PR #75127: fix: guard session reset prompts against fabricated data

• Repository: openclaw/openclaw
• Author: afurm
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/75127

Description (problem / solution / changelog)

Summary

• Problem: Bare /new and /reset startup prompts did not explicitly prevent models from presenting invented data as user-provided context.
• Why it matters: On session reset, a model can fabricate realistic calendar/email/JSON-style data and act on it before verification.
• What changed: Added a shared reset-startup guardrail that tells the model not to invent user data and to verify real data with tools before acting.
• What did NOT change (scope boundary): No runtime behavior, tool permissions, model routing, bootstrap flow, or config defaults changed.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #75070
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: The bare session reset prompt guided startup/greeting behavior but did not explicitly forbid fabricating contextual data during the first reset response.
• Missing detection / guardrail: Existing prompt tests checked startup and bootstrap wording, but not the anti-fabrication instruction.
• Contributing context (if known): The issue report showed reset responses could present invented calendar/API-style data as real.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/auto-reply/reply/session-reset-prompt.test.ts
• Scenario the test should lock in: Bare reset prompts, bootstrap-pending reset prompts, and limited-bootstrap reset prompts all include the anti-fabrication guardrail.
• Why this is the smallest reliable guardrail: The bug is in reset prompt construction, so direct prompt assertions catch regressions without model/provider variability.
• Existing test that already covers this (if any): Existing reset prompt tests covered startup/bootstrap wording; this PR extends them.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

Bare /new and /reset startup prompts now explicitly instruct the model not to invent user data and to verify real data with tools before acting.

Diagram (if applicable)

Before:
[/new or /reset] -> [startup prompt] -> [model may fill gaps with fabricated data]

After:
[/new or /reset] -> [startup prompt + anti-fabrication guardrail] -> [model must not present invented data as real]

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: macOS
• Runtime/container: Node 22 / pnpm
• Model/provider: N/A, prompt-construction unit coverage
• Integration/channel (if any): Session reset prompt path
• Relevant config (redacted): N/A

Steps

1. Trigger a bare /new or /reset session startup.
2. Inspect the generated reset startup prompt.
3. Verify the prompt includes the anti-fabrication guardrail.

Expected

• Reset startup prompt tells the model not to invent user data and to verify real data with tools before acting.

Actual

• Previous prompt did not explicitly include that guardrail.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios:
  • Normal bare reset prompt includes the anti-fabrication guardrail.
  • Bootstrap-pending reset prompt includes the guardrail.
  • Limited-bootstrap reset prompt includes the guardrail.
• Edge cases checked:
  • Current-time prompt behavior remains covered by existing tests.
  • Bootstrap wording remains distinct from normal greeting wording.
• What you did not verify:
  • Live model behavior across providers.
  • Full repo lint, because lint:core currently fails on unrelated existing files.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: Prompt wording could become too broad and discourage legitimate startup reads.
  • Mitigation: The guardrail only forbids inventing or presenting unverified data as real; it still allows tool verification before acting.

Changed files

• src/auto-reply/reply/session-reset-prompt.test.ts (modified, +4/-0)
• src/auto-reply/reply/session-reset-prompt.ts (modified, +16/-2)