openclaw - ✅(Solved) Fix sessions_send blocked by visibility guard even when a2a policy allows cross-agent messaging [1 pull requests, 3 comments, 3 participants]

openclaw2026-03-30 03:35:27

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#57447•Fetched 2026-04-08 01:49:35

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

commented ×3referenced ×2cross-referenced ×1

Error Message

Per-action visibility exception: skip the visibility gate for send when a2a policy explicitly allows the target agent, or

Root Cause

createSessionVisibilityGuard (sessions-access.ts) applies the same visibility check to all actions:

if (isCrossAgent) {
  if (params.visibility !== "all") {  // ← blocks send even when a2a allows it
    return { allowed: false, status: "forbidden", ... };
  }
  // a2a policy check comes after — never reached
}

Additionally, restrictToSpawned in sessions-send-tool.ts adds spawnedBy to label resolution, which prevents resolving cross-agent session targets entirely.

Fix Action

Fix / Workaround

GHSA-6hf3-mhgc-cm65 — session visibility hardening (introduced the current behavior)
#10004 — multi-agent isolation prerequisites (acknowledges sessions_send is denied as interim mitigation)
#55872 — cross-AI IPC feature request

PR fix notes

PR #57483: fix(sessions): let a2a policy gate cross-agent sends independently of visibility

Repository: openclaw/openclaw
Author: anthhub
State: open | merged: False
Link: https://github.com/openclaw/openclaw/pull/57483

Description (problem / solution / changelog)

Summary

Fixes #57447

createSessionVisibilityGuard() blocked all cross-agent access when visibility !== "all", including sessions_send, even when agentToAgent policy explicitly allowed it
This forced an all-or-nothing choice: visibility=all exposes all sessions, visibility=tree blocks legitimate cross-agent messaging
One-line fix: skip the visibility gate for "send" action on cross-agent targets, letting a2a policy be the sole authorization gate

Rationale

Action	Gate	Rationale
list	visibility	controls what you can see
history	visibility	controls what you can read
status	visibility	controls what you can inspect
send	a2a policy	controls what you can message — sending does not require seeing

Changes

src/agents/tools/sessions-access.ts: Add params.action !== "send" to the cross-agent visibility check
src/agents/tools/sessions-access.test.ts: Add 2 tests — send allowed with tree+a2a, history still blocked with tree+a2a

Test plan

14 unit tests pass (sessions-access.test.ts)
Manual: configure visibility=tree + agentToAgent.enabled=true, verify cross-agent sessions_send works while sessions_history remains blocked

🤖 Generated with Claude Code

Changed files

src/agents/tools/sessions-access.test.ts (modified, +40/-0)
src/agents/tools/sessions-access.ts (modified, +5/-4)

Code Example

if (isCrossAgent) {
  if (params.visibility !== "all") {  // ← blocks send even when a2a allows it
    return { allowed: false, status: "forbidden", ... };
  }
  // a2a policy check comes after — never reached
}

RAW_BUFFERClick to expand / collapse

Problem

When tools.sessions.visibility is set to tree (the default) and tools.agentToAgent.enabled=true with appropriate allow patterns, sessions_send is still blocked for cross-agent messaging. The visibility guard in createSessionVisibilityGuard rejects all cross-agent access when visibility !== "all", regardless of the a2a policy.

This forces operators into an all-or-nothing choice:

visibility=all → send works, but list/history also exposes cross-agent sessions (data leak risk)
visibility=tree → data isolation preserved, but send is blocked despite a2a policy allowing it

Use Case

Multi-agent deployments where:

Each agent runs in a sandbox with sessionToolsVisibility=spawned
Agents need to send messages to each other (sidecar → platform, partner → coordinator)
Agents must not list or read each other's session history

This is the standard model for platforms hosting multiple tenant agents on a single OpenClaw instance, where a2a policy defines the trust boundary for messaging.

Root Cause

createSessionVisibilityGuard (sessions-access.ts) applies the same visibility check to all actions:

if (isCrossAgent) {
  if (params.visibility !== "all") {  // ← blocks send even when a2a allows it
    return { allowed: false, status: "forbidden", ... };
  }
  // a2a policy check comes after — never reached
}

Additionally, restrictToSpawned in sessions-send-tool.ts adds spawnedBy to label resolution, which prevents resolving cross-agent session targets entirely.

Proposal

Let the a2a policy serve as the authorization gate for sessions_send, independent of the visibility setting that governs list/history/status.

