vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-05 17:20:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden sessions_spawn delivery params and telegram account routing (#31000, #31110)

Browse Source
This commit is contained in:
Peter Steinberger
2026-03-02 02:35:26 +00:00
parent 684ac44b71
commit b0c7f1ebe2
6 changed files with 89 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/agents/tools/sessions-spawn-tool.test.ts
View File

@@ -136,4 +136,26 @@ describe("sessions_spawn tool", () => {
);
expect(hoisted.spawnSubagentDirectMock).not.toHaveBeenCalled();
});
it.each(["target", "transport", "channel", "to", "threadId", "thread_id", "replyTo", "reply_to"])(
"rejects unsupported routing parameter %s",
async (key) => {
const tool = createSessionsSpawnTool({
agentSessionKey: "agent:main:main",
agentChannel: "discord",
agentAccountId: "default",
agentTo: "channel:123",
agentThreadId: "456",
});
await expect(
tool.execute("call-unsupported-param", {
task: "build feature",
[key]: "value",
}),
).rejects.toThrow(`sessions_spawn does not support "${key}"`);
expect(hoisted.spawnSubagentDirectMock).not.toHaveBeenCalled();
expect(hoisted.spawnAcpDirectMock).not.toHaveBeenCalled();
},
);
});

20
src/agents/tools/sessions-spawn-tool.ts
View File

@@ -4,10 +4,20 @@ import { ACP_SPAWN_MODES, spawnAcpDirect } from "../acp-spawn.js";
import { optionalStringEnum } from "../schema/typebox.js";
import { SUBAGENT_SPAWN_MODES, spawnSubagentDirect } from "../subagent-spawn.js";
import type { AnyAgentTool } from "./common.js";
import { jsonResult, readStringParam } from "./common.js";
import { jsonResult, readStringParam, ToolInputError } from "./common.js";
const SESSIONS_SPAWN_RUNTIMES = ["subagent", "acp"] as const;
const SESSIONS_SPAWN_SANDBOX_MODES = ["inherit", "require"] as const;
const UNSUPPORTED_SESSIONS_SPAWN_PARAM_KEYS = [
"target",
"transport",
"channel",
"to",
"threadId",
"thread_id",
"replyTo",
"reply_to",
] as const;
const SessionsSpawnToolSchema = Type.Object({
task: Type.String(),
@@ -47,6 +57,14 @@ export function createSessionsSpawnTool(opts?: {
parameters: SessionsSpawnToolSchema,
execute: async (_toolCallId, args) => {
const params = args as Record<string, unknown>;
const unsupportedParam = UNSUPPORTED_SESSIONS_SPAWN_PARAM_KEYS.find((key) =>
Object.hasOwn(params, key),
);
if (unsupportedParam) {
throw new ToolInputError(
`sessions_spawn does not support "${unsupportedParam}". Use "message" or "sessions_send" for channel delivery.`,
);
}
const task = readStringParam(params, "task", { required: true });
const label = typeof params.label === "string" ? params.label.trim() : "";
const runtime = params.runtime === "acp" ? "acp" : "subagent";