fix(ui): require user intent for chat sessions by TurboTheTurtle · Pull Request #91480 · openclaw/openclaw

TurboTheTurtle · 2026-06-08T17:40:13Z

Summary

require an explicit user intent token before the WebChat UI helper can create a new session
keep sidebar New Chat, chat view New Session, and typed /new working by passing that user intent at those action boundaries
add a regression test that verifies the helper does not call sessions.create or mutate the active conversation without explicit intent
restore real timers in a task-maintenance test that was timing out in the CI status-tools lane

Verification

git diff --check
node scripts/run-vitest.mjs ui/src/ui/app-render.helpers.node.test.ts ui/src/ui/app-gateway-chat-load.node.test.ts ui/src/ui/app-chat.test.ts src/gateway/server.sessions.reset-hooks.test.ts ui/src/ui/navigation.browser.test.ts
node scripts/run-vitest.mjs src/commands/tasks.test.ts
git log --format='%h %an <%ae> %s' upstream/main..HEAD

Real behavior proof

Behavior addressed: WebChat startup, reconnect, or bootstrap paths cannot accidentally call the shared new-session helper and emit sessions.create reset hooks unless the caller passes explicit user intent. Explicit user actions still create new sessions normally.
Real environment tested: Local macOS worktree /Users/andy/openclaw-89760 on branch codex/89760-webchat-no-auto-new, PR-head commit b58e185d5491b23b7a58e671d936d1bac5a7ce83, running the patched OpenClaw WebChat session helper through node --import tsx.
Exact steps or command run after this patch: node --import tsx --input-type=module imported ./ui/src/ui/app-render.helpers.ts, called createChatSession(state) to simulate a startup/reconnect/no-user-intent path, then called createChatSession(state, { source: "user" }) to simulate an explicit New Chat user action against the same idle WebChat state.
Evidence after fix: Terminal output from the PR-head source probe:

OpenClaw #89760 PR-head source probe
HEAD=b58e185d5491b23b7a58e671d936d1bac5a7ce83
startup_no_intent_result=false
startup_no_intent_methods=(none)
startup_no_intent_sessionKey=agent:ops:main
startup_no_intent_messages=old context
explicit_user_result=true
all_methods_after_explicit=sessions.create,sessions.list,loadAssistantIdentity,commands.list,sessions.messages.subscribe,chat.history,sessions.list
explicit_create_emitCommandHooks=true
final_sessionKey=agent:ops:dashboard:new-chat

Observed result after fix: The no-intent path returned false, emitted no RPC methods, kept agent:ops:main, and kept the existing old context message. The explicit user path still emitted sessions.create with emitCommandHooks=true and switched to agent:ops:dashboard:new-chat.
What was not tested: I did not run a live browser reconnect against a production gateway in this local pass. The repo changed-files Crabbox gate could not be run locally because the configured Azure provider needs Azure CLI/login, the Blacksmith Testbox path requires Crabbox >= 0.22.0 while this machine has 0.20.0, and local-container requires Docker, which is not installed on PATH.

TurboTheTurtle · 2026-06-08T17:40:25Z

@clawsweeper re-review

clawsweeper · 2026-06-08T17:40:28Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

TurboTheTurtle · 2026-06-08T17:43:32Z

@clawsweeper re-review

clawsweeper · 2026-06-08T17:43:35Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27156055307
Updated: 2026-06-08T17:51:35.525Z

clawsweeper · 2026-06-08T17:46:15Z

Codex review: passed. Reviewed June 9, 2026, 6:39 PM ET / 22:39 UTC.

Summary
The PR adds an explicit user-intent argument to createChatSession, updates the New Chat and /new action callers to pass it, adds helper regression coverage, and carries minor gateway formatting/import ordering churn.

PR surface: Source +8, Tests +9. Total +17 across 8 files.

Reproducibility: yes. at source level: current main lets createChatSession(state) reach sessions.create with command hooks and the gateway maps that to a WebChat new reset path. I did not run the full browser reconnect flow, so the exact user-path reproduction remains integration-level rather than locally reproduced here.

Review metrics: none identified.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Mantis proof suggestion
A short browser/WebChat smoke would materially help reviewers see the user-visible reconnect/session-preservation flow that terminal helper proof cannot fully show. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

visual task: verify WebChat reconnect after a completed conversation preserves the active session, while New Chat and typed /new still create a new session.

