openclaw - 💡(How to fix) Fix [Bug] /status leaks full subagent prompt text when task has no label [1 participants]

Description

When running /status, the full subagent prompt (including runtime context, session keys, and task instructions) is displayed in the task summary line instead of a short title.

Reproduction

1. Spawn a subagent via sessions_spawn (runtime: "subagent")
2. Wait for the subagent to complete
3. Run /status
4. The task line shows the entire runtime context and prompt text — potentially several KB of internal details

Root Cause

Two interacting bugs:

1. No truncation in formatSessionTaskLine()

File: dist/commands-status-CFG5ky0y.js, line ~27

// Current (buggy):
const title = latest.label?.trim() || latest.task.trim();

When a task has no label, the full latest.task string (entire multi-line prompt) is used as the display title with zero length limit.

2. Subagent completion creates tasks without labels

When a subagent finishes, OpenClaw creates a CLI task for result delivery. This task gets:

• No label (NULL)
• task field: The complete runtime context block, including the original subagent prompt

So the full prompt (with internal session details) gets stored in SQLite and displayed unfiltered via /status.

Suggested Fix

// Patched:
const rawTitle = latest.label?.trim() || latest.task.trim().split("\n")[0];
const title = rawTitle.length > 80 ? rawTitle.slice(0, 77) + "…" : rawTitle;

Changes:

• Fallback to task takes only the first line instead of the entire multi-line text
• Truncation to max 80 chars with ellipsis

Additionally, subagent delivery tasks should be created with a meaningful label (e.g., (subagent delivery task)) instead of leaving it NULL.

Impact

• Information leak: internal runtime context (session keys, prompts, instructions) visible to anyone with CLI access
• UX: /status output becomes unusably long with verbose subagent tasks

Environment

• OpenClaw 2026.3.31 (Build 213a704)
• macOS, Telegram channel

Workaround

Local patch applied to dist/commands-status-CFG5ky0y.js + SQLite cleanup of existing tasks. Patch is not upgrade-safe — overwritten by npm install -g openclaw.