundary exemption and let required checks gate the exact head.

Security
Cleared: No concrete security or supply-chain defect was found in the diff; the sensitive point is the intended ACP-key exemption from an existing deleted-agent guard.

Review details

Best possible solution:

Merge the shared helper exemption after maintainer security-boundary confirmation and required CI, preserving deleted-agent rejection for non-ACP session keys.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main parses agent:claude:acp:* as agent claude and the resolver/send paths call the deleted-agent helper. I did not run local tests because this review was required to keep the checkout read-only.

Is this the best way to solve the issue?

Yes, this appears to be the best narrow fix: the shared helper is the common owner boundary for sessions.resolve, sessions.send, sessions.steer, and chat.send. A resolver-only bypass would be too narrow, while changing parseAgentSessionKey would affect unrelated agent-key semantics.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0c33f4e0786e.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live gateway command output showing sessions.resolve succeeds for an ACP harness key when the harness id is not in agents.list.

Label justifications:

P2: This is a normal-priority gateway bug fix for ACP follow-up routing with limited, well-scoped blast radius.
merge-risk: 🚨 security-boundary: The diff narrows a guard that prevents deleted-agent session execution, so the ACP key ownership invariant needs maintainer acceptance before merge.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live gateway command output showing sessions.resolve succeeds for an ACP harness key when the harness id is not in agents.list.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live gateway command output showing sessions.resolve succeeds for an ACP harness key when the harness id is not in agents.list.

Evidence reviewed

PR surface:

Source +4, Tests +79. Total +83 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	6	2	+4
Tests	3	79	0	+79
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	85	2	+83

What I checked:

Repository policy applied: Read the full root policy and the gateway scoped policy; the review applied the gateway/security-boundary guidance and avoided mutating the checkout. (AGENTS.md:1, 0c33f4e0786e)
Current-main bug path: On current main, resolveDeletedAgentIdFromSessionKey parses any agent-scoped key and returns the agent id when absent from agents.list, so agent:claude:acp:* is classified as deleted claude. (src/gateway/session-utils.ts:921, 0c33f4e0786e)
ACP key contract: The existing isAcpSessionKey helper recognizes agent::acp:* as ACP-shaped, and docs describe ACP session keys as agent::acp: for external harness targets. (src/sessions/session-key-utils.ts:290, 0c33f4e0786e)
Shared call sites: sessions.resolve validates key, sessionId, and label results through validateSessionAgentExists, while sessions.send/sessions.steer and chat.send call the same deleted-agent helper directly. (src/gateway/sessions-resolve.ts:41, 0c33f4e0786e)
PR implementation: The PR adds an early isAcpSessionKey return in the shared helper, so the exemption reaches sessions.resolve and direct send guards without per-caller bypasses. (src/gateway/session-utils.ts:925, fed9faa9f829)
Regression coverage: The PR adds tests for helper behavior, key-based resolution, and real store resolution by key, sessionId, and label for an ACP harness key whose harness id is absent from agents.list. (src/gateway/sessions-resolve-store.test.ts:210, fed9faa9f829)

Likely related people:

Vincent Koc: git blame in this checkout attributes the deleted-agent helper, ACP key predicate, and resolver guard to the current-main gateway/session snapshot commit. (role: current-main area contributor; confidence: medium; commits: b9d530e29213; files: src/gateway/session-utils.ts, src/sessions/session-key-utils.ts, src/gateway/sessions-resolve.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

scotthuang · 2026-06-07T17:59:20Z

@clawsweeper re-review

clawsweeper · 2026-06-07T17:59:24Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27100394792
Updated: 2026-06-07T18:07:52.638Z

ACP session keys use agent:<harnessId>:acp:<uuid>, so sessions_send and sessions.resolve must not treat harness ids as agents.list owners.

shakkernerd · 2026-06-09T17:40:45Z

Merged with rebase.

What landed:

ACP harness session keys like agent:<harnessId>:acp:<uuid> no longer trip the deleted-agent guard when the harness id is not an OpenClaw agent.
Configured ACP binding keys like agent:<agentId>:acp:binding:* still keep the deleted-agent protection because that segment is the owning OpenClaw agent.
Added helper and real store resolver regression coverage for key, sessionId, and label resolution.

Verification:

Auto-review: clean, no accepted/actionable findings.
AWS Crabbox cbx_2cf7ec2bfbe3: focused gateway tests passed, 12 files / 492 tests; check:changed passed.
AWS Crabbox cbx_391eb945bf7f: RPC/caller proof passed, 6 files / 12 tests.

Thanks @scotthuang.

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

openclaw-barnacle Bot added gateway Gateway runtime size: XS triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels Jun 7, 2026

openclaw-barnacle Bot added size: S and removed size: XS labels Jun 7, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 7, 2026

sallyom self-assigned this Jun 9, 2026

shakkernerd force-pushed the fix/acp-session-deleted-agent-guard branch from fed9faa to ad8b7fd Compare June 9, 2026 17:28

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 9, 2026

scotthuang added 3 commits June 9, 2026 18:29

fix(gateway): skip deleted-agent guard for ACP harness session keys

02fe9bb

ACP session keys use agent:<harnessId>:acp:<uuid>, so sessions_send and sessions.resolve must not treat harness ids as agents.list owners.

test(gateway): add store integration proof for ACP deleted-agent guard

c964f7b

fix: preserve configured ACP deleted-agent guard

c09c475

shakkernerd force-pushed the fix/acp-session-deleted-agent-guard branch from ad8b7fd to c09c475 Compare June 9, 2026 17:30

shakkernerd merged commit 52154ed into openclaw:main Jun 9, 2026
11 checks passed

xmoxmo mentioned this pull request Jun 10, 2026

[Bug]: MEDIA directive final replies still duplicate text through channel.message split path #91861

Closed

amknight mentioned this pull request Jun 10, 2026

[Bug]: openclaw update 2026.6.5-beta.5 → 2026.6.5 fails with TypeError: resolveAllAgentSessionStoreTargetsSync is not a function; Feishu channel stops replying #91816

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(gateway): skip deleted-agent guard for ACP harness session keys#91219

fix(gateway): skip deleted-agent guard for ACP harness session keys#91219
shakkernerd merged 3 commits into
openclaw:mainfrom
scotthuang:fix/acp-session-deleted-agent-guard

scotthuang commented Jun 7, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 7, 2026 •

edited

Loading

Uh oh!

scotthuang commented Jun 7, 2026

Uh oh!

clawsweeper Bot commented Jun 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

shakkernerd commented Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

scotthuang commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

scotthuang commented Jun 7, 2026

Uh oh!

clawsweeper Bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

shakkernerd commented Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

scotthuang commented Jun 7, 2026 •

edited

Loading

clawsweeper Bot commented Jun 7, 2026 •

edited

Loading

clawsweeper Bot commented Jun 7, 2026 •

edited

Loading