Risk before merge

[P1] I did not inspect a full live browser close/reopen smoke; the supplied proof exercises the patched helper boundary and explicit user path from terminal output.

Maintainer options:

Decide the mitigation before merge
Land this exact-head PR after normal CI and mergeability gates, with an optional live WebChat reconnect smoke if maintainers want end-to-end confirmation before closing the linked issue.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P2] No repair lane is needed; the PR has no concrete patch defect and can continue through exact-head automerge, CI, and mergeability gates.

Security
Cleared: The diff changes UI session-helper behavior, tests, and formatting/import ordering only; it does not touch dependencies, lockfiles, CI/workflow execution, secrets, permissions, or package publishing surfaces.

Review details

Best possible solution:

Land this exact-head PR after normal CI and mergeability gates, with an optional live WebChat reconnect smoke if maintainers want end-to-end confirmation before closing the linked issue.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main lets createChatSession(state) reach sessions.create with command hooks and the gateway maps that to a WebChat new reset path. I did not run the full browser reconnect flow, so the exact user-path reproduction remains integration-level rather than locally reproduced here.

Is this the best way to solve the issue?

Yes, this is the best small fix I found: gating the shared UI helper makes accidental startup/reconnect calls fail closed while preserving explicit New Chat and /new action boundaries. A gateway block or new config option would be broader and would not target accidental helper reuse as directly.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against e9bd90d20912.

Label changes

Label changes:

add status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The PR body includes structured after-fix terminal proof from a real local PR-head source probe showing the no-intent path emits no RPC and explicit user action still creates a session.
remove status: 👀 ready for maintainer look: Current PR status label is status: 🚀 automerge armed.

Label justifications:

P1: The PR targets a linked WebChat session-state/data-loss bug where reconnect or bootstrap paths can archive active context without user intent.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The PR body includes structured after-fix terminal proof from a real local PR-head source probe showing the no-intent path emits no RPC and explicit user action still creates a session.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes structured after-fix terminal proof from a real local PR-head source probe showing the no-intent path emits no RPC and explicit user action still creates a session.

Evidence reviewed

PR surface:

Source +8, Tests +9. Total +17 across 8 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	18	10	+8
Tests	2	20	11	+9
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	8	38	21	+17

What I checked:

Current main helper can create a session without an intent token: On current main, createChatSession(state) only checks connection/run/session-loading state before calling createSessionAndRefresh with parentSessionKey and emitCommandHooks: true when the active session is present in the loaded session list. (ui/src/ui/app-render.helpers.ts:699, e9bd90d20912)
Gateway maps WebChat create hooks to the reset/new path: sessions.create with emitCommandHooks === true and a main parent session calls performGatewaySessionReset with reason: "new" and commandSource: "webchat", matching the linked issue's action:"new" symptom. (src/gateway/server-methods/sessions.ts:1392, e9bd90d20912)
Reset/new replaces active session state and archives the previous transcript: performGatewaySessionReset writes a replacement session entry, archives transcripts for the old session id/file, and emits end/start lifecycle hooks, which explains the user-visible context loss reported in the linked issue. (src/gateway/session-reset-service.ts:970, e9bd90d20912)
PR diff adds the intent gate and updates all current helper callers: The diff changes createChatSession to return false unless { source: "user" } is passed, and the only current UI call sites in sidebar New Chat, chat New Session, and typed /new pass that token. (ui/src/ui/app-render.helpers.ts:696, e7cd79006b59)
Regression coverage targets the no-intent boundary: The PR adds a helper test asserting createChatSession(state) returns false, does not call createSessionAndRefresh, and preserves the active session key and old messages; existing creation tests are updated to pass { source: "user" }. (ui/src/ui/app-render.helpers.node.test.ts:784, e7cd79006b59)
Real behavior proof exercises the patched helper boundary: The PR body includes terminal output from a local macOS PR-head source probe showing the no-intent path returned false, emitted no RPC methods, kept the existing session/messages, and an explicit user path still emitted sessions.create with emitCommandHooks=true. (e7cd79006b59)