Conceptually:

action	gate	rationale
list	visibility	controls what you can see
history	visibility	controls what you can read
status	visibility	controls what you can inspect
send	a2a policy	controls what you can message — sending does not require seeing

This could be implemented as:

Per-action visibility exception: skip the visibility gate for send when a2a policy explicitly allows the target agent, or
New visibility level: e.g. tree+a2a-send that preserves tree isolation for read operations but allows a2a-gated sends, or
Separate config key: tools.sessions.sendVisibility that defaults to a2a while keeping the existing visibility for other actions

Option 1 is the simplest and aligns with the existing a2a policy design — the policy already validates requester→target agent pairs, so it provides equivalent or stronger authorization than visibility alone.

Security Analysis

With option 1 (a2a policy gates send):

scenario	current	proposed	security
send cross-agent, a2a allows	❌ blocked	✅ allowed	a2a policy validates
send cross-agent, a2a denies	❌ blocked	❌ blocked	unchanged
list cross-agent	❌ blocked	❌ blocked	unchanged
history cross-agent	❌ blocked	❌ blocked	unchanged

No new attack surface is introduced — send already requires a2a policy approval, which is a stricter check than visibility=all (which allows everything).

GHSA-6hf3-mhgc-cm65 — session visibility hardening (introduced the current behavior)
#10004 — multi-agent isolation prerequisites (acknowledges sessions_send is denied as interim mitigation)
#55872 — cross-AI IPC feature request

Environment

OpenClaw v2026.3.24+ (tree visibility default)
Multi-agent deployment with sandbox, a2a enabled

extent analysis

Fix Plan

To address the issue, we will implement a per-action visibility exception. This involves modifying the createSessionVisibilityGuard function to skip the visibility gate for send when the a2a policy explicitly allows the target agent.

Step-by-Step Solution

Modify createSessionVisibilityGuard: Update the createSessionVisibilityGuard function in sessions-access.ts to include a conditional check for the send action. If the action is send and the a2a policy allows it, skip the visibility check.

if (action === 'send' && isA2APolicyAllowed(params)) { // Skip visibility check for send action when a2a policy allows it return { allowed: true }; }

if (isCrossAgent) { if (params.visibility !== "all") {
return { allowed: false, status: "forbidden", ... }; } // a2a policy check comes after — now reachable for send action }


2. **Implement `isA2APolicyAllowed` function**:
   Create a new function `isA2APolicyAllowed` that checks if the a2a policy allows the target agent for the `send` action.

   ```typescript
function isA2APolicyAllowed(params) {
  // Implement logic to check a2a policy for target agent
  // Return true if policy allows, false otherwise
}

Update restrictToSpawned in sessions-send-tool.ts: Modify the restrictToSpawned function to allow resolving cross-agent session targets for the send action when the a2a policy allows it.

if (action === 'send' && isA2APolicyAllowed(params)) { // Allow resolving cross-agent session targets for send action return; }

// Existing logic to add spawnedBy to label resolution


### Verification
To verify the fix, test the following scenarios:
* Send cross-agent with a2a policy allowing it: should be allowed
* Send cross-agent with a2a policy denying it: should be blocked
* List cross-agent: should still be blocked
* History cross-agent: should still be blocked

### Extra Tips
* Ensure the `isA2APolicyAllowed` function correctly implements the a2a policy check to avoid introducing security vulnerabilities.
* Monitor the system for any unexpected behavior after applying the fix.
* Consider adding additional logging or auditing to track cross-agent send actions and a2a policy decisions.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#runtime error #dependency conflict #environment setup #docker error #permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - ✅(Solved) Fix sessions_send blocked by visibility guard even when a2a policy allows cross-agent messaging [1 pull requests, 3 comments, 3 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

PR fix notes

PR #57483: fix(sessions): let a2a policy gate cross-agent sends independently of visibility

Description (problem / solution / changelog)

Summary

Rationale

Changes

Test plan

Changed files

Code Example

Problem

Use Case

Root Cause

Proposal

Security Analysis

Related

Environment

extent analysis

Fix Plan

Step-by-Step Solution

Still need to ship something?

TRENDING

openclaw - ✅(Solved) Fix sessions_send blocked by visibility guard even when a2a policy allows cross-agent messaging [1 pull requests, 3 comments, 3 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fix / Workaround

PR fix notes

PR #57483: fix(sessions): let a2a policy gate cross-agent sends independently of visibility

Description (problem / solution / changelog)

Summary

Rationale

Changes

Test plan

Changed files

Code Example

Problem

Use Case

Root Cause

Proposal

Security Analysis

Related

Environment

extent analysis

Fix Plan

Step-by-Step Solution

Still need to ship something?

RELATED_DISCOVERY

TRENDING