fix(memory-lancedb): guard memory recall output [AI] by pgondhi987 · Pull Request #91425 · openclaw/openclaw

pgondhi987 · 2026-06-08T13:00:53Z

Summary

Guards memory_recall output with the same untrusted-memory instruction used by auto-recall.
Escapes recalled memory text before it is returned in model-visible tool content, while keeping structured details aligned to sanitized entries.
Reuses the recall sanitizer for both recall paths so stale media/envelope contamination filtering does not drift.
Overfetches manual recall candidates before filtering, then slices back to the requested limit, so dirty top hits do not hide clean matches.
Tightens the capture filter for common instruction-override phrasing, including the canonical multi-word form.

Linked context

Maintainer-requested remediation for a security-sensitive memory plugin behavior. No public issue is linked from this PR body.

Real behavior proof (required for external PRs)

Behavior or issue addressed: memory_recall no longer returns recalled memory text as unguarded model-visible tool content.
Real environment tested: Local source checkout with the memory-lancedb plugin test harness and mocked LanceDB/OpenAI boundaries.
Exact steps or command run after this patch: node scripts/run-vitest.mjs extensions/memory-lancedb/index.test.ts
Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): Test Files 1 passed (1); Tests 125 passed (125).
Observed result after fix: The regression test verifies memory_recall includes the untrusted-memory guard, escapes tool-like markup, strips stale media annotations, overfetches before filtering, and keeps sanitized details consistent.
What was not tested: Live OpenAI/LanceDB credentials were not available in this environment, so OPENCLAW_LIVE_TEST=1 coverage was not run.
Proof limitations or environment constraints: The focused test mocks external embedding/vector-store boundaries to keep validation deterministic; a credentialed live run remains a proof gap before merge if maintainers require it.
Before evidence (optional but encouraged): Existing implementation formatted r.entry.text directly into memory_recall content.

Tests and validation

node scripts/run-vitest.mjs extensions/memory-lancedb/index.test.ts
scripts/pr review-tests 91425 extensions/memory-lancedb/index.test.ts
Added regression coverage for guarded and escaped memory_recall output.
Added regression coverage that stale media-only top hits are filtered while clean overfetched matches are still returned.
Added capture-filter coverage for Ignore all previous instructions and related override phrasing.

Risk checklist

Did user-visible behavior change? (Yes)

Did config, environment, or migration behavior change? (No)

Did security, auth, secrets, network, or tool execution behavior change? (Yes)

What is the highest-risk area?

The model-visible text returned by the memory_recall tool changes formatting by adding an explicit untrusted-memory guard, escaping markup-like characters, and filtering stale media/envelope contamination before slicing to the requested result count.

How is that risk mitigated?

The change is local to the memory-lancedb plugin recall presentation path, preserves recall parameters and result details shape for sanitized entries, overfetches before filtering to avoid hiding clean matches, and is covered by the focused plugin test suite plus review-pr/autoreview gates.

Current review state

What is the next action?

GitHub CI monitoring and final GHSA gate are pending.

What is still waiting on author, maintainer, CI, or external proof?

GitHub CI is pending. Live OpenAI/LanceDB proof is not available from this environment; maintainers may need to run that credentialed lane if required before merge.

Which bot or reviewer comments were addressed?

Autoreview requested overfetch before filtering manual recall results; this was addressed in de0f989abf. ClawSweeper requested real behavior proof; this body records the available focused proof and the remaining live-proof limitation.

clawsweeper · 2026-06-08T13:03:11Z

Codex review: needs real behavior proof before merge. Reviewed June 8, 2026, 11:48 AM ET / 15:48 UTC.

Summary
The PR hardens memory-lancedb manual recall output by sanitizing and escaping recalled text, adding the untrusted-memory guard, overfetching before filtering, and expanding focused regression tests.

PR surface: Source +13, Tests +114. Total +127 across 2 files.

Reproducibility: yes. from source: current main formats raw remembered text directly into manual memory_recall tool content, while the sibling auto-recall path already filters, escapes, and marks memories untrusted. I did not run a live reproduction because this is a read-only review and the PR reports credentialed live proof was unavailable.

Review metrics: 1 noteworthy metric.

Memory recall output surface: 1 tool output changed. memory_recall model-visible text now gains warning text, escaping, filtering, and overfetch-before-slice behavior.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted real memory_recall output from an actual setup, or get an explicit maintainer proof override for the credentialed live gap.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body and follow-up comment provide focused mocked Vitest/CI proof, but no redacted live memory_recall output from an actual memory-lancedb/LanceDB/OpenAI-compatible setup; redact private details before posting proof, then update the PR body to trigger re-review.