Likely related people:

clay-datacurve: Authored the dashboard session API work that substantially added sessions.create behavior and session controller plumbing around this bug's gateway/UI surface. (role: feature introducer; confidence: medium; commits: 7b61ca1b0615; files: src/gateway/server-methods/sessions.ts, ui/src/ui/controllers/sessions.ts)
Peter Steinberger: Authored the gateway reset-service split and later split chat session controls, both adjacent to the reset/new lifecycle and UI action boundary this PR changes. (role: reset-path and chat-controls area contributor; confidence: medium; commits: c91d1622d5a6, 1fad8efa12cf; files: src/gateway/session-reset-service.ts, src/gateway/server-methods/sessions.ts, ui/src/ui/chat/session-controls.ts)
Byron: Authored a nearby reconnect/tab-switch fix that preserves user-selected sessions, directly adjacent to the reported WebChat reopen behavior. (role: recent adjacent contributor; confidence: medium; commits: 891e42beec49; files: ui/src/ui/app-gateway.ts)
Cameron Beeley: Current shallow blame for the implicated helper and gateway method points at a recent grafted snapshot commit, so this is useful only as a low-confidence current-source routing signal. (role: recent snapshot contributor; confidence: low; commits: 7269b26926d3; files: ui/src/ui/app-render.helpers.ts, src/gateway/server-methods/sessions.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

TurboTheTurtle · 2026-06-08T17:51:57Z

@clawsweeper re-review

clawsweeper · 2026-06-08T17:52:01Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27156511013
Updated: 2026-06-08T18:01:05.241Z

# Conflicts: # src/commands/tasks.test.ts

TurboTheTurtle · 2026-06-09T18:08:01Z

Updated this branch with current origin/main in e7cd790 and resolved the single conflict in src/commands/tasks.test.ts by keeping main's explicit startedAt setup, which makes the prior fake-timer restoration unnecessary there.\n\nValidation: pnpm vitest run src/commands/tasks.test.ts ui/src/ui/app-render.helpers.node.test.ts (78 tests passed).\n\n@clawsweeper re-review

clawsweeper · 2026-06-09T18:17:22Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27226577875
Updated: 2026-06-09T18:28:20.005Z

Takhoffman · 2026-06-09T22:03:36Z

@clawsweeper visualize

clawsweeper · 2026-06-09T22:03:39Z

🦞👀
ClawSweeper visual brief is being prepared.

I queued a read-only visual pass. It will create or update one marker-backed visual brief comment and will not trigger close, merge, repair, label, or branch changes.

Lens: auto

clawsweeper · 2026-06-09T22:05:23Z

Source: #91480 (comment)
Visual model: gpt-5.5, reasoning low.

Visual brief

Lens: state

Advisory only. Maintainers remain the final judges.

PR: #91480
Bug: #89760

Legend: ✅ expected/preserved, 🐛 pre-fix broken path, ⚠️ unresolved concern, 🧠 active UI state, 💾 stored session state, 🧑‍⚖️ maintainer judgment

Before

WebChat opens/reconnects
        |
        v
Shared createChatSession(state)
        |
        v
🐛 emits sessions.create / action:new
        |
        v
💾 existing completed session marked done/archive
        |
        v
User returns to missing chat context

After

                 +-----------------------------+
                 | createChatSession(state, ?) |
                 +-----------------------------+
                         /              \
                        /                \
No explicit user intent                 Explicit user action
startup / reconnect / bootstrap         button / New Session / /new
        |                                |
        v                                v
✅ return false                          ✅ create new session
✅ no sessions.create                    ✅ sessions.create
✅ keep sessionKey                       ✅ emitCommandHooks=true
✅ keep old messages                     ✅ switch to new chat

State boundary:

Caller path                         Intent token           Result
----------------------------------  ---------------------  -------------------------
Startup / reconnect / bootstrap     none                   ✅ no mutation
Sidebar New Chat                    { source: "user" }     ✅ new session
Chat view New Session               { source: "user" }     ✅ new session
Typed /new                          { source: "user" }     ✅ new session

Changed surface:

ui/src/ui/app-render.helpers.ts
  createChatSession(state)
        becomes
  createChatSession(state, { source: "user" }?)

ui/src/ui/app-render.ts
  sidebar New Chat       -> passes user intent
  chat New Session       -> passes user intent

ui/src/ui/app.ts
  /new slash action      -> passes user intent

ui/src/ui/app-render.helpers.node.test.ts
  adds regression:
    no intent => no create, no active conversation mutation

Proof supplied:

Patched-source probe

No intent:
  result=false
  RPC methods=(none)
  sessionKey=agent:ops:main
  messages=old context

Explicit user:
  result=true
  RPC includes sessions.create
  emitCommandHooks=true
  final_sessionKey=agent:ops:dashboard:new-chat

Maintainer judgment point:

✅ Helper-level behavior is directly exercised.
✅ Existing user-initiated new-session paths are preserved.
⚠️ Live browser reconnect against a production gateway was not tested.
🧑‍⚖️ Decide whether helper proof + unit coverage is enough for this P1
    session-state/data-loss fix, or whether a live WebChat smoke is needed.

