Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Feature Request: Session visibility allowlist (`tools.sessions.visibility=allowlist`) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#55420•Fetched 2026-04-08 01:39:44
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
1
Author
horakhty05horakhty05
Participants
horakhty05horakhty05

Add allowlist as a value for tools.sessions.visibility, with a companion tools.sessions.allowlist array of session key patterns.

Root Cause

Add allowlist as a value for tools.sessions.visibility, with a companion tools.sessions.allowlist array of session key patterns.

Fix Action

Fix / Workaround

Current workaround

Using shared workspace files as a manual context bridge, but native support would be much cleaner.

Code Example

"tools": {
  "sessions": {
    "visibility": "allowlist",
    "allowlist": [
      "agent:main:telegram:group:*",
      "agent:main:signal:group:*"
    ]
  }
}

---

~/.openclaw/agents/main/
└── sessions/
    ├── sessions.json        ← index: maps session keys → UUID filenames
    └── [uuid].jsonl         ← one file per session

---

"tools.sessions.visibility": {
  "type": "string",
  "enum": ["self", "tree", "agent", "allowlist", "all"]
},
"tools.sessions.allowlist": {
  "type": "array",
  "items": { "type": "string" },
  "description": "Session key glob patterns allowed when visibility=allowlist"
}
RAW_BUFFERClick to expand / collapse

Summary

Add allowlist as a value for tools.sessions.visibility, with a companion tools.sessions.allowlist array of session key patterns.

Current behavior

tools.sessions.visibility supports 4 levels: self, tree, agent, all. There is no middle ground between tree (current session only) and agent (all sessions on the agent).

Desired behavior

"tools": {
  "sessions": {
    "visibility": "allowlist",
    "allowlist": [
      "agent:main:telegram:group:*",
      "agent:main:signal:group:*"
    ]
  }
}

Supports glob/prefix patterns. Sessions matching any pattern are readable; others are isolated. Patterns can be as specific or broad as needed.

Use case

Running a personal AI assistant across multiple channels: Telegram groups, Signal groups, and DMs. I want cross-channel context sharing between trusted groups I explicitly whitelist — but not automatic access if the agent gets added to an unknown or unauthorized group.

agent visibility solves the context problem but is all-or-nothing. An allowlist gives single-user setups the power without the exposure risk.

Architecture note (for implementors)

The filesystem layout makes this straightforward to implement:

~/.openclaw/agents/main/
└── sessions/
    ├── sessions.json        ← index: maps session keys → UUID filenames
    └── [uuid].jsonl         ← one file per session

sessions.json maps human-readable session keys (e.g. agent:main:telegram:group:*:topic:1) to UUID filenames. The allowlist check would sit at this index level — before sessions_list / sessions_history / sessions_send resolve a key to a UUID, OpenClaw checks it against the configured glob patterns. No match = forbidden. Should be a small, clean change.

Proposed config schema addition

"tools.sessions.visibility": {
  "type": "string",
  "enum": ["self", "tree", "agent", "allowlist", "all"]
},
"tools.sessions.allowlist": {
  "type": "array",
  "items": { "type": "string" },
  "description": "Session key glob patterns allowed when visibility=allowlist"
}

Current workaround

Using shared workspace files as a manual context bridge, but native support would be much cleaner.

extent analysis

Fix Plan

To implement the allowlist feature for tools.sessions.visibility, follow these steps:

  1. Update config schema:

    • Add "allowlist" to the enum list of "tools.sessions.visibility".
    • Introduce a new property "tools.sessions.allowlist" as an array of strings for glob patterns.

  2. Implement allowlist check:

    • Before resolving a session key to a UUID in sessions.json, check if the key matches any pattern in the tools.sessions.allowlist array.
    • Use a glob matching library to perform the pattern matching.

  3. Modify session access logic:

    • If tools.sessions.visibility is set to "allowlist", only allow access to sessions that match the patterns in tools.sessions.allowlist.

Example Code (Python):

import glob

def match_allowlist(session_key, allowlist):
    """Check if a session key matches any pattern in the allowlist."""
    for pattern in allowlist:
        if glob.fnmatch(session_key, pattern):
            return True
    return False

def get_session_uuid(session_key, sessions_index, visibility, allowlist=None):
    """Resolve a session key to a UUID, considering visibility settings."""
    if visibility == "allowlist" and not match_allowlist(session_key, allowlist):
        raise Forbidden("Session key not in allowlist")
    # Existing logic to resolve session key to UUID

# Example usage:
config = {
    "tools": {
        "sessions": {
            "visibility": "allowlist",
            "allowlist": ["agent:main:telegram:group:*", "agent:main:signal:group:*"]
        }
    }
}

session_key = "agent:main:telegram:group:123"
if match_allowlist(session_key, config["tools"]["sessions"]["allowlist"]):
    print("Session key is in allowlist")
else:
    print("Session key is not in allowlist")

Verification

To verify the fix, test the following scenarios:

  • Set tools.sessions.visibility to "allowlist" and add a pattern to tools.sessions.allowlist. Verify that only sessions matching the pattern are accessible.
  • Test with different glob patterns (e.g., *, agent:main:telegram:group:*) to ensure correct matching.
  • Ensure that sessions not matching any pattern in the allowlist are inaccessible when tools.sessions.visibility is set to "allowlist".

Extra Tips

  • Use a robust glob matching library to handle various pattern formats and edge cases.
  • Consider adding logging or monitoring to track allowlist matches and potential security issues.
  • Review the existing sessions.json index and UUID filename structure to ensure compatibility with the new allowlist feature.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#output truncation#response parsing#generation error#database connection#vector store

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Feature Request: Session visibility allowlist (`tools.sessions.visibility=allowlist`) [1 participants]