Risk before merge

[P1] External contributor proof remains mocked-only; no redacted live memory_recall output from an actual memory-lancedb/LanceDB/OpenAI-compatible setup has been posted.
[P1] The PR intentionally changes existing memory_recall output wording, escaping, result filtering, and vector query limit, so exact-output consumers may see different behavior after upgrade.
[P1] This narrow manual-tool hardening does not resolve the broader relevant-memory agent/session scoping issue tracked at [Bug] Relevant memory treated as instructions — agent scope leakage #83437.

Maintainer options:

Require proof, then accept the hardening (recommended)
Ask for redacted real memory_recall output from an actual setup, or an explicit maintainer proof override, before merging the acknowledged output-format change.
Pause for a staged compatibility path
Pause the PR if maintainers want an opt-in or staged migration for exact memory_recall text consumers before changing the default output.

Next step before merge

[P1] The next action is contributor real behavior proof plus maintainer/security acceptance of a compatibility-sensitive output change, not an automated code repair.

Security
Cleared: The diff is limited to memory-lancedb runtime/test hardening and does not add dependency, CI, permission, secret, install, or supply-chain changes beyond the intended recall-output hardening.

Review details

Best possible solution:

Land the plugin-local recall presentation hardening only after redacted real behavior proof or an explicit maintainer proof override, with maintainers accepting the output-format compatibility change.

Do we have a high-confidence way to reproduce the issue?

Yes from source: current main formats raw remembered text directly into manual memory_recall tool content, while the sibling auto-recall path already filters, escapes, and marks memories untrusted. I did not run a live reproduction because this is a read-only review and the PR reports credentialed live proof was unavailable.

Is this the best way to solve the issue?

Yes, with a maintainer caveat: recall presentation is the narrow plugin-owned boundary before recalled memories reach model-visible tool content. The best merge state still needs real behavior proof or a maintainer override because the default output format changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 53357e8e7fa1.

Label changes

Label changes:

add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

P2: The PR is a bounded memory plugin hardening change with limited blast radius but non-trivial output compatibility impact.
merge-risk: 🚨 compatibility: Existing consumers of exact memory_recall text or result ordering may see different wording, escaped markup, filtered entries, and a larger vector-store query.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body and follow-up comment provide focused mocked Vitest/CI proof, but no redacted live memory_recall output from an actual memory-lancedb/LanceDB/OpenAI-compatible setup; redact private details before posting proof, then update the PR body to trigger re-review.

Evidence reviewed

PR surface:

Source +13, Tests +114. Total +127 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	32	19	+13
Tests	1	115	1	+114
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	147	20	+127

Acceptance criteria:

[P1] node scripts/run-vitest.mjs extensions/memory-lancedb/index.test.ts.
[P1] OPENCLAW_LIVE_TEST=1 pnpm test:live extensions/memory-lancedb/memory-lancedb.live.test.ts when credentials are available.

What I checked:

Current main behavior: Current main formats r.entry.text directly into manual memory_recall model-visible content and returns raw recalled text in details. (extensions/memory-lancedb/index.ts:1569, 53357e8e7fa1)
Sibling auto-recall hardening: The existing auto-recall path already filters recalled memory text, escapes prompt-like markup, and wraps memories with the untrusted historical-data warning. (extensions/memory-lancedb/index.ts:1316, 53357e8e7fa1)
PR implementation: The PR head overfetches manual recall candidates, filters/slices clean results, escapes returned text, and adds the untrusted-memory guard to memory_recall content. (extensions/memory-lancedb/index.ts:1549, 6bab895497dd)
Regression coverage: The PR adds focused tests for untrusted warning text, escaped tool-like markup, stale media filtering, overfetch-before-slice behavior, and sanitized details. (extensions/memory-lancedb/index.test.ts:719, 6bab895497dd)
Tool-result contract: Agent tool result content is model-returned content, while structured details are for logs/UI rendering; provider serializers inspected use content blocks for tool output. (packages/agent-core/src/types.ts:419, 53357e8e7fa1)
Provider serialization check: OpenAI chat serialization extracts text/image content from tool results and does not serialize structured details into the model tool message. (src/llm/providers/openai-completions.ts:1088, 53357e8e7fa1)

Likely related people:

vignesh07: Vignesh Natarajan authored the earlier memory-lancedb hardening commit that added the existing recall sanitization and untrusted-memory treatment this PR extends to manual recall. (role: feature hardening contributor; confidence: high; commits: 61725fb37e33; files: extensions/memory-lancedb/index.ts, extensions/memory-lancedb/index.test.ts)
steipete: Peter Steinberger appears most frequently in shortlog for the memory-lancedb implementation and tests, including recent cleanup/refactor commits around the same files. (role: heavy area contributor; confidence: medium; commits: 0ebeee8b0de4, e0ad3e79e6bf, 1226361c6da1; files: extensions/memory-lancedb/index.ts, extensions/memory-lancedb/index.test.ts, extensions/memory-lancedb/memory-lancedb.live.test.ts)
vincentkoc: Vincent Koc recently touched the same memory-lancedb test/packaging surface and release baseline history, making him a plausible routing candidate for plugin compatibility review. (role: recent adjacent contributor; confidence: medium; commits: 2e08f0f4221f, 97c542a67b68, 0f56b16d47f1; files: extensions/memory-lancedb/index.ts, extensions/memory-lancedb/index.test.ts)
Xin Sun: Xin Sun authored the recent memory-lancedb cloud storage feature touching the same runtime and test files, so they may know the plugin's LanceDB/runtime behavior. (role: recent feature contributor; confidence: medium; commits: df918c4de530; files: extensions/memory-lancedb/index.ts, extensions/memory-lancedb/index.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

pgondhi987 · 2026-06-08T13:23:33Z

@clawsweeper review

Updated the PR body with the current proof and limitation details after the overfetch fix. Current head is de0f989abf7bb8f999eb35518feffaad31c4512c.

clawsweeper · 2026-06-08T13:23:36Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

clawsweeper · 2026-06-08T13:23:38Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Superseded
Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27140688012
Updated: 2026-06-08T13:28:13.465Z

pgondhi987 · 2026-06-08T13:39:54Z

Verification before merge:

Behavior addressed: memory_recall now treats recalled memory as untrusted historical data instead of returning raw remembered text as unguarded model-visible tool content.
Real environment tested: local source checkout, review-pr artifact worktree, GitHub Actions PR CI; no live OpenAI/LanceDB credentialed environment was available.
Exact steps or command run after this patch:

node scripts/run-vitest.mjs extensions/memory-lancedb/index.test.ts
node scripts/run-bundled-extension-oxlint.mjs
scripts/pr review-tests 91425 extensions/memory-lancedb/index.test.ts
timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
ghsa_dry_run gate
ghsa_real_gate gate
Evidence after fix:
Head SHA 6bab895497dda66a4275e20a638c4a167d461291; GitHub CI has no failed or pending checks and merge state is CLEAN.
Focused Vitest passed: 1 file, 125 tests; bundled extension oxlint passed.
review-pr: passed, READY FOR /prepare-pr with 0 findings; autoreview: passed, no accepted/actionable findings.
ghsa_dry_run: passed; ghsa_real_gate: passed.
Observed result after fix: The regression coverage verifies guarded/escaped recall output, stale media-only filtering with overfetch before final limit slicing, sanitized details, and tightened instruction-override filtering.
What was not tested: Credentialed live OpenAI/LanceDB memory_recall run was not available in this environment.

Regression Risk:
Low. The change is limited to the memory-lancedb plugin recall presentation path and tests; auth, policy, approvals, sandboxing, config, migrations, storage schema, provider routing, channel behavior, persisted credentials, and plugin contracts are unchanged. The main risk is exact text consumers seeing the added untrusted-context wording and escaped markup, bounded by focused tests and green CI.

Best fix verdict: best/appropriate. Recall presentation is the right layer because storage-time prompt-injection matching remains heuristic, while the tool result content is the final plugin-owned model-visible boundary before recalled memory reaches the model.

User behavior change:
Before, memory_recall could return remembered text directly in tool content. After, the same tool returns recalled memories with an untrusted-history warning, escaped memory text, stale media/envelope filtering, and overfetch-before-filtering so clean matches are not hidden by dirty top hits. Tool parameters, result details shape, config, storage, provider, channel, auth, approval, and sandbox behavior do not change.

pgondhi987 · 2026-06-08T15:39:14Z

@clawsweeper review

clawsweeper · 2026-06-08T15:39:18Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27149049632
Updated: 2026-06-08T15:48:49.716Z

* fix: guard memory recall output * fix: overfetch memory recall candidates * fix: avoid memory recall lint shadow

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix: guard memory recall output

ed6eb83

openclaw-barnacle Bot added extensions: memory-lancedb Extension: memory-lancedb size: S maintainer Maintainer-authored PR labels Jun 8, 2026

fix: overfetch memory recall candidates

de0f989

fix: avoid memory recall lint shadow

6bab895

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 8, 2026

joshavant self-assigned this Jun 8, 2026

Merge remote-tracking branch 'origin/main' into fix/fix-728

8d92230

pgondhi987 merged commit 03a8d18 into openclaw:main Jun 9, 2026

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 07:39 UTC curtismercier/openclaw-mods#1043

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(memory-lancedb): guard memory recall output [AI]#91425

fix(memory-lancedb): guard memory recall output [AI]#91425
pgondhi987 merged 4 commits into
openclaw:mainfrom
pgondhi987:fix/fix-728

pgondhi987 commented Jun 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

pgondhi987 commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

pgondhi987 commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pgondhi987 commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading