mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-28 02:11:12 +00:00
0a588fa795
* fix(acp): scope /acp sessions listing for non-owner senders /acp sessions listed every ACP session on the gateway for any sender allowlisted via commands.allowFrom, exposing other senders' session labels, agent ids, runtime state, and thread bindings. The handler now returns only the current bound or requester session for non-owner senders, while owner identity and operator.admin clients keep the full gateway-wide listing, matching the documented contract. Fixes #103055 * test(acp): cover empty and missing-session cases for /acp sessions scoping * fix(acp): avoid non-owner session scans * docs(acp): remove duplicated session scope text * test(acp): cover internal session visibility * fix(acp): require current ACP metadata * test(acp): reject sessions target tokens --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>
