OpenClaw’s compaction safeguard can promote credential-shaped text into summaries

openclaw/openclaw issue #90010 is the inspected primary source: “Compaction identifier extraction leaks credentials from string-encoded tool arguments.” The two related records below were inspected as supporting context, not treated as independent confirmation.

The facts

- openclaw/openclaw issue #90010 was created 2026-06-03T20:56:42Z and was open at inspection; its title is “Compaction identifier extraction leaks credentials from string-encoded tool arguments.” - openclaw/openclaw issue #90014 was created 2026-06-03T20:56:42Z and was open at inspection; its title is “ReDoS vulnerability in exec approval argPattern matching.” - openclaw/openclaw PR #109009 was created 2026-07-16T12:54:48Z and was open at inspection; its title is “fix(agents): exclude MEMORY.md from shared channel session bootstrap.” - The repository reported 384499 stars, 5842 open issues, default branch main, and last push 2026-07-30T01:01:36Z. - The latest tagged-release baseline checked was v2026.7.2-beta.5 published 2026-07-28T03:23:12Z.

What changed

openclaw/openclaw issue #90010 reports: Problem Two issues in compaction identifier survival: 1. extractMessageTextForIdentifiers appends string-encoded tool arguments raw without sanitization. Credential values like {"token":"deadbeef12345678"} feed the hex identifier extractor and leak into ## Exact identifiers in compacted summaries. 2. When strict mode detects that final capping removed required identifiers and the recovery block would exceed MAX_COMPACTION_SUMMARY_CHARS, compaction returns a summary with known identifier loss instead of cancelling. This allows sessions to continue with silently dropped identifiers. Expected behavior 1. String-encoded JSON tool arguments should be parsed and sanitized via sanitizeDiagnosticPayload before identifier scanning, same

openclaw/openclaw issue #90014 reports: Problem matchArgPattern in src/infra/exec-command-resolution.ts compiles user-provided argPattern strings via new RegExp(argPattern) without any ReDoS validation. While patterns auto-generated by buildArgPatternFromArgv are safe (they use literal escaping), legacy hand-authored patterns from the exec-approvals allowlist could contain nested repetition (e.g., (a+)+$) that causes catastrophic backtracking. Expected behavior Patterns with nested repetition should be rejected before compilation to prevent ReDoS. Actual behavior Any pattern string is compiled directly with new RegExp(argPattern), including patterns with catastrophic backtracking potential. Affected files src/infra/exec-command-resolution.ts (matchArgPattern)

openclaw/openclaw PR #109009 reports: Closes #108881 Summary Shared channel sessions (Telegram groups, Discord guilds, Slack channels, etc.) receive MEMORY.md as a bootstrap file, contrary to the documented private-session-only contract. Enforce a channel-agnostic private-session boundary by excluding MEMORY.md from shared channel session bootstrap via a table-driven allowlist and post-hook boundary re-enforcement. Problem: filterBootstrapFilesForSession returns all files unchanged for every session key that is neither subagent nor cron, so group/channel sessions retain MEMORY.md — leaking private persistent context across users in shared conversations Solution: Add isSharedChannelSessionKey (dual-path: parseSessionDeliveryRoute + legacy regex fallback), GROUP_CHANNEL_BOOTSTRAP_ALLOWLIST excluding MEMORY.md, and

Why it matters

Compaction is privileged translation: it reads more context than the next turn should necessarily retain. Parsing, redaction and fail-closed caps must happen before identifier survival turns arbitrary strings into durable prompt material. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.

Current

The primary record was open when captured on 2026-07-30. The release baseline was v2026.7.2-beta.5 published 2026-07-28T03:23:12Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/openclaw/openclaw/issues/90010. Supporting records are https://github.com/openclaw/openclaw/issues/90014 and https://github.com/openclaw/openclaw/pull/109009. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Treat compaction output as a new data product with its own secret scanner, provenance and cancellation rule; do not rely on the original tool schema to remain visible after serialization. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.