Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Security]: session transcript persistence path missing redaction gate [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#73565•Fetched 2026-04-29 06:18:07
View on GitHub
Comments
1
Participants
2
Timeline
3
Reactions
0
Author
Ziy1-TanZiy1-Tan
Participants
clawsweeper[bot]clawsweeper[bot]Ziy1-TanZiy1-Tan
Timeline (top)
commented ×1cross-referenced ×1renamed ×1

One of the remaining gaps under #64046 where message payloads reach disk storage without passing through the standard redaction pipeline.

Root Cause

One of the remaining gaps under #64046 where message payloads reach disk storage without passing through the standard redaction pipeline.

Fix Action

Fixed

PR fix notes

PR #73563: fix(security): add session transcript redaction guards at bare appendMessage call sites

Description (problem / solution / changelog)

What

Session transcript files (*.jsonl) persisted full message payloads to disk without applying the existing redaction hooks at several appendMessage() entry points. This meant credentials that were already scrubbed from console and file-log sinks could still appear in transcript files on disk.

This PR wraps SessionManager with the existing guardSessionManager() at all 4 bare call sites, ensuring the same beforeMessageWriteHook (redaction + tool-result guard) runs before every appendMessage — matching the pattern already used in attempt.ts / compact.ts.

Changes

PathBeforeAfter
src/config/sessions/transcript.tsBare SessionManager.open(...)guardSessionManager(sm, { agentId, sessionKey })
src/agents/command/attempt-execution.tsBare SessionManager.open(...), return value discardedguardSessionManager(sm, { agentId }), return value used
src/gateway/server-methods/chat-transcript-inject.tsBare SessionManager.open(...)guardSessionManager(sm, {}) with comment (system-level inject)
extensions/codex/src/app-server/transcript-mirror.tsManual runAgentHarnessBeforeMessageWriteHook + block check (14 LoC)Single guardSessionManager() call
src/plugin-sdk/agent-harness-runtime.ts—Re-export guardSessionManager for Codex extension
src/config/sessions/transcript.test.ts0 redaction tests17 new tests: API key strip, Bearer token redact, safe content preserved, config-driven patterns

Testing

  • pnpm check — 0 typecheck errors in changed files (2 pre-existing typebox failures in unrelated code)
  • Import boundary checks — 0 violations (src + sdk-package)
  • npx vitest --project runtime-config — 17/17 passed
  • npx vitest --project agents-core attempt-execution — 34/34 passed

Tested: fully tested

Test CaseExpectedActualPASS
API key in assistant content strippedSecret replaced with [REDACTED]Unit test asserts✅
Bearer token in message text redactedToken replaced with placeholderUnit test asserts✅
Non-sensitive content preserved intactSafe fields pass through unchangedUnit test asserts✅
Config-driven redact patterns loadedCustom patterns applied from configUnit test asserts✅
Attempt-execution guard integrationSessionManager wrapped correctly34 tests pass✅
Gateway inject system-level pathWorks without agent contextCode review + test✅

AI Disclosure

  • AI-assisted: Yes
  • Testing depth: fully tested
  • Review: CE review completed (7-perspective), all findings addressed. Adversarial review performed.
  • I confirm understanding of all changes and they follow existing project conventions.

Refs #64046 · Closes #73565

Changed files

  • extensions/codex/src/app-server/transcript-mirror.ts (modified, +11/-18)
  • src/agents/command/attempt-execution.ts (modified, +5/-1)
  • src/agents/session-tool-result-guard-wrapper.ts (modified, +25/-0)
  • src/agents/session-tool-result-guard.tool-result-persist-hook.test.ts (modified, +37/-0)
  • src/agents/session-tool-result-guard.ts (modified, +19/-7)
  • src/config/sessions/transcript.test.ts (modified, +280/-34)
  • src/config/sessions/transcript.ts (modified, +8/-14)
  • src/gateway/server-methods/chat-transcript-inject.ts (modified, +3/-7)
  • src/plugin-sdk/agent-harness-runtime.ts (modified, +1/-0)
  • src/sessions/transcript-events.ts (modified, +8/-0)
RAW_BUFFERClick to expand / collapse

Summary

One of the remaining gaps under #64046 where message payloads reach disk storage without passing through the standard redaction pipeline.

Scope

Session transcript write paths (appendMessage sites) in core session management, CLI attempt execution, gateway inject, and bundled extension mirror surfaces.

Suggested approach

Apply the existing guard infrastructure at each bare entry point rather than building new redaction logic.

Note: This is a tracking sub-issue scoped to one specific sink family. See #64046 for the full umbrella.

extent analysis

TL;DR

Apply the existing guard infrastructure at each bare entry point to ensure message payloads pass through the standard redaction pipeline.

Guidance

  • Identify all bare entry points in the session transcript write paths, including appendMessage sites in core session management, CLI attempt execution, gateway inject, and bundled extension mirror surfaces.
  • Apply the existing guard infrastructure at each of these entry points to enforce redaction.
  • Verify that message payloads are being properly redacted by checking the output of the redaction pipeline.
  • Review the related issue #64046 for additional context and potential solutions.

Notes

This approach may not cover all possible scenarios, and additional testing may be necessary to ensure comprehensive redaction.

Recommendation

Apply workaround: Implementing the existing guard infrastructure at each bare entry point is a targeted solution to address the specific gap identified in this issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#cache error#pipeline error#runtime error#dependency conflict#environment setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Security]: session transcript persistence path missing redaction gate [1 pull requests, 1 comments, 2 participants]