Maintainer ruling

Benefit: Prevents WebChat startup/reconnect/bootstrap paths from silently creating a new session and archiving existing context without user intent.

Risk: The remaining uncertainty is integration-level: the supplied proof does not include a live browser reconnect against a production gateway.

Proof needed: Optional live WebChat smoke covering close/reopen after a completed conversation.

Recommended next action: Maintainer review of the intent boundary and decision on whether live smoke proof is required.

Question presented: Is requiring { source: "user" } at explicit UI action boundaries the right product/API boundary for preventing autonomous session creation?

Takhoffman · 2026-06-09T22:32:34Z

@clawsweeper automerge

clawsweeper · 2026-06-09T22:32:37Z

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=e7cd79006b5939acbd73ad1212625b4c4fb0f496)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-06-09T22:40:08Z
Merge commit: 9833f3ea9bf8

What merged:

The PR adds an explicit user-intent argument to createChatSession, updates the New Chat and /new action callers to pass it, adds helper regression coverage, and carries minor gateway formatting/import ordering churn.
PR surface: Source +8, Tests +9. Total +17 across 8 files.
Reproducibility: yes. at source level: current main lets createChatSession(state) reach sessions.create ... ct flow, so the exact user-path reproduction remains integration-level rather than locally reproduced here.

Automerge notes:

PR branch already contained follow-up commit before automerge: test(tasks): restore timers before maintenance apply
PR branch already contained follow-up commit before automerge: Merge remote-tracking branch 'origin/main' into HEAD

The automerge loop is complete.

Automerge progress:

2026-06-09 22:33:16 UTC review queued e7cd79006b59 (queued)

2026-06-09 22:39:56 UTC review passed e7cd79006b59 (structured ClawSweeper verdict: pass (sha=e7cd79006b5939acbd73ad1212625b4c4fb0f...)

2026-06-09 22:40:10 UTC merged e7cd79006b59 (merged by ClawSweeper automerge)

Summary: - The PR adds an explicit user-intent argument to `createChatSession`, updates the New Chat and `/new` action callers to pass it, adds helper regression coverage, and carries minor gateway formatting/import ordering churn. - PR surface: Source +8, Tests +9. Total +17 across 8 files. - Reproducibility: yes. at source level: current main lets `createChatSession(state)` reach `sessions.create` ... ct flow, so the exact user-path reproduction remains integration-level rather than locally reproduced here. Automerge notes: - PR branch already contained follow-up commit before automerge: test(tasks): restore timers before maintenance apply - PR branch already contained follow-up commit before automerge: Merge remote-tracking branch 'origin/main' into HEAD Validation: - ClawSweeper review passed for head e7cd790. - Required merge gates passed before the squash merge. Prepared head SHA: e7cd790 Review: openclaw#91480 (comment) Co-authored-by: Andy Ye <35905412+TurboTheTurtle@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(ui): require user intent for chat sessions

1e3ccc6

openclaw-barnacle Bot added the app: web-ui App: web-ui label Jun 8, 2026

openclaw-barnacle Bot added size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 8, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 8, 2026

test(tasks): restore timers before maintenance apply

b58e185

openclaw-barnacle Bot added the commands Command implementations label Jun 8, 2026

Merge remote-tracking branch 'origin/main' into HEAD

e7cd790

# Conflicts: # src/commands/tasks.test.ts

openclaw-barnacle Bot added gateway Gateway runtime size: S and removed commands Command implementations size: XS labels Jun 9, 2026

clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jun 9, 2026

clawsweeper Bot merged commit 9833f3e into openclaw:main Jun 9, 2026
199 of 208 checks passed

TurboTheTurtle deleted the codex/89760-webchat-no-auto-new branch June 9, 2026 22:41

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 23:13 UTC curtismercier/openclaw-mods#1049

Open

Uh oh!

Conversation

TurboTheTurtle commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Real behavior proof

Uh oh!

TurboTheTurtle commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TurboTheTurtle commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TurboTheTurtle commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TurboTheTurtle commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Takhoffman commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 9, 2026

Visual brief

Maintainer ruling

Uh oh!

Takhoffman commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

TurboTheTurtle commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading